The January 2027 Prior Authorization Rule: What Changes for Your Practice

From January 1, 2027, the CMS prior authorization rule (CMS-0057-F) requires Medicare Advantage plans, Medicaid and CHIP programs and their managed care plans, and Affordable Care Act exchange plans to support electronic prior authorization through standard APIs. The rule speeds up how requests are exchanged, but it does not remove prior authorization, and much of the work stays with your staff.

Prior authorization is one of the heaviest administrative jobs in a medical practice. In the American Medical Association's physician survey of 1,000 physicians, practices completed an average of 39 prior authorization requests per physician each week, and physicians and staff spent about 13 hours a week on them. The federal rule taking full effect on January 1, 2027 aims to cut that burden. This guide explains what the rule requires, which plans it covers, what will and will not change for your front office, and how to prepare in the weeks before the deadline.

What Is the CMS Prior Authorization Rule?

The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, was finalized in January 2024. It sets deadlines for how fast certain health plans must answer prior authorization requests, requires them to explain denials, and requires them to build electronic connections that let practices check requirements and submit requests from their own systems.

The rule arrives in two phases:

The decision deadlines exclude exchange plans, and none of the rule's prior authorization provisions apply to drugs.

Which Health Plans Does the Rule Cover?

CMS calls the plans it covers "impacted payers." They are:

• Medicare Advantage organizations
• State Medicaid and CHIP fee-for-service programs
• Medicaid managed care plans and CHIP managed care entities
• Qualified Health Plan issuers on the federally facilitated exchanges

Commercial employer-sponsored plans and traditional Medicare fee-for-service are not on that list. If a large share of your patients have commercial coverage, their plans will not be required by this rule to change their prior authorization process, although the American Hospital Association notes that voluntary commitments by major insurers could extend some improvements beyond the plans the rule covers.

What Does the Prior Authorization API Let a Practice Do?

The Prior Authorization API is the part of the rule practices will feel most. Once a payer's API is live and connected to your EHR or practice management system, your staff should be able to:

• Check whether a service needs prior authorization for a specific plan
• See the documentation that plan requires for approval
• Fill in and submit the request from your own system instead of a payer portal or fax
• Receive the decision electronically: approved (with the end date), denied (with a specific reason), or more information needed

That removes much of the searching, retyping, and portal hopping that eats staff time today. It depends, though, on your EHR vendor building the connection and on each payer's API working as intended.

What Stays Manual After January 2027?

More than many practices expect. The AHA is direct about it: prior authorization itself is not going away. The rule "does not eliminate prior authorization requirements or plan coverage policies," and the main change is how information is exchanged.

Work that still needs people after the deadline includes:

• Commercial plans: requests to plans outside the rule continue through portals, fax, and phone.
• Clinical documentation: someone still has to gather the right notes, results, and orders for each request. Clinicians supply the medical details; administrative staff assemble and send them.
• Follow-up: pending requests, requests for more information, and peer-to-peer scheduling still need tracking.
• Denials and appeals: a specific denial reason helps, but resubmitting or appealing is still staff work.
• Gaps in payer readiness: the AHA advises providers to plan contingency processes in case payer capabilities are not fully working at launch.
• Drugs: prescription drug prior authorizations are outside this rule.

How Should a Practice Prepare Before January 1, 2027?

With weeks left, focus on what you control:

1. Ask your EHR or practice management vendor whether its electronic prior authorization connection will be ready by January 1, 2027, and whether you can test it first.
2. Ask your top payers when their Prior Authorization API goes live and how they will handle requests if it is not ready.
3. List your highest-volume services and plans. Mark which plans fall under the rule and which do not.
4. Keep your manual process documented for commercial plans and as a backup.
5. Track the numbers: requests per week, average turnaround, and denial rate by plan, so you can see whether the rule actually reduces the load.
6. Plan for the MIPS measure. Starting with the 2027 performance period, MIPS eligible clinicians must attest to requesting at least one prior authorization electronically through a payer's Prior Authorization API using certified EHR technology, or claim an exclusion.

Does Outsourcing Prior Authorization Still Make Sense After the Rule?

For many practices, yes. The rule shortens the submission step, but checking requirements, assembling documents, tracking pending requests, and working denials continue, especially for commercial plans. Practices often pair a prior authorization team with insurance verification specialists so coverage problems are caught before the visit rather than after the claim.

Outsource Philippines™ provides non-clinical healthcare support teams whose HIPAA-trained staff work only on one practice's account under a signed BAA, preparing and tracking authorization requests while your clinicians supply the medical details.

Frequently Asked Questions

When Does the CMS Prior Authorization API Requirement Take Effect?

January 1, 2027. From that date, Medicare Advantage plans, Medicaid and CHIP programs and their managed care plans, and exchange plans must support electronic prior authorization through a Prior Authorization API. Decision deadlines of 72 hours for urgent and 7 days for standard requests have applied since January 1, 2026.

Does the Rule Apply to Commercial Insurance?

No. The rule covers Medicare Advantage, Medicaid and CHIP fee-for-service programs and managed care plans, and Qualified Health Plan issuers on the federally facilitated exchanges. Commercial employer-sponsored plans and traditional Medicare are not on the list of impacted payers.

Will the Rule End Prior Authorization?

No. It changes how requests and decisions are exchanged and sets response deadlines, but it does not remove prior authorization requirements or plan coverage policies. Practices still need to prepare documentation, track requests, and work denials.

Does the Rule Cover Prescription Drugs?

No. The prior authorization provisions in CMS-0057-F, including the API and the decision deadlines, do not apply to drugs.

What Do Practices Need to Do for MIPS?

Starting with the 2027 performance period, MIPS eligible clinicians must attest yes or no to having requested at least one prior authorization electronically through a payer's Prior Authorization API using certified EHR technology, or report an exclusion.