CMS Interoperability & Prior Authorization Final Rule (CMS-0057-F)
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), published in January 2024, is the most significant healthcare data interoperability mandate in U.S. history. It requires impacted payers to implement FHIR-based APIs for patient access, provider access, payer-to-payer data exchange, and prior authorization.
Who Must Comply
The rule applies to:
- Medicare Advantage (MA) organizations
- Medicaid managed care plans
- CHIP managed care entities
- Qualified Health Plan (QHP) issuers on the ACA marketplace
Not covered: Traditional Medicare fee-for-service (FFS), self-funded employer plans, and commercial plans outside the marketplace (though the industry expectation is that commercial payers will adopt voluntarily).
Four Mandated APIs
1. Patient Access API
- Purpose: Allow members to access their own claims, clinical, and prior auth data through third-party apps
- Standard: CARIN Blue Button IG + US Core
- Data: Claims/EOB, coverage, clinical data (conditions, meds, labs, etc.), prior auth decisions
- Auth: SMART on FHIR (OAuth 2.0)
- Timeline: Already effective (original CMS-9115-F, 2020); expanded data requirements by Jan 1, 2027
2. Provider Access API
- Purpose: Allow in-network providers to access member clinical and claims data to inform treatment
- Standard: Da Vinci PDex + US Core
- Data: Claims, encounters, clinical data, prior auth decisions
- Consent: Opt-out model (members enrolled by default, can opt out of data sharing)
- Timeline: January 1, 2027
3. Payer-to-Payer API (FHIR)
- Purpose: When a member switches plans, the new payer can request the member's data from the previous payer
- Standard: Da Vinci PDex (including $member-match and Bulk FHIR)
- Data: Up to 5 years of claims, clinical data, and encounter data
- Consent: Member must opt in to trigger the exchange
- Timeline: January 1, 2027
4. Prior Authorization API
- Purpose: Modernize prior auth with FHIR-based submission and real-time responses
- Standard: Da Vinci PAS (Prior Authorization Support)
- Requirements:
- Accept FHIR-based PA requests
- Respond within 72 hours (urgent) / 7 calendar days (standard)
- Provide specific, actionable reasons for denials
- Report PA metrics publicly (approval rates, average response times, denial reasons)
- Timeline: January 1, 2026 (certain provisions); January 1, 2027 (full)
Additional Requirements
Prior Authorization Metrics Reporting
Payers must publicly report:
- Percentage of prior auth requests approved, denied, and approved after appeal
- Average response time by service category
- Percentage decided within 72 hours (urgent) and 7 days (standard)
Prior Authorization Decision Transparency
- All PA decisions must include specific reasons for denials (not just generic codes)
- PA decisions must be accessible via the Patient Access API
Electronic Prior Authorization for Certain Services
Payers must support electronic PA for all items and services they require PA for, not just a subset.
Compliance Timeline Summary
| Requirement | Compliance Date |
|---|---|
| Patient Access API (expanded data) | January 1, 2027 |
| Provider Access API | January 1, 2027 |
| Payer-to-Payer API | January 1, 2027 |
| Prior Authorization API (FHIR) | January 1, 2026/2027 |
| PA metrics public reporting | March 2026 |
| PA decision reason transparency | January 1, 2026 |
Enforcement
CMS can enforce compliance through:
- Corrective action plans
- Civil monetary penalties
- Contract non-renewal or termination for MA/Medicaid plans
- Marketplace certification denial for QHPs
