CMS Rule Redefines Prior Authorization: What Health Plans Must Do Now to Comply

A New Era for Prior Authorization

For decades, prior authorization, though widely used, has often proven frustrating and upsetting for patients, providers, and payers alike. In response, policymakers at both the state and federal levels have accelerated efforts to modernize and improve the prior authorization process. A major development came with the release of the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F).

Aimed at payers participating in CMS programs, the rule introduces sweeping changes: increasing transparency through public reporting, tightening turnaround times, setting new expectations for denial communications, and requiring the implementation of a prior authorization application programming interface (API). The goal: a faster, clearer, and more consistent prior authorization experience for patients, providers, and payers. This article highlights components of CMS-0057-F that payers should consider as they prepare for compliance and explore opportunities to improve prior authorization operations in the process.

Bringing Transparency to Prior Authorization Data

To enhance prior authorization transparency, CMS-0057-F requires payers to publicly report key prior authorization metrics on their web site annually, such as average turnaround time and the percentage of authorization requests approved and denied. Additionally, plans will need to list all and services requiring prior authorization.

Payers must post their 2025 prior authorization data by March 1, 2026. Some. To positively impact prior authorization metrics, payers should consider:

• Utilization Management (UM) Staffing – Ensure appropriate staffing to handle prior authorization volumes; train staff to improve skillsets and create prior authorization expertise.
• UM Technology – Leverage electronic prior authorization and consider AI enabled solutions; ensure UM systems reflect accurate contract configurations; automate processes wherever possible.
• Process Standardization – Adopt standardized forms and data exchange formats; provide definitive criteria for when prior authorization is required and what documentation is expected.
• Provider Network Coordination– Conduct audits to identify network gaps that impact prior authorization; collaborate with out-of-network providers to improve authorization workflows.
• Utilization Pattern Analysis – Review historical utilization data for improvement opportunities; use predictive analytics to forecast future authorization demand.

Raising the Bar on Timely Decisions

To improve prior authorization turnaround time, new decision timeframes take effect January 1, 2026.  Specifically, standard prior authorization decisions must be made within seven calendar days while expedited authorization decisions must be made within 72 hours. These new requirements apply across CMS regulated programs in the following ways:

Many state laws are already more stringent with prior authorization turnaround time, but some plans will need to shorten prior authorization decision making timeframes to achieve compliance, improve publicly reported metrics and ensure timely access to care.

It’s worth noting that the new turnaround requirements exclude prescriptions, however Medicare Advantage and many state Medicaid programs already require similar prior authorization turnaround time requirements for prescription coverage.

Making Denials Clear and Actionable

To make prior authorization decisions easier to understand, CMS-0057-F sets new expectations for communicating denials. Starting January 1, 2026, payers must “provide a specific reason” for denied prior authorization decisions (excluding prescriptions). This could include explaining how the submitted documentation failed to support the request or citing the specific plan provisions on which the denial is based. Decisions may be communicated via portal, fax, email, mail, or phone and must be provided regardless of the submission method.

As payers implement these changes, they have an opportunity to standardize and strengthen denial data. Greater consistency in denial data can streamline resubmissions and appeals, reduce administrative burden, and minimize confusion.

Modernizing Prior Authorizations with API Integration

To streamline and accelerate prior authorization processes, CMS is requiring payers to implement and maintain a new API. This API must include a list of items and services requiring authorization along with the payer’s supporting documentation requirements. It must also support the electronic exchange of prior authorization requests and decisions directly within a provider’s electronic health records (EHR) or practice management system.

Payers familiar with prior CMS API experience should note this requirement is more complex than implementing previous APIs. Despite a January 1, 2027, deadline, planning and development should start now considering the expected implementation challenges including:   

• Provider collaboration – Facilitating a multistep, bi-directional data exchange with considerable process variability
• Data alignment – Matching authorizations to claims across systems that likely have different patient identifiers
• Delegation impacts – Coordinating with entities where utilization management is delegated to or from another healthcare organization  

Developing this API technology is not only needed for compliance but will also reduce burdensome unneeded prior auth submissions, decrease reliance on outdated technologies, and enable more efficient communications throughout the authorization process.

From Compliance to Competitive Advantage

This new prior authorization legislation represents a significant step forward. The rule promotes health plan transparency, shortens decision timelines, improves denial communications, and includes an API dedicated to prior authorization. With compliance implications in 2025 and required actions starting in 2026, payers should be working now. Those who take a strategic compliance approach now can transform regulatory compliance into a catalyst for improving workflows, reducing administrative burden, and enhancing the provider and patient experience.