The 2026 prior authorization mandate.

On January 1, 2026, the CMS Interoperability and Prior Authorization Final Rule — CMS-0057-F — took effect for Medicare Advantage, Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plans on the federal exchanges.¹ It is the first federal rule to impose hard, enforceable timelines and machine-readable interfaces on the prior authorization process, and it is already reshaping the back office of every specialty practice that takes a commercial or government-line payer.

Three months in, the picture is clearer than the regulatory press releases suggested — and in some ways, more complicated. This is a field report on what the rule actually requires, what payers have shipped so far, and where practices (and the software between them and the payer) still have to do the work manually.

What changed on January 1

The most immediate change most practices have already felt is the decision-timeline tightening. Medicare Advantage plans, which previously operated under voluntary standards that stretched to 14 days for standard requests, are now bound to 7 calendar days — and the expedited window is a hard 72 hours.¹

In a cardiology practice, that means a nuclear stress test submitted on a Monday afternoon must have a decision by Monday of the following week. In a pulmonology practice, a home sleep test request queued on Friday must be decided by the next Friday. These are not aspirational numbers. They are rule-of-law deadlines, and plans that miss them are subject to CMS enforcement.

The less-immediate but larger change is the API requirement. Today, most prior authorization still runs through payer portals, secure fax, and phone. By 2027, the impacted payers must expose machine-readable interfaces that let an EHR — or an AI agent sitting alongside an EHR — query requirements, submit a request with the required clinical documentation, and receive a structured decision.²

The intermediate period — 2026 — is where practices are right now. Some payers have shipped production APIs against a limited scope of procedures. Many have shipped sandbox or developer-preview APIs. Most are still running the old workflow in parallel.

The seven-day window, in practice

In the specialty practices we work with, the 7-day standard decision window has had a second-order effect that the rule’s authors may not have fully anticipated: it has moved the bottleneck upstream.

Before CMS-0057-F, the bottleneck was the payer. Staff submitted an auth, then waited, then followed up, then appealed. The clock on the practice’s side was slow because the clock on the payer’s side was slow.

With a 7-day cap, the payer clock is now fast enough that the practice’s internal process — pulling the chart, composing the clinical justification, attaching the right supporting documentation — becomes the limiting factor. An auth that used to sit in the payer’s queue for a week now sits in the practice’s outbox for three days waiting for a human to draft the justification.

What the operating layer actually does here

The practical answer for most specialty practices is not to hire more prior authorization staff. It is to compress the submission side of the cycle — to get the clinical justification drafted, the supporting documentation attached, and the request submitted closer to the moment of referral.

This is where an AI system earns its keep under CMS-0057-F — not by making the payer faster (the rule did that) but by making the practice fast enough to match.

• Policy lookup against current payer rules. Each payer’s prior authorization requirements change quarterly. The operating layer should read the chart, pick the right study or procedure code, and check it against the current published requirements before the auth ever gets composed.
• Clinical justification drafted from the note, not retyped. The medical necessity narrative that accompanies most auths is effectively a rewrite of information already in the chart. An AI system drafts it from the note and flags anything the clinician needs to sign off on.
• Structured submission when the API is available. Where the payer has shipped a production Prior Authorization API, the submission can be structured directly. Where the payer is still on portal/fax, the AI system still drafts and submits — via the old channel — but keeps the data structured internally.
• Appeal drafting for documentation denials. The CMS rule requires specific denial reasons. That specificity makes the majority of denials — those based on missing or insufficient documentation rather than lack of medical necessity — amenable to automated appeal with the right supplement pulled from the chart.

The payer rollout so far

We have been tracking the public status of the major Medicare Advantage payers on their CMS-0057-F API readiness. As of early April 2026, the picture is uneven.

Where the rule does not reach

CMS-0057-F is a significant rule, but it is not a universal one. Several important categories of payer and service are explicitly excluded or deferred:

• Prescription drug prior authorization is out of scope. The rule covers medical services. Pharmacy benefits and drug PAs run on a separate track and are not addressed here.¹
• Fully insured commercial plans outside the federal exchanges are not covered. The rule reaches Medicare Advantage, Medicaid, CHIP, and QHPs on the federal exchanges. A large portion of commercial coverage remains on its existing voluntary or state-level standards.¹
• Self-funded ERISA plans are not covered. A substantial share of employer-sponsored coverage continues to operate outside the rule’s scope.
• The 2027 API compliance deadline is the real one. 2026 is the build-out year. Practices that design workflows assuming the API exists everywhere today will be disappointed; practices that design workflows assuming it will exist everywhere by 2027 will be positioned.

What to do in 2026

1. Measure the submission-side lag explicitly

Most practices track days-to-decision on prior auth. Fewer track days-from-referral-to-submission. Under the old regime, that upstream number was dominated by the payer’s clock. Under CMS-0057-F, it becomes the metric that actually determines your cycle time. If you are not already measuring it, start.

2. Draft appeals assuming the denial reason is structured

The specific-denial-reason requirement is one of the most consequential parts of the rule. Denials under the old regime often arrived with a reason code that did not clearly indicate what additional information would reverse the decision. Under the new rule, that ambiguity is meaningfully reduced — which makes appeal-drafting a much more tractable workflow for an AI system.

3. Do not wait for the API to go universal

The temptation, especially for practices with lean IT, is to postpone process change until the API landscape stabilizes. We would argue the opposite: the submission-side lag is already the binding constraint today, and the process improvements that address it — whether the interface is an API, a portal, or a fax cover sheet — are the same improvements that will carry forward when the API does go universal.

4. Know which of your payers are API-ready

Because payer readiness is uneven in 2026, practices need to know — per payer, per procedure — whether the API is live, in sandbox, or not yet shipped. This changes the optimal submission path and the expected decision-time envelope. The operating layer should maintain this map and route accordingly.

The broader direction

CMS-0057-F is the most concrete expression of a broader regulatory direction: the federal government is making the administrative connective tissue of American medicine machine-readable. Price transparency rules from 2022 did it for cost data. The ONC interoperability rules did it for clinical data. CMS-0057-F does it for prior authorization.

Each of these rules, considered in isolation, is a compliance exercise. Considered together, they describe an endpoint: an API surface between practices and payers broad enough that the current generation of administrative work — the staff member on hold, the staff member retyping a clinical note into a portal — simply should not exist five years from now.

We are in the middle of that transition, not at the end of it. The 90-day report is that the rule has moved the clock, surfaced the right next bottleneck, and made the case — clearer than it was a year ago — that the practices that win the 2026–2028 window will be the ones that treat prior authorization not as a manual workflow with software bolt-ons, but as a fundamentally automated pipeline with humans in the loop where they add judgment.