Yesterday, January 17, 2024, CMS released the Interoperability and Prior Authorization final rule, CMS-0057-F. If you run a practice that fights with Medicare Advantage plans over prior authorizations, this is the rule you have been waiting for since the proposal in December 2022. It is also a rule whose most useful provisions do not take effect for two to three years, so we want to be careful about what it does and does not fix for you this year.
The short version: covered payers must answer prior authorization requests within fixed timeframes starting in 2026, must give a specific reason when they deny, must publish their approval and denial statistics, and must build a standards-based prior authorization API by 2027 so that requests can move between your EHR and the payer without a fax machine or a portal login. CMS estimates about $15 billion in savings over ten years, mostly on the provider side.
We read the rule twice yesterday afternoon, once as technologists and once as the people who sit on hold with plans. What follows is the second reading.
Key takeaways
- CMS-0057-F applies to Medicare Advantage, Medicaid and CHIP fee-for-service and managed care, and exchange plans on the federal marketplace. Traditional Medicare and employer group plans are not covered.
- From January 1, 2026, covered payers must decide expedited requests within 72 hours and standard requests within 7 calendar days, and must state a specific reason for every denial.
- From 2026, each payer must post its prior authorization metrics publicly every year, starting with 2025 data by March 31, 2026.
- The Prior Authorization API and the other FHIR APIs arrive January 1, 2027, a year later than proposed. Drugs are excluded from the whole rule.
- Nothing is required of a practice in 2024. The useful work now is building a prior authorization log so you have your own numbers when the payers publish theirs.
Who is covered, and who is not
The rule applies to what CMS calls impacted payers:
- Medicare Advantage organizations
- State Medicaid and CHIP fee-for-service programs
- Medicaid managed care plans and CHIP managed care entities
- Qualified health plan issuers on the federally facilitated exchanges
It does not apply to traditional Medicare, which has very little prior authorization to begin with, and it does not apply to employer group plans or to commercial plans sold outside the federal exchange. If your payer mix is heavy on commercial group business, this rule changes nothing for those contracts unless the carrier chooses to apply the same process across its lines. Several large carriers have said they will; we will believe it when the turnaround times change.
A quick way to size the effect on your own practice: pull last year's prior authorization requests by payer, or if you have no log, pull charges by payer for the services that usually need authorization in your specialty (advanced imaging, injectables, sleep studies, DME, elective procedures). Mark each payer as covered or not covered. A primary care practice with 35 percent Medicare Advantage and 15 percent Medicaid managed care will find that about half its authorization volume falls under the rule. An orthopedic practice that is 70 percent commercial group will find that most of its volume does not.
The timeline
| Requirement | Effective | What it means at the desk |
|---|---|---|
| Decision timeframes: 72 hours for expedited requests, 7 calendar days for standard requests | January 1, 2026 | A Medicaid managed care plan can no longer sit on a routine MRI request for three weeks |
| Specific reason for every denial | January 1, 2026 | The denial letter must say why, whatever channel the request came through: fax, portal, phone or API |
| Public reporting of prior authorization metrics on the payer's website | Annually, starting March 31, 2026 for 2025 data | You will be able to see approval rates, appeal overturn rates and average decision times by plan |
| Prior Authorization API (FHIR based), Provider Access API, Payer-to-Payer API, Patient Access API updates | January 1, 2027 | Your EHR vendor can build a submit-and-track workflow that talks to the payer directly |
| MIPS Promoting Interoperability measure "Electronic Prior Authorization" | 2027 performance period | Clinicians attest to using the API, or claim an exclusion |
Two things worth noticing. The timeframe rule applies to medical items and services, not drugs; drug prior authorization is excluded from this rule. And the 2027 API date was pushed back a year from the proposal in response to payer comments, so do not expect your EHR vendor to ship anything usable before then.
What the timeframes do and do not fix
Seven calendar days for a standard request is an improvement for Medicaid managed care, where we routinely see two to three weeks. For Medicare Advantage, the existing rules already required 14 days for standard requests and 72 hours for expedited, so the 2026 change cuts the standard window in half. That matters for scheduling: a practice that today books an MA patient's procedure three weeks out to allow for authorization can tighten that once the rule is in force.
What the rule does not touch is the substance of the decision. A payer can still deny, still require peer-to-peer, still apply its own medical necessity criteria within CMS limits. Faster no is still no. The denial reason requirement helps here: a specific reason lets your team correct a request instead of guessing, and it gives an appeal something to argue against.
Here is what that looks like in practice. Today a request for a lumbar MRI comes back from a Medicaid managed care plan as "does not meet medical necessity criteria." The authorization coordinator has no idea whether the plan wanted six weeks of documented conservative treatment, a neurological finding, or a different diagnosis code. She calls, waits 40 minutes, and learns it was the conservative treatment. In 2026 that reason has to be in the denial itself. The request goes back with the physical therapy notes attached, the same day, without the call.
The public metrics are the part everyone skips
Starting in 2026, each impacted payer must post, for the prior year, the share of requests approved, denied and approved after appeal, and the average time to decision, broken out by standard and expedited. We think this is the most underrated provision. For the first time a practice negotiating a Medicare Advantage contract will be able to say: your denial rate for imaging is twice the plan across town, and here is your own published number. Contract negotiators should calendar March 2026 now.
The metrics are only useful if you can compare them with your own experience, which brings us to the one piece of work that makes sense this year.
Build the authorization log now
Most practices cannot answer "how long does Aetna Medicare take on a knee MRI" today, because the answer lives in a coordinator's memory and a pile of fax confirmations. A log fixes that. It does not need software; a shared spreadsheet with locked columns works for a practice with one or two coordinators. The fields we ask for:
| Field | Why it is there |
|---|---|
| Payer and plan type (MA, Medicaid MCO, exchange, commercial group) | Tells you which requests fall under the rule in 2026 |
| Service, with CPT or HCPCS code | Lets you compare turnaround by service line and spot the codes that always get denied |
| Date submitted, date decided, expedited or standard | Your own turnaround time, to hold against the payer's published figure |
| Outcome and denial reason exactly as written | A baseline of what "not medically necessary" with no detail used to look like |
| Appeal filed, appeal outcome, date | Your overturn rate; a high overturn rate is a negotiating point and an audit target |
| Channel: fax, portal, phone, EHR integration | Shows where staff time goes and what the API could replace |
A two-coordinator practice that tracks 60 requests a week has, by the end of 2025, roughly 6,000 rows. That is enough to say with confidence that one plan decides in four days and another in sixteen, and that a particular plan denies 30 percent of sleep study requests and overturns two thirds of them on appeal. Those are the sentences that change contract negotiations.
Questions we hear
Does this rule end prior authorization for anything?
No. It regulates how fast and how transparently payers decide. It does not remove any service from prior authorization requirements. Some plans have separately announced reductions in their prior authorization lists; those are business decisions, not requirements of this rule.
Will the API replace payer portals?
Eventually, for covered payers, if EHR vendors build the provider side. The rule requires the payer to expose the API. It does not require your EHR to use it. Expect a period where both the portal and the API exist and staff use whichever works. Ask your EHR and practice management vendor, in writing, about their plans for the Prior Authorization API. The answer will be vague. Ask again in 2025.
Should we change staffing for prior authorization now?
Not because of this rule. The volume of requests does not change in 2024. If authorization denials are a current problem, the fix is the same as it was last year: submit complete requests, track every one, and appeal with documentation. The Revelrex denial management team handles authorization-related denials as a category of its own, and our RCM audit reports how many of your denials trace back to an authorization that was never obtained or never attached.
What to do this month
- Start the prior authorization log with the fields above, and make every request from February 1 onward go into it, whatever channel it came through.
- Classify your payers as covered or not covered by the rule, and note the share of your authorization volume that falls under it.
- Read the denial section of your Medicare Advantage contracts. Some already promise faster turnaround than the rule requires, and nobody has enforced it.
- Send one email to your EHR vendor asking about their Prior Authorization API roadmap, and file the reply for comparison next year.
- Put two dates on the practice calendar: January 2026 for the timeframe and denial reason rules, and March 31, 2026 for the first published payer metrics.
