The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) is a federal regulation from the Centers for Medicare and Medicaid Services (CMS) that forces major health plans to make prior authorization decisions faster and to share health data through standard electronic connections. CMS released it on January 17, 2024. It arrives in two phases: operational changes starting in 2026, and new data-exchange connections, called application programming interfaces or APIs, starting in 2027. It applies to Medicare Advantage, Medicaid and CHIP, and Qualified Health Plans sold on the federal exchange at HealthCare.gov.
Most prior authorization still moves by fax, phone, and web portal, and this rule bans none of them. What changes is the speed and the transparency payers owe providers, plus the electronic connections they now have to build. At FaxSIPit, we have built HIPAA-compliant cloud fax infrastructure for regulated healthcare organizations since 2008, so we wrote this guide to explain what CMS-0057-F requires, who it affects, and what it means if your prior authorization workflow still runs on fax.
Key Takeaways
CMS-0057-F applies to Medicare Advantage, Medicaid, CHIP, and Qualified Health Plans on the federal exchange. It does not touch original Medicare, prescription drugs, employer-sponsored health plans, or plans sold on state-run exchanges.
There are two deadlines, not one. Faster-decision and transparency rules start January 1, 2026. The electronic data-exchange APIs are due January 1, 2027.
Decisions get faster. Payers must answer urgent requests within 72 hours and standard requests within 7 calendar days, and give a specific reason for every denial.
Most prior authorization still runs on fax and phone. 35% of medical prior authorizations were fully electronic in the 2024 CAQH Index, and the rule does not require anyone to stop faxing.
CMS estimates about $15 billion in savings across the health system over ten years.
What Is the CMS Prior Authorization Final Rule (CMS-0057-F)?
The CMS Interoperability and Prior Authorization Final Rule, known as CMS-0057-F, is a regulation that requires health plans to shorten prior authorization decision times, explain their denials, report their prior authorization data publicly, and build standardized electronic connections for exchanging health information. CMS announced it on January 17, 2024, and it was published in the Federal Register on February 8, 2024.
Prior authorization is the approval a health plan requires before it will pay for a treatment, test, or medication. The process is slow and heavily manual, and CMS built this rule to reduce that burden. According to the CMS announcement, the changes are expected to result in "approximately $15 billion of estimated savings over ten years."
The process CMS-0057-F is built to speed up.
One point of confusion is worth clearing up now. CMS-0057-F is the 2024 final rule and is the subject of this guide. It is not the same as the proposed rule on interoperability standards and prior authorization for drugs, a separate measure that remains proposed as of July 2026. When people search for the "CMS prior authorization rule," CMS-0057-F is almost always the one they mean.
Who Does CMS-0057-F Apply To?
CMS-0057-F applies to a defined group CMS calls "impacted payers." Per the CMS announcement, that group is Medicare Advantage (MA) organizations, Medicaid and Children's Health Insurance Program (CHIP) fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs) on the Federally-Facilitated Exchanges (FFEs).
Just as important is who the rule leaves out. Original fee-for-service Medicare is not covered. Prescription drugs and provider-administered drugs are not covered, and CMS has said it will address them in future rulemaking. Employer-sponsored (self-funded) health plans are not covered either, which leaves a large share of the insured market outside the rule. If your coverage comes through an employer plan, CMS-0057-F does not govern its prior authorization process.
The exchange piece is narrower than it sounds. Only issuers on the Federally-Facilitated Exchanges are covered. Plans sold through a state-run exchange are outside the rule.
Who CMS-0057-F reaches, and who it does not. Source: CMS.
One detail matters for the faster-decision rules specifically. QHP issuers on the FFEs are included in the rule overall, but CMS excluded them from the new 72-hour and 7-day decision timeframes. The other impacted payers must meet those timeframes.
The CMS-0057-F Compliance Timeline: 2026 vs 2027
CMS-0057-F rolls out in two phases, and the two are easy to conflate. The operational changes come first in 2026. The technical connections come a year later in 2027. The CMS fact sheet lays out the full schedule.
CMS-0057-F arrives in two phases a year apart. Source: CMS fact sheet.
Date | What is required | Who |
|---|---|---|
January 1, 2026 | Faster decision timeframes (72 hours expedited, 7 calendar days standard) and a specific reason for every denial | Medicare Advantage organizations and state Medicaid and CHIP fee-for-service programs |
Rating period beginning on or after January 1, 2026 | Same operational requirements | Medicaid and CHIP managed care plans |
Plan year beginning on or after January 1, 2026 | Denial reasons and public reporting. The 72-hour and 7-day timeframes do not apply | Qualified Health Plan issuers on the federal exchange |
March 31, 2026 | First set of prior authorization metrics posted publicly, covering calendar year 2025 | All impacted payers |
January 1, 2027 | The four FHIR APIs go live: Prior Authorization, expanded Patient Access, Provider Access, and Payer-to-Payer | Medicare Advantage organizations and state Medicaid and CHIP fee-for-service programs |
Rating period or plan year beginning on or after January 1, 2027 | Same four APIs | Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federal exchange |
CMS says it plainly: the exact compliance dates vary by the type of payer. If you run a Medicaid managed care plan on a rating period that does not start in January, your clock is your rating period, not the calendar.
The 2027 date is later than CMS first planned. Announcing the rule, CMS said it was "delaying the dates for compliance with the API policies from generally January 1, 2026, to January 1, 2027" in response to public comment. That gave payers and their technology vendors an extra year to build the connections, which is why the process rules and the technology rules now sit a year apart.
What CMS-0057-F Requires: Faster Decisions and Transparent Denials
The 2026 phase of CMS-0057-F is about how fast payers answer and how clearly they explain themselves. These are process rules, not technology projects, and they apply no matter how a request arrives.
Faster turnaround times. Impacted payers must send prior authorization decisions within 72 hours for expedited (urgent) requests and 7 calendar days for standard (non-urgent) requests. Per CMS, for some payers "this new timeframe for standard requests cuts current decision timeframes in half."
A specific reason for every denial. The rule requires payers to "include a specific reason for denying a prior authorization request." That reason helps a provider fix a missing detail and resubmit, or file an appeal, without guessing why the request failed.
Public reporting of prior authorization data. Impacted payers must publicly report prior authorization metrics, such as approval and denial rates, and post their first set of numbers by March 31, 2026. CMS modeled this on the metrics that Medicare fee-for-service already publishes.
These rules apply to prior authorization for medical items and services. They do not apply to prior authorization for drugs.
The Four FHIR APIs CMS-0057-F Requires (Effective 2027)
The 2027 phase of CMS-0057-F requires impacted payers to build four standardized electronic connections. All four use FHIR, which stands for Fast Healthcare Interoperability Resources, the HL7 data-exchange standard that lets different health systems trade information in a common format.
Prior Authorization API. Lets a provider's system check whether a service needs prior authorization, see what documentation the payer wants, and submit the request and receive the decision electronically.
Patient Access API (expanded). Payers already share claims and clinical data with patients through this connection. The rule expands it to include prior authorization information.
Provider Access API. A new connection that lets payers share a patient's data, including prior authorization details, with in-network providers. Patients can opt out.
Payer-to-Payer API. A new connection that moves a patient's data between plans when the patient switches insurers or holds two plans at once, with the patient's permission.
The Provider Access and Payer-to-Payer APIs also have to carry the data classes in USCDI, the United States Core Data for Interoperability, which is the federal baseline list of clinical data elements every certified health IT system has to support. A payer building an all-FHIR prior authorization API, rather than the older X12 278 transaction standard, will not be enforced against under HIPAA Administrative Simplification rules for that choice. For the fax-specific side of HIPAA compliance, see our guide to HIPAA fax requirements.
Why CMS-0057-F Matters
Prior authorization delays care, and the data behind that statement is stark. In its 2025 prior authorization physician survey, published in May 2026, the American Medical Association found that 95% of physicians said prior authorization delays access to necessary care.
Share of physicians reporting each impact of prior authorization. Source: American Medical Association 2025 prior authorization physician survey.
The same survey found that 26% of physicians, more than one in four, said prior authorization has led to a serious adverse event for a patient in their care, including hospitalization, permanent impairment, or death. And 79% said patients abandon treatment because of it. Prior authorization now consumes an average of 13 hours of physician and staff time a week, and 40% of physicians employ staff who do nothing else.
CMS-0057-F is the federal response to that burden. Faster decisions, clear denial reasons, and public reporting are meant to cut the delays that the AMA data describes, and to make each payer's performance visible.
What CMS-0057-F Means for Fax-Based Prior Authorization Workflows
Most prior authorization still runs on fax, and CMS-0057-F does not change that overnight. Per the 2024 CAQH Index, the most recent edition published in full, 35% of medical prior authorizations were conducted fully electronically, up from 31% the year before. The rest move through web portals, phone calls, mail, and fax.
Two-thirds of medical prior authorizations are still not fully electronic. Source: 2024 CAQH Index.
The rule sets decision timeframes and mandates electronic APIs, but it does not require providers to stop faxing prior authorization documents. CMS is explicit about this. In the fact sheet for the rule, CMS writes that payers must give a specific denial reason "regardless of the method used to send the prior authorization request," and that "such decisions may be communicated via portal, fax, email, mail, or phone." Fax is not a loophole CMS forgot to close. It is a channel CMS names in the rule's own summary.
A payer can still receive a request by fax and must still meet the 72-hour or 7-calendar-day clock. So through the 2026 and 2027 transition, the fax channel carrying prior authorization paperwork is not going away, and the reason is structural, not just slow adoption. Three things sit outside this rule. Payers it does not reach, including employer-sponsored plans, original Medicare, and state-exchange plans, keep running prior authorization on the channels they already use. Provider-to-provider exchange, which is referrals, records releases, and discharge summaries, is untouched by CMS-0057-F and is a larger share of healthcare fax volume than prior authorization ever was. And even inside the rule, a payer can accept a request by fax and still has to meet the clock. What changes is not whether fax carries the document. What changes is that the document it carries is now on a federal timeline.
That raises the real question for a regulated organization: is the fax channel handling your prior authorization documents compliant, reliable, and auditable? The clock only starts when the payer receives the request, so a provider's fax that never lands is not a late decision, it is a decision that never begins. On the payer side, the reverse is true. The denial notice has to go out inside the timeframe no matter which channel carries it, and CMS names fax as one of those channels.
This is the gap we work in. At FaxSIPit, we run a HIPAA-compliant cloud fax platform, cloud fax that works with your existing fax machines and modern tools like Teams and Outlook. Every fax is encrypted in transit over TLS, delivery is recorded in full audit trails, and documents can be retained for up to seven years, which is what an auditor asks for when a payer or a regulator questions whether a request was ever sent. We run a dedicated fax network with intelligent multi-carrier retry, meaning if one carrier path fails, another takes over automatically. That reliability shows in the numbers: a 95%+ delivery rate versus 70 to 80% on raw T.38 fax, based on transmission data across FaxSIPit's network. For a deeper look at why that gap exists, see fax reliability in regulated industries.
To be clear about the boundary: we do not build FHIR APIs or run prior authorization. What we do is keep the fax channel that carries these documents encrypted, reliable, and provable, during the transition and after it.
How to Prepare for CMS-0057-F
Preparation depends on whether you are a payer or a provider, but the first move for both is the same: map where your prior authorization volume actually goes today. Fax, phone, portal, and API each carry a share, and you cannot fix what you have not measured.
Confirm 2026 readiness first. The faster-decision and denial-reason rules are process changes, not IT builds. Impacted payers should check that their intake and review workflows can hit 72 hours and 7 calendar days by January 1, 2026.
Plan API readiness for 2027. The four FHIR APIs are a technology project that involves EHR and vendor coordination. The build touches EHR and vendor coordination, so scoping in 2026 leaves room for the integration work that follows.
Do not neglect the interim channels. Since roughly two-thirds of prior authorizations are not fully electronic as of the last full CAQH Index, confirm that your fax and document channels are HIPAA-compliant and produce audit trails, because they are inside the decision clock too.
Providers who report under the Merit-based Incentive Payment System (MIPS) also face a new attestation measure tied to electronic prior authorization, which is worth confirming with your compliance team.
Frequently Asked Questions
What is the new CMS rule on prior authorization?
The new CMS rule on prior authorization is the CMS Interoperability and Prior Authorization Final Rule, or CMS-0057-F, finalized on January 17, 2024. It requires Medicare Advantage plans, Medicaid and CHIP programs, and Qualified Health Plan issuers on the federal exchange to make faster prior authorization decisions, give specific denial reasons, report prior authorization data publicly, and build standardized electronic APIs.
What is the CMS final rule for 2026 versus 2027?
They are two phases of the same rule. The 2026 phase brings the specific-denial-reason requirement for every impacted payer, the faster decision timeframes (72 hours expedited, 7 calendar days standard) for every impacted payer except Qualified Health Plan issuers on the federal exchange, and the first public metrics by March 31, 2026. The 2027 phase requires the four FHIR APIs for electronic data exchange.
Is the CMS 2026 prior authorization proposed rule the same as this rule?
No. CMS-0057-F is the 2024 final rule covered in this guide. The 2026 proposed rule on interoperability standards and prior authorization for drugs is a separate measure that, as of July 2026, is still proposed and focuses on prescription and provider-administered drugs, which CMS-0057-F left out.
What happens if a payer does not comply with CMS-0057-F?
Impacted payers that miss the requirements face CMS oversight and enforcement through their program agreements, and their public metrics make performance visible to providers and regulators. CMS administers each affected program (Medicare Advantage, Medicaid, CHIP, and the exchanges) and can act through those channels.
Does CMS-0057-F ban fax for prior authorization?
No. CMS-0057-F sets decision timeframes and requires electronic APIs, but it does not prohibit submitting or receiving prior authorization by fax. A payer can still get a request by fax and must still meet the 72-hour or 7-day decision clock, which is why a compliant, reliable fax channel still matters through the transition.
The Bottom Line
CMS-0057-F is a real shift in how prior authorization works for Medicare Advantage, Medicaid, CHIP, and Qualified Health Plans on the federal exchange. Decisions get faster, denials must be explained, performance becomes public in 2026, and standardized FHIR APIs arrive in 2027. It leaves out original Medicare, drugs, and employer plans, so its reach is wide but not total.
What it does not do is retire fax. With only about a third of prior authorizations fully electronic today, fax and manual workflows will carry a legally timed workload well past 2027. That is where the fax channel has to be dependable. We built FaxSIPit as HIPAA-compliant cloud fax for regulated healthcare organizations, on a dedicated fax network with intelligent multi-carrier retry, so prior authorization documents arrive and stay provable while the rest of the system modernizes.
If your organization needs a compliant, auditable fax channel that can carry prior authorization documents through this transition, see our enterprise and institutional fax solutions.
Sources
CMS: Interoperability and Prior Authorization Final Rule Press Release
CMS: Interoperability and Prior Authorization Final Rule (CMS-0057-F) Fact Sheet
CMS: Interoperability and Prior Authorization Final Rule Overview
Federal Register: Advancing Interoperability and Improving Prior Authorization Processes
American Medical Association: 2025 Prior Authorization Physician Survey
CMS: Interoperability Standards and Prior Authorization for Drugs Proposed Rule
