CMS Finalizes Interoperability and Prior Authorization Rule

The Centers for Medicare & Medicaid Services (CMS) has published its CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), reflecting its efforts to improve access to health information and the prior authorization process.

The final rule includes the following provisions: patient access API (application programming interfaces), provider access API, payer-to-payer API, and prior authorization API. The final rule does not apply to prior authorization decisions for drugs.

Under the final rule, impacted payers will be required to provide information about prior authorizations via the patient access API. Per the CMS Fact Sheet, impacted payers will be required to “implement and maintain a provider access API to share patient data with in-network providers with whom the patient has a treatment relationship.” This is meant to “facilitate care coordination and support movement toward value-based payment models.”

To facilitate care continuity, impacted payers will be required to implement and maintain a payer-to-payer API to make available certain data including information about certain prior authorizations. Beginning in 2027, impacted payers will also be required to, per the CMS Fact Sheet, “implement and maintain a prior authorization API that is populated with its list of covered items and services, can identify documentation requirements for prior authorization approval, and supports a prior authorization request and response.”

The final rule also includes a provision on improving prior authorization processes which includes the following: prior authorization decision timeframes; provider notice, including denial reason; and prior authorization metrics. The prior authorization policies have a compliance date starting January 1, 2026. Impacted payers will be required to provide prior authorization decision within 72 hours for urgent requests and 7 calendar days for non-urgent requests. In 2026, impacted payers will also have to provide a specific reason for any prior authorization denial decisions. Impacted payers, per the CMS Fact Sheet, will be required to “publicly report certain prior authorization metrics annually by posting them on their website.”

In the American Medical Association (AMA) press release, AMA President Jesse M. Ehrenfeld, M.D., MPH, expressed support for the reforms. Dr. Ehrenfeld commented, “The American Medical Association applauds Centers for Medicare & Medicaid Services Administrator Brooks-LaSure for heeding patients and the physician community in a final rule that makes important reforms in government-regulated health plans’ prior authorization programs for medical services.”

Dr. Ehrenfeld added, “Today’s final rule requires impacted plans to support an electronic prior authorization process that is embedded within physicians’ electronic health records, bringing much-needed automation and efficiency to the current time-consuming, manual workflow.”

Dr. Ehrenfeld continued, “The AMA also appreciates that the rule will significantly enhance transparency around prior authorization by requiring specific denial reasons and public reporting of program metrics as well as requiring that prior authorization information be available to patients to help them become more informed decision makers.”