Prior authorisation is one of the most disliked processes in US healthcare: faxes, portals, phone calls and long waits for decisions that often affect care. CMS's Interoperability and Prior Authorization final rule, CMS-0057-F, is the most significant federal push to move it onto standard APIs. It has two phases, and the second is close.
What applies when
| Requirement | Generally from |
|---|---|
| Decisions within 72 hours for expedited and seven calendar days for standard requests, with specific denial reasons | 1 January 20261 |
| Public reporting of prior authorisation metrics | 2026, with the first report due by 31 March 202614 |
| Patient Access API usage metrics | 20262 |
| Provider Access, Payer-to-Payer and Prior Authorization APIs, plus prior authorisation data in Patient Access | 1 January 202713 |
Dates differ by plan type: commentary notes that Medicaid and CHIP managed care follow rating periods, and exchange plans follow plan years beginning on or after 1 January 20274. Drugs are excluded from the prior authorisation API requirements1. Secondary sources disagree on some plan-specific details, so confirm your own obligations against the rule text with counsel.
The four API workstreams
- Patient Access API, extended with prior authorisation information, so members can see requests and decisions in their own apps.
- Provider Access API, giving in-network providers data on their attributed patients, with a patient opt-out.
- Payer-to-Payer API, moving a member's data to a new payer when they switch, with patient opt-in.
- Prior Authorization API, letting provider systems check whether authorisation is needed, see documentation requirements, and submit requests and receive decisions electronically13.
These build on FHIR and the HL7 Da Vinci implementation guides that commentary associates with the rule, covering coverage requirements discovery, documentation templates and prior authorisation support3. CMS also proposed in April 2026 to adopt FHIR standards for prior authorisation transactions under HIPAA, as I covered in the April 2026 briefing.
The hard part isn't the API
Exposing FHIR endpoints is the visible work. The hidden work is behind them:
- Codifying policy. The Prior Authorization API needs machine-readable rules for when authorisation is required and what documentation is needed. Many payers hold those rules in PDFs and reviewer knowledge.
- Integrating with utilisation management systems so decisions, statuses and reasons flow back through the API within the required timeframes.
- Member and provider identity and attribution, which Provider Access and Payer-to-Payer depend on, plus opt-in and opt-out consent handling.
- Clinical data normalisation: claims and clinical data mapped to US Core and related profiles, using the pipeline patterns in FHIR Bulk Data pipelines for bulk exchange.
- Metrics. The reporting requirements need reliable timestamps across the whole workflow, not just the API.
Start with policy codification. It has the longest lead time, involves clinical and business owners rather than engineers, and nothing in the Prior Authorization API works without it.
Where AI fits, carefully
Prior authorisation is an obvious target for AI: extracting evidence from clinical documents, summarising cases for reviewers, and turning policy documents into structured rules. Those are reasonable uses with human oversight. Using models to make or influence denials is a different matter, with regulatory and reputational risk. I keep AI on the assistive side, log its contributions as described in AI incident postmortems, and design so a clinician owns every adverse decision.
How I can help
I design FHIR API platforms and the data and policy layers behind them, for payers and the vendors who serve them. See healthcare data architecture, or analyse your challenge and bring the result to a call.
- 1CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheetCenters for Medicare & Medicaid Services · 17 Jan 2024
- 2Fact sheet: CMS Interoperability and Prior Authorization Final Rule (PDF)Centers for Medicare & Medicaid Services
- 3
- 4