Prior Authorization Rules and CMS – Changes are Coming

For many providers, prior authorization has always felt like an unavoidable obstacle. CMS is now stepping in to standardize and modernize parts of that process. This post walks through those changes with practical context drawn from hands-on experience.

The Longstanding Burden of Prior Authorization

Requirements for complying with a prior authorization process have been the bane of existence for health care providers for decades. Health insurance companies maintained their own lists of procedures and services that require prior authorization. In the early days of managed care plans, even a referral to a specialist might require prior authorization. And no one was happy with the requirements to obtain approval, even when the medical necessity was obvious.

In 2020, the Centers for Medicare and Medicaid Services (CMS) also got in on the act. They began to require prior authorization for a short list of procedures in hospital outpatient departments. These were cosmetic procedures such as Blepharoplasty (eyelids), Rhinoplasty (noses), and Panniculectomy (tummy tuck). In recent years, they added prior authorization requirements for cervical fusion with disc removal, implanted spinal neurostimulators, and facet joint interventions to the prior authorization process. More on the impact of these prior authorization decisions on utilization later.

A CMS Initiative to Improve the Prior Authorization Process for Everyone

Some of the most important provider complaints about a prior authorization process were the issues of timeliness of prior authorization decisions and documentation requirements to support medical necessity review. Prior authorization forms were not standardized among health insurance companies or health plans. Some health plans had internal policies on review and decision time frames. At best, there were state guidelines on the timeliness of decisions, but no overall federal regulatory requirements. 

In December 2022, CMS issued the Interoperability and Prior Authorization proposed rule. The stated purpose of the Rule was to “improve the electronic exchange of health care information and streamline prior authorization for medical items and services.” In January 2024, CMS issued the CMS Interoperability and Prior Authorization final rule (CMS-0057-F). This final rule (Final Prior Authorization Rule) laid out requirements for many entities (called impacted payers) who currently require prior authorization for various health care services, to make information available to patients about prior authorizations. Impacted payers are also required to implement and maintain Application Programming Interfaces (APIs) to improve electronic exchange of health care data and streamline the prior authorization process. The requirements also mostly do not cover authorizations for prescription drugs.

Most of the requirements have compliance dates in 2027, but some are due in 2026 as well.

Who are the Impacted Payers Under the CMS Prior Authorization Rule?

There is a robust list of impacted payers in the Final Prior Authorization Rule. They include:

• Medicare Advantage (MA) organizations, 
• state Medicaid and Children’s Health Insurance Program (CHIP) Fee-for-Service (FFS) programs,
• Medicaid managed care plans, 
• CHIP managed care entities, and
• Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs) (essentially health plans selling policies on Affordable Healthcare Act exchanges).

What are Impacted Payers Required to do in 2026 Under the CMS Prior Authorization Rule?

In 2026, the federal rules will mostly involve the prior authorization process, decision timelines, and denial notice reasons. Impacted payers (except for QHPs issuers on FFEs) are required to send prior authorization decisions to providers within specific time frames. Expedited (urgent) prior authorization requests must be responded to in 72 hours. All other requested services must be responded to in seven days.

A healthcare provider and the patient must be notified of the reason(s) for denial using written or electronic methods, or even phone calls. For Impacted Payers subject to other requirements for denial notices, for example, in writing, the Rule does not supersede those requirements.

Impacted payers must also begin compiling statistics on their prior authorization processes each year and post various prior authorization metrics on their website(s). Some of these nine prior authorization metrics include:

• A list of all items and services that require prior authorization.
• The percentage of standard prior authorization requests that were approved, aggregated for all items and services.
• The percentage of standard prior authorization requests that were denied, aggregated for all items and services.
• The average and median time that elapsed between the submission of a request and a determination by the MA plan, for standard prior authorizations, aggregated for all items and services.
• The average and median time that elapsed between the submission of a request and a decision by the MA plan for expedited prior authorization requests, aggregated for all items and services.

The metrics must be compiled for a year and reported by March 31 of the following year.

What are Impacted Payers required to do in 2027 under the CMS Prior Authorization Rule?

Impacted payers must be in compliance with some of the most important prior authorization requirements, including the APIs, by January 1, 2027. 

• Patient Information API: an existing HL7® FHIR® Patient Access API must include information about prior authorization requests. This is in addition to information on clinical encounters and other clinical data, and/or claims, healthcare provider remittances, and patient cost-sharing. 
• Provider Access API: this API must be compliant with HL7® FHIR® standards. It must contain information on patient data, adjudicated claims, and prior authorization information.
• Payer-to-Payer API: impacted payers must exchange information as patients move between payers to enhance continued access to health data and support continuity of care. The five years of data will include adjudicated claims and encounter data, but not provider remittances or patient cost-sharing information.
• Prior Authorization API: Payers must make available an API that allows providers to see a list of covered services and the documentation requirements for prior authorization requests. This API must also allow providers to receive approval when an original request for authorization is approved, or to be notified of a denial, along with a reason for the denial.
• Finally, CMS is adding a new Electronic Prior Authorization Measure for MIPS Eligible Clinicians and Eligible Hospitals and Critical Access Hospitals (CAHs). Eligible clinicians and eligible hospitals/CAHs will be asked to attest Yes or No to using a Provider Access API for at least one requested authorization during the reporting period. 

Do Prior Authorization Requirements Work?

There is no doubt that many healthcare providers have low opinions of the prior authorization processes utilized by many payers. There are no summary statistics on the effectiveness of prior authorization processes in general. But there are some statistics on the outcomes of the prior authorization process put in place by CMS for a short list of procedures mentioned above. 

In a report on the results of their prior authorization process for Fiscal Year 2024, CMS found:

• Hospital Outpatient Requests: 79.2% of 423,830 requests processed were approved. Eighty-six percent of claims were paid; only 18% of claims were paid on appeal.
• Totals paid for certain services declined between FY2022 and FY2024:
  • Facet Joint intervention payments declined by 19% ($23 million)
  • Cosmetic procedures declined by 25% ($13 million)

So taxpayers might conclude that prior authorization requirements do save money by reducing waste or abuse of federal healthcare programs. 

But one factor that has not been around long enough is the introduction of AI-based decision-making systems for considering prior authorization requests. Some health plans are already being sued for supposedly denying care for patients based on algorithms. The trend toward employing AI-based systems is in full swing. The question is, will it be accurate enough to save taxpayers and ratepayers money without denying necessary care? The jury hasn’t even been seated yet, let alone come in with a verdict.

In the meantime, the new CMS Prior Authorization Rule is here; it remains to be seen if it is effective for healthcare providers and patients.