Halfway through 2026, most practices have not noticed that the payers they argue with every day are now required to tell them things they never had to tell them before. The CMS Interoperability and Prior Authorization final rule (CMS-0057-F, published January 2024) put its first substantive requirements into effect on January 1, 2026. For the payers it covers, standard authorization decisions must come within seven calendar days and expedited decisions within 72 hours; every denial must state a specific reason; and each payer must publish a set of prior authorization metrics on its public website once a year. The first reports, covering calendar year 2025, were due by March 31, 2026.
The reports are out. Most are buried on provider or transparency pages, formatted differently by payer, and read by almost nobody. They should be read by you, because they turn "this payer denies everything" from a complaint into a number, and numbers move contract negotiations and appeals in a way complaints do not.
Key takeaways
- The rule covers Medicare Advantage, Medicaid and CHIP fee-for-service and managed care, and Exchange plans. Not traditional Medicare, not employer plans.
- Each covered payer must publish approval, denial, appeal-reversal and turnaround metrics for the prior year by March 31.
- A published reversal rate is an argument you can quote in a level two appeal.
- Capture the specific denial reason as a field, by payer. A covered payer that gives none is out of compliance.
- January 1, 2027 brings the FHIR prior authorization API. Ask your EHR vendor now.
Which payers this covers
The rule applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and qualified health plans on the federally facilitated Exchanges. It does not apply to traditional Medicare (which has its own, limited prior authorization programs), to employer self-funded plans, or to fully insured commercial plans outside the Exchanges. For most practices that means the rule covers roughly a third to a half of the authorizations they submit, concentrated in Medicare Advantage and Medicaid managed care.
Two cautions. First, the same insurer often runs covered and uncovered products under one brand, so the seven-day clock applies to a Medicare Advantage member and not to the employer-plan member in the next chair. Second, drugs are excluded from the rule's prior authorization provisions; the metrics and turnaround rules cover items and services.
What the metrics reports contain
CMS specified the metrics, so the reports are comparable across payers even when the formatting is not. For the prior calendar year, each payer must publish, aggregated across items and services:
| Metric | What it tells you |
|---|---|
| Items and services requiring prior authorization | The list itself, which you can compare against the payer's denial behavior |
| Percentage of standard requests approved, denied, and approved after appeal | The payer's baseline denial rate and how often denials are reversed |
| Percentage of expedited requests approved and denied | Whether urgent requests are treated differently |
| Percentage of requests where the decision period was extended | How often the payer uses the extension provision |
| Average and median time to decision, standard and expedited | Whether the payer is meeting the seven-day and 72-hour limits |
The metrics are aggregated, not by service or specialty, which limits them. They still tell you a great deal about how a plan behaves, and they are the plan's own numbers, which is what makes them useful.
A worked comparison
Here is what two Medicare Advantage plans in the same market might look like side by side. The figures are illustrative, but the spread is the kind we see when practices actually pull the reports.
| Metric (2025, standard requests) | Plan A | Plan B |
|---|---|---|
| Approved | 88% | 96% |
| Denied | 12% | 4% |
| Denials approved after appeal | 60% | 20% |
| Decision period extended | 18% | 5% |
| Median days to decision | 6 | 2 |
Plan A denies three times as often and then reverses most of those denials on appeal, which tells you its first-level review is not doing much reviewing. It also extends nearly one request in five. For a practice, Plan A is a payer that needs an appeals process staffed and a pre-visit lead time of at least two weeks for scheduled procedures. Plan B is a payer where the first answer is usually the final answer and where a denial deserves a careful clinical look rather than a reflex appeal. Same market, same specialty, two different workflows, and until this year nobody outside the plans could have told you which was which.
Three ways to use them
1. In appeals
A payer that publishes a 60 percent reversal rate on appeal has told you that most of its denials do not survive review. Say so, politely, in the level two appeal letter: "This plan's published 2025 prior authorization metrics report that 60 percent of denied standard requests were approved on appeal. We ask that this request receive the same review." It does not change the clinical facts, but it changes the tone, and it signals that your practice reads what the payer publishes.
2. In denial reason tracking
The specific denial reason requirement means CO-197 and related denials from covered payers should now come with a stated reason: missing documentation, criteria not met, wrong site of service, duplicate request. Capture that reason in your denial log as its own field. After a quarter you will have a payer-by-reason table that tells you whether the fix is at scheduling, in the clinical documentation, or in the payer's criteria. A payer that still returns "not medically necessary" with no criterion named is out of compliance with the rule, and you can say so in the appeal and in a complaint to the plan's regulator.
3. In contract conversations
Bring the payer's own metrics report to the renewal meeting alongside your denial log. "Your report says a median decision time of five days; our log for your plan shows nine, with 30 percent of requests extended." Payers negotiate differently when the practice has data, and they negotiate differently again when the data is theirs.
Building your side of the comparison
The published metrics are only half the picture. The other half is your own authorization log, and most practices do not keep one that can be compared. The minimum fields: payer and plan type, CPT or HCPCS code, date submitted, date decided, standard or expedited, outcome, stated denial reason, appeal filed, appeal outcome, appeal decision date. Ten columns. A spreadsheet is enough for a practice submitting fewer than 200 requests a month; above that, use the practice management system's authorization module or a dedicated tool.
With that log, "the payer says median five days, we see nine" becomes a sentence you can prove. Without it, the payer's report is the only evidence in the room, and it was written by the payer.
What is coming on January 1, 2027
The second phase of the rule requires covered payers to offer a prior authorization API built on FHIR standards, so that a practice's EHR can ask whether a service needs authorization, learn what documentation is required, submit the request and receive the decision without a portal or a fax. Whether your EHR vendor will support it is a question to ask now. The voluntary industry commitments signed in June 2025 set a parallel goal of 80 percent of electronic approvals returned in real time by the same date. Between the two, the mechanics of authorization should change more in 2027 than in the previous decade, for the payers covered.
Our denial management service tracks authorization denial reasons by payer as a standard report, and our billing clients receive a quarterly payer scorecard that includes the published metrics. Rates are on the pricing page.
Questions we hear
Where do we find a payer's report?
Usually on the provider section of the payer's website, sometimes under transparency or regulatory disclosures. Search the site for "prior authorization metrics" and the year. If you cannot find it, ask your provider representative for the link, in writing.
Does the seven-day clock apply to our commercial patients?
Only if the plan is a qualified health plan on the federal Exchange. Employer plans and off-Exchange commercial plans are outside the rule, though several states have their own turnaround laws.
What if a covered payer misses the seven-day deadline?
The rule sets the standard; enforcement runs through CMS for Medicare Advantage and through state agencies for Medicaid managed care. Document the dates, escalate through the plan's provider relations, and report persistent failures to the regulator. A late decision is not automatically an approval.
What to do this month
- Find and download the 2025 metrics report for each Medicare Advantage, Medicaid managed care and Exchange plan you bill. Save each with the date.
- Put the five metrics for each plan on one page and rank the plans by denial rate and reversal rate.
- Add "stated denial reason" as a required field in your denial log and start capturing it for covered payers.
- Start the ten-column authorization log if you do not have one.
- Write to your EHR vendor asking whether they will support the FHIR prior authorization API by January 1, 2027, and with which payers they are testing.
