Many payers now have seven days to answer a prior authorization, and must publish how often they say no

Most prior authorization advice is about filling in the form better. This post is about something else: a federal rule that changed what some payers owe you, starting this year.

It is called the CMS Interoperability and Prior Authorization Final Rule, or CMS-0057-F. CMS (the Centers for Medicare & Medicaid Services) released it on 17 January 2024, and it was published in the Federal Register on 8 February 2024. Most of its process requirements took effect in January 2026.

We read the rule's regulation text and the CMS fact sheet, not summaries of them. Every claim below links to where we checked it, listed at the end.

Who it covers

The rule applies to these payers:

• Medicare Advantage plans
• State Medicaid and CHIP fee-for-service programs (CHIP is the Children's Health Insurance Program)
• Medicaid managed care plans and CHIP managed care plans
• Qualified Health Plans sold on the federal exchange, HealthCare.gov

Three things are not on that list.

• Employer health plans. For most practices that is a large share of the payer mix.
• Traditional Medicare. Only Medicare Advantage is covered.
• Drugs. The deadlines, the denial-reason rule and the public reports all leave out drugs. A medication that needs authorization is outside the rule. Imaging, procedures and equipment are inside it.

What changed in January

Deadlines. Covered payers must decide within 72 hours for an urgent request and within seven calendar days for a standard one. Before this, the Medicare Advantage limit for a standard request was 14 calendar days. Plans on HealthCare.gov are excluded from this part.

There are two details the summaries usually leave out.

• The payer can extend. A Medicare Advantage plan may take up to 14 more calendar days in some cases, for example when the patient asks for more time or when more medical evidence could change a denial. It must tell the patient in writing why. Medicaid managed care plans can also extend by up to 14 days, at the patient's or provider's request, or when the plan can justify it to the state.
• States can be stricter. For Medicaid managed care, seven days is a ceiling. A state can set a shorter limit. The new limit starts with each plan's first contract period that begins on or after 1 January 2026.

A real reason for every denial. A covered payer, including plans on HealthCare.gov, must give a specific reason when it denies a prior authorization. That applies however the request was sent: portal, fax or phone.

Public numbers. By 31 March each year, covered payers must post on their website a report on the previous year. The first reports, covering 2025, were due on 31 March 2026. Each report must include:

• the list of items and services that need prior authorization
• the share of standard requests approved, denied, and approved after appeal
• the share of standard requests where the payer extended its deadline and then approved
• the share of urgent requests approved and denied
• the average and median time from request to decision, for standard and urgent requests

Medicare Advantage plans report per contract. HealthCare.gov plans report per insurer.

What the first reports showed

KFF, a health policy research group, read the first reports from 14 large insurers and published its analysis on 13 August 2026.

| Market | Standard requests denied | Denials overturned on appeal | |---|---|---| | Medicare Advantage | 12% | 67% | | Medicaid managed care | 14% | 47% | | HealthCare.gov plans | 18% | 43% |

KFF found the median decision time for a standard request was about one day in all three markets. A median is the middle request, so half took longer. The figures are averages across those insurers; your own plans may sit well above or below them.

KFF also found real gaps. The reports give percentages, not counts. Insurers used different formats. The metrics were hard to find on some websites. And a payer reporting 0% approved after appeal does not have to say whether that means no appeals were won or none were filed.

Older Medicare Advantage data from CMS points the same way. In 2024, plans denied 7.7% of about 53 million requests. Only 11.5% of denials were appealed, and more than eight in ten of those appeals were overturned.

Three things you can do with this

1. Look up your payers' reports. Take your top few Medicare Advantage, Medicaid and HealthCare.gov plans. Search each payer's website for "prior authorization metrics". Look first at the share approved after appeal. If a payer reverses many of its own denials, an appeal there is usually worth the time. Treat a very low number with care, for the reason above.

2. Count the days. Write the submission date on every request to a covered payer. If a standard request passes seven calendar days with no decision and no written extension notice, the payer has missed a federal deadline, and you can say so when you phone. For Medicaid, check whether your state sets a shorter limit.

3. Do not accept a vague denial. "Not medically necessary" with nothing else attached does not tell you what to fix. From a covered payer, you are entitled to the specific reason. Ask for it in writing before you resubmit.

What comes in 2027

From 1 January 2027, covered payers must generally offer a prior authorization API. An API is a standard connection that lets your EHR send a request and receive the answer directly, without a portal. Whether that helps you depends on your EHR vendor building its side. It is worth asking them now what their plan is.

Doctors who report to MIPS, Medicare's quality-payment program, will also be asked from the 2027 performance year to attest yes or no that they requested a prior authorization electronically through one of these APIs.

What this does not fix

The rule does not reduce the number of authorizations, and it does not touch employer plans, traditional Medicare or prescriptions. Somebody still has to decide what needs authorizing, assemble the chart notes, submit, track the clock and work the denials.

What it does give a practice is a deadline it can hold a payer to, and the payer's own numbers to argue with.

---

Sources: CMS fact sheet on CMS-0057-F for who is covered, the deadlines, the denial-reason rule, the 2027 API date and the MIPS measure. The final rule in the Federal Register, 8 February 2024. The regulation text: 42 CFR 422.122 for the Medicare Advantage report contents, 42 CFR 422.568 for the Medicare Advantage seven-day limit, the old 14-day limit and extensions, 42 CFR 438.210 for Medicaid managed care limits, extensions and state limits, and 45 CFR 156.223 for HealthCare.gov plans. First reports: KFF, Prior Authorization Metrics Provide New Insights into Insurer Practices, but Gaps Remain, 13 August 2026. Medicare Advantage 2024 data: KFF, Medicare Advantage Insurers Made Nearly 53 Million Prior Authorization Determinations in 2024, 28 January 2026, from CMS Part C reporting data.