Unpacking CMS’ prior authorization rule on interoperability

Modern Healthcare – Friday, August 29, 2025
By Bridget Early

Payers and providers are on the clock to comply with federal interoperability rules designed to streamline prior authorization.

In June 2024, the Centers for Medicare and Medicaid Services finalized a regulation that set prior authorization transparency requirements and sped up mandatory reporting timelines for government-sponsored health plans. The rule kicks in on Jan. 1, with additional deadlines in January 2027, when the industry will need to stand up infrastructure that facilitates seamless data exchange between payers, providers and patients.

Experts say the bipartisan priorities in this regulation, amid President Donald Trump’s second administration that’s prioritizing health technology and improving prior authorization, signals that federal interoperability efforts are finally making some headway after years of stops and starts.

“Yes, there might be differences in details, but on broad stroke, macro policy, there’s a clear consensus and belief and understanding that we need to make headway on this decades-long challenge,” said Kyle Zebley, senior vice president of public policy at the American Telemedicine Association and executive director of the American Telemedicine Association’s lobbying arm, ATA Action.

Here’s a refresher on the rule and what comes next for the industry:

What are the rule’s prior authorization policies?

In its 2024 final rule, CMS required Medicare Advantage, Medicaid, Children’s Health Insurance Program and exchange plans to issue non-urgent prior authorization decisions within seven days and respond to urgent requests within 72 hours by the start of next year.

Insurers also will have to send justification of any prior authorization denials to providers and publicly disclose data on their determinations online, according to CMS.

What are the 2027 interoperability compliance requirements?

Insurers and states must implement several new Health Level 7 Fast Healthcare Interoperability Resources application programming interfaces. These interfaces, called APIs for short, allow software programs to communicate and swap data with one another. The aim is to streamline prior authorizations and electronic data exchange beginning in 2027.

Accomplishing true interoperability has been a multi-decade endeavor that’s been slow to materialize because of the complex nature of aligning so many moving pieces, Zebley said.

“Even doing some very basic elements that seem simple enough to the average individual, like updating forms on a website, can create tremendous problems on the back end,” Zebley said. “It’s going to be a big lift. There’s no question about it.”

CMS also added an interoperability quality metric to the Merit-based Incentive Payment System, or MIPS, meant to financially incentivize providers’ use of electronic prior authorizations.

What do payers need to set up?

Ahead of the 2026 start date, payers need to prepare their technology infrastructure and collect prior authorization data. Much of the technology has already been set up, and Blues plans are beta testing their new systems, said Jen Jones, executive director of legislative and regulatory policy for the Blue Cross Blue Shield Association.

Preparation for this regulation, which Blues companies have broadly supported, builds off of preexisting work, Jones said, and health plans, providers and health IT vendors are separately collaborating on other interoperability initiatives, including developing guidelines for simplifying electronic prior authorizations.

The bigger challenge will be meeting the Jan 1., 2027 timeline to implement new APIs, Jones said. The interfaces will allow payers, patients and providers to make faster and more coordinated decisions, Jones said.

But the rule introduced new, standardized requirements that didn’t always match existing infrastructure. As a result, Jones said plans have had to build new systems and update their existing workflows for utilization management, customer services work queues and business operating procedures.

What do providers need to implement?

Providers will need to implement APIs to enable data exchange, which Jones acknowledged will be a big lift, especially among smaller providers with fewer resources. Providers should rely on a bundled set of implementation guides CMS laid out that will help avoid burden, which means close collaboration with health plans and electronic health record vendors, Jones said.

Along with bolstering their infrastructure, providers need to ensure their own prior authorization practices align with submission requirements and are standardized across the provider’s organization, said Jeff Wurzburg, a partner at the law and lobbying firm Norton Rose Fulbright, in an email.

What does the industry still need from CMS?

Regulators should be communicating closely with payers and providers impacted by the regulation to help navigate obstacles to implementation, as these changes are complex and difficult to update, Zebley said.

Payers are looking to CMS to clarify requirements on the data reporting regulation that overlaps with requirements in separate rules on Medicare Advantage prior authorizations, Jones said.

“Let’s make sure that the data elements are the same, and they’re captured in the same way, and potentially, if there’s room, maybe reporting it once instead of of twice, just to reduce the administrative spend on something that isn’t necessarily adding value,” Jones said.

On the provider side, CMS could offer implementation resources, financial assistance or regulatory relief, Wurzburg said.

Access this article at its original source.