CMS-0057-F summary: what applied in 2026, what lands in 2027

CMS-0057-F is the Interoperability and Prior Authorization final rule that CMS released on 17 January 2024 and published on 8 February 2024. In summary, it binds Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and Qualified Health Plan issuers on the federal exchanges, and it works in two waves. Its operational duties applied from 1 January 2026: prior authorization decisions within 72 hours for expedited and seven calendar days for standard requests (for every impacted payer except the exchange issuers), a specific reason for every denial, and public prior authorization metrics, first posted by 31 March 2026. Its technical duties, four FHIR APIs, are due from 1 January 2027. Drugs are excluded throughout. Botminds' Utilization Management Automation was built for the operational wave: the clocks, the timestamps behind the metrics and the routing that keeps physicians on the denials.

What is CMS-0057-F?

It is a federal rule with two aims: to move health data between payers, providers and patients through standard APIs, and to make prior authorization faster and more transparent. CMS's rule page puts the timing in one sentence: impacted payers implement certain provisions by 1 January 2026, but "impacted payers have until primarily January 1, 2027, to meet the application programming interface (API) requirements in this final rule". It builds on the 2020 Interoperability and Patient Access rule, which created the first Patient Access API.

The rule also reaches providers, gently. It adds an "Electronic Prior Authorization" attestation measure for clinicians in the Merit-based Incentive Payment System and for hospitals, beginning with the 2027 performance and reporting periods (CMS fact sheet). Providers are encouraged to request prior authorization through the new API; they are not required to stop faxing.

Who does CMS-0057-F apply to, and who is left out?

It applies to government-program payers and exchange issuers, not to employer plans or the rest of the commercial market. The "impacted payers" are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and QHP issuers on the federally facilitated exchanges. Even among those, the new clocks do not reach the exchange issuers, which keep 15 days for standard and 72 hours for expedited decisions under the existing claims rules (CMS-0057-F preamble).

Employer plans governed by ERISA and state-regulated commercial plans are not impacted payers. They follow the federal claims procedure rule, 72 hours for urgent claims and 15 days for pre-service claims (29 CFR 2560.503-1), and state utilization review laws. A commercial plan that wants to match the 2026 clocks may; nothing in CMS-0057-F requires it. The 2026 proposal CMS-0062-P would add small-group issuers on the federally facilitated small business exchanges and give exchange issuers a seven-day standard clock, but it is a proposal (CMS, April 2026).

What changed on 1 January 2026 for prior authorization

Three things changed: the clocks, the denial reason and the metrics. The standard clock for an item or service under prior authorization fell from 14 calendar days to seven in Medicare Advantage; the expedited clock stayed at 72 hours. Medicaid managed care moved with its contracts: the seven-day maximum applies "For rating periods that start on or after January 1, 2026", so a state whose rating period begins on 1 July moved on 1 July. Medicaid fee-for-service programs gained federal decision timeframes for the first time, and CHIP fee-for-service programs their first expedited one (CMS template).

The denial reason is the change providers notice first. Every impacted payer must give a specific reason for a denied prior authorization, and CMS was explicit that this applies "regardless of the method used to send the prior authorization request": portal, fax, email, mail or phone. A reason that names the missing criterion lets a provider fix and resubmit a request instead of appealing it. The specific-reason duty is a nurse and physician task as much as a letter template, which is why it belongs with the medical director's decision; the boundary is drawn in medical director utilization management.

Re-read and restarted: a request moved to the expedited clock from its arrival stamp

The 31 March metrics posting

Every impacted payer must post, each year by 31 March, prior authorization metrics for the previous calendar year on its public website: the list of services requiring prior authorization, approval and denial rates for standard and expedited requests, approvals after appeal, extended requests later approved, and average and median decision times (42 CFR 422.122(c)). Medicare Advantage reports by contract, Medicaid managed care by plan, fee-for-service programs by state and exchange issuers by issuer.

The first posting, in March 2026, covered 2025, a year still under the 14-day standard clock; the March 2027 posting will show the first full year of the new clocks. CMS's template is strict about what counts as public: "Posting the required metrics only through password-protected provider or member portals or in other locations that cannot be reached through ordinary navigation from the payer’s public-facing website does not satisfy the “publicly accessible” requirement of the final rule." How the elapsed-time metrics should be built from timestamps is traced in prior authorization metrics reporting.

The nine figures, drafted for the 31 March posting from every decision as it is made

What APIs does CMS-0057-F require by 2027?

Four, all built on HL7 FHIR, generally due 1 January 2027 with exact dates varying by payer type. The Prior Authorization API lists the services that need prior authorization and the documentation each needs, accepts requests and returns approval, denial with a specific reason, or a request for more information. The Provider Access API shares claims, clinical data and prior authorization information with in-network providers who treat the patient, with a patient opt-out. The Payer-to-Payer API moves the same data to a new payer when a patient switches, with a patient opt-in and a five-year look-back. And the existing Patient Access API must add prior authorization information (CMS fact sheet).

For the Prior Authorization API, HHS chose not to enforce the X12 278 transaction standard against payers that build an all-FHIR API, so a plan may run FHIR alone or FHIR with X12. As of CMS's rule page in October 2026, the 1 January 2027 dates stand. For UM operations, the API is one more way a request arrives; it does not change who decides or how fast.

Does CMS-0057-F cover prescription drugs?

No. Every provision excludes drugs, including the clocks, the denial reason, the metrics and the APIs; Part B drugs in Medicare Advantage keep their own 24- and 72-hour clocks under separate rules. The next step is proposed, not final. In CMS-0062-P, published on 14 April 2026, CMS proposed that impacted payers "be required to support electronic prior authorization for all drugs through the Prior Authorization API and NCPDP standards beginning on October 1, 2027". Comments closed on 15 June 2026, and the rule was still a proposal in late October 2026, so no plan should treat that date as law.

What sits beside the rule in 2026: proposals, pilots and rescissions

Four other 2026 developments shape the same work, and two of them are often misreported. First, the Medicare Advantage UM annual data submission: every Medicare Advantage organization now sends CMS the internal coverage criteria it or its delegates use for services under prior authorization, first by 30 April 2026 and then every 28 February. CMS cut the collection back when it finalized it: "CMS is not finalizing the proposed audit protocol or any of the audit tools that were included in the proposed data collection."

Second, the Contract Year 2027 Medicare Advantage final rule, published on 6 April 2026 and effective 1 June 2026, rescinded the UM committee's annual health equity analysis of prior authorization and its health-equity member (CMS, 2026). Third, CMS's proposed guardrails for AI in Medicare Advantage were not finalized in the Contract Year 2026 rule, and no AI-specific federal UM regulation has replaced them. Fourth, CMS is piloting service-level prior authorization data collection from volunteer Medicare Advantage plans; KFF reports that CMS anticipates expanding the requirement to all plans in 2027, which would be a separate requirement from CMS-0057-F's public metrics.

A readiness checklist by date

A plan that met the 1 January 2026 dates on paper may still fail them in practice, because the clocks and metrics depend on timestamps the plan may not capture. The checklist runs in date order and separates what is due now from what is only proposed.

Utilization Management Automation covers the first four lines directly: it reads every door and sets each clock from receipt, keeps any adverse decision with a physician who must state the reason, and computes the nine metrics from timestamps written as decisions are made, for compliance to sign. The APIs are the plan's interoperability work; when they arrive, they are another door into the same board. What the clocks cost when they slip is priced in prior authorization turnaround time.

Questions people ask

What are the CMS-0057-F deadlines?

Operational duties from 1 January 2026 (decision clocks, specific denial reasons; Medicaid and CHIP managed care clocks from the first rating period starting on or after that date), public metrics by 31 March each year starting in 2026, and the API duties generally from 1 January 2027. Drug provisions are only proposed, in CMS-0062-P.

Does CMS-0057-F apply to commercial plans?

No. It covers Medicare Advantage, Medicaid and CHIP programs and plans, and QHP issuers on the federally facilitated exchanges. Employer plans and other commercial plans follow the ERISA claims rules and state utilization review laws, although many insurers made voluntary prior authorization commitments in 2025 that include commercial business.

Do Marketplace plans have to decide prior authorizations in 7 days?

Not under CMS-0057-F. Exchange issuers keep 15 days for standard and 72 hours for expedited requests, though they must report the public metrics. CMS-0062-P proposes a seven-calendar-day standard clock for them; until it is finalized, 15 days stands.

Is the X12 278 still required for prior authorization?

HHS announced it will not enforce the X12 278 standard against covered entities that implement an all-FHIR Prior Authorization API under CMS-0057-F, so a plan may use FHIR alone or FHIR with X12. Plans may also continue to offer an X12-only transaction.

Where can I read the official CMS-0057-F summary?

CMS published a fact sheet on 17 January 2024 and keeps a rule page with the fact sheet, FAQs, workflows and the metrics template; the rule itself is at 89 FR 8758 in the Federal Register of 8 February 2024. The codified text sits mainly in 42 CFR 422.122, 422.568, 422.572 and 438.210.