Skip to main content

CMS Finalizes Prior Authorization & Interoperability Rule

In mid-January the Centers for Medicare and Medicaid Services (CMS) issued the Prior Authorization Final Rule, and with it a very significant interoperability component to increase availability of electronic health information (EHI) across multiple platforms. 

The CMS final rule will initially establish these new requirements for Medicare Advantage (MA) organizations, Medicaid (Medi-Cal in California) and state Children’s Health Insurance Program (CHIP), Fee-for-Service (FFS) programs, Medi-Cal managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs). 

The success of a more streamlined prior authorization (PA) process will require the implementation of application programming interfaces (APIs) to increase the exchange of electronic health information (EHI) for medical items and services―excluding drugs. Notably, CMS excluded all drugs, including Part B drugs paid through a medical benefit. Unexpectedly, CMS notes in the final rule that it did not anticipate an overwhelming response it received in favor of including medications, prompting them to evaluate potential options to include them in the future. 

In a CMS press release, Secretary of the Department of Health and Human Services (HHS), Xavier Becerra, stated, “When a doctor says a patient needs a procedure, it is essential that it happens in a timely manner. Too many Americans are left in limbo, waiting approval from their insurance company.”¹ Those likely to benefit the soonest by these new requirements will be Medicare Advantage enrollees due to a prior MA and Part D finalized rule in calendar year 2024 that complement the prior authorization final rule to add continuity of care requirements and reduce disruptions in treatment plans for beneficiaries. Starting mostly in 2026, most impacted payers will be required to send PA decisions within 72 hours for urgent requests and seven calendar days for non-urgent (standard) requests for medical items and services. Starting in 2026, these payers will also be required to provide a specific reason for a denied PA decision, regardless of the method used to send the PA request to help facilitate resubmission of the request or an appeal when needed. 

Responding to heavy feedback, HHS will continue to evaluate the HIPAA prior authorization transaction standards, including the use of enforcement discretion of covered entities that have already implemented the necessary prior authorization API for future rulemaking. Fortunately, the rule will not be implemented until January 2027. This ensures sufficient time to train staff, giving payers the ability to build and update APIs and operational procedures. 

The January 17th final rule is estimated to achieve approximately $15 billion dollars in savings over ten years, but more importantly, reduce the instances of denying care and services to patients already covered for those benefits and the unnecessary time burden placed on valuable administrative and clinical time. 

CMS Final Rule Fact Sheet:…;

Gabriela Villanueva is CAP’s Government and External Affairs Analyst. Questions or comments related to this article should be directed to

¹Centers for Medicare & Medicaid Services.  2024. "CMS Finalizes Rule to Expand Access to Health Information and Improve the Prior Authorization Process." January 17, 2024.….