Prior authorization now runs on a clock

A specialty practice we spoke with kept a whiteboard behind the front desk. Every prior authorization request went up with the date it was sent, and the oldest were circled in red. Some circles stayed up for three weeks. The patient could not start treatment until the plan answered, and the plan had no federal deadline to answer by.

That whiteboard should be getting shorter. The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, put its first operational requirements into effect on January 1, 2026. For the first time, most government-sponsored health plans have a federal deadline for prior authorization decisions.

What the rule requires now

The rule covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated exchanges. Since January 2026:

• Expedited (urgent) requests must be decided within 72 hours.
• Standard requests must be decided within seven calendar days.
• Every denial must include a specific reason, however the request was sent.
• Plans must post prior authorization metrics on their websites each year. The first reports were due by March 31, 2026.

One carve-out matters: the 72-hour and seven-day limits do not apply to qualified health plan issuers on the federally facilitated exchanges. If many of your patients have Marketplace coverage, those plans still follow their existing timelines.

Why the reason matters more than the clock

A fast denial still leaves a patient waiting. The more useful change for billing teams is that plans now have to explain themselves. "Not medically necessary" gives your staff nothing to fix. "The record does not show six weeks of conservative therapy" tells them exactly what to attach before they resubmit.

The cost of the old way is well documented. In the AMA survey published in May 2026, 95% of physicians said prior authorization delays access to care and 26% said it had led to an adverse event for a patient. MGMA's 2026 Regulatory Burden Report ranked prior authorization as the top administrative burden for medical groups again.

What has not changed

The rule sets deadlines for the plan, not for your office. A request that goes in without a lab result or a therapy note still gets denied, just faster. Commercial plans outside these programs are not bound by the rule, although many large insurers made voluntary pledges in 2025 to reduce prior authorization requirements.

The electronic part is still coming. Most plans must have a Prior Authorization API and the other data-exchange APIs the rule requires in place by January 1, 2027. Until then, most requests still move through portals, fax and phone.