Quick answer: Starting January 1, 2027, Medicare Advantage plans, Medicaid and CHIP programs, and federal Marketplace plans must offer a Prior Authorization API. Providers can use it to check whether a service needs authorization, see the payer’s documentation requirements, submit the request, and receive the decision electronically. For critical access hospitals (CAHs), electronic prior authorization becomes an optional bonus measure under the Medicare Promoting Interoperability Program in 2027 and a required measure in 2028. Rural hospitals and clinics that wait until 2028 to prepare will be behind.
Prior authorization has mostly been treated as a staffing problem: phone calls, fax cover sheets, payer portals and staff assigned to keep track of all of it. CMS’s Interoperability and Prior Authorization Final Rule (CMS-0057-F) turns it into a technology and compliance issue as well. The first set of payer deadlines has already passed. The API deadline is only about two months away, and the provider-side requirements follow a year after that.
For rural facilities, the timing is tight. Many small hospitals are less technically ready than larger systems, and a growing share of rural patients are enrolled in the plan types the rule covers. The sections below explain what the rule requires, what has already taken effect, and what CAHs and rural health clinics (RHCs) should do in the coming year.
What CMS-0057-F Requires, and of Whom
CMS finalized the rule in January 2024. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges.[^1] Employer-sponsored commercial plans and Original Medicare’s own fee-for-service claims are outside its scope.
The rule has two phases. Phase one requirements have already taken effect, and phase two requirements are coming up.
Phase one: operational changes (2026)
Since January 1, 2026, impacted payers must:[^1]
- Decide expedited prior authorization requests within 72 hours and standard requests within seven calendar days. Marketplace issuers are exempt from these timeframes.
- Give a specific reason for every denial, however the request was submitted.
- Publish annual prior authorization metrics on their websites, with the first report, covering calendar year 2025, published by the March 31, 2026 deadline.
Phase two: the APIs (2027)
By January 1, 2027, impacted payers must have three new FHIR-based application programming interfaces in place, alongside the existing Patient Access API:[^1]
- Prior Authorization API: lists covered items and services, identifies documentation requirements, accepts requests and returns an approval, a denial with a reason, or a request for more information.
- Provider Access API: lets in-network providers retrieve a patient’s claims, encounter data and prior authorization history.
- Payer-to-Payer API: moves a patient’s data, including prior authorization history, when they change plans.
Drugs are excluded throughout. None of the API, timeframe or denial-reason requirements apply to prior authorization for drugs.[^1] CMS estimated that the rule would save about $15 billion over ten years.[^2]
What the First Public Metrics Showed
The first public reports were due March 31, 2026, and cover calendar year 2025.[^5] They give rural finance leaders a benchmark they didn’t have before. KFF analyzed reports from 14 large insurers and found average denial rates for standard requests of 12% in Medicare Advantage, 14% in Medicaid managed care and 18% in the ACA Marketplace.[^6] Rates varied widely by insurer, from 5% to 17% among Medicare Advantage plans and from 2% to 23% among Medicaid managed care plans.
Appeals stood out. Overturn rates on appealed denials were 67% in Medicare Advantage, 47% in Medicaid managed care and 43% in the Marketplace.[^6] KFF’s earlier analysis of Medicare Advantage found that insurers made about 53 million prior authorization determinations in 2024 and fully or partly denied 7.7% of them. Only 11.5% of those denials were appealed, and insurers overturned 80.7% of appealed denials.[^7]
KFF also identified gaps. Insurers report percentages but not request counts; there is no breakdown by service category, and formats are inconsistent.[^6] Even with those limits, the reports let a CAH compare its own experience with each payer to what that payer has published.
Why the Rule Matters More in Rural Markets
Rural patients are increasingly in covered plans
Medicare Advantage enrollment among eligible beneficiaries in rural counties rose from 11% in 2010 to 40% in 2023, according to KFF.[^8] Add Medicaid, which covers a large share of rural patients, and most of a rural hospital’s prior authorization volume now comes from payers the rule covers. Original Medicare does not generally require prior authorization for the hospital services covered here, so the shift toward Medicare Advantage brings more authorization work.
Rural hospitals start from a lower technology baseline
The APIs are only useful if a hospital’s EHR can connect to them. ONC data from 2023 show that 37% of CAHs were routinely interoperable across all four domains (sending, finding, receiving and integrating data), compared with 45% of other hospitals. Among independent hospitals, the figure was 22%, compared with 53% for system-affiliated hospitals.[^9] Many independent CAHs depend entirely on their EHR vendor’s development schedule for new capabilities.
Small teams feel the workload most
The AMA’s 2025 physician survey found that practices complete an average of 40 prior authorizations per physician each week, spending 13 hours of physician and staff time, and that 40% of physicians employ staff who work exclusively on prior authorization.[^10] A rural hospital with a few employed providers, outpatient imaging and infusion services handles the same kinds of requests with fewer people and less room to absorb backlogs.
The Provider Side: What CAHs Must Do and When
The payer APIs require nothing of providers by themselves. CMS’s adoption incentive is the Electronic Prior Authorization measure in the Medicare Promoting Interoperability Program.
Under the FY 2027 hospital inpatient payment rule (CMS-1849-F), finalized in July 2026, the measure works like this for eligible hospitals and CAHs:[^4]
- CY 2027: optional. Hospitals and CAHs that report it earn bonus points.
- CY 2028 and after: required to meet program requirements and to count as a meaningful EHR user.
In practice, a CAH will need to request prior authorization electronically through a payer’s Prior Authorization API, using data from certified EHR technology, for at least one medical item or service other than a drug.[^3] Promoting Interoperability performance affects Medicare payment for CAHs, so the measure carries financial weight as well as compliance weight.
The certified technology requirement
The technical standards come from ONC’s HTI-4 Final Rule, released in August 2025. It adopted the HL7 Da Vinci implementation guides for Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS), and created three new certification criteria for electronic prior authorization.[^4] A CAH’s EHR must be certified to these criteria before the hospital can meet the 2028 requirement.
What about rural health clinics?
The Promoting Interoperability measure applies to hospitals, CAHs and MIPS-eligible clinicians, not to RHCs as an entity type. RHCs still benefit from the payer APIs, because their Medicare Advantage and Medicaid patients are covered by the rule. Provider-based RHCs that share an EHR with their parent CAH will gain the hospital’s capabilities as the hospital adopts them. Independent RHCs should ask their EHR vendor directly when electronic prior authorization will be available.
What’s Next: Drugs and HIPAA Standards
In April 2026, CMS proposed a follow-on rule, CMS-0062-P, extending the framework to drugs.[^11] The proposal would require Medicaid, CHIP and ACA plans to support pharmacy data standards for formulary lookups, real-time benefit checks and electronic prior authorization for drugs, with shorter drug decision timeframes taking effect October 1, 2027. It would also adopt HL7 FHIR as the HIPAA standard for prior authorization transactions, which would extend standardized electronic prior authorization well beyond the payers covered by the current rule.[^4]
Payers have also made voluntary commitments. In June 2025, a group of insurers pledged to standardize electronic prior authorization, reduce the number of services that require it, and expand real-time approvals for most requests by 2027.[^3] AMA survey data suggest physicians remain skeptical that the pledge will change much.[^10]
A 2027 Readiness Checklist for CAHs and RHCs
- Ask your EHR vendor three questions. When will the system be certified to the new electronic prior authorization criteria? Which payers has the vendor connected to? What will activation cost?
- List your prior authorization volume by payer. Identify which requests go to Medicare Advantage, Medicaid and Marketplace plans and which go to commercial plans outside the rule. Start with the covered payers.
- Pull each payer’s published metrics. Compare their reported denial rates and response times with your own experience, and raise the differences in contract discussions.
- Track decision timeframes now. Payers covered by the rule have been required to meet the 72-hour and seven-day deadlines since January 2026. Record the date of each request and decision so you can document missed deadlines.
- Make denial reasons usable. Specific reasons are now required. Code them consistently so patterns point to fixes in documentation or ordering workflows.
- Plan for the 2027 bonus. Reporting the measure in 2027 earns bonus points and gives your team a year of practice before it becomes mandatory.
- Coordinate clinical and revenue cycle staff. Electronic prior authorization pulls documentation from the EHR at the point of ordering, so clinical staff and the business office need a shared workflow.
Frequently Asked Questions
When does the CMS prior authorization API requirement take effect?
Impacted payers must have the Prior Authorization API, Provider Access API and Payer-to-Payer API in place by January 1, 2027. The faster decision timeframes, specific denial reasons and public reporting requirements took effect in 2026.
Which payers are covered by CMS-0057-F?
Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges. Employer-sponsored commercial plans are not covered.
Do critical access hospitals have to use electronic prior authorization?
The Electronic Prior Authorization measure is an optional bonus measure for CAHs in the Medicare Promoting Interoperability Program for CY 2027. It becomes required beginning in CY 2028.
Does the rule apply to prior authorization for drugs?
No. CMS-0057-F excludes drugs. A separate proposed rule, CMS-0062-P, released in April 2026, would extend electronic prior authorization standards to drugs.
How fast must Medicare Advantage plans decide prior authorization requests?
Since January 1, 2026, Medicare Advantage, Medicaid and CHIP plans must decide expedited requests within 72 hours and standard requests within seven calendar days, and must give a specific reason for any denial.
How CPa Medical Billing Supports Rural Providers
CPa Medical Billing, a GeBBS Healthcare Solutions company, provides revenue cycle management for rural health clinics, critical access hospitals, FQHCs, and other safety-net providers. Our teams track payer rule changes like CMS-0057-F and help rural facilities adjust prior authorization, documentation and denial workflows as requirements take effect.
Sources
- Centers for Medicare & Medicaid Services. “CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) Fact Sheet.” https://www.cms.gov/newsroom/fact-sheets/cms-interoperability-and-prior-authorization-final-rule-cms-0057-f
- Centers for Medicare & Medicaid Services. “CMS Finalizes Rule to Expand Access to Health Information and Improve the Prior Authorization Process.” January 17, 2024. https://www.cms.gov/newsroom/press-releases/cms-finalizes-rule-expand-access-health-information-and-improve-prior-authorization-process
- Centers for Medicare & Medicaid Services. “Electronic Prior Authorization.” https://www.cms.gov/priorities/electronic-prior-authorization/overview
- Centers for Medicare & Medicaid Services. “Electronic Prior Authorization: Industry Commitments, Finalized and Proposed Rulemaking.” https://www.cms.gov/files/document/electronic-prior-authorization-industry-commitments-finalized-proposed-rulemaking.pdf
- Becker’s Hospital Review. “Payers’ Prior Authorization Denial Rates Go Public: 5 Notes.” March 2026. https://www.beckershospitalreview.com/legal-regulatory-issues/payers-prior-authorization-denial-rates-go-public-5-notes/
- KFF. “Prior Authorization Metrics Provide New Insights into Insurer Practices, but Gaps Remain.” August 2026. https://www.kff.org/patient-consumer-protections/prior-authorization-metrics-provide-new-insights-into-insurer-practices-but-gaps-remain/
- American Hospital Association. “Analysis: MA Insurers Made 53 Million Prior Authorization Determinations in 2024.” January 28, 2026. https://www.aha.org/news/headline/2026-01-28-analysis-ma-insurers-made-53-million-prior-authorization-determinations-2024
- KFF. “Medicare Advantage Enrollment, Plan Availability and Premiums in Rural Areas.” https://www.kff.org/medicare/medicare-advantage-enrollment-plan-availability-and-premiums-in-rural-areas/
- Office of the National Coordinator for Health IT. “Interoperable Exchange of Patient Health Information Among U.S. Hospitals: 2023.” Data Brief No. 71, May 2024. https://www.healthit.gov/sites/default/files/2024-05/Interoperable-Exchange-of-Patient-Health-Information-Among-U.S.-Hospitals-2023.pdf
- American Medical Association. “AMA Survey: Prior Authorization Reform Pledge Falls Short With Physicians.” https://www.ama-assn.org/press-center/ama-press-releases/ama-survey-prior-authorization-reform-pledge-falls-short-physicians
- Becker’s Payer Issues. “CMS Proposes Extension of Prior Authorization Rule to Cover Drugs: 6 Notes.” April 2026. https://www.beckerspayer.com/policy-updates/cms-proposes-extension-of-prior-authorization-rule-to-cover-drugs-6-notes/