US prior authorization rules changed on January 1, 2026, and the more demanding half of the reform takes effect on January 1, 2027.
The Interoperability and Prior Authorization Final Rule (CMS-0057-F) from the Centers for Medicare & Medicaid Services (CMS) puts a clock on payer decisions, requires a specific reason for every denial, and mandates four standards-based APIs.
Provider billing teams, many of them already supported by medical billing outsourcing services, now have to submit, track, and appeal requests against those same clocks. For insurers outside the US, the rule offers a working model of what regulated decision deadlines and published approval data look like in practice.
This guide covers what the rule requires, where payer operations and provider billing teams tend to break, and the compliance handoffs between them.
What the CMS prior authorization rule requires, and when
CMS-0057-F applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan (QHP) issuers on the federally facilitated exchanges. Operational provisions began January 1, 2026. Most API requirements begin January 1, 2027. Prior authorization for drugs sits outside the rule.
CMS estimated the policies would produce approximately $15 billion in savings over ten years when it finalized the rule in January 2024. Those savings depend on both sides of the transaction changing how they work.
Why the new deadlines are a data problem first
A 72-hour clock works only when the request arrives complete. A missing clinical note, a wrong member ID, or a stale eligibility record forces the payer to pend the request, ask for more information, or deny it. The rule shortens the time payers have to decide. Fixing the quality of what reaches them stays with both parties.
The volume makes small error rates expensive. In the American Medical Association 2025 prior authorization survey of 1,000 physicians, practices reported completing about 40 prior authorizations per physician each week, with physicians and staff spending 13 hours a week on them. Forty percent of physicians said they employ staff who work exclusively on prior authorization, and 95% said the process causes care delays. More than one in four (26%) reported a serious adverse event for a patient in their care linked to prior authorization.
What payers must get right
Payers need four things working together: intake that timestamps and triages requests, denial notices a billing team can act on, metrics they can defend in public, and APIs that expose the same data their reviewers see. A weakness in any one of them shows up in the published numbers.
Decision clocks and intake triage
Operations teams should track every request against its 72-hour or seven-day window from the moment it arrives, and flag pended requests before the window closes. Intake staff who catch an incomplete submission on day one give the provider time to respond. Catch it on day six and the likely outcome is a denial that both sides will rework.
Denial reasons a billing team can use
The rule requires a specific reason for each denial. Write that reason so a billing specialist can act on it: name the missing document, the unmet coverage criterion, or the policy that applies. A reason the provider can fix turns a denial into a corrected resubmission instead of an appeal.
Metrics that competitors, brokers, and journalists will read
Under 42 CFR 422.122(c), a Medicare Advantage organization must post, by March 31 each year, a list of all items and services that require prior authorization, plus approval, denial, and approved-after-appeal rates for standard and expedited requests, the share of approved requests that needed an extended review timeframe, and average and median decision times. The March 2027 report will cover calendar year 2026, the first full year under the new decision clocks. Payers should reconcile those figures now, while they can still trace and correct the source data.
APIs that match the operational data
The Provider Access API must share claims, encounter, and prior authorization data with in-network providers who have a treatment relationship with the patient. The Payer-to-Payer API requires an opt-in process and plain-language resources for members. If the API shows a different status than the call center or the portal, providers will keep calling, and the burden the rule targets will stay in place.
What provider billing teams must get right
Provider billing teams carry the other half of the clock. They need verified eligibility before they request authorization, a complete clinical packet on first submission, a tracker that knows each payer deadline, and a fast route from a specific denial reason to a corrected request or an appeal.
Verify eligibility first. The decision windows differ by plan type, so the team needs to know whether a patient sits in Medicare Advantage, Medicaid managed care, or an exchange plan before it submits.
Submit complete packets. Match the documentation to the payer criteria the first time, since every information request eats into the window.
Track the clock from your side. Log submission times so you can spot a missed payer deadline and escalate it.
Read every denial reason. Route correctable denials to resubmission and clinical disagreements to appeal.
Prepare for the 2027 attestation. MIPS-eligible clinicians will attest to the Electronic Prior Authorization measure starting with the CY 2027 performance period, which pushes requests into EHR-connected workflows.
Outsourced revenue cycle teams already run this sequence as one workflow. Helpware, for example, performs insurance eligibility checks and prior service authorization before appointments inside HIPAA-compliant billing operations, uses AI for data extraction and document management while staff handle exceptions and compliance decisions, and reports billing accuracy above 95%. That split matters under a 72-hour clock: automation handles the repeatable data entry, and people handle the judgment calls that decide whether a request clears on first submission.
The compliance handoffs between payers and providers
Most prior authorization failures happen at handoff points, where one party assumes the other has the data. Mapping who owns each step, and what breaks when nobody does, gives payer and provider teams a shared checklist before the 2027 API deadline.
What comes next: drug prior authorization and industry commitments
CMS has already proposed the next layer. On April 10, 2026, it published the Interoperability Standards and Prior Authorization for Drugs proposed rule (CMS-0062-P), which would extend decision deadlines to drugs, at no later than 24 hours for urgent requests and 72 hours for standard requests. The CMS fact sheet lists October 1, 2027, as the proposed compliance date for most drug provisions. HHS also proposes FHIR-based standards for prior authorization and eligibility transactions, with 24 months to comply after the final rule takes effect (36 months for small health plans). Treat these dates as proposals until CMS publishes a final rule.
Health plans have also made voluntary commitments. In the June 2025 industry pledge announced by HHS, insurers covering an estimated 257 million Americans committed to real-time answers for at least 80% of electronic prior authorization approvals by 2027, and to honor existing authorizations during a 90-day transition when patients switch plans. CMS Administrator Mehmet Oz said the agency could use rulemaking if plans fall short.
For insurers in the UK and Europe, the US approach offers a preview of where regulators can take pre-authorization: fixed decision clocks, published approval rates, and machine-readable data exchange. Carriers that already record decision times and denial reasons in structured form would find a similar regime easier to absorb.
Key takeaways
Decision clocks of 72 hours and seven days have applied to most impacted payers since January 1, 2026.
Four API requirements start January 1, 2027, and the March 2027 metrics report will show how payers performed in 2026.
Incomplete requests eat into the decision window, so eligibility checks and documentation quality decide outcomes on both sides.
Specific denial reasons pay off only when billing teams route them to fast corrections.
Drug prior authorization rules are proposed for October 2027 and could change before they are finalized.
FAQ
When do the CMS prior authorization API requirements take effect?
Most API requirements in CMS-0057-F take effect January 1, 2027. Impacted payers must implement the Prior Authorization API, the Provider Access API, and the Payer-to-Payer API, and add prior authorization data to the Patient Access API. The decision timeframes, specific denial reasons, and public metrics reporting began in 2026.
Does the CMS prior authorization rule cover drugs?
No. CMS-0057-F covers items and services and excludes drugs. CMS proposed a separate rule, CMS-0062-P, in April 2026 that would add drug decision deadlines of 24 hours for urgent requests and 72 hours for standard requests, with a proposed compliance date of October 1, 2027, for most provisions.
Which prior authorization metrics do payers have to publish?
Payers post annual data by March 31, including the list of items and services that need prior authorization, approval and denial rates for standard and expedited requests, approvals after appeal, the share of approvals that needed an extended review, and average and median decision times. Drug data is excluded.
What should provider billing teams change first?
Start with eligibility verification and complete first submissions, since incomplete requests consume the payer decision window. Then track submission times against each payer deadline, route specific denial reasons to correction or appeal, and connect prior authorization workflows to the EHR ahead of the CY 2027 Electronic Prior Authorization measure.
Be the first to comment