Since January 1, 2026, the CMS Interoperability and Prior Authorization final rule (CMS-0057-F) has required Medicare Advantage plans, Medicaid and CHIP fee-for-service programs, and Medicaid and CHIP managed care plans to decide prior authorization requests within 72 hours for urgent requests and seven calendar days for standard ones, and to give a specific reason whenever they deny one. By January 1, 2027, those payers must also offer a Prior Authorization API that lets your systems see what needs authorization and send requests electronically. Separately, Original Medicare began requiring prior authorization or pre-payment review for a short list of services in six states under a model called WISeR.
None of this applies to every patient you see. The rule names its payers, and employer-sponsored and other commercial plans aren't among them. Prescription drugs are left out entirely. So the first job for your practice is knowing which of your patients' plans the rules cover, and then using what they give you: a deadline you can hold the plan to, and a denial reason you can act on.
Why it matters to a small practice
Prior authorization is one of the heaviest administrative loads a practice carries. In the 2025 AMA Prior Authorization Physician Survey of 1,000 practicing physicians, respondents reported completing an average of 40 prior authorizations per physician each week, spending an average of 13 hours of physician and staff time on them weekly, and 40% said they employ staff who work only on prior authorization. Nearly one in three (32%) said requests are often or always denied.
The CMS rule doesn't reduce how many authorizations you need. It sets deadlines and requires explanations, which gives your staff something firm to track and follow up on.
Who the CMS rule covers
CMS calls the payers covered by the rule "impacted payers". Here is what applies to each, from the CMS fact sheet:
Payer | 72-hour / 7-day decisions | Specific denial reason | Public metrics | Prior Authorization API |
|---|---|---|---|---|
Medicare Advantage plans | Yes | Yes | Yes | Yes |
Medicaid and CHIP fee-for-service programs | Yes | Yes | Yes | Yes |
Medicaid managed care plans and CHIP managed care entities | Yes | Yes | Yes | Yes |
Qualified Health Plans on the federally facilitated exchanges | No | Yes | Yes | Yes |
Not covered by the rule:
- Employer-sponsored and other commercial plans outside that list. Their prior authorization rules come from the plan, the contract and any state law that applies, not from CMS-0057-F.
- Original Medicare. It isn't one of the rule's impacted payers. WISeR, covered below, is a separate program.
- Drugs. None of the rule's prior authorization policies apply to prior authorization for drugs, on any plan.
The dates
Date | What changed or changes |
|---|---|
January 1, 2026 | Decisions within 72 hours (expedited) or 7 calendar days (standard); a specific reason for every denial |
March 31, 2026 | Payers' first public prior authorization metrics due, posted on their websites |
January 1, 2027 | Prior Authorization API required, plus prior authorization data in the payers' other data-sharing APIs (compliance dates vary by payer type) |
2027 performance year | New MIPS measure, "Electronic Prior Authorization": clinicians attest to at least one electronic request through a payer's API, or claim an exclusion |
The 72-hour and 7-day decisions
An expedited (urgent) request must get a decision within 72 hours, and a standard request within seven calendar days. Calendar days include weekends and holidays. If a covered plan goes past those limits on a request you sent, note it in your log and raise it with the plan. Your record of when you sent the request is what makes that conversation possible, so keep the confirmation each portal, fax or electronic submission gives you.
A specific reason for every denial
Since 2026, covered payers must give a specific reason when they deny a prior authorization request, however the request was sent and however the decision comes back: portal, fax, email, mail or phone. CMS says the point is to let providers fix and resubmit a request when that's possible. The rule doesn't replace the denial notices some payers already have to send to patients or providers; those continue.
Public metrics
Each covered payer must post prior authorization metrics on its website every year, with the first set due March 31, 2026. It is worth looking up the figures for the plans that cover most of your patients, so you know what to expect from each.
The Prior Authorization API, January 2027
By January 1, 2027, each covered payer must run a Prior Authorization API that lists the items and services needing authorization, identifies the documentation each one requires, and accepts a request and returns a response. The response must say whether the request is approved (and when the approval ends), denied (with a specific reason) or needs more information.
Your practice reaches that API through your EHR or practice management software, not on its own. Ask your vendor now whether, and when, it will connect to your main covered payers' APIs. Until it does, the portals and fax lines you use today remain the way in.
WISeR: prior authorization comes to Original Medicare in six states
The WISeR (Wasteful and Inappropriate Service Reduction) Model runs from January 1, 2026 to December 31, 2031 in Original Medicare. It uses technology companies, with review by licensed clinicians, to check whether selected services meet Medicare's existing coverage rules. Examples CMS gives are skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis. Inpatient-only services, emergency services and services that would put the patient at substantial risk if delayed are excluded.
State | Medicare Administrative Contractor (MAC) |
|---|---|
Arizona | JF Noridian |
New Jersey | JL Novitas |
Ohio | J15 CGS |
Oklahoma | JH Novitas |
Texas | JH Novitas |
Washington | JF Noridian |
For a selected service in one of these states, the provider chooses: send a prior authorization request (to the model participant directly, or through the MAC, which forwards it), or skip it and have the claim go through medical review before it is paid. WISeR doesn't change what Medicare covers or what it pays for a covered service, and it doesn't apply to Medicare Advantage patients. CMS says providers with a record of compliance may be exempted from WISeR review in the future.
If you deliver any of the selected services to Original Medicare patients in these states, read CMS's WISeR provider and supplier operational guide and decide, service by service, which route you will take.
Build a prior authorization log
The new deadlines and denial reasons are only useful if someone tracks them. A shared log, one line per request, is enough to start:
Column | Why it's there |
|---|---|
Internal account number and visit date | Links the request to the visit and the claim |
Payer and plan type (MA, Medicaid, exchange, employer, Original Medicare) | Tells you which rules apply |
Service and codes requested | So the claim matches what was approved |
Urgent or standard | Sets the decision deadline |
Date and method sent, with confirmation | Your proof of when the clock started |
Decision due date | 72 hours or 7 calendar days for covered payers; the plan's own terms for others |
Decision and date received | Shows whether the plan met its deadline |
Authorization number, approved units and valid dates | So the claim can show it, and a date change triggers a recheck |
Denial reason, word for word | Drives the next step |
Next step, owner and due date | So nothing waits on a desk |
Keep patient details in your practice management system and use the account number in the log. Review open requests every day, and look at the month's denials by payer and reason once a month.
What to do with a denial reason
Read the reason before doing anything else, then sort it:
- Missing or incomplete documentation. Send what the plan named and resubmit the request. This is the case the denial-reason requirement was meant to help.
- Wrong code, units or site of service. Correct the request to match what the provider is actually ordering and resubmit.
- The plan's criteria aren't met. Compare the plan's published criteria with the note. If the record supports the service, ask for the reconsideration or appeal the denial notice describes, or a peer-to-peer review if the plan offers one, and attach the notes that answer the stated reason. If the record doesn't support it, the provider and patient decide what happens next.
- Not a covered benefit. This one is about the plan, not the paperwork. The patient needs to know before the service, not after.
The denial notice, or the plan's provider manual, sets out how and by when to challenge a denial. Copy that deadline into the log the day the denial arrives.
If a service is performed without a required authorization, the claim is likely to come back denied with reason code 197 ("Precertification/authorization/notification/pre-treatment absent"). Our post on why medical claims get denied covers what to do with that and other common denials.
Start with the eligibility check
Most prior authorization problems begin before anyone asks for one. An eligibility check before the visit tells you who the patient's payer really is and what kind of plan it is: Medicare Advantage or Original Medicare, Medicaid managed care or fee-for-service, an exchange plan or an employer plan. That answer tells you which rules apply, whether WISeR could apply, and whether the plan requires a referral or authorization for the service at all.
Check again when the patient says anything has changed, when a visit moves to a new date, or when the number of visits grows past what was approved.
Where Beeline fits
Beeline is a US company with a dedicated billing team. Our eligibility verification work checks coverage before the visit and flags to your team any referral or authorization the plan requires. Our denial management work reads each claim denial's codes, corrects, resubmits or appeals the claim, and traces repeat denials back to the step that caused them; its tool, "The denial decoder", explains the common codes. To look at your own denials first, start with a free consultation.
Frequently Asked Questions
Does the 7-day prior authorization rule apply to commercial insurance?
No. The 72-hour and 7-day decision times in CMS-0057-F apply to Medicare Advantage plans, Medicaid and CHIP fee-for-service programs, and Medicaid and CHIP managed care plans. Employer-sponsored and other commercial plans aren't covered by the rule, and Qualified Health Plans on the federal exchanges are excluded from the decision times.
When do payers have to offer the Prior Authorization API?
Covered payers must have it in place beginning January 1, 2027, with exact compliance dates varying by payer type. Your practice will use it through your EHR or practice management system, so ask your vendor about its plans.
Does CMS-0057-F apply to prescription drugs?
No. None of the rule's prior authorization policies, including the decision times and the denial-reason requirement, apply to prior authorization for drugs.
What is the WISeR model, and which states does it cover?
WISeR is a CMS model that adds prior authorization, or pre-payment review, for selected services in Original Medicare from January 1, 2026 to December 31, 2031. It covers Arizona, New Jersey, Ohio, Oklahoma, Texas and Washington, and doesn't apply to Medicare Advantage patients.
What should we do when a prior authorization is denied?
Read the specific reason the payer gave and sort it: send missing documentation and resubmit, correct a wrong code or site of service, or ask for reconsideration or appeal when the record supports the service. Record the appeal deadline from the denial notice in your log the same day.