The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) is a federal regulation that requires Medicare Advantage, Medicaid, CHIP and federal Marketplace plans to make prior authorization faster and more transparent. Since 2026, most of these payers must decide urgent requests within 72 hours and standard requests within 7 calendar days, explain denials, and publish approval metrics.
Prior authorization still eats staff hours, delays care and quietly drains revenue when requests stall or die without an appeal. The CMS interoperability and prior authorization final rule changes the rules for many payers you bill, but only some of them, and the biggest technology pieces land in 2027. This guide shows which payers are covered, which deadlines already apply, how to measure whether payers are meeting them, and how to adjust your workflow. A self-assessment checklist near the end scores your readiness.
The Rule’s Key Numbers at a Glance
| Metric | Practical target/range | Review frequency | Source type |
| Expedited (urgent) decision time | 72 hours or less | Weekly, per payer | Published standard (CMS-0057-F) |
| Standard decision time | 7 calendar days or less | Weekly, per payer | Published standard (CMS-0057-F) |
| Decisions issued within the required timeframe | Every request, unless a permitted extension applies | Monthly, per payer | Published standard (CMS-0057-F) |
| Denials that include a specific reason | Every denial | Every denial | Published standard (CMS-0057-F) |
| Prior authorization denial rate | Median 7.2% in Medicare Advantage; about 12-14% in Medicaid managed care, CHIP and Marketplace plans | Quarterly, per payer | Named data provider (AuthDenied data, via Forvis Mazars, 2026) |
| Share of denials appealed | Median plan 7.3%; most practices can justify appealing more | Monthly | Named data provider (AuthDenied data, via Forvis Mazars, 2026) |
| Appealed denials overturned | Median plan 52.6% | Quarterly | Named data provider (AuthDenied data, via Forvis Mazars, 2026) |
| Staff time per prior authorization | About 20 minutes (13 hours / 39 requests per physician per week) | Quarterly | Named survey (AMA, 2024) |
Source labels: “Published standard” means the number is written into the CMS regulation. “Named data provider” means a benchmark drawn from payers’ own public reports, compiled by a named organization. “Named survey” means a published survey with its sponsor and year. Benchmarks vary by payer type, plan and specialty.
What Does the CMS Interoperability and Prior Authorization Final Rule Actually Require?
The rule requires impacted payers to shorten prior authorization decision times, state a reason for every denial, publish yearly prior authorization statistics, and build four standards-based data-sharing APIs. CMS finalized CMS-0057-F on January 17, 2024, building on its 2020 Interoperability and Patient Access rule. The operational pieces started on January 1, 2026; most API requirements start on January 1, 2027.
The 2026 operational requirements
Three provisions already affect your front desk and billing team. First, decision deadlines: 72 hours for expedited requests and 7 calendar days for standard requests. Before 2026, Medicare Advantage and Medicaid managed care plans could take up to 14 calendar days on standard requests. Second, every denial must carry a specific denial reason, whether the request arrived by portal, fax, phone or mail. Third, payers must post prior authorization metrics on their public websites every year, with the first report due March 31, 2026, covering 2025.
The four APIs coming in 2027
An API (application programming interface) is a secure, standardized connection that lets two systems exchange data automatically. CMS-0057-F requires payers to use HL7 FHIR (Fast Healthcare Interoperability Resources), the modern standard for health data exchange. The CMS overview of CMS-0057-F lists the policies and supporting guidance.
| API | Who uses it | What it does | Compliance date |
| Prior Authorization API | Providers and their EHRs | Shows whether an item or service needs authorization, lists documentation requirements, and sends requests and decisions electronically | January 1, 2027 |
| Provider Access API | In-network providers with a treatment relationship | Shares a patient’s claims, clinical (USCDI) data and prior authorization history; patients may opt out | January 1, 2027 |
| Payer-to-Payer API | The patient’s new health plan | Moves up to five years of data, including prior authorizations, when a patient switches plans; patients must opt in | January 1, 2027 |
| Patient Access API | Patients, via apps | Adds prior authorization information to data patients can already access; usage metrics reported to CMS from 2026 | January 1, 2027 |
Drugs are excluded from all of the above under CMS-0057-F. Medicaid and CHIP managed care and Marketplace plans meet the 2027 dates on rating periods or plan years starting on or after January 1, 2027.
What the Prior Authorization API replaces, and what it does not?
The Prior Authorization API is the engine of electronic prior authorization (ePA). It is built to replace portal re-keying and fax packets, not to remove clinical review. HHS announced enforcement discretion in February 2024, so payers may run a FHIR-only API without also using the older X12 278 HIPAA transaction. CMS recommends, but does not mandate, the Da Vinci implementation guides (Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support). Your EHR vendor’s support for these guides decides how much of the benefit you actually see.
Which Deadlines Have Passed, and What Is Still Coming?
The 2026 decision deadlines, denial reasons and first public metrics are already in force; the APIs follow on January 1, 2027, and two newer CMS proposals could extend the rule further. The CMS fact sheet on CMS-0057-F sets out the original dates. Because these dates shift with new rulemaking, treat the timeline below as a snapshot as of October 2026.
Firm dates from the final rule
- January 1, 2026: 72-hour and 7-day decision deadlines, specific denial reasons, and Patient Access API usage reporting begin.
- March 31, 2026: first public prior authorization metrics due (2025 data). By July 21, 2026, 92% of required plans had posted them, according to AuthDenied data cited by Forvis Mazars.
- January 1, 2027: Prior Authorization, Provider Access, Payer-to-Payer and expanded Patient Access APIs due.
Proposals that may change the picture
Two proposals were still pending when this guide was researched. The CY 2027 Physician Fee Schedule proposed rule (July 2026) would make the MIPS Promoting Interoperability Electronic Prior Authorization measure optional in 2027, worth 10 bonus points, and required from the 2028 performance period. Separately, the CMS-0062-P proposed rule on drug prior authorization (April 2026) would extend electronic prior authorization to drugs, with most provisions starting October 1, 2027. Check the final versions before changing attestation or pharmacy workflows.
Which Payers Must Follow the 72-Hour and 7-Day Clock?
Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans and CHIP managed care entities must follow the 72-hour and 7-day clock. Qualified Health Plans on the federal Marketplace must build the APIs, give denial reasons and report metrics, but they are excluded from the new decision timeframes. Everything else sits outside the rule.
| Payer type | 72-hr / 7-day clock | Specific denial reason | Public metrics | 2027 APIs |
| Medicare Advantage | Yes | Yes | Yes (by MA contract) | Yes |
| Medicaid and CHIP fee-for-service | Yes | Yes | Yes (by state) | Yes |
| Medicaid and CHIP managed care | Yes | Yes | Yes (by plan) | Yes |
| Marketplace QHPs (federal exchange) | No | Yes | Yes (by issuer) | Yes |
| Traditional Medicare | Not covered by CMS-0057-F | Not covered | Not covered | Not covered |
| Employer and other commercial plans | Not covered by CMS-0057-F | Not covered | Not covered | Not covered |
Traditional Medicare is a separate story
Traditional Medicare is not an impacted payer, but it now uses more prior authorization, not less. CMS’s WISeR model began January 1, 2026, adding prior authorization for selected services, such as certain nerve stimulation, cervical fusion and skin substitute services, in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. If your practice bills Medicare in those states, track WISeR requests separately from Medicare Advantage requests.
Commercial plans follow contracts, state law and a voluntary pledge
Employer and commercial plans set their own prior authorization timelines through contracts and state law. In June 2025, health plans organized by AHIP pledged voluntary reforms, including 90-day continuity of care during plan changes and a target of 80% real-time electronic approvals by 2027. A pledge is not a regulation, so hold commercial payers to your payer contract terms and your state’s prior authorization statute.
In payer-mix reviews, a common pattern is that practices assume “the new CMS rule” covers every plan on the card. A Medicare Advantage denial and a self-funded employer-plan denial look identical on a remittance, but only one comes with federal decision deadlines. Tag each request with its payer category at intake so your tracking report sorts itself.
How Should Your Practice Adapt Its Prior Authorization Workflow?
Practices should adapt by timestamping every request, sorting payers by regulatory category, and using the new denial reasons and public metrics to fight stalled or denied requests. The rule shortens payer deadlines; it does not fix incomplete submissions. Most avoidable delays still start inside the practice, so the steps below begin there.
- Build a payer category list. Label every payer as impacted with clock, impacted without clock (Marketplace QHP), traditional Medicare, WISeR, or commercial. Do this before tracking anything else.
- Timestamp every submission. Record date, time and channel (portal, fax, phone, API) when the payer receives each request. The rule measures decision time from receipt, in calendar days, so weekends count.
- Confirm the requirement before submitting. Check payer prior authorization lists alongside real-time eligibility verification, so you do not request authorizations the plan does not need.
- Submit complete documentation. Use payer documentation checklists now; when your EHR connects to payer APIs in 2027, use their documentation rules instead.
- Escalate overdue requests. When an impacted payer passes 72 hours or 7 calendar days without a decision or a permitted extension notice, escalate through provider relations and log the escalation.
- Read every denial reason. Route clinical-necessity denials to the provider for a peer-to-peer review and documentation denials to staff for correction and resubmission.
- Appeal by default when the reason is fixable. Appeals overturn many denials, yet few denials are appealed, as the benchmark table shows.
- Benchmark payers quarterly. Compare your own numbers with each payer’s posted metrics and bring the gaps to payer meetings.
In prior authorization audits, a common pattern is that a missing submission timestamp makes a late payer decision impossible to prove. Practices that log only the decision date cannot show a payer exceeded 7 calendar days. A single “date received by payer” field in your tracking log, a copy of the fax confirmation or a portal screenshot, solves this. If you are already rethinking authorizations, our guide to streamlining prior authorization workflows covers staffing and routing. For a refresher on why plans require authorization at all, see our explainer on the role of prior authorization in health insurance.
Get your EHR and clearinghouse ready for 2027
The Prior Authorization API only helps when your EHR or practice management system can talk to it. Ask your vendor three questions in writing: which payers’ APIs it will connect to in 2027, whether it supports the Da Vinci guides, and whether it can attest for the MIPS measure. Practices running EHR-integrated medical billing will usually see these features earlier than practices on standalone systems. Our team’s electronic transactions services cover claims, eligibility and remittance connections that sit alongside these APIs. Vendors are also adding automation on top; our overview of AI-assisted prior authorization explains where it helps and where human review still matters.
How Do You Measure Whether Payers Are Meeting the New Deadlines?
You measure compliance by calculating, per payer, the share of requests decided within the required timeframe, then comparing denial and appeal results with each payer’s posted metrics. Four calculations cover most of what a small practice needs. They fit naturally into your existing set of medical billing KPIs.
Worked example 1: Turnaround compliance rate
Formula: requests decided within the timeframe ÷ total requests to that payer × 100.
Illustrative scenario (not an actual client record): a practice sends 400 standard requests to impacted payers in one quarter. Payer A decides 171 of 180 within 7 calendar days (95%). Payer B decides 133 of 140 (95%). Payer-C decides only 56 of 80 (70%). The blended rate is 360 of 400, or 90%, which looks acceptable. The blend hides the real problem: nearly one in three Payer C requests missed a federal deadline.
Worked example 2: Counting the clock correctly
Formula: deadline = time the payer received the request + 7 calendar days (standard) or + 72 hours (expedited).
A standard request received at 4:00 p.m. on Friday, October 2, 2026 is due by Friday, October 9, 2026, weekend included. An expedited request received at 9:00 a.m. on Monday is due by 9:00 a.m. Thursday. Teams that count business days give payers two extra days of slack on every standard request and miss real escalation points.
Worked example 3: Denial rate, appeal rate and overturn rate
Formulas: denial rate = denials ÷ decisions; appeal rate = appealed denials ÷ denials; overturn rate = denials reversed on appeal ÷ appealed denials.
Illustrative scenario (not an actual client record): the same practice receives 36 denials on 400 requests, a 9% denial rate. It appeals 6 of them (16.7%) and wins 4 (66.7%). Thirty denials were never appealed. If even half of those were winnable, at an illustrative average of $850 per authorized service, about $12,750 of care went unbilled or unpaid. Solid denial follow-up and appeals routines close that gap.
Worked example 4: Staff minutes per authorization
Formula: weekly prior authorization hours × 60 ÷ weekly requests.
The AMA’s 2024 prior authorization physician survey reported 39 requests and 13 hours per physician each week. That works out to 13 × 60 ÷ 39, or about 20 minutes per request. At an illustrative staff cost of $25 an hour, that is $325 a week per physician. Track your own number before and after 2027 API connections to see whether electronic prior authorization is saving time.
How Should You Read Payer-Posted Metrics Without Being Misled?
Payer-posted metrics are useful only when you compare like with like: the same payer type, the same reporting level and the same request type. Medicare Advantage metrics are posted per contract, Medicaid managed care per plan, and Marketplace metrics per issuer. Comparing a Medicare Advantage contract’s denial rate with a Medicaid plan’s rate says little about either.
Forvis Mazars (August 2026) also noted that payers use inconsistent methods, and the data has no detail below the plan level. A plan’s 7% denial rate may hide a 25% denial rate for imaging or therapy. Your own specialty-level numbers matter more. One missed benchmark is a signal to investigate, not a verdict; check volume, service mix and submission completeness before escalating.
How Long Does It Take a Practice to Adapt?
Most practices can install basic tracking within weeks, but meaningful payer comparisons usually take a full quarter of data. Treat these as general planning ranges, not guarantees, because payer readiness and vendor timelines vary widely.
- Payer category list, intake tags and timestamp logging: commonly 2-6 weeks.
- First reliable per-payer compliance and denial report: typically 3-6 months, once a full quarter of requests has closed.
- Electronic prior authorization through payer APIs: depends on your EHR vendor and each payer; plan for gradual adoption through 2027 and 2028.
Common Mistakes Practices Make With the New Rule
In onboarding reviews, a common pattern is that practices expect 2026 to fix prior authorization on its own. The rule shortens payer deadlines, but only for impacted payers, and incomplete submissions still slow everything down.
- Applying the 7-day clock to every plan. Check payer category first; Marketplace QHPs, traditional Medicare and employer plans follow other rules.
- Counting business days. The rule uses calendar days for standard requests and hours for expedited ones.
- Ignoring the denial reason. A specific reason tells you whether to fix documentation, request a peer-to-peer or appeal.
- Assuming drugs are covered. Drug prior authorization sits outside CMS-0057-F; the CMS-0062-P proposal may change that from October 2027.
- Waiting for 2027 to start tracking. The APIs will not show you which payers missed deadlines in 2026; your own log will.
Quick Summary
- Impacted payers must decide expedited requests within 72 hours and standard requests within 7 calendar days (published standard).
- Every denial from an impacted payer must include a specific reason (published standard).
- Public metrics show median denial rates near 7% in Medicare Advantage and about 12-14% in Medicaid managed care, CHIP and Marketplace plans (AuthDenied data, 2026).
- Only about 7% of denials are appealed, yet about half of appeals succeed at the median plan.
- FHIR-based APIs arrive January 1, 2027; drug and MIPS changes are still proposals.
Self-Assessment: Is Your Practice Ready for CMS-0057-F?
Answer yes or no to each question.
- Is every payer in your system tagged by regulatory category?
- Do you record the date and time each payer received every request?
- Do you count standard deadlines in calendar days, not business days?
- Do you escalate impacted-payer requests that pass 72 hours or 7 calendar days?
- Do you track turnaround compliance separately for each payer, not as one blended rate?
- Is your denial rate measured per payer at least quarterly?
- Do you appeal more than the 7.3% of denials appealed at the median plan?
- Have you compared your numbers with each payer’s posted 2025 metrics?
- Has your EHR vendor confirmed, in writing, its 2027 Prior Authorization API plans?
- Do you know how many staff minutes each authorization costs you?
Scoring: 8-10 yes answers means you are well prepared; keep reviewing quarterly. 5-7 yes answers means the basics are in place, but blind spots could be costing revenue. 0-4 yes answers means start with payer categories and timestamps this month.
When Does Outside Prior Authorization Support Make Sense?
Outside support makes sense when authorization work is outpacing your team’s capacity to track deadlines, read denial reasons and appeal. These signals suggest your in-house approach has hit its limits:
- Your team cannot say which payers missed the 7-day deadline last quarter.
- Denials are mostly written off instead of corrected or appealed.
- Authorization delays are rescheduling procedures or holding claims.
- Staff time per authorization is rising, or one person holds all payer knowledge.
- Nobody owns the 2027 API and EHR readiness conversation.
Look for a partner that tracks timestamps per payer, separates impacted from non-impacted plans, reports denial and overturn rates by payer, and works inside your existing EHR. Ask how they handle peer-to-peer requests and how often they report.
Zmed Solutions is one example of this kind of partner. Our team provides end-to-end billing, credentialing, coding, denial management and compliance support, and our denial management and appeals services handle the follow-up described above. Results vary by practice, payer mix and specialty. To see how authorizations fit into the full revenue cycle, review our revenue cycle management services.
Final Thoughts
The CMS interoperability and prior authorization final rule gives practices something they lacked: firm deadlines, written denial reasons and public data for Medicare Advantage, Medicaid, CHIP and Marketplace plans. It does not cover traditional Medicare, employer plans or drugs, and its API benefits depend on vendor readiness in 2027.
The 72-hour and 7-day timeframes and the denial-reason requirement are published federal standards. The denial, appeal and overturn figures are named benchmarks from payer reports compiled in 2026. The dollar and wage figures in the worked examples are illustrative. Like other new CMS regulations, this rule pays off only when billing workflows change with it.
Your natural next question is which of your payers are already missing the deadlines. A per-payer tracking log answers it within one quarter. If you want help building that log, appealing denials and preparing for 2027, talk to our team about end-to-end revenue cycle management support.
Frequently Asked Questions
When did the CMS prior authorization final rule take effect?
CMS finalized the rule on January 17, 2024. The decision timeframes, specific denial reasons and Patient Access API usage reporting began January 1, 2026. Payers posted their first public prior authorization metrics by March 31, 2026. The Prior Authorization, Provider Access, Payer-to-Payer and expanded Patient Access APIs are due January 1, 2027.
Does the CMS prior authorization rule apply to commercial insurance?
No. CMS-0057-F covers Medicare Advantage, Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care, and Qualified Health Plans on the federal Marketplace. Employer and other commercial plans follow their contracts and state law. Many commercial insurers joined a voluntary 2025 AHIP pledge, but that pledge is not enforceable regulation.
Does CMS-0057-F cover prior authorization for prescription drugs?
No. CMS-0057-F excludes drugs from its decision timeframes, denial-reason rules and API requirements. In April 2026, CMS proposed a separate rule, CMS-0062-P, that would add electronic prior authorization for drugs, with most provisions starting October 1, 2027. Until a final rule is issued, follow each payer’s current pharmacy and medical-benefit drug processes.
What is a good prior authorization turnaround time for a payer?
For impacted payers, a good turnaround is any decision within the federal limits: 72 hours for expedited requests and 7 calendar days for standard ones. Track the share of decisions made inside those limits for each payer. A payer that regularly misses them, without a permitted extension, should be escalated through provider relations.
What is a good prior authorization denial rate?
There is no CMS-mandated target. Public 2025 data compiled by AuthDenied and analyzed by Forvis Mazars (2026) showed median denial rates of 7.2% in Medicare Advantage and about 12-14% in Medicaid managed care, CHIP and Marketplace plans. Compare your rate with the same payer type and plan, not with a single blended industry figure.
What is a good appeal overturn rate for prior authorization denials?
At the median plan, 52.6% of appealed prior authorization denials were overturned, according to AuthDenied data analyzed by Forvis Mazars (2026). Only 7.3% of denials were appealed. A practice overturning about half its appeals is roughly in line with that median. A practice appealing very few denials is probably leaving approvals behind.
Sources and Methodology
(a) Published standards and definitions: CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), CMS overview page and fact sheet (January 2024; page updated August 2026); CMS-0062-P proposed rule on drug prior authorization (CMS fact sheet, April 2026; Federal Register, April 14, 2026); CY 2027 Physician Fee Schedule proposed rule (July 2026) for the Electronic Prior Authorization measure; Congressional Research Service overview of the WISeR model (2026).
(b) Named benchmarking data providers: AuthDenied database of payer-posted 2025 prior authorization metrics, as analyzed by Forvis Mazars (“CMS-0057-F: Using Public Payor Prior Authorization Data,” August 2026).
(c) Practical or illustrative targets: the per-payer compliance, denial and appeal scenarios, the $850 average service value and the $25 hourly staff cost are illustrative assumptions for teaching the formulas, not benchmarks. Implementation timeframes are general planning ranges commonly reported across industry sources.
(d) Survey or study data: American Medical Association 2024 Prior Authorization Physician Survey (1,000 physicians); AHIP health plan prior authorization commitments (June 2025), as reported by HFMA.
Results vary by practice, payer, specialty and state. Figures reflect information available at the time of research (October 2026); proposed rules may change before they are finalized.
Key Market Player
Ready to optimize your medical billing and boost your revenue? Look no further. Zmed Solutions LLC is your trusted partner in professional Medical Billing Services.
Join our growing network of healthcare providers who have already elevated their revenue with our expert services. Don't miss out on what could be your practice's most profitable decision.
Schedule a Consultation Today!
Contact Us Now, and experience the difference. Your financial success starts here!
