The Centers for Medicare & Medicaid Services (CMS) finalized the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) today. The rule sets requirements for Medicare Advantage (MA) organizations, Medicaid and the Children’s Health Insurance Program (CHIP) fee-for-service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs) offered on the Federally-Facilitated Exchanges (FFEs), (collectively “impacted payers”), to improve the electronic exchange of health information and prior authorization processes for medical items and services. A fact sheet for this final rule is available. .

Together, these policies will improve prior authorization processes and reduce burden on patients, providers, and payers, resulting in approximately $15 billion of estimated savings over ten years.

The announcement noted that while prior authorization can help ensure medical care is necessary and appropriate, it can sometimes be an obstacle to necessary patient care when providers must navigate complex and widely varying payer requirements or face long waits for prior authorization decisions.

This final rule establishes requirements for certain payers to streamline the prior authorization process and complements the Medicare Advantage requirements previously finalized.

Beginning primarily in 2026, impacted payers (not including QHP issuers on the FFEs) will be required to send prior authorization decisions within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests for medical items and services.

For some payers, this new timeframe for standard requests cuts current decision timeframes in half. The rule also requires all impacted payers to include a specific reason for denying a prior authorization request, which will help facilitate resubmission of the request or an appeal when needed. Finally, impacted payers will be required to publicly report prior authorization metrics, similar to the metrics Medicare FFS already makes available.

The rule also requires impacted payers to implement a Health Level 7 (HL7®) Fast Healthcare Interoperability Resources (FHIR®) Prior Authorization application programming interface (API), which can be used to facilitate a more efficient electronic prior authorization process between providers and payers by automating the end-to-end prior authorization process.

Medicare FFS has already implemented an electronic prior authorization API, demonstrating the efficiencies other payers could realize by implementing such an API. Together, these new requirements for the prior authorization process will reduce administrative burden on the healthcare workforce, empower clinicians to spend more time providing direct care to their patients, and prevent avoidable delays in care for patients.

CMS is also finalizing API requirements to increase health data exchange and foster a more efficient health care system for all. CMS values public input and considered the comments submitted by the public, including patients, providers, and payers, in finalizing the rule. Informed by public comments, CMS is delaying the dates for compliance with the API policies from generally January 1, 2026, to January 1, 2027.

In addition to the Prior Authorization API, beginning January 2027, impacted payers will be required to expand their current Patient Access API to include information about prior authorizations and to implement a Provider Access API that providers can use to retrieve their patients’ claims, encounter, clinical, and prior authorization data. Also informed by public comments on previous payer-to-payer data exchange policies, we are requiring impacted payers to exchange, with a patient’s permission, most of those same data using a Payer-to-Payer FHIR API when a patient moves between payers or has multiple concurrent payers.

Finally, the rule also adds a new Electronic Prior Authorization measure for eligible clinicians under the Merit-based Incentive Payment System (MIPS) Promoting Interoperability performance category and eligible hospitals and critical access hospitals (CAHs) in the Medicare Promoting Interoperability Program to report their use of payers’ Prior Authorization APIs to submit an electronic prior authorization request. Together, these policies will help to create a more efficient prior authorization process and support better access to health information and timely, high-quality care.