New regulations are projected to bring providers a measure of relief from prior authorization headaches

Hospitals and other healthcare providers hailed a newly published final rule designed to improve prior authorization and the electronic exchange of health information.

The Interoperability and Prior Authorization rule sets requirements for Medicare Advantage (MA) health plans, state Medicaid and CHIP programs, and Medicaid managed care organizations, all of which starting in 2026 must send prior authorization decisions within 72 hours for urgent requests and seven calendar days for standard requests.

“For some payers, this new time frame for standard requests cuts current decision time frames in half,” CMS wrote in a news release.

Payers also will need to include a specific reason for denying authorization, theoretically facilitating resubmission of the request or submission of an appeal. They also will need to publicly report their prior authorization metrics, thereby increasing transparency and potentially affecting consumer choice of plans.

The American Hospital Association (AHA) said the provisions relating to MA plans are especially welcome.

“With this final rule, CMS addresses a practice that too often has been used in a manner that leads to dangerous delays in patient treatment and clinician burnout in the healthcare system,” Rick Pollack, AHA president and CEO, said in a written statement.

Insurers seem to be on board with the pending requirements.

“CMS took a step in the right direction by finalizing the Interoperability and Prior Authorization rule,” AHIP (formerly America’s Health Insurance Plans) said in a statement.

Not far enough

Soumi Saha, senior vice president for government affairs with Premier, said the requirements should have been stricter: 72 hours for standard requests and 24 hours for urgent services.

“Postponing care for potentially up to seven days is still untenable when a patient’s health is on the line,” Saha said in a statement.

Similarly, Jerry Penso, MD, president and CEO of the American Medical Group Association, said the timelines “need to be much shorter. There is nothing expedited about three days.” Better deadlines would be 48 hours for standard requests and 24 hours for urgent requests, he said in a statement. And in the event of a missed deadline, the request should be considered approved — a step CMS declined to take, instead noting that “generally, such a failure to meet the deadline constitutes an adverse decision on the prior authorization request that may be appealed.”

Enforcement in general is discussed somewhat vaguely in the rule, given that the affected payers operate in different programs. MA plans may be subject to sanctions and fines for persistent noncompliance, the rule suggests.

Chip Kahn, president and CEO of the Federation of American Hospitals, said the new requirements nonetheless “should rein in the worst abuses” with respect to prior authorization. An important next step will be for Congress to pass legislation that would entrench the new requirements as the law of the land, Kahn said in a statement.

Congress also should consider expanding the requirements to commercial plans, stakeholders said. Not only are plans in the group insurance market exempt, but so are plans that operate in the Affordable Care Act (ACA) insurance marketplaces.

However, ACA plans are subject to the various technical requirements of the rule.

Enhancing information exchange

ACA plans and the other payers that are subject to the new regulations will need to implement an HL7 Fast Healthcare Interoperability Resources (FHIR) application programming interface (API) by 2027. The step is intended to automate the end-to-end prior authorization process and reduce administrative burden on providers. The 2027 start date marks a one-year delay from the proposed rule.

The final rule states that HHS will exercise discretion in enforcing the HIPAA prior-authorization transaction standard, which generally requires use of X12 278 technology. Payers can use a FHIR-only or FHIR and X12 combination API in complying with the new rule.

AHIP lauded that accommodation but said there remains a need to require vendors to “build electronic prior authorization capabilities into the electronic health record so that providers can do their part, or plans will build a bridge to nowhere.”

The rule also requires APIs to be in place for patients to find information about authorization decisions and for providers to access data on claims, patient encounters, clinical metrics and prior authorizations.

“This is a welcome first step in ensuring providers have the most comprehensive data set available about their patients,” Penso said. “Quickly sharing data ensures appropriate care is provided, and just as importantly, any unnecessary or duplicative care is avoided. Patients will get the care they need and avoid the care they don’t.”

CMS will consider whether to expand the data-access requirements to incorporate out-of-network providers. Until then, payers are encouraged to share information via API with out-of-network providers “to the extent permitted by law if they can verify a treatment relationship,” CMS wrote.

Payers also must install an API that provides the capacity to exchange such information between each other for instances when a patient changes insurers or has multiple payers.

A nudge for providers

CMS is implementing a new measure in the Promoting Interoperability Program starting in 2027 for hospitals to report on their use of the new prior authorization API in submitting a request. A similar metric will be added to the Merit-based Incentive Payment System for physicians.

The new API requirements should help “streamline the current error-riddled, burdensome and costly process that leads to delayed care and patient harm,” Saha said.

However, she added that the rule should have begun setting the parameters for real-time prior authorization.

“CMS missed a valuable opportunity to develop incentives to move payers and providers closer to real-time processes using innovative technologies,” Saha said. “With record labor shortages, inflation and other demands in the healthcare sector, it is more critical than ever that providers are able to leverage technology to create efficiencies.”