CMS Interoperability & Prior Authorization Final Rule

Impacted Payers: It affects Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans on Federally-Facilitated Exchanges.

Prior Authorization Timeframes: From 2026, certain payers will need to respond within 72 hours for urgent requests and seven days for standard requests, which is a significant reduction from current timeframes.

Denial Transparency: Payers must provide specific reasons for denying prior authorization requests to facilitate resubmissions or appeals.

Public Reporting: Impacted payers will be required to publicly report prior authorization metrics.

API Implementation: The rule mandates the implementation of a Health Level 7 (HL7) Fast Healthcare Interoperability Resources (FHIR) Prior Authorization application programming interface (API) to automate the authorization process.

HIPAA Enforcement Discretion: There will be flexibility for entities using an all-FHIR-based Prior Authorization API regarding HIPAA X12 278 transaction standard compliance.

API Requirements for Data Exchange: Finalization of API requirements to increase health data exchange, with compliance dates pushed from January 2026 to January 2027.

Payer-to-Payer Data Exchange: Impacted payers are required to exchange health data using a Payer-to-Payer FHIR API when a patient moves between payers or has multiple payers.

Electronic Prior Authorization Measure: Introduction of a new measure for eligible clinicians and hospitals to report their use of Prior Authorization APIs under the MIPS and Medicare Promoting Interoperability Program.