On January 1, 2026, the first operational requirements of the CMS Interoperability and Prior Authorization final rule (CMS-0057-F) take effect. For Medicare Advantage organizations, Medicaid and CHIP programs and their managed care plans, the rule shortens decision timeframes, requires a specific reason for every denial and, within three months, makes prior authorization performance public. The API requirements follow in 2027. With four weeks left in the year, the question is no longer what the rule says. It is whether workflows, delegated entities and reporting are ready to prove compliance.

What Changes on January 1, 2026

Shorter decision timeframes

Impacted payers must decide expedited (urgent) prior authorization requests within 72 hours and standard (non-urgent) requests within seven calendar days. For Medicare Advantage, the 72-hour expedited timeframe is familiar, but the standard timeframe drops from 14 calendar days to seven, effectively cutting the window in half for the largest share of requests. Qualified health plan issuers on the federally facilitated exchanges are not subject to the new timeframes, and the requirements do not apply to drugs.

A specific reason for every denial

Payers must provide a specific reason for denied prior authorization requests, regardless of how the request was submitted, whether through a portal, fax, email, mail or phone. Generic language such as "not medically necessary" without explaining which criteria were not met will not satisfy the intent of the rule, and it invites appeals.

Public Reporting Arrives in March

By March 31, 2026, impacted payers must post prior authorization metrics for the prior calendar year on a publicly accessible website. Medicare Advantage organizations report at the contract level. The metrics include:

  • A list of all items and services that require prior authorization
  • The percentage of standard and expedited requests approved and denied
  • The percentage of requests approved after appeal
  • The percentage of requests for which the decision timeframe was extended and then approved
  • The average and median time between submission and decision for standard and expedited requests

Because the first report covers 2025 activity, data quality problems from this year will be visible to providers, members, regulators and competitors next spring. Organizations should validate now that request receipt times, decision times, request types and appeal outcomes are captured consistently across every channel and every delegated entity.

The 2027 API Requirements

Beginning in 2027 (generally January 1, 2027), impacted payers must implement a set of FHIR-based APIs:

  • Prior Authorization API to identify which items and services require authorization, surface documentation requirements, and support electronic requests and responses, including approval, denial with a specific reason or a request for more information.
  • Provider Access API to share claims, encounter, clinical and prior authorization data with in-network providers who have a treatment relationship with the member.
  • Payer-to-Payer API to exchange data, including prior authorization information, when members change plans.
  • Patient Access API enhancements to include prior authorization information.

On the provider side, an Electronic Prior Authorization measure enters the Merit-based Incentive Payment System Promoting Interoperability category beginning with the 2027 performance period, so clinicians will have their own reasons to use these APIs. Separately, many large payers made voluntary commitments this summer, convened by HHS and CMS, to reduce the volume of services requiring authorization, honor existing authorizations for 90 days when members switch plans and expand real-time electronic decisions. Regulatory and market pressure are pointing in the same direction.

What Delegated Groups Need to Know

Many Medicare Advantage plans delegate utilization management to medical groups, MSOs and independent practice associations. Delegation does not transfer accountability. The plan remains responsible to CMS for compliance, which means delegated entities should expect updated contracts, tighter oversight, more frequent data submissions and audits against the new timeframes and denial reason standards. Delegated groups that can produce clean, timestamped decision data will be in a stronger position in contract negotiations. Those that cannot may see delegation pulled back.

An Operational Checklist for the Next 30 Days

  1. Recalibrate turnaround clocks. Update system timers, queue priorities and escalation rules so standard requests are tracked against seven calendar days, including weekends and holidays.
  2. Stress-test staffing. Model request volume against the new timeframe, especially for January, when authorization volume often rises with new enrollment and benefit resets.
  3. Expand auto-approval where criteria are clear. Requests that meet established clinical criteria with complete documentation do not need manual review. Automating them frees reviewers for complex cases and shortens turnaround.
  4. Standardize denial reason language. Build reason templates that cite the specific criteria not met and the documentation that would support approval, and review a sample of denials before go-live.
  5. Normalize intake across channels. Fax, phone and portal requests should land in one queue with a consistent receipt timestamp. The clock starts when the request arrives, not when it is keyed in.
  6. Build the metrics report now. Run a draft of the March 31 public report using 2025 data and reconcile anomalies before it becomes public.
  7. Align delegates. Issue updated requirements to delegated entities, confirm their reporting formats and schedule oversight reviews in the first quarter.
  8. Plan the 2027 API roadmap. Confirm sequencing for the Prior Authorization, Provider Access and Payer-to-Payer APIs, including member attribution and opt-out processes.

Utilization Data Is a Strategic Asset

The new requirements turn prior authorization from a back-office function into a visible measure of plan performance. Approval rates, overturn rates and turnaround times will be compared across contracts and used by providers deciding where to contract and by regulators deciding where to look. Organizations that track utilization by service, provider and reviewer will be able to identify authorization requirements that add little value, retire them and improve both provider relationships and their public numbers.

How a Platform Approach Helps

Meeting shorter timeframes is easier when authorization, clinical documentation and utilization data live together. Curitics manages prior authorizations with an auto-approval engine for requests that meet defined criteria and utilization tracking that supports turnaround monitoring and reporting, alongside the clinical record that reviewers need to make and explain decisions. For delegated groups, having decisions, timestamps and documentation in one place simplifies plan oversight.

January 1 is a starting line, not a finish line. The organizations that treat 2026 as the year to build reliable decision data and streamline review will be ready for public scrutiny in March and for the API requirements that follow in 2027.