CMS Interoperability and Prior Authorization Final Rule Impacts for MA
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) includes a series of changes meant to streamline prior authorization and advance interoperability. Impacted payors include Medicare Advantage (MA) organizations, state Medicaid and CHIP Fee-For-Service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges. Most of the Final Rule’s changes become effective in 2026, with the new API standards generally going into effect in 2027.
Changes to Prior Authorization Decision-making and Reporting
The Final Rule includes a series of changes to prior authorization decision-making and reporting processes. The changes are effective January 1, 2026, and the initial set of metrics must be reported by March 31, 2026.
The Final Rule includes new timeframes for prior authorization decisions. Impacted payors are required to send prior authorization decisions within:
- 72 hours for expedited (i.e., urgent) requests, and
- 7 calendar days for standard (i.e., non-urgent) requests for medical items and services.
The new Final Rule halves the pre-Final Rule timeframes for some payors, including MA organizations, which currently have fourteen days to respond to non-urgent medical requests. When denying a prior authorization request, all impacted payors must include a specific reason for a denial. This is new for integrated plans, but not other impacted payors.
Information about prior authorizations must be available via the Patient Access API for as long as the authorization is active and at least 1 year after the last status change. This means that information on denied and expired prior authorizations will be available for at least 1 year after expiring or being denied. CMS adds that payors may make the information available for more than 1 year but are not required to do so. In addition, impacted payers will be required to publicly report prior authorization metrics.
Patient and Provider Access API
The Final Rule also requires impacted payers to implement and maintain application programming interfaces (APIs) to improve the prior authorization process and facilitate the electronic exchange of health care data. CMS will require payers to implement and maintain a Patient Access API to give patients greater access to their data as well as a Provider Access API to support providers in moving toward value-based care payment models. At a high level, the requirements for these APIs include the following:
Patient Access API:
- Prior authorization decisions
- Confirming receipt of requests and status changes
- 1 business day to upload changes
- Does NOT apply to drugs
Provider Access:
- Information about patient claims and encounter data
- Prior authorization requests and decisions
- Opt-out system
The Final Rule also includes reporting requirements regarding data transfer to health applications (apps). Impacted payers will also be required to annually report the total number of unique patients whose data is transferred via the Patient Access API to a health app designated by the patient along with the number of patients whose data is transferred more than once. CMS is collecting this data to get a better sense of how many patients are using health apps and which apps they are using.
The changes to both the Patient Access and Provider Access API are effective January 1, 2027. This is a change from the Proposed Rule, under which the new API standards would have become effective in 2026. The Final Rule on the Patient Access API also differs from the Proposed Rule in that the Final Rule does not require impacted organizations to include quantity of items or services used under a prior authorization or unstructured documentation related to a prior authorization.
