The CMS Prior Authorization Rule Billing Teams Need to Track in 2026

CMS finalized the Interoperability and Prior Authorization rule (CMS-0057-F) back in January 2024, but most of what it actually requires is landing in two waves this year and next — which makes 2026 the year billing and prior-auth teams need to have their processes ready, not just aware.

What's changing for rating periods starting January 1, 2026

The rule applies to Medicaid and CHIP managed care organizations, and it tightens the process side of prior authorization first:

• Standard decision timeframe cut in half. Non-expedited prior authorization requests must be decided within 7 calendar days, down from the 14-day standard that's applied for years.
• Denial reasons become mandatory and specific. Plans have to give providers a concrete reason for every prior-authorization denial, not a generic code.
• Public reporting begins. Payers subject to the rule must post prior-authorization metrics on their public websites — approval rates, denial rates, appeal outcomes, and average decision times by category.

None of this requires new technology to comply with — it's a process and disclosure mandate. But it does mean prior-auth denial data that used to live only inside a payer's internal systems is about to become publicly comparable across plans, which is worth watching if your practice is evaluating which payers to contract with or push back on.

What's changing for rating periods starting January 1, 2027

The heavier lift — the electronic Prior Authorization API requirement — has a one-year runway. Affected plans must stand up an API that lets providers submit prior-authorization requests electronically, attach the specific documentation a payer requires for a given service, and receive a status update, all without the fax-and-portal workflow that dominates prior auth today. For context, similar API infrastructure has existed in Medicare Advantage for roughly 15 years, so CMS is largely extending an established model to Medicaid and CHIP managed care rather than inventing something new.

Why this matters even if your payers aren't directly named

CMS-0057-F's direct scope is Medicaid/CHIP managed care plans (plus Medicare Advantage and QHP issuers on the Federally Facilitated Exchanges under related provisions). Commercial payers aren't compelled by this specific rule. In practice, though, regulatory pressure on prior authorization tends to spread: several major commercial payers have already announced their own prior-authorization reductions independent of this rule, and public reporting requirements tend to create competitive pressure even on payers who aren't legally required to publish the same data.

For billing teams, the practical takeaway for the rest of 2026 is to start tracking, payer by payer, which of your top contracted plans are subject to the new 7-day standard timeframe — and flagging any that are still running on the old 14-day clock as a candidate for an escalation or appeal when a decision runs long.