CMS recently finalized a prior authorization rule for medical claims related to Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs), (collectively “impacted payers”). Notably, the policies in CMS’ final rule do not apply to prior authorization decisions for drugs. For details, see CMS’ fact sheet, press release, and final rule, but for now check this out: plans must comply with the following policies starting Jan. 1, 2026, with initial reporting metrics due by March 31, 2026. What does this mean?
-
Impacted payers (excluding QHP issuers on the FFEs) must send prior authorization decisions within 72 hours for expedited/urgent requests and seven calendar days for standard/non-urgent requests.
-
Impacted payers must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request. Such decisions may be communicated via portal, fax, email, mail, or phone.
-
Impacted payers must publicly report certain prior authorization metrics annually by posting them on their website.
By Jan. 1, 2027, impacted payers must:
-
Implement and maintain Provider Access application programming interfaces (API) to share patient data with in-network providers with whom the patient has a treatment relationship.
-
Impacted payers will be required to make the following data available via the Provider Access API: individual claims and encounter data (without provider remittances and enrollee cost-sharing information); data classes and data elements in the United States Core Data for Interoperability (USCDI); and specified prior authorization information.
-
-
Add information about prior authorizations to the data available via Patient Access APIs.
