What does the CMS Interoperability and Prior Authorization Final Rule require?
CMS-0057-F puts payers on a clock. Urgent prior authorization decisions get 72 hours, standard ones get 7 calendar days, and every denial must say why.
Answered in short
5 things that decide this
- 01CMS-0057-F, the CMS Interoperability and Prior Authorization Final Rule, was finalized January 17, 2024. It covers Medicare Advantage plans, Medicaid and CHIP programs, and Qualified Health Plan issuers on the federal exchanges.
- 02Covered payers must decide urgent prior authorization requests within 72 hours and standard requests within 7 calendar days. These decision timelines generally apply starting January 1, 2026.
- 03Every denial must carry a specific reason, and each payer must report its prior authorization metrics publicly.
- 04Payers have until January 1, 2027 to build the rule's APIs, including a Prior Authorization API that tells your systems what each payer requires and accepts requests electronically.
- 05The rule regulates payers, not clinics. What a clinic gains is a clock it can hold payers to, denial reasons it can act on, and an electronic submission lane worth preparing for.
What CMS-0057-F orders payers to do
CMS-0057-F sets deadlines and disclosure duties for government-program payers. Urgent prior authorization requests get a decision within 72 hours. Standard requests get one within 7 calendar days. Denials must state a specific reason, and each payer must publish its approval, denial and appeal numbers every year. CMS finalized the rule on January 17, 2024.
Its reach covers Medicare Advantage, Medicaid and CHIP in both fee-for-service and managed care, and Qualified Health Plans sold on the federal exchanges. Employer commercial plans sit outside it. Your payer mix therefore decides how much of your prior auth volume the new clocks actually cover.
The second half of the rule is plumbing. By January 1, 2027, covered payers must run a Prior Authorization API. It lets your practice system ask whether an item needs prior auth and what documents the payer wants. The request and the decision then travel electronically.
What changes inside a clinic
The rule works in a clinic's favor rather than adding duties. You can now time every government-program request against a published clock. Escalate the ones that blow past it, and read denials that must say why. The pressure is real: prior auth denial rates rose 31% year over year in 2026, per Medical Billers and Coders' trend analysis. This rule is the counterweight.
Using that edge takes tracking. Each request needs logging with its payer, submission time and deadline. And you'll want an alert before a 72-hour or 7-day window lapses. Most practices keep this in a spreadsheet a biller updates between calls, which is exactly where deadlines get missed.
That's a problem shape we build for: capture at submission, a deadline engine, and an escalation queue that surfaces the requests worth a phone call. It plugs into athenahealth, Epic, or whatever EHR your group runs.
- Request submittedPayer, procedure, timestamp logged.
- Clock starts72 hours urgent, 7 days standard.
- Decision dueAlert before the window lapses.
- Denial reason readSpecific reason, required by the rule.
- Escalate or resubmitWith the reason, not a guess.
CMS-0057-F gives every request a deadline. The clinics that benefit are the ones tracking it.
Related questions
01Does CMS-0057-F apply to commercial employer plans?+
No. It covers Medicare Advantage, Medicaid, CHIP and Qualified Health Plans on the federal exchanges. Employer commercial coverage is outside the rule, so requests to those payers still run on contract terms and state law.
02When did the 72-hour and 7-day timelines take effect?+
The decision timelines and specific denial reasons generally apply starting January 1, 2026. The API requirements follow by January 1, 2027. State Medicaid timing can vary, which is worth confirming payer by payer.
03What is the Prior Authorization API?+
A required electronic interface each covered payer must run by January 1, 2027. It reports whether an item needs prior authorization, lists the documentation the payer wants, accepts requests, and returns decisions electronically. For a clinic it is the foundation for getting prior auth out of fax queues and portals.
Related
- How to automate prior authorization →The mechanics: where automation genuinely helps a clinic.
- Best prior authorization automation tools →The vendor field, ranked.
- Software for medical clinics →What we build for outpatient groups.
- RCM automation →Where prior auth sits in the wider revenue cycle.
- Thirteen hours a week on prior auth →Why the workload keeps growing.
