The CMS Interoperability and Prior Authorization rule

The CMS Interoperability and Prior Authorization final rule — identified in agency documents as CMS-0057-F and finalized in early 2024 — is a federal regulation that requires certain government-regulated health plans to streamline prior authorization and share data through standardized electronic interfaces. Issued by the Centers for Medicare & Medicaid Services, it sets decision timeframes, requires payers to give a specific reason when they deny a request, and mandates public reporting of authorization data. It reaches only the payers CMS oversees. It arrives in two waves, and the first is already landing: the denial-reason, decision-timeframe and reporting duties began binding impacted payers at the start of 2026 — on each program's own clock, which for managed care plans means their rating period rather than the calendar — while the four programming interfaces are a 2027 requirement whose exact date likewise depends on the payer.

Updated August 2, 202615 min read

Reviewed by Anwaar Tayyab

Director of Billing Operations · July 31, 2026

On this page

Key takeaways

CMS-0057-F is a federal rule finalized in 2024 that targets prior authorization burden and payer-to-payer data sharing.
It applies to CMS-regulated payers — Medicare Advantage, Medicaid and CHIP programs and managed care plans, and Qualified Health Plans on the federal exchanges — not most commercial or employer plans.
The operational requirements arrived during 2026, on each program's own clock: a specific reason for every denial, a maximum of 7 calendar days for a standard decision, and public reporting of prior authorization metrics, whose first posting deadline was 31 March 2026.
The four FHIR-based APIs — Patient Access, Provider Access, Payer-to-Payer, and the Prior Authorization API — have not. They are a 2027 requirement, and the exact date differs by payer type.
There is no single compliance date. Medicare Advantage runs on flat calendar dates; Medicaid and CHIP managed care runs on rating periods; Qualified Health Plans run on plan years, and were left out of the decision-timeframe change altogether.
The rule also created an obligation for hospitals, not only for payers — and CMS made that one optional for its first year in a final rule published on 4 August 2026.
Drugs are excluded from the prior authorization provisions. CMS has proposed to change that; the proposal is not final.

What the rule is

The rule ties two goals together: making health data flow more freely among plans, providers, and patients, and reducing the friction that prior authorization adds to care. Identified in CMS documents as CMS-0057-F and finalized in early 2024, it builds on the agency's earlier 2020 Interoperability and Patient Access rule, which first required certain payers to expose patient data through standardized programming interfaces. The newer rule extends that foundation specifically to the authorization process, obligating covered plans to share requirements electronically, decide requests faster, and report on how they use prior authorization.

Importantly, the rule governs payer behavior rather than the clinical criteria behind any decision. It does not define which services need approval or what counts as medically necessary — those judgments remain with each payer and its policies. What the rule changes is the plumbing and the timeline around the request: how information moves, how quickly a determination must be returned, and what a plan must disclose when it declines a service.

Interoperability vs. the authorization itself

Interoperability refers to standardized ways for software systems to exchange data. The rule pairs those data standards with new prior authorization duties, but it does not replace the underlying review — a plan still evaluates each request against its own coverage rules.

Which payers it applies to

The rule reaches the payers CMS directly oversees. That scope is central to understanding it, because a requirement that binds a Medicare Advantage organization may not apply to a neighboring employer-sponsored plan at all. The categories of impacted payers are:

Medicare Advantage organizations
State Medicaid and CHIP fee-for-service programs
Medicaid and CHIP managed care plans
Qualified Health Plan issuers on the Federally-Facilitated Exchanges

Most commercial and self-funded employer plans fall outside the rule's direct authority. Drugs are excluded too, and the exclusion is wider than the phrase "prescription drugs" suggests: for Medicare Advantage the rule defines drugs, for this purpose, as any and all drugs the organization covers, including those covered under the Part D benefit, and every operative paragraph — the denial-reason duty, the decision timeframe, the reporting metrics and the Prior Authorization API — carries the same carve-out. Medication approvals therefore continue to run through pharmacy-benefit processes and other standards, and none of the timing or transparency described below reaches them. Because the rule's reach varies by payer type and program — and because states may layer their own prior authorization laws on top — the requirements that actually apply should be confirmed against the specific plan and jurisdiction involved. The related articles on prior authorization under Medicare Advantage and under Medicaid describe how each program administers authorization within that framework.

The electronic interfaces it requires

A core mechanism of the rule is a set of application programming interfaces, or APIs, built on the HL7 FHIR standard — a common healthcare data format that lets different systems exchange structured information. Rather than prescribing one vendor's product, the rule requires covered payers to expose data through these standardized interfaces so that the provider and patient applications that connect to them can exchange information in a common format. Four interfaces are central to the rule.

Patient Access API: Lets patients retrieve their own claims, encounter, and — under the newer rule — prior authorization information through an application they choose.
Provider Access API: Shares a patient's data, including prior authorization details, with in-network providers to support care coordination.
Payer-to-Payer API: Moves a member's data, including active prior authorizations, from a former plan to a new one when the patient changes coverage.
Prior Authorization API: A FHIR-based interface intended to tell a provider's system whether a service needs authorization, what documentation is required, and the payer's decision — the technical backbone for electronic prior authorization.

New prior authorization obligations

Beyond data sharing, the rule imposes several operational duties on covered payers. Together they aim to make determinations faster and more transparent, and to give the field data on how often prior authorization is used and upheld.

Faster standard decisions — the codified maximum for a standard prior authorization decision is 7 calendar days, replacing the 14 that applied in the programs that already had a limit and establishing one where none existed. The maximum for an expedited request stayed where it was, at 72 hours. Both windows may still be extended by up to 14 calendar days on the grounds each program's rule states.
Specific denial reasons — when a request is denied, the payer must give the provider a specific reason, whatever channel it uses to communicate the decision. That is what makes a cleaner resubmission or appeal possible, and it is the provision most directly useful to a billing operation.
Public reporting — covered payers must post nine specified prior authorization metrics for the previous calendar year on their own websites by 31 March. The set is enumerated in the rule: the list of items and services requiring authorization, approval and denial percentages for standard and expedited requests, the share approved after appeal, the share whose review was extended and then approved, and the average and median elapsed time for standard and for expedited decisions.

What the reporting requirement is worth to a practice

It is the only one of the three that creates something a provider can read rather than something a payer must do. A practice measuring its own authorization turnaround now has a published counterpart to read it against, payer by payer, from the payer's own website — and the metric definitions are fixed by the rule, so the figures are meant to be comparable across plans in a way self-reported vendor figures are not.

Which requirements have arrived, and which have not

This is where most summaries of the rule go wrong, in two directions at once. They describe the whole rule as future, when the operational half of it has been arriving since the start of 2026; and they give a single date, when the rule does not have one. The compliance date is written into each program's own regulation, and the three programs use three different clocks — a calendar date for Medicare Advantage, a rating period for Medicaid and CHIP managed care, and a plan year for Qualified Health Plans.

When each requirement binds, by payer type, from the compliance date written into each program's codified rule. The distinction between a calendar date, a rating period and a plan year is the rule's, not a simplification.

When each requirement binds, by payer type, from the compliance date written into each program's codified rule. The distinction between a calendar date, a rating period and a plan year is the rule's, not a simplification.
Requirement	Medicare Advantage	Medicaid and CHIP	Qualified Health Plans on the FFEs
A specific reason for every denial	1 January 2026 — 42 CFR 422.122(a)	1 January 2026 for fee-for-service (42 CFR 431.80(a); CHIP at 457.732(a)). For managed care plans it is the rating period beginning on or after that date (42 CFR 438.242(b)(8))	1 January 2026 — 45 CFR 156.223(a)
A 7-calendar-day maximum for a standard decision	1 January 2026 — 42 CFR 422.568(b)(1)(ii), which applies only to items and services subject to the prior authorization rules; other standard determinations keep the 14-day window	1 January 2026 for fee-for-service (42 CFR 440.230(e)(1)(i); CHIP at 457.495(d)(2), each yielding to a shorter minimum set by state law). For managed care, the rating period beginning on or after that date (42 CFR 438.210(d)(1)(i)(B))	No change. The rule left QHP issuers under the decision timeframes that already applied to them
Public reporting of prior authorization metrics	First posting due 31 March 2026, at MA contract level — 42 CFR 422.122(c)	First posting due 31 March 2026, at state level for fee-for-service (42 CFR 440.230(e)(3); CHIP at 457.732(c)) and at plan level for managed care (42 CFR 438.210(f))	First posting due 31 March 2026, at issuer level — 45 CFR 156.223(c)
The four APIs, including the Prior Authorization API	1 January 2027 — 42 CFR 422.119(b)(1)(iv), 422.121(a) and (b), 422.122(b)	1 January 2027 for fee-for-service, but a state may apply for a one-time one-year extension, and a state with at least 90 percent of its beneficiaries in managed care may apply to be exempted outright (42 CFR 431.80(b) and (c); CHIP at 457.732(b) and (d)). For managed care, the rating period beginning on or after that date (42 CFR 438.242(b)(7))	Plan years beginning on or after 1 January 2027, subject to an exception process — 45 CFR 156.221(b)(1)(iv), 156.222(a), 156.223(b)

Read as of the codified text current through 5 August 2026. Two consequences follow for anyone working a queue. A Medicaid managed care plan whose rating period began mid-2025 was still on the old decision window for part of 2026, so the same requirement arrived at different plans on different days. And because the API date can be extended or waived for a state, 1 January 2027 is when the obligation attaches, not a guarantee that every payer will have an interface on that date.

The public reporting has already happened

The first posting deadline under this rule has passed. Every impacted payer was required to publish the previous calendar year's prior authorization metrics on its own website by 31 March 2026. A practice that has never looked for them is leaving on the table the only payer-published, definition-matched authorization data this rule produces.

The part of the rule that lands on providers

The rule is usually described as a set of payer duties, and it mostly is. But its full title also names Merit-based Incentive Payment System eligible clinicians and eligible hospitals and critical access hospitals in the Medicare Promoting Interoperability Program, and for those it created a reporting obligation of its own: the Electronic Prior Authorization measure. As adopted, an eligible hospital or critical access hospital had to attest that, for at least one item or service ordered during the reporting period, the prior authorization was requested electronically through a Prior Authorization API using certified health IT — with a narrow set of exclusions, and with a "No" attestation meaning the hospital failed to meet minimum program requirements and took a downward payment adjustment.

Changed on 4 August 2026 — optional for its first year

In the FY2027 inpatient prospective payment final rule, CMS finalized making the Electronic Prior Authorization measure optional for the CY2027 reporting period, worth 10 bonus points to a hospital that attests "Yes" and costing nothing to one that does not. Exclusions are not offered for that year, because an optional measure does not need them. It becomes a required measure beginning with the CY2028 reporting period. CMS gave three reasons: procurement and testing time, the burden on small and rural hospitals, and its own pending changes to the API standards. Anything written before August 2026 describes the CY2027 requirement as mandatory, and that is no longer correct.

Two details of the measure are worth knowing because they narrow it more than its name suggests. Drugs are outside its scope, on both the medical and the pharmacy benefit. And an item or service that turns out not to require authorization is outside it too: CMS has stated that querying an API and being told no authorization is needed does not satisfy the measure, because the need for authorization has to have been established first. To attest "Yes" for the reporting period, the request has to end in a decision — satisfied, approved, or denied.

What is proposed, and the narrow part that became law

In April 2026 CMS published a further proposed rule, identified as CMS-0062-P, that would extend this framework rather than replace it. Among its proposals: bringing prior authorization for drugs inside the requirements the current rule excludes them from; requiring impacted payers to report their API endpoints to CMS and to collect usage metrics; adding small group market Qualified Health Plan issuers on the Federally-facilitated Small Business Health Options Program exchanges to the list of impacted payers; and converting the FHIR implementation guides the current rule merely recommends into requirements. HHS also proposed adopting the FHIR base standard as a HIPAA standard for the referral certification and authorization transaction, which is the transaction prior authorization runs on today.

Part of it was finalized on 4 August 2026 — but not the part that changes a payer's obligations

The comment period closed on 15 June 2026, and a final rule under the same docket number, CMS-0062-F, followed on 4 August 2026. It was not published as a rule of its own: it appears inside the FY 2027 IPPS final rule (91 FR 49570), which carries both docket numbers. What it finalized is narrow. Only the Office of the National Coordinator's provisions were adopted — updated versions of certain health IT standards and specifications at 45 CFR 170.215, replacing the previously adopted versions on the rule's effective date of 1 October 2026. Those standards are the ones ONC health IT certification criteria for electronic prior authorization point at, so the effect lands on certified software rather than on plans.

Everything CMS itself proposed remains proposed. Prior authorization for drugs, the API endpoint reporting and usage metrics, the addition of small group market Qualified Health Plan issuers, the conversion of recommended implementation guides into required ones, and the adoption of the FHIR base standard for the referral certification and authorization transaction — none of these was finalized on 4 August, and none is an obligation today. The distinction is easy to lose because one docket number now attaches to both a proposal and a final rule, and because a reader who sees "CMS-0062-F, final" will reasonably assume the drug exclusion is gone. It is not. The advice is unchanged: a practice planning multi-year work around medication authorization should know the proposal exists and should not build to it.

What it means for billing operations

For revenue cycle teams working with affected plans, two things are already true of most impacted payers and one is not yet true of any. The specific denial reason and the shorter standard decision window are in force — for a managed care plan, from the start of its first rating period on or after 1 January 2026, so it is worth knowing which rating period a plan is in before leaning on either. Where they apply, a vague rejection is now a compliance question rather than a fact of life, and a standard request that has been open past the applicable window is a follow-up with a rule behind it. What is not yet true is the electronic rail itself. As covered payers stand up their interfaces during 2027, a provider's system may be able to learn whether a service needs authorization and what documentation is required without a portal login or fax, and to receive decisions and a distinct authorization number through the same channel. Shorter maximum windows for standard decisions and specific denial reasons can also compress the time spent chasing status and interpreting vague rejections, which supports tighter tracking of authorization status and deadlines.

The rule does not eliminate the underlying work, however. Teams still confirm whether a service requires review, assemble clinical documentation, and follow the payer's authorization workflow to a decision — the steps the prior authorization request checklist walks through, and the wider subject of the prior authorization knowledge base. Payers not covered by the rule may continue with existing processes, so front-end steps and per-payer verification remain essential regardless of how far electronic exchange advances. In short, the rule reshapes the mechanics and the timelines of prior authorization for a defined set of plans — it does not remove the clinical judgment, the documentation, or the need to match what was approved to what is ultimately billed.

Common questions

Does the CMS rule eliminate prior authorization?

No. It standardizes and speeds parts of the process for covered payers and requires clearer denials, but providers still submit documentation and payers still evaluate each request against their coverage and medical-necessity criteria.

Does the rule apply to commercial or employer health plans?

Not directly. It governs CMS-regulated payers — Medicare Advantage organizations, Medicaid and CHIP programs and managed care plans, and Qualified Health Plans on the Federally-Facilitated Exchanges. Whether any other requirement reaches a commercial or self-funded employer plan depends on the plan and the jurisdiction, so confirm it against the plan involved.

Does the rule cover prescription drugs?

No. Every operative provision — the denial-reason duty, the decision timeframe, the reporting metrics and the Prior Authorization API — excludes drugs, and for Medicare Advantage the rule defines that to mean any and all drugs the organization covers, including Part D drugs. Medication prior authorization continues to run through pharmacy-benefit processes and other standards. CMS proposed in April 2026 to bring drugs inside the framework; that proposal has not been finalized.

When do the requirements take effect?

In two waves, and not on a single date. The operational requirements — a specific reason for every denial, a 7-calendar-day maximum for a standard decision, and public reporting of prior authorization metrics — began applying at the start of 2026, and the first reporting deadline was 31 March 2026. The four APIs are a 2027 requirement. Within each wave the exact date depends on the payer: Medicare Advantage runs on calendar dates, Medicaid and CHIP managed care on the rating period beginning on or after the date, and Qualified Health Plans on plan years beginning on or after it. Medicaid and CHIP fee-for-service programs may also apply for a one-year extension or, in heavily managed-care states, an exemption from the API requirement.

Do the shorter decision timeframes apply to every plan the rule covers?

No. Qualified Health Plan issuers on the Federally-Facilitated Exchanges were left under the decision timeframes that already applied to them. For Medicare Advantage the 7-calendar-day maximum also reaches only items and services that are subject to the rule's prior authorization provisions — other standard organization determinations keep the longer window — and the timeframes for Part B drug requests are separate again.

Does the rule require anything of providers?

Yes, for hospitals and clinicians in the Medicare Promoting Interoperability Program and MIPS. It created an Electronic Prior Authorization measure requiring attestation that at least one prior authorization was requested electronically through a Prior Authorization API using certified health IT. For eligible hospitals and critical access hospitals, CMS made that measure optional and worth bonus points for the CY2027 reporting period in a final rule published on 4 August 2026, and required beginning with CY2028.

What is the Prior Authorization API meant to do?

It is a FHIR-based interface intended to let a provider's system learn whether a service needs authorization, what documentation is required, and the payer's decision, supporting electronic prior authorization.

Key terms in this article

Defined once, on their own pages.

Continue learning

Where to go next on prior authorization and the systems around it.

Authoritative sources

CMS Interoperability and Prior Authorization final rule (CMS-0057-F), 89 FR 8758 (opens in a new tab)
Centers for Medicare & Medicaid Services final rule published February 8, 2024 — the source of the covered payer list, the four APIs, the drug exclusion, the phased compliance dates, and the public reporting requirement.
42 CFR 422.122 — Prior authorization requirements (Medicare Advantage) (opens in a new tab)
Codified rule text, read current through 5 August 2026. Paragraph (a): beginning 1 January 2026, a denied prior authorization response to the provider must include a specific reason for the denial, regardless of the method used to communicate it. Paragraph (b): beginning 1 January 2027, a Prior Authorization API populated with the covered items and services requiring authorization, able to identify the documentation required, supporting a HIPAA-compliant request and response, and communicating approval (with the date or circumstance under which it ends), denial with a specific reason, or a request for more information. Paragraph (c): beginning in 2026, prior authorization data reported at MA contract level by 31 March for the previous calendar year, enumerating nine metrics. Every paragraph excludes drugs, defined at 422.119(b)(1)(v) as "any and all drugs covered by the MA organization", including Part D drugs
42 CFR 422.568 — Standard timeframes and notice requirements for organization determinations (opens in a new tab)
Codified rule text. Paragraph (b)(1)(i) keeps 14 calendar days for a service or item not subject to the prior authorization rules in 422.122; paragraph (b)(1)(ii) sets 7 calendar days beginning on or after 1 January 2026 for a service or item that is subject to them. Paragraph (b)(2) allows a 14-calendar-day extension on stated grounds. The expedited window at 422.572(a)(1) remains 72 hours
42 CFR 431.80 and 42 CFR 440.230(e) — Medicaid prior authorization requirements and decision timeframes (opens in a new tab)
Codified rule text. 431.80(a): the specific-denial-reason duty from 1 January 2026. 431.80(b): the Prior Authorization API from 1 January 2027, and 431.80(c) the two escape routes — a written application for a one-time one-year extension, and an exemption for a state with at least 90 percent of its Medicaid beneficiaries in managed care organizations. 440.230(e)(1): from 1 January 2026, 7 calendar days for a standard determination and 72 hours for an expedited one, each yielding to a shorter minimum established under state law, with a 14-day extension available. 440.230(e)(3): the same nine reporting metrics, at state level, by 31 March
42 CFR 438.210 and 42 CFR 438.242(b) — Medicaid managed care authorization and health information systems (opens in a new tab)
Codified rule text, and the reason a flat compliance date is wrong for managed care. 438.210(d)(1)(i) sets 14 calendar days for rating periods that start before 1 January 2026 and 7 for rating periods that start on or after it. 438.242(b)(8) applies the denial-reason duty by the rating period beginning on or after 1 January 2026, and 438.242(b)(7) applies the Prior Authorization API requirement by the rating period beginning on or after 1 January 2027. 438.210(f) requires the nine reporting metrics at plan level by 31 March
45 CFR 156.221, 156.222 and 156.223 — Qualified Health Plan issuers on the Federally-facilitated Exchanges (opens in a new tab)
Codified rule text, in title 45 rather than title 42. 156.223(a) sets the specific-denial-reason duty from 1 January 2026; 156.223(b) and 156.222(a) set the Prior Authorization and Provider Access APIs for plan years beginning on or after 1 January 2027, each subject to an exception process; 156.221(b)(1)(iv) adds prior authorization information to the Patient Access API on the same plan-year basis; 156.223(c) requires the nine reporting metrics at issuer level by 31 March. There is no decision-timeframe paragraph — this is the program the rule left alone on timing
Hospital Inpatient Prospective Payment Systems and FY2027 Rates, final rule (91 FR 49570, 4 August 2026), section IX.F.5 at 91 FR 50043–50053 — CMS restates the Prior Authorization API compliance structure payer by payer: "by January 1, 2027 for MA organizations and state Medicaid and CHIP FFS programs; by the first rating period beginning on or after January 1, 2027 for Medicaid managed care plans and CHIP managed care entities; and for plan years beginning on or after January 1, 2027 for individual market QHP issuers on the FFEs". It then finalizes making the Electronic Prior Authorization measure "optional and eligible for 10 bonus points" for eligible hospitals and critical access hospitals for the CY2027 EHR reporting period, replacing the CMS-0057-F policy under which a "No" attestation meant failing minimum program requirements, and required beginning with the CY2028 reporting period. It also states that a query answered "prior authorization is not needed" is outside the measure, and that drugs are outside it on both the medical and prescription benefit (opens in a new tab)
U.S. Government Publishing Office (Federal Register), Centers for Medicare & Medicaid Services
Adoption of Health Information Technology Standards and Incorporation by Reference — the CMS-0062-F finalization, at 91 FR 49578–49579 within the FY 2027 IPPS final rule (4 August 2026), which carries the docket numbers "CMS-1849-F and CMS-0062-F" and RINs 0938-AV79 and 0938-AV44. ONC states that it "is finalizing certain provisions" of the 14 April 2026 proposed rule — specifically the adoption of updated health IT standards and specifications at 45 CFR 170.215(j), (k), (m) and (n) on behalf of HHS, replacing the previously adopted versions "upon the effective date of this final rule" (1 October 2026). RIN 0938-AV44 is the same RIN as CMS-0062-P, which is how a proposal and its partial finalization can be matched across two documents. The CMS proposals in that docket — drug prior authorization, endpoint reporting, SHOP QHP issuers, mandatory implementation guides, FHIR as a HIPAA standard — are not among the finalized provisions (opens in a new tab)
U.S. Government Publishing Office (Federal Register), Office of the National Coordinator for Health Information Technology and Centers for Medicare & Medicaid Services
Interoperability Standards and Prior Authorization for Drugs, proposed rule CMS-0062-P (91 FR 19890, 14 April 2026, comments closed 15 June 2026) — proposes electronic prior authorization for drugs and the extension of existing non-drug interoperability requirements to drug authorizations; API endpoint reporting to CMS and collection of API usage metrics; the addition of small group market QHP issuers on the FF-SHOPs as impacted payers; converting recommended HL7 FHIR implementation guides into required ones; and HHS adoption of the FHIR base standard for the referral certification and authorization and associated eligibility transactions under HIPAA. Every one of these CMS proposals remains proposed. Only the Office of the National Coordinator's provisions from this docket were finalized, as CMS-0062-F inside the FY 2027 IPPS final rule (opens in a new tab)
U.S. Government Publishing Office (Federal Register), Centers for Medicare & Medicaid Services
CMS Interoperability and Prior Authorization final rule; Correcting Amendment (89 FR 85070, 25 October 2024) — corrects errors in executing the amendatory instructions for 42 CFR 431.60 and 457.730, restoring the intended paragraph structure. CMS states it makes no substantive change to the policies adopted in the final rule, which is why the compliance dates above are read from the codified text rather than from the February 2024 document (opens in a new tab)
U.S. Government Publishing Office (Federal Register), Centers for Medicare & Medicaid Services