Prior authorization metrics reporting is the yearly duty, under the CMS-0057-F interoperability and prior authorization rule, for Medicare Advantage organizations, Medicaid and CHIP programs and plans, and Marketplace issuers on the federal exchanges to post their prior authorization results on a public website by 31 March. A Medicare Advantage organization posts nine items for each contract: the list of services that need prior authorization, the shares of standard and expedited requests approved and denied, approvals after appeal, extended requests later approved, and the average and median time from request to decision. Most of those numbers are simple counts. The two elapsed times are not, because each rests on a receipt timestamp and a decision timestamp that several systems and people touch. Botminds' Utilization Management Automation writes both timestamps as each decision is made, so the posted median is computed from the same data an auditor would test.
To see why that matters, follow one request. It is invented, but every step in it happens in UM departments every week.
One standard request: the clock the rule counts, and the clock a platform logged
- Fax queue, Fri to Mon64 h
- Logged, read, pended, asked26 h
- Provider sends records27.5 h
- Waits for a reviewer23 h
- Review and decision, 2 h
- Logged, read, pended, asked26 h
- Provider sends records27.5 h
- Waits for a reviewer23 h
- Review and decision, 2 h
What prior authorization metrics must health plans report?
Medicare Advantage organizations must post nine items for each contract every year: a list of services requiring prior authorization, and eight measures of how standard and expedited requests were decided and how long the decisions took. The regulation opens: "Beginning in 2026, following each calendar year that it offers an MA plan, an MA organization must report prior authorization data, excluding data on drugs as defined in § 422.119(b)(1)(v), at the MA contract level by March 31." Medicaid managed care plans report the same measures at the plan level (42 CFR 438.210(f)), state Medicaid and CHIP fee-for-service programs at the state level, and Marketplace issuers on the federal exchanges at the issuer level.
The rule names the measures but not the arithmetic. CMS filled part of that gap with an overview and template for payers, which says: "While the CMS Interoperability and Prior Authorization final rule does not specify the required denominators for these metrics, in the template below, we specify the expected numerators and denominators". The table below sets them out.
The nine metrics, with the numerators and denominators CMS's template expects
| # | Metric | Counts | Out of | Note |
|---|---|---|---|---|
| 1 | Items and services that require prior authorization | CountsA list in plain language, with service descriptions | Out of— | NoteA list of procedure codes alone does not count as publicly accessible, per CMS’s template. |
| 2 | Standard requests approved | CountsStandard requests approved in the year | Out ofAll standard requests | NoteCMS recommends posting counts as well as percentages. |
| 3 | Standard requests denied | CountsStandard requests denied | Out ofAll standard requests | |
| 4 | Standard requests approved after appeal | CountsApproved after appeal | Out ofStandard requests appealed | NoteA subset of appealed requests, not of all requests. |
| 5 | Extended, then approved | CountsRequests whose review time was extended and that were approved | Out ofAll requests | NoteCMS recommends showing standard and expedited separately. |
| 6 | Expedited requests approved | CountsExpedited requests approved | Out ofAll expedited requests | NoteExpedited approved after appeal is optional. |
| 7 | Expedited requests denied | CountsExpedited requests denied | Out ofAll expedited requests | |
| 8 | Time to decision, standard | CountsAverage and median elapsed time | Out ofFrom receipt by the plan to the decision | NoteUnits stated; under one day, in hours. |
| 9 | Time to decision, expedited | CountsAverage and median elapsed time | Out ofFrom receipt by the plan to the decision | NoteSame rule on units. |
Two denominators surprise teams that build the report from habit. Approved after appeal is a share of the standard requests that were appealed, not of all standard requests; the template's sample shows 3,000 approvals out of 5,000 appeals, 60 percent. Extended and approved is a share of all requests: the sample shows 7,500 of 50,000, or 15 percent. A plan that divides by the wrong base publishes a figure that cannot be compared with any other plan's.
When are prior authorization metrics due, and where are they posted?
They are due by 31 March each year, covering the previous calendar year, on the plan's own public website. The first posting, due 31 March 2026, covered 2025 decisions, which were made under the old 14-day standard clock; for Medicare Advantage the posting due by 31 March 2027 is the first to show a full year under the 7-day clock. CMS does not receive the data. In the final rule it wrote that "CMS is not collecting these data, but instead requiring impacted payers to post such data on the payer's website".
"Public" means public. CMS's template says a posting reachable only behind a provider or member portal login does not satisfy the requirement, and asks for counts as well as percentages, explicit time units, and an explanation of any data quality problem next to the affected metric (CMS template). It also gives the timing rule the whole page depends on, set out below.
One request's timestamps, from fax tone to notice
The request in the figure above is ordinary. A spine clinic faxes a standard request for a lumbar MRI at 16:52 on a Friday. The fax server stamps it. Nobody opens the fax line until Monday at 09:10, when an intake coordinator keys it into the UM platform, which records that moment as the request's creation time. A nurse reads it Monday afternoon, sees that the conservative-therapy notes are missing and pends it; the letter to the clinic goes out Tuesday at 11:00. The notes arrive Wednesday at 14:30. A nurse picks the request up Thursday at 13:50, approves it at 15:40, and the notice goes out at 16:05.
Measured from the fax stamp, the decision took 5 days, 22 hours and 48 minutes. Measured from the platform's creation time, it took 3 days, 6 hours and 30 minutes. Both are inside a seven-day clock, so nothing looks wrong. But if the plan's posted median is built from creation times, every weekend fax shortens it, and the plan publishes a faster figure than its members experienced.
Where does the prior authorization clock start?
The clock starts when the plan receives the request, in whatever channel it arrives, and the published elapsed times are measured from the same point. The Medicare Advantage rule sets the standard deadline at 7 calendar days "after receiving the request", and the expedited deadline at 72 hours after receiving it (42 CFR 422.572). The regulation's own wording for the metric is "the submission of a request", which raised the question of whose clock counts. CMS's template answers it for both metrics: "This should be measured from the time the payer receives the request, not when it is sent by the provider".
For a fax, receipt is the fax server's arrival stamp. For the portal, it is the submission time the portal records. For a phone request it is the time of the call, written into the case file. For mail it is the mailroom's date stamp. None of them is the moment a person keys the request into the UM platform, and a timeliness report that cannot show the receipt source for each request cannot show that any clock started in the right place.
The timeliness log in Utilization Management Automation: receipt, decision and notice, as they happened
Four places a clock starts or stops wrongly
Most errors in a published median come from four places, and none of them is arithmetic. They are moments when a system records a time that is not the time the rule counts.
Four failure points between the fax machine and the published median
- The clock starts at logging, not receipt
Weekend faxes, phone calls written up later and scanned mail all arrive before they are logged. Keep the arrival stamp as the clock start and show its source on every request.
- A duplicate starts a second, later clock
The same request by fax on Friday and through the portal on Monday is one request. The earlier arrival keeps the clock; the later one is merged into it.
- The request runs on the wrong clock
A physician who indicates that the standard timeframe could seriously jeopardize the patient’s health makes the request expedited, wherever the box sits in the fax. Filed as standard, it counts in the wrong metric and is probably late.
- The clock pauses during a pend, or stops at the wrong event
A pend for records does not stop a Medicare Advantage clock; only a permitted extension, with written notice, adds time. And the member’s deadline is met by notification, so log the notice time beside the decision time.
The third failure deserves its own example, because it moves a request between metrics as well as making it late. Under the Medicare Advantage rule, when a request is made or supported by a physician, the plan must expedite it whenever the physician indicates that the standard timeframe could seriously endanger the enrollee's life, health or ability to regain maximum function (42 CFR 422.570(c)(2)(ii); the guide to prior authorization AI agents quotes the rule and explains why no agent may lower that urgency). If the MRI request above had carried a ticked expedited box on page two, its deadline was Monday 16:52, seven hours after it was first logged, and it would belong in metrics 6, 7 and 9, not 2, 3 and 8.
The page the old fax rules never read
Do extensions count in prior authorization metrics?
Yes, in two ways: an extended request has its own metric, and its whole elapsed time, extension included, counts in the average and median. Metric 5 is the share of requests whose review time was extended and that were then approved; CMS's template recommends showing standard and expedited requests separately, though that breakdown is optional. Because the elapsed-time metrics run from receipt to decision, a request extended by 14 days adds up to 14 days to the average, which is one reason extensions are worth watching even when they are lawful.
An extension is lawful only on the grounds the rule lists and only with written notice to the member explaining the reasons for the delay (42 CFR 422.568(b)(2)). CMS's auditors find that notice wanting often enough to list it among their 2025 lessons on delegated work: "Extension notices failed to explain the reason for extending a decision timeframe." A request extended without a proper notice is not an extended request at all for audit purposes. It is a late one.
From timestamps to an average and a median
Once each request has a trustworthy receipt and decision time, the arithmetic is simple, but the choice between average and median is not cosmetic. The median is the middle request and barely moves when a few requests take very long; the average moves with every long one. A plan with a good median and a poor average has a tail: a few requests that waited far longer than the rest, usually in a channel or a pend nobody watched.
CMS's template also fixes the units. Its instruction is that "median turnaround times of less than one calendar day must be reported in hours rather than rounded to “0 days.”" For expedited requests on a 72-hour clock that is the normal case, so a plan's report should compute in minutes and present in hours.
Median time to an expedited decision, by quarter, on the sample plan
What the posted page has to show, and what CMS does with it
The posted page has to show the nine items for the previous calendar year, at the right level (contract, plan, issuer or state), on a public page, with counts, percentages and units. CMS does not collect or score the figures, but the page is public: members choosing a plan, providers deciding whether to contract and regulators can all read it, and CMS's preamble expected plans to use the data to compete on performance. The CMS-0057-F summary sets the metrics beside the rule's other duties and dates.
The metrics also have a second audience inside CMS. Program audits test the same timeliness, request by request, from universes of receipt, decision and notice times. A plan whose public median and audit universe come from different systems will one day be asked to reconcile them. Building both from one log, written as decisions are made and never edited, removes that reconciliation. In Utilization Management Automation the metrics reporter computes the nine items from that log and drafts the page; a compliance analyst reviews and publishes it.
The nine figures, computed from every decision as it is made
Speed is the other half of the metric. Where an expedited request's hours actually go, and what each one costs, is worked through in prior authorization turnaround time.
Questions people ask
Is there a CMS template for prior authorization metrics reporting?
Yes. CMS publishes a Prior Authorization Metrics Reporting overview and template that sets expected numerators and denominators, asks for counts as well as percentages, and shows a sample page. Using the template is not required, but its definitions, such as measuring time from the payer's receipt of the request, are CMS's stated expectations.
Do prior authorization metrics include drugs?
No. The Medicare Advantage metrics exclude drugs as defined in 42 CFR 422.119(b)(1)(v), and the Medicaid managed care metrics exclude all drugs the plan covers. A separate 2026 proposal, CMS-0062-P, would bring drugs into the electronic prior authorization requirements; it is a proposal, not a rule.
At what level does a Medicare Advantage organization report?
At the contract level, aggregating all plan benefit packages under each contract. Medicaid managed care plans report at the plan level, state fee-for-service programs at the state level, and Marketplace issuers on the federal exchanges at the issuer level.
Does the clock stop while a plan waits for medical records?
Not in Medicare Advantage. The rule allows an extension of up to 14 calendar days only on listed grounds and with written notice of the reasons; without that, the clock keeps running while a request is pended, and the elapsed time counts in full in the published average and median.
Can a plan post its metrics inside its provider portal?
Not only there. CMS's template says posting the metrics only behind a password-protected provider or member portal, or where ordinary navigation from the public website cannot reach them, does not meet the rule's requirement that they be publicly accessible.