Article contents
Regulatory information can change. This resource is educational and should not be treated as legal, clinical, or regulatory advice. Consult the applicable primary guidance and qualified professionals for decisions affecting your organization. Last reviewed September 21, 2026.
What the rule is
CMS released the Interoperability and Prior Authorization final rule, CMS-0057-F, on January 17, 2024. It builds on the earlier Interoperability and Patient Access final rule and adds requirements aimed at improving data exchange and prior authorization practices for impacted payers.
CMS states that certain provisions apply beginning January 1, 2026, while the application programming interface requirements primarily apply beginning January 1, 2027. Confirm the dates and payer categories that apply to your organization directly with CMS before making planning commitments.
The API surfaces to understand
Patient Access API
Lets a patient's chosen application retrieve covered information held by the payer, expanded under this rule to include prior authorization information.
Provider Access API
Supports sharing patient information with providers involved in the patient's care.
Payer-to-Payer API
Supports transferring member information when coverage changes between impacted payers.
Prior Authorization API
Supports discovering requirements, assembling a request, and exchanging the payer's decision electronically.
What CMS says about the decision itself
Under the rule, a payer's response to a prior authorization request through the API must either approve the request and state when the authorization ends, deny it with a specific reason, or ask for the additional information needed to decide.
CMS also describes timeframe expectations for impacted payers other than qualified health plan issuers on the federally facilitated exchanges: as expeditiously as the patient's condition requires, and at most 72 hours for an expedited request and seven calendar days for a standard request. These requirements cover medical items and services and exclude drugs.
What actually changes in operations
An API removes a transport problem. It does not decide what documentation your organization must produce.
- 01Confirm which payers you work with are impacted and on what timeline
- 02Identify which of your current manual lookups an API can replace
- 03Decide where requirement discovery fits in the clinical and administrative workflow
- 04Keep a non-API path for payers and situations the API does not cover
- 05Define who reviews a denial, a request for more information, or a conflicting requirement
- 06Record what was requested, what was returned, and who acted on it
Illustrative operating sequence; obligations vary by organization and payer.
Questions worth asking your vendors and payers
- Which of these APIs will be available, and when?
- Which implementation guides are being used?
- How are errors, timeouts, and partial responses surfaced to staff?
- Where does the response land in the existing queue and worklist?
- How is the evidence of a request and decision retained?
- What remains a portal, fax, or phone workflow after the change?
Where this leaves the operating team
Even in a fully API-enabled path, someone has to assemble clinical documentation, judge whether criteria are met, respond to a request for more information, and decide how to handle a denial. Those are the parts of prior authorization that carry professional accountability.
The practical opportunity is to remove the repeated coordination around those decisions: finding the requirement, gathering what already exists, checking status, and escalating what has stalled.
Sources
Authoritative references
Rules, standards, and guidance can change. The links below were reviewed on September 21, 2026.
- 1Centers for Medicare & Medicaid Services. CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
- 2Centers for Medicare & Medicaid Services. Prior Authorization API — Frequently Asked Questions
- 3Centers for Medicare & Medicaid Services. Electronic Prior Authorization
- 4Assistant Secretary for Technology Policy / Office of the National Coordinator. Electronic Prior Authorization Fact Sheet