CMS updates prior authorization transparency requirements for health plans

As part of efforts to improve prior authorization, CMS has bolstered its transparency requirements for health plans.

Based on 2024 regulations that partially took effect in 2026 and are intended to promote electronic prior authorization, new requirements apply to health plans in Medicare Advantage (MA), Medicaid managed care and the Affordable Care Act marketplaces, along with state Medicaid and Children’s Health Insurance Program (CHIP) agencies. In a machine-readable format, those entities must list all medical items and services that require prior authorization, with separate lists for standard and expedited requests.

The American Medical Association (AMA) said it reviewed 15 MA plans earlier this year to examine how they were complying with the transparency requirements. The AMA flagged issues that it said made the transparency reports problematic to use.

“Patients should not need a portal password, a billing manual or medical training to find and understand a health plan’s prior authorization practices,” AMA President Willie Underwood III, MD, said in a news release.

CMS clarifies how health plans must disclose prior authorization data

The AMA said CMS responded to the cited concerns by making key changes in updated transparency guidance. Among the modifications is a statement that access to the transparency metrics must be free and open for any patient or provider.

“Posting the required metrics only through password-protected provider or member portals or in other locations that cannot be reached through ordinary navigation from the payer’s public facing website does not satisfy the ‘publicly accessible’ requirement of the final rule,” CMS wrote in the guidance.

Another change that the AMA had encouraged was to ensure health plans identify items and services with plain-language descriptions in addition to procedure codes.

“The required list must identify the medical items and services in a manner that is understandable to patients and providers,” CMS wrote. “A list consisting solely of procedure codes (e.g., CPT codes) without corresponding service descriptions is not considered a publicly accessible list of medical items and services for purposes of this reporting requirement.”

The AMA said its reviewed sample of posted transparency metrics made clear that such instruction was necessary.

“One plan posted an 832-page list of billing codes without a word of plain English,” Underwood said in the news release. “Others buried required information behind portals. Another published numbers that didn’t add up — and acknowledged that its data should ‘not be relied upon.’”

The updated guidance from CMS also includes specifics on determining the denominator for each metric and additional requirements for how turnaround times should be expressed (e.g., in hours, rather than as “0 days,” if the time is less than one day).

Association calls for additional transparency requirements

The AMA is calling for more changes to the prior-authorization transparency guidance. For example, CMS should ensure the regulations apply to any process that functions as prior authorization, making sure to include processes that go by a different name (e.g., “precertification”) at some health plans or that are delegated to a third-party vendor.

Another way to further strengthen transparency reporting, per the AMA, is to make prior authorization metrics available to prospective health plan members at the point of enrollment. Links could be included on Medicare Plan Finder, Medicaid and CHIP plan-comparison and enrollment tools, and Healthcare.gov.

Use of standardized templates for prior authorization reporting should be required, rather than merely recommended.

“Consistent formats would make information easier for patients and physicians to understand and compare across plans,” the AMA said.

CMS continues push toward electronic prior authorization

Prior authorization regulatory updates appeared in CMS’s July rulemaking.

Via the 2027 proposed rule for the Medicare Physician Fee Schedule, CMS is looking to nudge physician practices to use certified electronic health record technology (CEHRT) that is enabled with Fast Healthcare Interoperability Resources (FHIR) data-sharing capability, as applied to prior authorization.

In 2027 quality reporting under the Merit-based Incentive Payment System (MIPS), the electronic prior authorization measure would be made optional. To receive bonus points, physicians would need to attest to use of CEHRT with IT modules that are FHIR-enabled and certified by the Office of the National Coordinator for Health Information Technology.

In 2028, the electronic prior authorization measure would become mandatory for most physicians and would maintain the requirement to reflect the use of FHIR-enabled IT.

A similar progression from optional to required electronic prior authorization reporting was proposed for the Ambulatory Specialty Model, which is a mandatory model starting in 2027 to promote longitudinal care by physicians who treat heart failure or low back pain and are located in designated geographical areas.

The same proposed rule includes a request for information about ways to incorporate reporting on FHIR-enabled electronic prior authorization in the Medicare Shared Savings Program for accountable care organizations.

Elsewhere, as previously noted, the annual Medicare proposed rule for hospital outpatient departments listed eight botulinum toxin injection codes that are slated to be newly subject to prior authorization in traditional Medicare.