CMS Issues Final Rule to Streamline Prior Authorization

The Centers for Medicare & Medicaid Services (CMS) published its Interoperability and Prior Authorization final rule (CMS-0057-F) on January 17, 2024, to advance its interoperability goals and tackle process challenges related to prior authorization.

The rule will place new requirements on Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs), (collectively “impacted payers”), to improve the electronic exchange of health care data and streamline prior authorization processes.

To encourage providers to adopt electronic prior authorization processes, the rule will also add a new measure for Merit-based Incentive Payment System (MIPS) for eligible clinicians under the Promoting Interoperability performance category of MIPS, as well as for eligible hospitals and critical access hospitals (CAHs), under the Medicare Promoting Interoperability Program.

Prior authorization is a cost containment tool used by insurers in which providers seek approval for certain drugs and services before they are delivered to patients. Physicians have long complained that the amount of prior authorization requests has increased in recent years, causing undue administrative burdens for practices and delays in patient care.

According to a 2019 survey by the American Medical Association, 91% of physicians reported that prior authorization had a negative impact on patient clinical outcomes, and 28% reported that prior authorization had led to a serious adverse event for a patient in their care.

The final rule aims to reduce patient, provider, and payer burden by increasing efficiency, transparency, and access to health information. It builds on the technological foundation of the May 2020 CMS Interoperability and Patient Access final rule (85 FR 25510), which required impacted payers to implement and maintain certain Health Level 7® (HL7®) Fast Healthcare Interoperability Resources® (FHIR®) application programming interfaces (APIs) to facilitate the electronic exchange of health care data. These APIs are based on a common set of standards and specifications that enable different systems to communicate and share data with each other. The final rule also incorporates the feedback that CMS received from public commenters on the December 2020 CMS Interoperability and Prior Authorization proposed rule (85 FR 82586), which was formally withdrawn by CMS.

The final rule includes the following provisions:

• Patient Access API: In the CMS Interoperability and Patient Access final rule, CMS required impacted payers to implement and maintain an HL7® FHIR® Patient Access API to give patients access to their health information, including claims and encounter data, clinical data, and formulary data. In the final rule, CMS requires impacted payers to add information about prior authorizations (excluding those for drugs) to the data available via the Patient Access API by January 1, 2027. This will help patients understand their payer’s prior authorization process and its impact on their care. CMS also requires impacted payers to report annual metrics to CMS about Patient Access API usage, beginning January 1, 2026.

• Provider Access API: To facilitate care coordination and support movement toward value-based payment models, CMS requires that impacted payers implement and maintain a Provider Access API to share patient data with in-network providers with whom the patient has a treatment relationship by January 1, 2027. The Provider Access API must include patient claims and encounter data (excluding cost information), data elements identified in the United States Core Data for Interoperability (USCDI) version, and prior authorization requests and decisions. The Provider Access API must also support the exchange of data between payers, with patient consent, when a patient changes plans or enrolls in a new plan.

• Prior Authorization Support API: In order to streamline prior authorization processes and reduce administrative burden, CMS requires that impacted payers implement and maintain a Prior Authorization Support API to enable the electronic submission and exchange of prior authorization requests and decisions between providers and payers by January 1, 2027. The Prior Authorization Support API must use the HL7® FHIR® Da Vinci Prior Authorization Support Implementation Guide, which defines the data elements and workflows for prior authorization. The PA Support API must also provide a specific reason for any prior authorization denial and instructions on how to resubmit the request or appeal the decision. CMS also establishes deadlines for payers to respond to prior authorization requests: within 72 hours for urgent requests and within seven days for standard requests. These deadlines are consistent with existing federal and state laws and regulations.
• Promoting Interoperability Program Measure: To encourage providers to adopt electronic prior authorization processes, CMS adds a new measure for eligible clinicians and hospitals under the Medicare Promoting Interoperability Program. The measure, called the Electronic Prior Authorization Support measure, will assess whether providers use a certified electronic health record technology (CEHRT) to generate and transmit prior authorization requests and receive prior authorization decisions from payers. The measure will be optional for the 2026 performance period and required for the 2027 performance period and beyond. Providers who report the measure will earn five bonus points under the Promoting Interoperability performance category of MIPS or the Medicare Promoting Interoperability Program, respectively.

CMS expects that the final rule will result in significant benefits for patients, providers, and payers, such as:

• Improved patient access to health information and prior authorization decisions, which will enable patients to make informed decisions about their care and avoid unnecessary delays or denials of care.
• Enhanced care coordination and quality of care, as providers will have access to more complete and timely patient data and prior authorization decisions, which will reduce duplication of services and improve clinical decision making.
• Increased efficiency and reduced burden, as providers and payers will be able to use standardized and interoperable APIs to automate and streamline prior authorization processes, which will save time and resources and improve operational performance.
• Greater transparency and accountability, as payers will be required to provide clear and specific reasons for prior authorization denials and instructions for resubmission or appeal, as well as report metrics on prior authorization and API usage to CMS and the public.

It is expected that the final rule will spur innovation and competition in the health IT market, as developers and vendors will have more opportunities to create and offer interoperable solutions that meet the needs and preferences of payers and providers.

The final rule will take effect on January 1, 2026 for most of the provisions. However, some of the API development and enhancement requirements have a later compliance date of January 1, 2027 or later, depending on the type of payer. CMS encourages payers and providers to begin implementing the final rule as soon as possible to realize its benefits and prepare for the compliance dates. For technical assistance and resources in meeting the final rule requirements, payers, providers, and physicians can check the CMS Interoperability Proving Ground, the CMS Blue Button 2.0 Developer Portal, and the CMS FHIR® at Scale Taskforce (FAST) Initiative.