The Centers for Medicare and Medicaid Services (CMS) released the CMS Interoperability and Prior Authorization Final Rule Jan. 17. It defines requirements to streamline health information exchange and the prior authorization process for impacted payers, including Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges.
This rule builds upon policies outlined in the CMS Interoperability and Patient Access final rule, where CMS required these payers to implement and maintain a Patient Access Application Programming Interface (API), allowing patients to download health information to a third-party application of their choosing. This rule adds the requirement of adding information about prior authorizations to the API, which must be implemented by Jan. 1, 2027. Impacted payers must also annually report certain metrics to CMS about patient data requests made via the API starting Jan. 1, 2026.
In addition to the Patient Access API, CMS requires the following APIs to be implemented by impacted payers:
- Provider Access API to share patient data with in-network providers as well as prior authorization information, beginning Jan. 1, 2027, for most payer types.
- Payer-to-Payer Access API to exchange patient data when a patient moves between payers to ensure continued access to their health information and to support continuity of care between payers, beginning Jan. 1, 2027.
- Prior Authorization API with a list of covered items and services, to identify documentation requirements for prior authorization approval, and to support a prior authorization request and response. These must also communicate whether the payer approves the request (with a date/circumstance for which the authorization ends), denies the request (with specific reason for the denial), or requests more information. This requirement must be implemented beginning Jan. 1, 2027.
To improve the prior authorization process, CMS requires impacted payers (excluding qualified health plan issuers on the federally facilitated exchanges) to send prior authorization requests within 72 hours for expedited requests and seven calendar days for standard requests. Beginning in 2026, payers must provide a specific reason for denials, regardless of which method was used to send the request. To enhance transparency, CMS requires impacted payers to publicly report certain prior authorization metrics on an annual basis by posting them on their website. The compliance date for these policies is Jan. 1, 2026, with initial metrics being reported publicly by March 31, 2026. These requirements complement the requirements set forth in the Contract Year 2024 Medicare Advantage and Part D Final Rule.
For questions related to this rule, contact Kimberly Greck, ACR Senior Economic Policy Analyst.