Key takeaways
- Since January 1, 2026, Medicare Advantage, Medicaid and CHIP payers must decide standard prior authorization requests within 7 calendar days and expedited requests within 72 hours, and give a specific reason for denials.
- By January 1, 2027, impacted payers must offer a FHIR-based Prior Authorization API, plus Provider Access and Payer-to-Payer APIs. Drugs are excluded.
- Traditional Medicare is testing prior authorization for selected services through the WISeR model in Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington.
- Major insurers have pledged that at least 80% of complete electronic prior authorization requests will get real-time answers in 2027. Results so far are mixed.
- Practices do not have to build anything, but they should ask their EHR vendor about electronic prior authorization support and keep a tight authorization tracker.
Prior authorization is the most common administrative complaint we hear from practices. It delays care, eats staff hours and is one of the top four causes of denials, according to Experian Health's 2026 State of Claims survey. Three separate developments are now changing how it works, and January 1, 2027 is a key date for all of them.
Part 1: The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)
CMS finalized this rule in January 2024. It applies to "impacted payers": Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and, for the API requirements, qualified health plan issuers on the federally facilitated exchanges. It does not directly regulate employer-sponsored commercial plans.
Already in effect since January 1, 2026
- Decision timeframes: a decision within 72 hours for expedited (urgent) requests and 7 calendar days for standard requests, for Medicare Advantage, Medicaid and CHIP payers.
- Specific denial reasons: payers must give a specific reason when they deny a prior authorization request, which makes resubmission and appeals far easier.
- Public reporting: payers must publish prior authorization metrics, such as approval and denial rates and average decision times, on their websites each year.
Due January 1, 2027
- Prior Authorization API: a FHIR-based interface that lets a provider's system find out whether an item or service needs authorization, see the documentation the payer requires, submit the request and receive the decision electronically.
- Provider Access API: lets in-network providers retrieve claims, encounter and clinical data, including prior authorization information, for their attributed patients.
- Payer-to-Payer API: moves a patient's data, including prior authorization history, to a new payer when they switch plans, so approved care is less likely to restart from zero.
The rule also added an Electronic Prior Authorization measure to the MIPS Promoting Interoperability category, starting with the 2027 performance period. CMS has since proposed adjustments to how it is scored, so check the current MIPS requirements before you plan around it.
Part 2: The WISeR model brings prior authorization to traditional Medicare
Traditional (fee-for-service) Medicare has historically required very little prior authorization. The CMS Innovation Center's Wasteful and Inappropriate Service Reduction (WISeR) model changes that for a defined list of services in six states: Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington. The model began January 1, 2026 and is scheduled to run through 2031.
Under WISeR, technology companies working with CMS review requests for selected services that CMS considers at higher risk of overuse, such as certain nerve stimulator procedures. Providers can request prior authorization, or skip it and accept prepayment medical review of the claim. Final decisions to deny must be made by a licensed clinician, not an algorithm alone.
If you practice in one of the six states and perform any of the listed services, build the WISeR list into your authorization tracker now. Check the CMS WISeR page for the current service list, because it can change.
Part 3: The insurer prior authorization pledge
In June 2025, a large group of health insurers, convened by AHIP and the Blue Cross Blue Shield Association, made voluntary commitments to simplify prior authorization across commercial, Medicare Advantage and Medicaid managed care plans. The commitments include reducing the number of services that need authorization, honoring existing authorizations for a period when patients switch plans, and having a standardized electronic prior authorization framework working by January 1, 2027, with a goal of answering at least 80% of electronic approvals with complete documentation in real time.
A year in, physician groups report limited change on the ground, while the insurers say they are on track. The honest summary: the commitments are real but voluntary, and 2027 is the year we will see whether they show up in day-to-day turnaround times.
What changes at the front desk, and what does not
Payers are the ones building APIs. Practices do not need to build anything to comply with CMS-0057-F. But your staff will only benefit if your EHR or practice management system can use those APIs. Until then, much of the work will still happen through payer portals, fax and phone.
| Area | Before | What to expect in 2027 |
|---|---|---|
| Knowing if auth is required | Search payer lists and portals | Automated lookup in the EHR, where the vendor supports it |
| Submitting requests | Portals, fax, phone | Electronic submission from the EHR for impacted payers |
| Decision time | Often weeks | 7 days standard / 72 hours expedited for MA, Medicaid, CHIP; real-time for some |
| Denial explanations | Often vague | A specific reason required, which makes resubmission easier |
| Traditional Medicare | Little to no prior auth | Prior auth for WISeR services in six states |
Six steps to take before January 2027
- Ask your EHR vendor whether and when it will support the payer Prior Authorization APIs, and what it will cost.
- Rebuild your authorization list by payer, including WISeR services if you are in an affected state.
- Track every authorization against what is actually performed and billed: CPT codes, units, dates and location.
- Hold payers to the timeframes. If a Medicare Advantage or Medicaid plan misses the 7-day or 72-hour window, document it and escalate.
- Use the specific denial reasons to fix and resubmit quickly, and add recurring reasons to your intake checklist.
- Review payer metrics once they are published, and raise outliers in contract discussions.
Prior authorization problems are among the most expensive denials to fix after the fact. If your team is short on time, our insurance eligibility and authorization specialists can take over verification and tracking, and our denial management team can work the authorization denials you already have.
Sources
- CMS: Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet
- Congressional Research Service: Overview of the Medicare WISeR Model
- Healthcare Financial Management Association: Insurers promise to make prior authorization processes easier
- Experian Health: State of Claims Report 2026
This article is general information for healthcare practices, not legal or coding advice for a specific claim. Payer policies change often; confirm details with your MAC, payer contracts and the current CPT and ICD-10-CM code books.
RCM Expert Consultants Editorial Team
Written and reviewed by our certified coders, billing specialists and credentialing staff, who work US claims every day for practices across dozens of specialties.
