CMS Releases New Payer Requirements on Interoperability and Prior Authorization

This month, the Centers for Medicare and Medicaid Services (CMS) published its Interoperability and Prior Authorization final rule (CMS-0057-F). The rule established new requirements concerning the electronic exchange of health information and prior authorization requirements specifically for Medicare Advantage (MA) organizations, Medicaid and the Children’s Health Insurance Program (CHIP) fee-for-service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs) offered on Federally-Facilitated Exchanges (FFEs).

CMS’ new prior authorization regulations include requirements for specified payers to provide a reason for all denied prior authorization requests and to publicly report prior authorization metrics on their websites annually. CMS also shortened the prior authorization response timeline for specified payers (excluding QHPs offered on FFEs), requiring decisions to be made within seven days for standard requests and within 72 hours for expedited requests. The above policies go into effect on January 1, 2026 with a deadline to report the initial set of prior authorization metrics by March 31, 2026.

The final rule required specified payers to develop and provide access to multiple application programming interfaces (APIs), including an EHR-to-payer prior authorization API, an API for patient access to data adhering to HL7® FHIR® standards, an API that allows physicians to access their patients’ data, and a payer-to-payer API. The deadline to meet these API-related requirements is January 1, 2027.

In addition, CMS introduced a new measure, “Electronic Prior Authorization,” to the Merit-based Incentive Payment System (MIPS) Promoting Interoperability performance category and the Medicare Promoting Interoperability Program. To report this measure, eligible clinicians “must attest ‘yes’ to requesting a prior authorization electronically via a Prior Authorization API using data from certified electronic health record technology (CEHRT) for at least one medical item or service (excluding drugs) ordered during the CY 2027 performance period or (if applicable) report an exclusion.”

For more information on the rule, see CMS’ fact sheet.

Please contact the ASA Department of Quality and Regulatory Affairs at [email protected] with any questions.