CMS Prior Authorization Rule 2026: What Providers Must Do Before the Compliance Deadlines

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), finalized in January 2024, creates the most significant federal changes to prior authorization workflow in two decades. The rule imposes new obligations on impacted payers including Medicare Advantage, Medicaid managed care, CHIP managed care, and qualified health plans on federally facilitated exchanges, with staged compliance deadlines running through 2027.

For providers, the rule brings shorter decision timeframes for eligible requests, specific reasons for non-drug PA denials, and public payer metrics. FHIR-based APIs will support electronic requests and responses. The API requirement does not require payers to make every decision in real time.

But “eventually” is doing work in that sentence. The benefits flow to providers whose workflows can consume faster decisions and the new APIs. Practices still running fax-and-portal submissions will not see most of the improvement, because the bottleneck will shift from payer response time to internal processing time.

This guide covers what the rule requires, the compliance timeline, the API obligations on payers, and a practical checklist of what providers should be doing now by organization type.

What is CMS-0057-F and which payers does it cover?

The CMS Interoperability and Prior Authorization Final Rule, formally known as CMS-0057-F, is a federal rulemaking finalized by the Centers for Medicare & Medicaid Services in January 2024. It applies to a defined set of impacted payers:

• Medicare Advantage organizations
• State Medicaid fee-for-service programs
• State Children's Health Insurance Program (CHIP) fee-for-service programs
• Medicaid managed care plans
• CHIP managed care plans
• Qualified Health Plan (QHP) issuers on federally facilitated exchanges

The rule does not apply directly to commercial PPO plans, employer self-funded plans, or workers' compensation. Many commercial payers are expected to adopt similar mechanisms voluntarily to align workflows, but compliance is not federally mandated.

The rule creates four sets of new obligations: faster decision timeframes, specific denial reasons, public reporting of PA metrics, and FHIR-based API requirements for PA submission and status tracking.

What are the new prior authorization decision timeframes?

Beginning generally in 2026, the rule sets the following decision timeframes for applicable non-drug prior authorizations. The shortened timeframes exclude Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges, even though those issuers are included in other provisions of the rule. See the CMS decision-timeframe provision.

Apply the timeframe for the specific payer program and request, including any applicable extension provisions in the CMS timing FAQs. Decisions are due as expeditiously as the patient's medical condition requires. These are payer decision maximums, not a guarantee that every request or the complete provider-to-payer workflow will finish within seven days.

Track preparation and submission separately from the payer's review. Time spent gathering records before submission still adds to the patient's wait. The seven-day standard is down from up to 14 calendar days for Medicare Advantage; it is a maximum subject to applicable extensions, not a predicted turnaround time for every request.

What does the rule require about denial reasons?

Beginning in 2026, impacted payers must give a specific reason when denying a non-drug prior authorization request. This applies regardless of whether the request arrived through an API, portal, fax, mail, email, or phone. QHP issuers on federally facilitated exchanges are included in this requirement.

Record the reason with the request so staff can distinguish missing information from a coverage or medical-necessity issue and route the next action. This supports PA denial pattern analysisand targeted resubmission. The rule requires a specific reason, not a universal machine-readable denial code.

Existing denial-notice and appeal requirements still apply. The rule does not replace those notices with the new denial-reason requirement.

What are the public reporting requirements?

Beginning in 2026, impacted payers must publicly report annual metrics on their prior authorization activity for non-drug items and services. The first reports, covering 2025, were due March 31, 2026. Required reporting includes:

• The items and services that require prior authorization, excluding drugs
• Approval and denial percentages for standard requests and for expedited requests
• The percentage of standard requests approved after appeal
• The percentage of requests approved after an extended review timeframe
• Average and median decision times, reported separately for standard and expedited requests

The reports must be posted publicly, which means provider organizations, contract negotiators, journalists, and researchers will be able to compare payer performance directly. The expected effect is competitive pressure on payers to demonstrate reasonable PA practices, which should benefit providers contracted with consistently slow or denial-heavy payers.

What is the Prior Authorization API and what are the API requirements?

The FHIR-based Prior Authorization API identifies covered items and services, documentation requirements, and the payer's response to a request. The rule also adds or updates three related data-sharing APIs:

1. Patient Access API. Patients can access their PA data programmatically via the payer's API. Existing requirement, expanded under CMS-0057-F to include PA decisions and status.

2. Provider Access API. Providers can access PA data for their attributed patients. New obligation.

3. Payer-to-Payer API. When a patient changes plans, the new payer can pull PA data from the previous payer. Enables continuity of care during plan transitions.

The Prior Authorization API specifically supports the authorization workflow: providers submit PA requests, retrieve status, and receive decisions through standardized FHIR endpoints rather than through proprietary payer portals or fax.

API compliance dates generally begin January 1, 2027 and vary by payer type. Operational requirements generally begin in 2026, so teams should distinguish the decision-timeframe changes from the later API rollout.

For providers, the practical implication is that the workflow disruption from this rule unfolds over two years. The first year is about adapting to compressed timeframes with existing submission methods. The second year is about adopting the APIs as payers expose them.

What should each organization type be doing now?

The compliance checklist varies by organization type because the operational impact depends on the payer mix and PA volume.

Specialty practices (sleep medicine, orthopedics, cardiology, oncology, etc.)

Primary care groups and FQHCs

PE-backed multi-site groups

How does CMS-0057-F interact with state-level reforms?

Federal CMS-0057-F operates alongside state-level prior authorization reforms, including gold carding legislation in Texas, Louisiana, and West Virginia, and broader PA reform statutes in dozens of other states. The federal rule does not preempt state requirements that are more stringent.

For multi-state practice groups, the practical implication is that compliance is a multi-layered question: federal CMS-0057-F obligations on impacted payers in all states, plus state-specific obligations that may exceed federal requirements in specific states. The operations team needs visibility into both.

The most common state-level addition is faster decision timeframes for specific procedure categories (e.g., behavioral health, certain medications) and more aggressive gold carding mechanisms. Where state requirements are stricter, the state requirement controls. Our companion piece on gold carding for prior authorization breaks down the state-by-state landscape.

Where regulatory-aligned PA automation fits (and where it does not)

Best fit:

• Practices with significant MA, Medicaid managed care, or QHP exposure
• Specialty practices with high PA volume on procedures affected by the new timeframes
• Multi-state groups managing federal plus state-level compliance
• Organizations with chronic coordinator vacancy or turnover
• Practices preparing for FHIR API integration in 2027

Less ideal fit:

• Practices with payer mix dominated by commercial PPO plans (not federally mandated to comply)
• Practices below 50 PAs per week where the automation business case is marginal
• Organizations without basic EHR integration capability
• Cash-pay or DPC practices not running insurance PA workflows

Sources

• CMS: Interoperability and Prior Authorization Final Rule fact sheet
• CMS: Prior authorization process, timeframe, and reporting FAQs

Frequently asked questions