On April 14, 2026, the Centers for Medicare and Medicaid Services (“CMS”) published a proposed rule[1] that would require faster prior authorization (“PA”) decisions, expand electronic PA to drugs, and increase transparency across federal health programs, with the goal of cutting long waiting periods and reducing barriers to timely access to critical treatments. The proposed rule was issued jointly by CMS and the Office of the National Coordinator for Health Information Technology and is designed to improve the electronic exchange of health care data while streamlining prior authorization processes. Public comments on the proposed rule are due by June 15, 2026.
This proposed rule is part of a broader regulatory push to fundamentally transform how drug prior authorization and health care interoperability are managed across federal health programs. It builds on two earlier CMS rulemakings: (1) the 2020 CMS Interoperability and Patient Access final rule[2], which focused on patient access to data, and (2) the 2024 CMS Interoperability and Prior Authorization final rule[3] (the “2024 PA Rule”), which required electronic prior authorization for non-drug items and services. Drugs were deliberately excluded from the 2024 PA Rule because drug prior authorization processes and electronic standards differ significantly from those used for other medical items and services. CMS stated that, following the 2024 PA Rule, it received feedback urging the agency to adopt consistent electronic prior authorization requirements for drugs, including recommendations to model those requirements on Medicare Part D’s existing approach using the NCPDP SCRIPT standard, a gap this proposed rule is intended to address.
Who Is Affected?
The proposed rule applies to Medicare Advantage (“MA”) organizations, state Medicaid fee-for-service (“FFS”) programs, state Children’s Health Insurance Program (“CHIP”) FFS programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (“QHPs”) on the Federally-facilitated Exchanges (“FFEs”, collectively referred to as “impacted payers”). While the proposed rule does not apply directly to pharmacy benefit managers (“PBMs”), CMS anticipates that PBMs may assist impacted payers in meeting the proposed rule’s requirements but makes clear that the impacted payer remains ultimately responsible for compliance.
What Are The Key Changes?
The proposed rule targets four key areas:
- Electronic Prior Authorization for All Drugs. The centerpiece of the proposal is a requirement that all impacted payers support electronic prior authorization for every drug that requires prior authorization, regardless of whether the drug is covered under the impacted payer’s medical benefit or the pharmacy benefit. The compliance date for this requirement is October 1, 2027. For drugs covered under a medical benefit, CMS proposes that the PA application programming interface (“API”) make available whether prior authorization is required, coverage and documentation requirements, and be able to transmit prior authorization requests and decisions between providers and the payer. For drugs covered under a pharmacy benefit, CMS proposes that impacted payers support an unexpired version of the NCPDP SCRIPT standard while still allowing use of non-electronic methods such as fax, phone, and web portal.
- Decisions Timeline and Reasons. For QHP issuers on the FFEs, CMS proposes shortened provider-notification timeframes for prior authorization decisions, including for drugs with standard requests no later than 72 hours and expedited requests no later than 24 hours. CMS also proposes to require state Medicaid and CHIP FFS programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the FFEs to respond to prescribers with a specific reason for denying any drug prior authorization request. The specific denial reason must be provided to the prescriber regardless of the method used to submit the request or receive the decision, and must explain why the request was denied and what actions are needed to resubmit or appeal. This requirement applies to prescriber-directed communications only and does not alter or supersede any existing requirements to separately notify patients of prior authorization denials.
- Public Reporting of Drug PA Metrics. CMS proposes requiring all impacted payers to publicly post on their websites a set of prior authorization metrics for all drugs with posting beginning in 2028 based on 2027 data with deadlines of March 31 following the calendar year for MA organizations, state Medicaid/CHIP FFS programs, and QHP issuers on the FFEs, and within 90 days after the end of each rating period for Medicaid managed care plans and CHIP managed care entities. For Medicaid/CHIP FFS and managed care, proposed metrics include a list of all drugs requiring prior authorization, total approvals and denials with percentages, approvals and denials after appeal with percentages, and average and median time between submission and decision. For QHP issuers on the FFEs, proposed metrics include a list of all drugs requiring prior authorization, approvals and denials for both standard and expedited requests with percentages, approvals and denials where review timeframes were extended, approvals and denials after appeal, and average and median decision times for both standard and expedited requests.
- Interoperability Infrastructure. Impacted payers must implement and maintain API technology in compliance with an unexpired version of the proposed additional Fast Healthcare Interoperability Resources (“FHIR”) implementation guides for each API beginning October 1, 2027. CMS also proposes requiring impacted payers to report their API endpoints and related information covering the Patient Access, Provider Directory, Provider Access, Payer-to-Payer, and PA APIs to CMS.CMS would then publish a centralized directory to help providers and payers discover endpoints for data access and prior authorization. New impacted payers (i.e., payers that are either newly formed or newly qualify as impacted payers after the final rule’s effective date) would be required to report their endpoints no later than 60 days after the effective date of the final rule. Following the initial report, impacted payers must update their endpoint information within one week of any change and verify its accuracy at least every 12 months. CMS further proposes requiring impacted payers to report the URLs for required API documentation, including direct URLs to FHIR capability statements, authorization and authentication implementation details, and API registration information, so CMS can publish them for centralized access.
What Is The Potential Impact Of This Proposed Rule?
CMS intends to move “into the digital age,” replacing fax machines and fragmented systems with real-time electronic workflows, standardizing the process, and allowing providers to focus more on patient care rather than administrative processes. CMS describes the current drug prior authorization landscape as a system that delays medically necessary medications and creates inefficiency throughout the healthcare system.
If finalized, the potential impact of the rule is likely to be significant:
- Patients: would benefit from faster decisions (24 hours for urgent and 72 hours for standard requests) designed to reduce waiting periods for critical medications.
- Providers: would gain more EHR-integrated workflows that reduce unnecessary or incomplete requests and administrative burden, letting them spend more time on patient care rather than paperwork.
- Payers: would face new operational requirements to implement electronic PA for all drugs, provide specific denial reasons, and meet strict decision timeframes.
- EHR vendors: would benefit from a centralized endpoint registry that reduces integration burden and improves API reliability by eliminating the current problem of hard-to-update endpoint information.
- The public: would gain access to publicly posted drug PA metrics beginning in 2028, allowing comparison of approval and denial rates, appeal outcomes, and decision times across plans and plan types.
FOOTNOTES
[1] 91 Fed. Reg. 19890 (April 14, 2026).
[2] 85 Fed. Reg. 25510 (May 1, 2020.
[3] 89 Fed. Reg. 8758 (Feb. 8, 2024).
