CMS proposes electronic prior authorization for drugs

Amid ongoing implementation of federally required electronic prior authorization for healthcare items and services, CMS now proposes to do the same for pharmaceuticals.

New regulations would apply to drugs under both medical and pharmacy benefits, according to a proposed rule published April 14. Faxes and payer portals for drug authorizations would be phased out in favor of Fast Healthcare Interoperability Resources (FHIR)-based application programming interfaces (APIs) and National Council for Prescription Drug Programs (NCPDP) electronic standards.

If the standards are implemented as proposed, a provider’s electronic health record (EHR) could give alerts when a drug needs prior authorization and allow for electronic submission as of Oct. 1, 2027.

“This proposal moves prior authorization into the digital age, replacing fax machines and fragmented systems with real-time electronic workflows,” Mehmet Oz, MD, administrator of CMS, said in a news release. “We are standardizing the process, increasing transparency and ensuring providers can focus on caring for patients instead of navigating red tape.”

Comments on the proposed rule can be submitted through June 15 at Regulations.gov.

What the CMS proposed rule would change

Previously issued regulations required that by Jan. 1, 2027, Medicare Advantage health plans, Medicaid managed care organizations (MCOs), state Medicaid programs and Affordable Care Act (ACA) marketplace insurers must have APIs in place for:

• Patient access (including prior authorization information)
• Provider access (including for care coordination of in-network patients)
• Payer-to-payer exchange (for data transfer if patients change plans or have concurrent coverage)
• Prior authorization (showing which services are subject to prior authorization and supporting electronic prior authorization)

In October 2027, the Prior Authorization API would have to allow for electronic submission of authorization requests for drugs covered under a medical benefit. Affected payers also must support NCPDP electronic standards for drugs covered under pharmacy benefits. Those standards include a group-level formulary and benefit standard, loaded into a provider’s EHR, along with real-time prescription benefit information showing patient-specific coverage and cost.

The Patient Access and Provider Access APIs would need to give information about the prior authorization status of a prescribed drug.

Key compliance timelines and requirements

The earlier rule established decision windows of 72 hours for urgent prior authorization requests and seven days for standard requests beginning in 2026. Whereas ACA marketplace insurers have been exempt from those deadlines, the new rule proposes to apply those requirements for items and services as covered by plans in federally facilitated marketplaces.

In October 2027, with respect to prior authorization for prescriptions, Medicaid MCOs and Medicaid fee-for-service programs would have to turn around decisions within 24 hours, and the same would apply to state Children’s Health Insurance Programs for any drug that has federal matching funds. Plans in federally facilitated marketplaces would have 72 hours for standard prior authorization requests and 24 hours for expedited requests.

Providers and all other HIPAA-covered entities would need to adopt FHIR-based prior authorization capabilities, including for eligibility transactions where the purpose is to determine whether PA is required. Most covered entities would have to comply within 24 months after the final version of the rule takes effect.

Transparency and reporting requirements

Other requirements for plans under the 2024 rule include providing specific reasons for any denial and publicly posting prior authorization metrics. Those obligations would expand to drug coverage in October 2027.

The proposed rule also would add or revise certain reporting metrics, such as requiring plans to provide the total number of requests that have been approved or denied, in addition to percentages. Metrics would be newly required for requests that remain denied after appeal, among other categories. Other reporting requirements in the new rule pertain to utilization metrics for the four required APIs.

CMS also seeks comments for future consideration of policies. As described in a fact sheet on the proposed rule, comments are being solicited on ways to enhance admission, discharge and transfer (ADT) notifications via electronic exchange. Another topic on which stakeholders can comment is step therapy, specifically ways to streamline the process through technology and data sharing that give payers access to historical patient information.

Broader prior authorization landscape and policy context

The proposed rule is being issued amid other efforts to mitigate the authorization burden. For example, the Trump administration in June 2025 announced a commitment by commercial health plans representing roughly 80% of Americans.

As part of that commitment, members of AHIP (formerly America’s Health Insurance Plans) and Blue Cross Blue Shield pledged to take steps such as implementing electronic prior authorization, reducing the number of services subject to prior authorization, and improving communication around prior authorization decision-making.

In a recent update, AHIP touted progress, saying “leading health plans eliminated 11% of prior authorizations across a range of medical services, representing 6.5 million fewer prior authorizations for patients.”

“Health plans also affirmed improvements that make it easier for members who switch insurance to maintain their prior authorization approvals and enhanced communications on prior authorization determinations,” according to the update.

Expanded use of electronic prior authorization and documented progress toward real-time responses are slated for 2027, AHIP said.

In a separate initiative, UnitedHealthcare announced it will eliminate most medical prior authorizations across all lines of business for 1,500 rural hospitals and their associated rural practitioners. The same group of hospitals can expect to receive accelerated payments for services, averaging fewer than 15 days. Both initiatives are set for implementation in Fall 2026.

AI-driven authorization challenges

Not everything is trending in the direction of reduced prior authorization, as seen with CMS’s new Wasteful and Inappropriate Services Reduction (WISeR) Model, which began this year in six states, applying AI-based prior authorization to 13 services in traditional Medicare.

One of the states is Washington, represented in the U.S. Senate by Maria Cantwell, a Democrat. Her office reported this past week that patients in the state are waiting two to four times longer than previously to complete procedures now subject to WISeR. Current time frames for procedure completion are between four and eight weeks, according to the report.

Per survey data from the Washington State Hospital Association, as cited in the report, approval times have increased to between 15 and 20 days, up from one day previously for urgent authorizations and three days for standard authorizations.

In questioning April 16 at a House Ways and Means Committee hearing, HHS Secretary Robert F. Kennedy Jr. didn’t disagree that the model should be tweaked as necessary to avoid such an outcome.