Simplifying Prior Authorization Processes in Healthcare 

Key Regulatory Timelines 

Impacted payers have until January 1, 2027 to implement provisions in the final rule. Some of the operational provisions, however, have to be available generally beginning January 1, 2026. 

One of the provisions to begin on January 1, 2026¹ is the timeframe for standard prior authorization of medical services (drugs excluded)².  

• Certain impacted payers such as MAOs are required to send standard PA decisions within 7 calendar days and expedited PA decisions within 72 hours³. 
• Payers must provide specific information about PA denials, regardless of how the PA request is submitted.
• Impacted payers are required to report certain metrics⁴ about their PA processes on their public website annually. This includes the percent of PA requests approved, denied, and approved after appeal, and average time between submission and decision.  

Key Operational Changes for Payers

Other provisions in the final rule include application programming interface (API) between different stakeholders: 

1. Implementation of a Prior Authorization API  
   Impacted payers have to implement and maintain a Prior Authorization API to show its list of covered items and services, identify documentation requirements for PA approval, and supports a PA request and response. These PA APIs must also communicate whether the payer approves the PA request (and the date or circumstance under which the authorization ends), denies the PA request (and a specific reason for the denial), or requests more information. This requirement takes effect January 1, 2027⁵. 
2. Patient Access API  
   Impacted payers have to make available information about prior authorizations (excluding drugs) to beneficiaries via Patient Access API to help beneficiaries understand their payer’s PA process and its impact on their care. This requirement must be implemented by January 1, 2027.  
3. Provider Access API  
   Impacted payers have to make data available via the Provider Access API to include individual claims and encounter data (without provider remittances and enrollee cost-sharing information); data classes and data elements in the United States Core Data for Interoperability (USCDI); and specified PA information (excluding drugs). Impacted payers have to maintain an attribution process to associate beneficiaries with in-network or enrolled providers with whom they have a treatment relationship and to allow beneficiaries to opt out of having their data available to providers under these requirements. Impacted payers have to provide plain language information to beneficiaries about the benefits of API data exchange with their providers and their ability to opt out. Implementation date is January 1, 2027. 
4. Payer-to-Payer Data Exchange  
   Impacted payers must implement and maintain a Payer-to-Payer API to make available claims and encounter data (excluding provider remittances and enrollee cost-sharing information), data classes and data elements in the USCDI and information about certain PA (excluding drugs) to facilitate care continuity when a beneficiary changes payers and ensure that beneficiaries have continued access to the most relevant data in their records. Impacted payers are only required to share beneficiary data with a date of service within five years of the request for data. Beneficiaries are able to opt-in for this process. Impacted payers have to help beneficiaries understand the benefits of op-in in plain language. 
5. Communication Standards for Interoperability  
   Along with the implementation requirements, CMS also requires communication standards for interoperability between systems. The required standards and implementation specifications in the final rule include the following:   
   • United States Core Data for Interoperability (USCDI)  
   • HL7® Fast Healthcare Interoperability Resources (FHIR®) Release 4.0.1  
   • HL7 FHIR US Core Implementation Guide (IG) Standard for Trial Use (STU) 3.1.1  
   • HL7 SMART Application Launch Framework Implementation Guide Release 1.0.0  
   • FHIR Bulk Data Access (Flat FHIR) (v1.0.0: STU 1)  
   • OpenID Connect Core 1.0 
6. The final rule requirements seem daunting especially for stakeholders who are not technology-ready.  

Taking the Next Steps

Inovaare is a technology provider that has been tracking various technology-related CMS requirements. The stated goal of the technology requirements is to promote secure exchange, access, and use of electronic health information to support better informed decision making and improve efficiency of the healthcare system. A secure, connected healthcare system enables and empowers beneficiaries and their providers to access and use electronic health information to achieve the stated goal. Inovaare can help MAOs unpack the requirements and support implementations. January 1, 2027 is not that distant in the future, call us at 408.850.2235 to begin a productive dialogue. 

Guest Author:
Yvonne Tso, Senior Vice President
Integritas Medicare