On January 17, 2024, the Centers for Medicare & Medicaid Services (CMS) issued the CMS Interoperability and Prior Authorization final rule (Final Rule) (fact sheet, CMS’ interoperability website), which aims to improve prior authorization processes and enhance patient, provider and payer access to interoperable patient data.

The Final Rule builds on the technological foundation implemented in CMS’ May 2020 CMS Interoperability and Patient Access rule and broadly applies to Medicare Advantage (MA) organizations, state Medicaid and the Children’s Health Insurance Program (CHIP) fee-for-service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the federally facilitated exchanges (FFEs) (collectively referred to as Payers).[1]

The Final Rule requires Payers to, among other things, implement certain application programming interfaces (APIs) to improve electronic data exchanges, adds a new measure to the Merit-based Incentive Payment System (MIPS) to encourage the adoption of electronic processes, and streamlines prior authorization to reduce the burden on providers and facilitate patients’ timely access to care. This On the Subject focuses on key changes to Payers’ prior authorization practices.

IN DEPTH

IMPLEMENTATION AND MAINTENANCE OF PRIOR AUTHORIZATION API

Beginning in 2027, Payers must implement Prior Authorization API to further “support and streamline” prior authorization decisions. The API must (i) be populated with the Payer’s list of covered items and services that require prior authorization, (ii) identify the documentation required to obtain approval of the item/service, (iii) support a Health Insurance Portability and Accountability Act of 1996 (HIPAA)-compliant request and response, and (iv) communicate whether the Payer approves, denies or requires more information regarding the request. With respect to an approval, a Payer must communicate the date or circumstance under which an authorization ends. As for a denial, a Payer must communicate the specific reason for the denial (as discussed further below).

The implementation of a Prior Authorization API may require Payers to make substantial investments. CMS delayed the proposed implementation date of this requirement by one year to allow Payers additional time to develop, test and maintain their platforms, as well as to conduct outreach and education to providers. Providers are not required to use the Prior Authorization API; however, the Final Rule includes incentives to encourage certain providers to take up the platforms (e.g., by finalizing new electronic prior authorization measures for MIPS-eligible clinicians).

PROVIDING REASONS FOR DENIALS

When Payers deny prior authorization requests today, the information they provide often varies from one Payer to the next. Beginning in 2026, the Final Rule will require Payers to provide a specific reason for denying a prior authorization request, regardless of the method used to send the request (calls, email, standard transactions, etc.). A “specific reason” for denial may include referencing the plan provision on which the denial is based, citing to coverage criteria, providing a narrative explanation, or noting that the documentation submitted did not support the plan of care. In comments to the Final Rule, CMS indicates that a “specific reason” for the denial means a Payer must provide sufficient information in the denial response so that a provider understands what action they must take to obtain coverage, which may include an appeal, submission of additional information or identifying alternative treatment options.

Depending on the line of business, Payers may already be subject to certain denial notification standards (e.g., before an MA plan can issue a denial based on medical necessity, the decision must be reviewed by a healthcare professional with relevant expertise). Those standards remain intact and are not changed by the Final Rule.

PRIOR AUTHORIZATION DECISION AND NOTIFICATION TIMEFRAMES

The Final Rule meaningfully shortens Payers’ decision and notification timeframes for standard prior authorization requests (i.e., a non-expedited, non-urgent request), while establishing decision timeframes for expedited prior authorization requests (i.e., an urgent request) for Medicaid FFS and CHIP FFS, which are not currently specified in federal regulations. Generally, Payers must now respond as expeditiously as a patient’s health condition requires but no later than 72 hours after receiving an expedited request (unless a shorter timeframe is required by applicable state law)[2] and no later than seven calendar days after receiving a standard request. In some instances, the timeframe for responding to a standard request may be extended to up to 14 calendar days. The reduced timeframes do not apply to QHP issuers on the FFEs since those issuers are subject to unique claims and appeals, external review and pre-service claims processes.

The new standards will apply beginning in 2026.

Depending on the line of business, the timeframes for standard prior authorization requests are noticeably shorter than current standards. For example, for MA plans, existing regulations require organizations to notify a beneficiary of its determination for a standard prior authorization request within 14 calendar days after the organization receives the request. Under the Final Rule, this timeframe would be cut in half for standard requests.

Current vs. Finalized Prior Authorization Timeframes

Authors’ summary of CMS’ proposed rule (Table 4) and Final Rule (Table E1), with a few modifications to reflect more detail. Extensions of timeframes are not included in the chart.

PUBLIC REPORTING: APPROVALS, DENIALS AND APPEALS

Beginning in 2026, Payers must post on their websites prior authorization data, including:

• A list of all items and services that require prior authorization
• The percentage of standard prior authorization requests that were approved, denied and approved after appeal
• The percentage of prior authorization requests for which the timeframe for review was extended
• The percentage of expedited prior authorization requests that were approved and denied
• The average and median time that elapsed between the submission of a request and a determination by the Payer for both standard and expedited requests.

MA plans will report at the contract level (a change from CMS’ proposed rule), Medicaid managed care plans and CHIP managed care entities will report at the plan level, QHP issuers on the FFEs will report at the issuer level, and state Medicaid and CHIP FFS programs will report at the state level.[3] Payers must post the initial set of metrics by March 31, 2026, and then provide updates annually thereafter. At this time, CMS will not collect the prior authorization data itself. However, the agency will continue to monitor complaints received by beneficiaries and providers for potential discrimination through prior authorization and utilization management programs and will take action, as necessary.

Note that none of the prior authorization policies included in the Final Rule apply to drugs.[4] CMS may consider options for improving the prior authorization processes for drugs in future rulemakings.