What the rule requires and when

CMS finalized its Interoperability and Prior Authorization rule, CMS-0057-F, in January 2024. Operational prior authorization policies started on 1 January 2026, including decision timeframes of 72 hours for expedited requests and seven days for standard requests for impacted payers. The API requirements were pushed back from January 2026 to generally 1 January 2027, with state Medicaid and CHIP fee-for-service programs also on that date.

The API package includes a Prior Authorization API and expanded Patient Access and Provider Access APIs, with the Patient Access API extended to include prior authorization data. Drugs are excluded from these prior authorization policies.

The rule uses standards-based, FHIR-oriented APIs. The hard part is rarely the standard; it is mapping messy internal systems to clean, reliable interfaces.

Where payers and vendors get stuck

Legacy utilization management systems were not built to expose real-time status and structured reasons for decisions. Teams find data quality gaps, inconsistent identifiers across systems, and tooling that cannot yet produce the structured denial reasons or metrics the rule expects.

Testing is the other bottleneck. Provider-facing and patient-facing integrations need sandboxes, conformance testing, and realistic data before go-live, and January 2027 leaves little room for a second attempt.

Map the systems first

Identify where each required data element lives today and who owns it before designing the API.

Test with realistic scenarios

Build conformance and end-to-end tests with real-world edge cases, not just happy paths.

Opportunities for health-tech builders

Payers that fall behind will need help: API gateways, data mapping, FHIR facades over legacy systems, monitoring, and provider-facing tooling that makes the new data useful. On the provider side, practices want tools that submit and track requests without extra phone calls.

Whatever you build, handle protected health information carefully and keep your own security program in line with the HIPAA expectations discussed elsewhere in this series.

Building for payers or providers under CMS-0057-F? Talk to us about FHIR APIs and integration delivery.

Key takeaways

  • CMS-0057-F operational policies, including 72-hour and seven-day decision timeframes, applied from 1 January 2026.
  • API requirements, including a Prior Authorization API, generally apply from 1 January 2027.
  • Legacy system mapping, data quality, and testing are the common bottlenecks.
  • Payers and providers will need integration help in a short window.
This is general information, not legal advice. Much of the available summary material is from 2024; confirm current requirements and any later CMS actions on CMS.gov.