Jan. 17, 2024

The Centers for Medicare and Medicaid Services (CMS) released the CMS Interoperability and Prior Authorization Final Rule Jan. 17. It defines requirements to streamline health information exchange and the prior authorization process for impacted payers, including Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges.

This rule builds upon policies outlined in the CMS Interoperability and Patient Access final rule, where CMS required these payers to implement and maintain a Patient Access Application Programming Interface (API), allowing patients to download health information to a third-party application of their choosing. This rule adds the requirement of adding information about prior authorizations to the API, which must be implemented by Jan. 1, 2027. Impacted payers must also annually report certain metrics to CMS about patient data requests made via the API starting Jan. 1, 2026.

In addition to the Patient Access API, CMS requires the following APIs to be implemented by impacted payers:

  • Provider Access API to share patient data with in-network providers as well as prior authorization information, beginning Jan. 1, 2027, for most payer types.
  • Payer-to-Payer Access API to exchange patient data when a patient moves between payers to ensure continued access to their health information and to support continuity of care between payers, beginning Jan. 1, 2027.
  • Prior Authorization API with a list of covered items and services, to identify documentation requirements for prior authorization approval, and to support a prior authorization request and response. These must also communicate whether the payer approves the request (with a date/circumstance for which the authorization ends), denies the request (with specific reason for the denial), or requests more information. This requirement must be implemented beginning Jan. 1, 2027.

To improve the prior authorization process, CMS requires impacted payers (excluding qualified health plan issuers on the federally facilitated exchanges) to send prior authorization requests within 72 hours for expedited requests and seven calendar days for standard requests. Beginning in 2026, payers must provide a specific reason for denials, regardless of which method was used to send the request. To enhance transparency, CMS requires impacted payers to publicly report certain prior authorization metrics on an annual basis by posting them on their website. The compliance date for these policies is Jan. 1, 2026, with initial metrics being reported publicly by March 31, 2026. These requirements complement the requirements set forth in the Contract Year 2024 Medicare Advantage and Part D Final Rule.

For questions related to this rule, contact Kimberly Greck, ACR Senior Economic Policy Analyst.


Related ACR News

  • State Legislatures Are Active As May Begins

    The American College of Radiology® (ACR®) is providing this weekly update on state bills as many state legislatures look to the end of their legislative sessions in the month of May.

    Read more
  • ACR Attends April 2025 RUC Meeting

    The ACR® participated in the American Medical Association/Specialty Society RVS Update Committee (RUC) meeting where they heard an update on the AMA’s Physician Practice Information Survey.

    Read more
  • Senate Committee Hearing Covers Concerns Related to Biomedical Research

    The U.S. Senate Committee held a hearing to discuss the importance of U.S. biomedical research for the nation’s health and economy.

    Read more