To combat growing criticism of prior authorization delays by payers, Centers for Medicare & Medicaid Services finalized a rule Wednesday that requires health plans to send prior authorization decisions within three days for urgent requests and seven days for standard requests starting in 2026.
The guidelines will affect Medicare Advantage, Medicaid, the Children's Health Insurance Program, Medicaid managed care and qualified health plans. It also requires payers to give patients and providers a reason for denying a prior authorization request, as well as instructing the other party how to resubmit the request or appeal the decision.
Payers will be required to implement an application programming interface to support a better, more efficient electronic automation process. CMS is delaying API compliance dates for the 2026 calendar year. Beginning in 2027, payers will be expected to have a prior authorization API, expand on its patient access API and implement a provider access API. With patient permission, data can be transferred from one payer's API to another.
All told, the agency expects the changes will result in approximately $15 billion in savings over 10 years by reducing the health care system's administrative burden and improving health outcomes, noting that decision timelines for some payers will be halved.
Critics of current prior authorization practices say the system stresses the healthcare system and is used as a tool by payers to not cover costly procedures and treatments as quickly as patients need.
"When a doctor says a patient needs a procedure, it is essential that it happens in a timely manner,” said HHS Secretary Xavier Becerra in a statement. “Too many Americans are left in limbo, waiting for approval from their insurance company. Today the Biden-Harris Administration is announcing strong action that will shorten these wait times by streamlining and better digitizing the approval process.”
“CMS is committed to breaking down barriers in the health care system to make it easier for doctors and nurses to provide the care that people need to stay healthy,” said CMS Administrator Chiquita Brooks-LaSure. “Increasing efficiency and enabling health care data to flow freely and securely between patients, providers and payers and streamlining prior authorization processes supports better health outcomes and a better health care experience for all.”
Under the rule, payers must report prior authorization metrics. CMS anticipates those metrics will be similar to metrics provided by traditional Medicare that is already available.
Organizations like the Medical Group Management Association, the Workgroup for Electronic Data Interchange (WEDI) and America's Physician Groups all applauded the rule change, with the latter calling prior authorizations a "blunt and misused instrument that poses obstacles to patients."
"Through the deployment of API technology, this historic final rule is expected to usher in a substantial reduction of administrative burden and unprecedented levels of health information exchange between health plans, providers, and the patients they serve," said WEDI President and CEO Charles Stellar.
Premier, Inc., comprised of a network of hospitals other providers, said the rule doesn't go far enough in providing care quickly to a patient in need, though it supports the agency's efforts to use APIs and other interoperability standards.
"While Premier appreciates CMS’ commitment to codifying required deadlines for prior authorization decisions by payers, postponing care for potentially up to seven days is still untenable when a patient’s health is on the line," said Soumi Saha, senior vice president of government affairs, in a statement. "Instead of making patients and providers play a dangerous waiting game, Premier maintains that CMS should require payers to deliver responses within 72 calendar hours for standard, non-urgent services and within 24 calendar hours for urgent services.
"Premier is also disappointed by the final rule’s lack of acknowledgment that a pathway to real-time prior authorization exists," she added. "CMS missed a valuable opportunity to develop incentives to move payers and providers closer to real-time processes using innovative technologies."
In April, CMS released guidance telling MA plans they could not "add additional hoops" for enrollees before they receive care by limiting when coordinated care plans can require prior authorization. Coordinated care plans are also required to give a 90-day grace period for enrollees that switch MA plans while receiving treatment. The April update also cracked down on misleading marketing practices and notifying payers they must install electronic prior authorization by 2026.
Wednesday's rule adds an electronic prior authorization measure for clinicians under the Merit-based Incentive Payment System Promoting Interoperability performance category.
CMS will apply enforcement through the Health Insurance Portability and Accountability Act, the release said. More information on the suggested implementation guides for payers can be found on the CMS website.
"Patients need protection from arbitrary critical care denials and delays due to insurance company prior authorization abuse," said Federation of American Hospitals President and CEO Chip Kahn in a statement shared with Fierce Healthcare. "It is important that CMS is taking a vital step to ensuring this protection by setting guiderails for prior authorization that should rein in the worst abuses. We urge Congress to further attack prior authorization abuse and protect access to care by passing the bipartisan Ensuring Seniors’ Timely Access to Care Act.”