Table of Contents
Key Takeaways
- As of January 1, 2026, impacted payers must decide standard prior auth requests within 7 calendar days and expedited requests within 72 hours.
- Impacted payers must now give a specific reason for every prior authorization denial, no matter how the request was submitted.
- The rule covers Medicare Advantage, Medicaid/CHIP managed care, and ACA marketplace plans on federally facilitated exchanges — not Original Medicare, which handles prior auth differently.
- A separate requirement for payers to support electronic, FHIR-based prior auth API submissions doesn't take effect until January 1, 2027 — so most practices are still submitting through existing payer portals for now.
Prior authorization has been the most consistent complaint in physician and practice-administrator surveys for years — not because authorization exists, but because of how long it takes and how little explanation comes with a denial. CMS's Interoperability and Prior Authorization Final Rule (CMS-0057-F) was finalized back in January 2024, but its headline provisions for payers didn't actually take effect until this year. Here's what's real as of today.
What actually changed on January 1, 2026
Two specific, enforceable changes landed for impacted payers this year:
- Faster decisions. Standard prior authorization requests must be decided within 7 calendar days, and expedited requests within 72 hours — roughly half of many payers' prior timelines.
- Specific denial reasons. A denial can no longer come back as a bare "not medically necessary." Payers must state the specific reason for the denial, regardless of whether the request was submitted electronically, by fax, or by phone.
CMS also required impacted payers to begin publicly reporting prior authorization metrics — including approval rates, denial rates, and average decision time — with initial reporting covering 2025 data due by March 31, 2026.
Which payers this applies to (and which it doesn't)
This is where a lot of confusion shows up in practice conversations, because the rule doesn't apply evenly across every payer type:
| Payer type | Covered by the 2026 decision-time standards? |
|---|---|
| Medicare Advantage organizations | Yes |
| Medicaid managed care plans | Yes |
| CHIP managed care plans | Yes |
| QHP issuers on federally facilitated exchanges | Yes, with some provisions applying differently than MA/Medicaid |
| Original (fee-for-service) Medicare | Not covered by this rule — traditional Medicare has its own, more limited prior auth footprint |
| Employer-sponsored commercial plans | Not directly covered by this specific rule |
Practically, this means a Medicare Advantage denial and an employer-plan denial in 2026 may follow very different rules — worth checking before assuming the new timelines apply to every authorization on your desk.
The new decision-time standards, in context
Before this rule, decision timelines varied more by payer, and slow turnaround was one of the most common reasons authorization delays turned into care delays or claim timing problems. Cutting the standard timeline to 7 calendar days doesn't eliminate prior authorization as a workflow — but it does give billing and clinical staff a firmer number to hold payers to, and a clearer basis for escalation when a payer misses it.
The reason-for-denial requirement matters just as much operationally. A vague denial used to mean guessing at what to fix before resubmitting or appealing. A specific reason turns that into a more targeted, faster correction — which is where a meaningful share of authorization-related denials actually get resolved.
What practices should actually do differently
- Know which of your payers are actually covered. Confirm which of your top payers by volume are Medicare Advantage, Medicaid managed care, or marketplace QHPs — those are where the new timelines apply.
- Track decision time as a real metric. If a covered payer routinely exceeds 7 days on standard requests, that's now a documented deviation worth raising with the payer.
- Use denial reasons to fix root causes, not just resubmit. A specific denial reason should change what you submit next time, not just prompt a faster resubmission of the same request.
- Don't expect the API changes yet. The electronic prior-auth API requirement doesn't take effect until January 1, 2027 — most practices are still working through existing portals and fax/phone channels for now.
Are Authorization Denials Eating Into Your Revenue?
Let Sirius Solutions Global review your prior authorization workflow and identify where requests are stalling or getting denied.
Get Your Free Billing AuditWhat's still coming
The decision-time and denial-reason standards are only part of CMS-0057-F. Payer support for electronic prior authorization requests via a standardized, FHIR-based API is required starting January 1, 2027 — intended to let practices submit and track authorization status directly from compatible EHR systems instead of payer portals. A related ONC certified health IT requirement (HTI-1) also pushed adoption of the USCDI v3 data standard starting in 2026, which feeds into how that future API exchange will work.
Getting stuck on authorization turnaround times?
We track decision timelines by payer so you know exactly who's missing the mark.
Frequently Asked Questions
Sources & References
- Centers for Medicare & Medicaid Services — Interoperability and Prior Authorization Final Rule (CMS-0057-F)
- CMS.gov — Fact sheet on prior authorization decision timelines and denial reason requirements
- Office of the National Coordinator for Health IT (ONC) — HTI-1 final rule, USCDI v3
