The CMS Prior Authorization Rule (CMS-0057-F): What Changes for Practices and Billing Teams in 2027

On January 1, 2027, the second phase of the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) takes effect. The first phase has applied since January 1, 2026. Together they are the largest federal change to prior authorization in years, and they are widely misread. The rule regulates payers, not providers. It covers some plans and not others. It excludes drugs. And it does not reduce the number of services that need an authorization.

This guide explains what the rule requires, who it applies to, and what a practice or billing company should change in its authorization workflow. Dates and requirements are taken from the CMS fact sheet for the final rule, checked in November 2026.

Which Payers the Rule Covers

CMS calls them "impacted payers." They are:

• Medicare Advantage organizations
• State Medicaid and CHIP fee-for-service programs
• Medicaid managed care plans and CHIP managed care entities
• Qualified Health Plan issuers on the Federally Facilitated Exchanges

Employer-sponsored commercial plans are not on that list, and neither are Marketplace plans sold through state-based exchanges. If most of your authorization volume is commercial, this rule changes less for you than the headlines suggest. If you bill a lot of Medicare Advantage or Medicaid managed care, it changes more.

The prior authorization provisions apply to medical items and services. Drugs are excluded. Authorizations for medications follow other rules and other timelines.

What Has Applied Since January 1, 2026

Three operational requirements are already in force.

Decision timeframes

Impacted payers, other than Qualified Health Plan issuers on the federal exchanges, must send prior authorization decisions within 72 hours for expedited (urgent) requests and seven calendar days for standard requests. State law or a payer contract can require a shorter turnaround.

A specific reason for every denial

Impacted payers must give a specific reason when they deny a prior authorization request, regardless of how the request was submitted: portal, fax, phone, or electronic transaction. A stated reason is what makes a resubmission or appeal targeted instead of a guess.

Public reporting of prior authorization metrics

Impacted payers must post certain prior authorization metrics on their websites each year. The first set was due by March 31, 2026. These reports show how often a payer approves, denies, and overturns on appeal, and how long decisions take.

What Starts January 1, 2027

The 2027 requirements are technical. Impacted payers must have four application programming interfaces (APIs) in place, built on the HL7 FHIR standard.

• Prior Authorization API. The payer publishes its list of covered items and services, identifies what documentation an authorization needs, and accepts requests and returns responses electronically. The response says whether the request is approved and through what date, denied and for what specific reason, or needs more information.
• Provider Access API. In-network providers with a treatment relationship can retrieve a patient's claims and encounter data, clinical data, and prior authorization information from the payer. Patients can opt out.
• Patient Access API. Payers add prior authorization information to the data patients can already pull into the health apps they choose.
• Payer-to-Payer API. When a patient changes plans and opts in, the new payer can request the patient's data, including prior authorization history, from the previous payer.

CMS has also added an Electronic Prior Authorization measure to the MIPS Promoting Interoperability category, starting with the 2027 performance period. Eligible clinicians attest yes or no to having requested at least one prior authorization for a medical item or service electronically through a Prior Authorization API using data from certified EHR technology, or they claim an exclusion. Eligible hospitals and critical access hospitals have a matching measure.

What the Rule Does Not Change

Planning goes wrong when a team assumes the rule does more than it does.

• It does not cut the list of services that require authorization. Each payer still decides what needs approval.
• It does not cover drug authorizations. CMS proposed a separate rule in April 2026 that would extend similar requirements to drugs, with proposed compliance dates starting October 1, 2027. As of this writing it is a proposal, not a final rule.
• It does not bind commercial employer plans. Those payers may adopt similar tools, but this rule does not require it.
• It does not require providers to use the API. The obligations sit with payers. The provider-side incentive is the MIPS measure.
• It does not guarantee your EHR is connected on day one. A payer having an API and your EHR or practice management system being able to use it are separate events. Portals, fax, and phone will remain part of the work during the transition.
• It does not make a decision an approval. A seven-day clock produces a faster answer. The answer can still be a denial or a request for more information.

What Billing Teams Should Do Differently

1. Map your payer mix against the rule

Tag each payer and product in your authorization worklist as covered or not covered. A Medicare Advantage plan is covered. The same insurer's employer plan is not. Staff should know which requests carry a federal clock.

2. Track the clock and escalate

Record the submission date and time for every request to a covered payer, and add a due date: 72 hours for expedited, seven calendar days for standard. A request past its due date is no longer a status check. It is an escalation, with the regulatory timeframe cited.

3. Put denial reasons to work

Capture the stated denial reason in a consistent field. Sort denials by reason each month. Missing documentation, a medical necessity criterion that was not addressed, and a wrong code or site of service each call for a different fix, and the pattern tells you where the front end is failing.

4. Read your payers' posted metrics

The public reports show which payers deny most often and which denials are most often overturned. A payer with a high overturn rate on appeal is one where appealing is worth the staff time.

5. Ask your EHR and clearinghouse vendors direct questions

Which impacted payers will you connect to through the Prior Authorization API, and when? Will staff submit from inside the EHR or through a separate tool? Does the product support the MIPS Electronic Prior Authorization measure? Get dates in writing, and plan to work the current way until the connection is live and tested.

6. Decide who owns the MIPS attestation

If your clinicians report Promoting Interoperability, someone needs to confirm whether an electronic request through a payer API has happened during the 2027 performance period, or whether an exclusion applies.

7. Keep the renewal worklist

Faster decisions do not change expiration dates. Authorizations still lapse at year-end and at plan changes. See the January deductible reset checklist for the renewal process.

Where the Manual Work Remains

An electronic request that is complete and meets criteria should move quickly, and that is the intent of the rule. What does not move by itself is everything else: requests returned as needing more information, clinical documentation that has to be gathered from the chart, peer-to-peer reviews that have to be scheduled, denials that have to be appealed, drug authorizations, and every payer outside the rule. That is the exception queue, and it is where authorization staff will spend most of their time once the routine requests are automated. We cover the wider pattern in where automation stops in the revenue cycle.

Where This Fits With RCM Staff

RCM Staff places dedicated, Philippines-based specialists who work inside your systems and follow your SOPs. Prior authorization support specialists submit requests, track decision due dates, follow up on pended requests, assemble documentation, and log denial reasons for your team to act on. Clinical decisions, peer-to-peer conversations, and payer strategy stay with your licensed and in-house staff.

If you want a second look at how your authorization work is set up before 2027 volume arrives, request a billing review.

Frequently Asked Questions