Prior Authorization in 2026: What Just Changed Under CMS-0057

On January 1, 2026, a federal rule went into effect that did something American prior authorization had not done in three decades. It put a clock on the answer. Covered Medicare Advantage plans, Medicaid managed care organizations, CHIP managed care plans, and Affordable Care Act Marketplace issuers now have seven calendar days to decide a non-urgent prior-authorization request and seventy-two hours to decide an urgent one, with specific written reasons required on every denial and quarterly approval and denial rates posted publicly to the plan's website. The rule is CMS-0057-F. The legal citation is 89 Fed. Reg. 8758, published February 8, 2024. In late March, a 58-year-old warehouse supervisor in Toledo handed his cardiologist's office paperwork for a left-heart catheterization and the hospital scheduler told him she would submit the prior-authorization request to his Medicare Advantage plan that afternoon. In 2024 the same scheduler at the same hospital had told her patients to expect three to four weeks. This time she called him back on day five with an approval number. The plan had not become more generous. The plan had become subject to a clock.

The rule is CMS-0057-F, the Centers for Medicare and Medicaid Services Interoperability and Prior Authorization Final Rule, published at 89 Fed. Reg. 8758 on February 8, 2024. It shortens decision deadlines for the carriers it covers, forces specific written reasons in denial notices, mandates public reporting of approval and denial rates, and lays the groundwork for an industry-wide application programming interface that will replace the fax-driven workflow the system has run on since the 1990s. It does not cover everyone. Knowing which side of that line a denial sits on is now a core piece of any prior-authorization appeal.

What CMS-0057 actually is

CMS-0057-F closed out the proceeding CMS opened in December 2022 under the proposed rule CMS-0057-P. The final rule was published in the Federal Register on February 8, 2024, at 89 Fed. Reg. 8758. It amends 42 CFR Part 422 for Medicare Advantage, 42 CFR Part 438 for Medicaid managed care, 42 CFR Part 457 for CHIP, and 45 CFR Part 156 for Qualified Health Plans on the Affordable Care Act Marketplace. It builds on CMS-9115-F from 2020, which established the original Patient Access and Provider Directory APIs.

The rule has two halves. The first half is the prior-authorization process reforms, which took effect January 1, 2026. The second half is the application programming interface mandate, which is phased in and reaches full effect January 1, 2027. Both halves cover the same set of payers, and neither half reaches into the largest single category of American commercial coverage.

The four mandates that took effect in 2026

The prior-authorization timing reforms are the headline. Four obligations apply to every payer the rule covers as of January 1, 2026.

The first is the standard prior-authorization decision deadline. Covered payers must issue a decision on a non-urgent request within seven calendar days of receiving it. The figure is at 89 Fed. Reg. 8826 and is codified at 42 CFR 422.122(c) for Medicare Advantage, 42 CFR 438.210 for Medicaid managed care, 42 CFR 457.1230 for CHIP managed care, and 45 CFR 156.223 for QHPs. Many carrier policies before 2026 permitted 14 days for standard MA requests and up to 30 days or longer in some Medicaid and Marketplace contexts. Seven days is the new ceiling.

The second is the expedited deadline. Covered payers must issue a decision on an urgent request within 72 hours. The 72-hour clock has been in place for Medicare Advantage under 42 CFR 422.572, and CMS-0057 harmonized the figure across Medicaid managed care, CHIP managed care, and QHPs. A request is urgent when applying the standard timeframe could seriously jeopardize the patient's life, health, or ability to regain maximum function.

The third is the specific-reason requirement. When a covered payer denies a request, the denial notice must state the specific reason in language sufficient for the patient and provider to understand what evidence or criterion the request failed to meet. The final rule at 89 Fed. Reg. 8829 requires the notice to "communicate the specific reason for the denial." Generic boilerplate, "does not meet medical-necessity criteria," "lacks documentation," is no longer sufficient. The notice has to identify which criterion, from which medical-policy document, the request failed to satisfy.

The fourth is public reporting. Covered payers must publicly report aggregate prior-authorization metrics annually, including the percentage of requests approved, denied, approved after appeal, and the average and median time to decision. The first reporting year is calendar year 2026. The first posting is required by March 31, 2027. The requirements are codified at 42 CFR 422.122(d) and parallel provisions for the other lines.

Who is covered, and who is not

Inside the rule are four payer categories. Medicare Advantage organizations, the Part C plans run by private carriers under contract with CMS, covering roughly 33 to 34 million beneficiaries in 2026. State Medicaid fee-for-service and managed-care organizations, covering roughly 71 million in total. CHIP fee-for-service and managed-care entities, covering roughly 7 million children. Qualified Health Plan issuers on the federally facilitated and state-based ACA Marketplaces, covering roughly 24 million enrollees in the 2026 plan year per the CMS open-enrollment report.

Outside the rule, and this is the part most patients do not realize, is the entire category of self-funded employer health plans governed by ERISA. Roughly 60 percent of Americans with employer-sponsored coverage are in a self-funded plan, on the order of 100 million people. ERISA plans are governed by the Department of Labor under 29 CFR 2560.503-1, not by CMS. They are not subject to CMS-0057. The seven-day standard, the 72-hour expedited deadline, the specific-reason requirement, and the public-reporting obligation do not apply to them. Also outside the rule is traditional Original Medicare under Parts A and B, and the small remaining category of grandfathered and short-term plans.

The practical effect is that two patients with very similar denials can sit on opposite sides of the CMS-0057 line. A Medicare Advantage patient whose carrier takes 20 days to deny is now appealing a procedural violation of 42 CFR 422.122(c). A patient with an ERISA self-funded plan whose carrier takes 20 days to deny the same request is appealing under whatever timeframe the Summary Plan Description provides. Same carrier name on the card. Different regulatory regime.

The API mandate that takes effect in 2027

Beginning January 1, 2027, covered payers must implement four FHIR-based application programming interfaces built on the HL7 Fast Healthcare Interoperability Resources standard. The Patient Access API, expanded to include prior-authorization information. The Provider Access API, which lets contracted providers query a payer for claims, encounters, clinical, and prior-authorization data with appropriate consent. The Payer-to-Payer API, which lets a new payer query the prior payer for clinical and prior-authorization history when the patient switches. And the Prior Authorization API, which lets a provider submit a request and receive a decision through automated channels rather than fax, phone, or proprietary portal.

The Prior Authorization API is the operationally important one, built on the HL7 Da Vinci Project implementation guides for Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support. Patients filing appeals in 2026 are operating in a transitional environment where the seven-day timing rule is enforceable but the technology that will eventually make it routine is still being built.

Where the carriers stand as of mid-2026

Implementation status varies widely. The figures below are estimates from recent public statements by each carrier's interoperability division and from the CMS Interoperability Standards Advisory through Q2 2026, and should be treated as approximate. UnitedHealthcare has published a partial Prior Authorization API for select MA lines and states it is on track for January 1, 2027. Aetna has published Provider Access and Patient Access endpoints and piloted a Da Vinci Prior Authorization Support endpoint. Humana has published Patient Access and Provider Directory APIs with its Prior Authorization API in development. Elevance Health has published Patient Access endpoints and indicated its MA and Medicaid lines are on track. Centene will meet the deadline through in-house build plus a clearinghouse vendor. Kaiser Permanente has the most advanced internal infrastructure but the smallest exposure to outside provider workflows. Molina will rely on its EDI clearinghouse. Regional Blue plans have published partial endpoints with substantial variation across the 34 licensees. The carriers without a published Prior Authorization API are still operating on fax, portal, and proprietary EDI. The seven-day clock applies to them anyway.

What makes this difficult in practice

CMS-0057 adds three new procedural arguments to a prior-authorization appeal: the timing argument (carrier missed the seven-day or 72-hour clock), the specific-reason argument (denial notice recited boilerplate), and the public-reporting argument (carrier's denial rate is outside industry norm). Each of those arguments requires a CFR citation matched to the patient's specific line of business. The mapped library Apellica has catalogued (more than two hundred carrier-by-denial-type cells, indexed at the bulletin level) each route the timing argument through a different reconsideration queue.

Knowing which side of the CMS-0057 line a denial sits on is a question many patients cannot answer from the insurance card alone. An ERISA self-funded plan administered by Aetna looks identical to a fully insured ACA plan administered by Aetna, and the seven-day clock applies to one and not the other. The Summary Plan Description, the employer's HR department, and the plan's master plan document are the documents that decide it. The 30-day document-request right that compels production of those documents requires a demand letter with the correct CFR cite.

The 60-day Medicare Advantage clock, the 180-day ACA clock, and the state-specific Medicaid managed-care clocks all run on different calendars. Procedural exhaustion missteps foreclose external review and (for ERISA) federal civil action. The carrier's reviewer reads the rule for a living. The patient is reading it for the first time.

The plan had not become more generous. The plan had become subject to a clock.

The work the desk does that a patient cannot

The senior-reviewer desk runs an internal index of more than two hundred carrier-by-denial-type cells that tracks CMS-0057 compliance across every Medicare Advantage organization, Medicaid managed-care organization, CHIP managed-care entity, and QHP issuer in the United States. The desk tracks which carriers routinely beat the seven-day clock, which routinely miss it, and which line of business sits inside or outside the rule for any given employer plan.

Same-day document-request letters go out with the correct CFR cite for the patient's line of business. Apellica's senior reviewers build the four-part evidence stack, plan-language citation, clinical facts, peer-reviewed evidence, regulatory hook combining CMS-0057 with the line-specific CFR, for every case. A senior reviewer reads every appeal before it goes out.

Initial review is free. There is no upfront fee. Patients are not asked to pay anything until the carrier reverses the denial.

What CMS-0057 does not cover

Two categories sit outside even the carriers the rule reaches. The first is drug formulary determinations. Prior authorization for prescription drugs under Medicare Part D, the Medicaid Pharmacy Benefit, and commercial pharmacy benefit managers is governed by a separate framework, principally 42 CFR Part 423 Subpart M for Part D. A Part D formulary denial runs on the Part D coverage-determination process with its own deadlines, generally 72 hours standard and 24 hours expedited, and its own appeal levels. The seven-day standard does not apply.

The second is step therapy. CMS-0057 addresses the timing and disclosure of prior-authorization decisions. It does not regulate the underlying use of step therapy, fail-first protocols, or other utilization-management tools. A Medicare Advantage plan can still require a patient to try a preferred medication before authorizing a non-preferred one under 42 CFR 422.136. The seven-day clock applies to the prior-authorization request for the non-preferred medication. The step-therapy requirement does not go away.

The industry pushback and where it stands

The American Hospital Association, the AMA, and most provider-side trade associations supported the proposed rule in December 2022 and the final rule in February 2024. The AMA has cited CMS-0057 in its 2024 and 2025 House of Delegates resolutions as a model for state-level legislation extending similar rules to commercial and self-funded plans.

The industry response has been more mixed. AHIP filed comments supporting the API framework in concept and raising operational concerns about the timing reforms. In October 2024, AHIP submitted a petition to CMS requesting implementation flexibility, citing carrier readiness concerns. CMS responded in subsequent guidance reaffirming the January 1, 2026 effective date for the timing reforms and the January 1, 2027 date for the API mandate. The Blue Cross Blue Shield Association has publicly supported the API direction while raising similar pacing concerns. There has been no successful court challenge to the rule.

Exhibit 1: Standard and expedited prior-authorization deadlines, before and after CMS-0057

The shift is not subtle. The decision clocks tightened materially for the carriers the rule covers.

| Decision type | Pre-2026 typical practice, covered carriers | Post-2026 requirement under CMS-0057 | |---|---|---| | Standard prior-auth, Medicare Advantage | 14 days | 7 calendar days | | Standard prior-auth, Medicaid managed care | up to 14 days, varied by state | 7 calendar days | | Standard prior-auth, CHIP managed care | varied | 7 calendar days | | Standard prior-auth, QHP Marketplace | varied, up to 15 days | 7 calendar days | | Expedited prior-auth, all covered lines | 72 hours, MA only | 72 hours, all covered lines |

Action title for designer: "Seven days, not fourteen. Seventy-two hours, not whatever the plan said. Carriers covered by CMS-0057 are now operating under a federally timed clock that did not exist before January 1, 2026."

Exhibit 2: Who is covered and who is not, by rough 2026 enrollment

Roughly 135 million Americans are inside the rule. Roughly 100 million more, mostly through self-funded employer plans, are outside it.

| Population | Approximate 2026 enrollment | Covered by CMS-0057? | |---|---|---| | Medicare Advantage | ~33-34 million | Yes | | Medicaid managed care and FFS | ~71 million | Yes | | CHIP managed care and FFS | ~7 million | Yes | | QHP Marketplace plans | ~24 million | Yes | | ERISA self-funded employer plans | ~100 million | No | | Original Medicare Parts A and B | ~33 million | Not applicable in the same form | | Fully insured ACA-compliant employer plans | varies | Partially, under separate ACA framework | | Grandfathered, short-term, and other | small | No |

Action title for designer: "CMS-0057 covers most government and Marketplace coverage. It does not reach the largest single category of American commercial insurance. The card in your wallet does not tell you which side you sit on. Your HR department does."

Exhibit 3: Carrier Prior Authorization API status as of mid-2026

The timing reforms are in effect. The API stack is not. Carrier readiness for the January 1, 2027 mandate varies meaningfully across major carriers, based on the most recent public statements from each carrier's interoperability division and the CMS Interoperability Standards Advisory through Q2 2026.

| Carrier | Patient Access API | Provider Access API | Prior Authorization API | |---|---|---|---| | UnitedHealthcare | Live | Live | Partial, MA pilot | | Aetna (CVS Health) | Live | Live | Pilot in select networks | | Humana | Live | Live | In development | | Elevance (Anthem BCBS) | Live | Partial | In development | | Centene | Live | Partial | Vendor partnership | | Kaiser Permanente | Live | Internal | Integrated, limited external | | Molina | Partial | Partial | Clearinghouse-dependent | | Regional Blue plans | Mixed across 34 licensees | Mixed | Mixed |

Action title for designer: "Every covered carrier has the same January 1, 2027 deadline. Some are most of the way there. Most are not. The timing rule applies regardless of whether the API is live."

What to do if you have a prior-authorization denial right now

The clock starts when the carrier dated the denial letter. The carrier's deadline started when it received the request. Both dates matter. Most patients calendar the wrong one.

Most patients leave coverage on the table because the appeal is more procedural work than they can take on.

The Toledo warehouse supervisor got his approval number on day five. The patient three doors down on a self-funded ERISA plan, with the same procedure and the same carrier logo, is still waiting in week three. The clock applies to one and not the other.

How Apellica engages a case

Apellica prepares the evidence-based appeal letter for prior-authorization denials across every line of business covered by CMS-0057 and every line of business outside it. The patient reviews and approves every word before submission and authorizes carrier communications under a HIPAA-compliant Assignment of Benefits. We are not a law firm. We are not a medical provider. We are not an insurance carrier. We are an independent administrative service that turns a denied claim into a properly documented appeal letter.

Our model is $0 upfront and a flat fee on successful recovery. If the appeal does not reverse, the patient owes nothing for the preparation work. Coverage extends to all 50 states, every Medicare Advantage plan, every Medicaid managed-care organization, every QHP issuer, and every ERISA self-funded plan. A senior reviewer reads every case before it goes out.

About the author

Apellica is an independent appeal-preparation service for patients facing health-insurance denials. Mark Henderson is one of the senior reviewers on the desk. The firm operates from One World Trade Center in lower Manhattan and serves patients in all fifty states. Apellica is not a law firm and does not give legal advice. Reach the office at press@apellica.com, +1 (888) 777-6120, or apellica.com.

References

• CMS-0057-F. Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally Facilitated Exchanges, Merit-based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program. 89 Fed. Reg. 8758, February 8, 2024.
• 42 CFR 422.122. Medicare Advantage prior authorization standards.
• 42 CFR 422.572. Timeframes for expedited organization determinations.
• 42 CFR 422.582. Request for a standard reconsideration.
• 42 CFR 438.210. Medicaid managed care coverage and authorization of services.
• 42 CFR 457.1230. CHIP managed care coverage and authorization.
• 45 CFR 156.223. QHP issuer prior authorization requirements.
• 45 CFR 147.136. ACA Internal Claims and Appeals and External Review.
• 29 CFR 2560.503-1. ERISA Claims Procedure.
• 42 CFR Part 423, Subpart M. Medicare Part D Coverage Determinations and Appeals.
• 42 CFR 422.136. Medicare Advantage step therapy.
• HL7 Da Vinci Project. Coverage Requirements Discovery, Documentation Templates and Rules, Prior Authorization Support implementation guides.
• American Medical Association, House of Delegates resolutions on prior authorization reform, 2024 and 2025 annual meetings.
• AHIP, public comments on CMS-0057-P and October 2024 implementation petition to CMS.
• Blue Cross Blue Shield Association, public statements on CMS-0057 implementation.
• CMS Office of Burden Reduction and Health Informatics, Interoperability Standards Advisory and implementation guidance through Q2 2026. cms.gov/interoperability.
• KFF, "Medicare Advantage Insurers Made Nearly 50 Million Prior Authorization Determinations in 2023." kff.org.
• HHS Office of Inspector General, OEI-09-18-00260, "Some Medicare Advantage Organization Denials of Prior Authorization Requests Raise Concerns."