On January 1, 2027, most government-regulated health plans must be able to take prior authorization requests electronically through a standard interface, and tell your practice electronically what they need and what they decided. This is the second half of the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F). The first half, which took effect in 2026, set decision deadlines and required specific denial reasons. This guide explains what changes in 2027, what it does not change, and what to ask your EHR vendor and billing company now.
Who Has to Comply
The rule applies to “impacted payers”: Medicare Advantage organizations, state Medicaid and CHIP programs (fee-for-service and managed care), and qualified health plans on the federal health insurance exchange. It does not apply to employer plans or most commercial insurance, which set their own rules. In most practices that still covers a large share of prior authorization requests.
What Changes on January 1, 2027
| Requirement | What it means for your practice |
|---|---|
| Prior Authorization API | Plans must offer an electronic connection that shows whether a service needs prior authorization, lists the documents they require, accepts the request and returns the decision, including the reason for a denial. |
| Provider Access API | Plans must let in-network providers request claims and clinical data for their attributed patients, which can help with history and coding. |
| Payer-to-Payer API | When a patient changes plans, data can move to the new plan, including recent prior authorization decisions, so care is less likely to restart from zero. |
| Public reporting | Plans keep publishing yearly prior authorization statistics, such as approval and denial rates and average decision times, a requirement that started in 2026. |
The Rule in Two Steps
Since January 2026
- Standard decisions within 7 calendar days
- Expedited decisions within 72 hours
- A specific reason for every denial
From January 2027
- Electronic prior authorization connection
- Provider and payer-to-payer data access
- Requirements and documents shown up front
What It Does Not Change
- It does not remove prior authorization. Plans still decide which services need it.
- Your practice only benefits if your EHR or practice management system connects to the plans’ interfaces. A plan’s API does nothing on its own if your software cannot use it.
- It does not cover prescription drugs, which follow separate rules.
- Fax and portal requests do not disappear overnight. Expect a mix of methods during 2027.
A Prior Authorization Measure for MIPS
CMS also added an Electronic Prior Authorization measure to the Promoting Interoperability category of the Merit-based Incentive Payment System, starting with the 2027 performance period. Clinicians report whether they requested prior authorization electronically through a certified system. If you report MIPS, ask how your EHR will capture this.
What to Ask Your EHR Vendor
- Will our system connect to plans’ Prior Authorization APIs in 2027, and for which plans first?
- Will it show, at the time of ordering, whether a service needs prior authorization?
- Will decisions and denial reasons flow back into the patient’s chart automatically?
- Is this included in our current fee, or is it an add-on?
What to Ask Your Billing Company
- Who on your team handles prior authorizations, and will you use the new electronic connections?
- How will you track the 7-day and 72-hour deadlines and follow up when a plan misses them?
- Will your monthly report show prior authorization volume, approval rate and time to decision by plan?
- How will you use the denial reasons plans now give to prevent the next denial?
Companies that list prior authorization as a service are on our prior authorization page. Our guide to the 2026 prior authorization rules covers the decision deadlines in detail.
