CMS Finalizes Payer Requirements to Streamline Prior Authorization

CMS has finalized requirements for payers to streamline the prior authorization process and improve the electronic exchange of health information to help limit patient care disruptions.

The CMS Interoperability and Prior Authorization Final Rule includes policies for Medicare Advantage organizations, Medicaid and the Children’s Health Insurance Program (CHIP) fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs) offered on the Federally Facilitated Exchanges (FFEs).

All public payers, except for QHPs, must send prior authorization decisions within 72 hours for urgent requests and seven calendar days for standard requests starting in 2026. The new timeline for standard requests will cut the current timeframes in half for some payers, the press release noted.

Payers must provide a specific reason for denying a prior authorization request, regardless of how the request was sent in. These reasons can be communicated via portal, fax, email, mail, or phone. Offering a specific reason for denial can help facilitate providers’ ability to resubmit prior authorization requests or appeals, if necessary.

The rule also finalized policies requiring payers to publicly report certain prior authorization metrics. Payers must start reporting metrics by March 31, 2026.

The provisions included in the final rule do not apply to prior authorization decisions for drugs.

Under the final rule, payers are required to implement a Health Level 7 (HL7) Fast Healthcare Interoperability Resources (FHIR) Prior Authorization application programming interface (API) to facilitate electronic prior authorization processes.

Payers must add prior authorization information to their Patient Access APIs, implement a Provider Access API, and establish a Payer-to-Payer API.

Additionally, payers must implement a Prior Authorization API that includes a list of covered items and services, identifies documentation requirements for prior authorization approval, and supports a prior authorization request and response. These APIs must share whether the payer approves, denies the request, or needs more information.

Payers must implement the API requirements by January 1, 2027.

These provisions will reduce administrative burden on healthcare workers and facilitate information access and exchange, CMS said.

The rule finalized an Electronic Prior Authorization measure for certain clinicians. Clinicians participating in the Merit-based Incentive Payment System (MIPS) must report the measure under the Promoting Interoperability performance category starting in the calendar year (CY) 2027 performance period. Critical access hospitals (CAHs) in the Medicare Promoting Interoperability Program must report the measure beginning with the CY 2027 EHR reporting period.

Clinicians and CAHs must report their use of payers’ prior authorization application programming interfaces (APIs) to submit electronic prior authorization requests. The measure aims to create a more efficient prior authorization process and improve access to health information and care.

The complete final rule can be found here.