On January 2 a Medicaid managed care plan received a standard prior authorization request from a pediatric practice for an MRI. Under the plan's old policy the practice would have waited up to fourteen days for an answer. Under the rule that took effect the day before, the plan owes a decision by January 9. If it denies, the letter has to say why in specific terms, not "does not meet medical necessity criteria".
That is the operational effect of the CMS Interoperability and Prior Authorization final rule, CMS-0057-F, which CMS finalized on January 17, 2024. Most of the attention at the time went to the API requirements, which do not arrive until January 1, 2027. The parts that arrived on January 1, 2026 are the ones a practice manager can use this month.
Key takeaways
- Since January 1, 2026, Medicare Advantage, Medicaid and CHIP plans owe a prior authorization decision within 72 hours for expedited requests and seven calendar days for standard ones.
- Every impacted payer, including marketplace plans on the federal exchange, must now state a specific reason for a denial, however the request was sent.
- The clock runs from receipt of a complete request, so the practice's evidence is a timestamped confirmation of a complete packet.
- By March 31, 2026, each impacted payer must post its prior authorization metrics for 2025, including approval, denial and overturn rates and decision times.
- Employer plans are outside the rule; the insurers' June 2025 pledge is the only standard that reaches them, and it has no enforcement mechanism.
Who the rule covers, and who it doesn't
The impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and qualified health plan issuers on the federally facilitated marketplaces. It does not cover traditional Medicare (which has its own new WISeR model in six states), employer-sponsored commercial plans, or plans sold on state-based marketplaces. If your payer mix is heavy in commercial employer plans, this rule changes less for you than the headlines suggest. If you see a lot of Medicare Advantage and Medicaid managed care, it changes a great deal.
What took effect January 1, 2026
| Requirement | Detail | Applies to |
|---|---|---|
| Expedited decision timeframe | Decision within 72 hours of receiving the request | MA, Medicaid and CHIP FFS and managed care (not QHP issuers) |
| Standard decision timeframe | Decision within seven calendar days; extensions allowed in limited circumstances | Same as above |
| Specific denial reason | Denial must state a specific reason, regardless of how the request was submitted (portal, fax, phone, mail) | All impacted payers including QHP issuers |
| Public metrics | Payers post prior authorization metrics on their websites annually; first posting due March 31, 2026 | All impacted payers |
| Patient Access API prior authorization data | Payers begin reporting API usage metrics to CMS | All impacted payers |
Two exclusions to keep straight. The rule does not apply to prior authorization for drugs, so pharmacy benefit requests keep their existing timelines. And the decision timeframes do not apply to marketplace plans on the federal exchange, because those issuers were already subject to the federal claims procedure rules that require a pre-service decision within 15 days for standard and 72 hours for urgent requests; the specific denial reason and the metrics requirements do apply to them.
What actually changed for Medicare Advantage is the standard timeframe. MA plans already had to decide expedited requests within 72 hours. The standard organization determination window was 14 calendar days, and the rule cuts it to seven for prior authorization requests. Medicaid managed care plans were also on a 14-day standard. So the practical change for most of the requests a practice submits is that the wait was halved, and a plan that is still working to its old 14-day habit is now late on day eight.
The clock starts when the request is complete
This is the part everyone skips. The seven days run from the payer's receipt of a request that contains what it needs to decide. A request missing the imaging report or the conservative treatment history can be pended for more information, and in most plans' interpretation the clock does not start until it arrives. So the practical way to use the rule is to submit complete requests and log the date and time the payer confirms receipt. A portal confirmation number with a timestamp is your evidence. A fax confirmation page is your evidence for a faxed request, and the rule is explicit that the timeframes apply however the request was sent.
What the denial letter has to say now
Before this year, a denial from a Medicaid managed care plan often arrived as a form letter citing a policy number. The rule requires a specific reason. In practice that means the letter should tell you which criterion was not met: the requested frequency exceeded the policy, the documentation did not show failure of conservative treatment, the diagnosis code does not support the service. That specific reason is the start of your appeal. If the reason is missing, the denial is deficient, and saying so in the appeal is legitimate.
The letter should also point to the appeal rights. Read them, because MA and Medicaid managed care appeal timelines differ, and a peer-to-peer request is often available before a formal appeal for the same denial.
The metrics payers must publish by March 31
By March 31, 2026, each impacted payer must post on its website its prior authorization metrics for the prior year: the list of services requiring authorization, approval and denial percentages, the share of denials overturned on appeal, the share of expedited and standard requests, and average and median decision times. We are looking forward to these. For the first time a practice will be able to compare its own denial rate with a plan against the plan's published rate, and use the gap in contract conversations. Put a reminder on April 1 to pull the pages for your top MA and Medicaid plans and save them; we expect some of them will be hard to find.
How this fits with the insurers' pledge
Separately from the rule, on June 23, 2025 more than 50 insurers signed a voluntary pledge with HHS and CMS through AHIP. The commitments that came due on January 1, 2026 were to reduce the number of services requiring authorization, to honor an existing authorization for 90 days when a patient changes plans mid-treatment, and to give clear explanations of denials and appeal options. The pledge covers commercial employer plans, which the rule does not, so the two together cover most of a typical payer mix. The pledge has no enforcement mechanism, which is why we think a practice should hold payers to it in writing rather than assume it happened. We will cover the specific service levels to request in a separate piece later this month.
Our denial management service has already added the due-date fields to the authorization tracking we do for practices, and the plan-level compliance count goes into the monthly report. Practices running their own authorizations can build the same log in a spreadsheet in an afternoon.
Questions we hear
A Medicare Advantage plan took nine days on a standard request. What can we do?
Call the plan, cite the timeframe, and ask for the decision. If the pattern repeats, file a complaint with the plan and, for MA, with CMS through the regional office. The rule does not create a private right of action, so the remedy is regulatory pressure and contract conversations, not a lawsuit. Keep the log; it is what makes the complaint credible.
Does the 72-hour clock run over weekends?
Yes. The expedited standard is 72 hours, and the standard timeframe is seven calendar days, not business days. A standard request confirmed on a Friday is due the following Friday.
The plan asked for more records on day five. Does that reset the clock?
Under the rule a plan can extend a standard decision in limited circumstances, including when the request is missing information the plan needs, and the extension is up to 14 additional calendar days. It is not a reset to zero, and the plan should tell you it is extending and why. Log the extension date and the reason. If the same plan extends most of your requests for records that your template already includes, that pattern belongs in the compliance report and in the next provider relations conversation.
What to do this month
- Add three fields to your authorization log: date and time of complete submission, decision due date, and actual decision date. Compute the due date from 72 hours or seven calendar days.
- When a decision is late, contact the plan and cite the timeframe. Document the call.
- When a denial arrives without a specific reason, request one in writing before appealing, and note the deficiency in the appeal.
- Track late decisions, extensions and non-specific denials by plan. By the end of March you will know which plans comply.
- Put a reminder on April 1 to pull each plan's published metrics and compare them to your own log.
