CMS-0057-F explained: the CMS Interoperability and Prior Authorization Final Rule

What is CMS-0057-F?

CMS-0057-F is the Centers for Medicare & Medicaid Services' Interoperability and Prior Authorization Final Rule. CMS released it on January 17, 2024, and it was published in the Federal Register on February 8, 2024, at 89 FR 8758. The regulations took effect on April 8, 2024, with most requirements phased in during 2026 and 2027 (CMS rule page; Federal Register).

The rule has two halves. The first changes how impacted payers run prior authorization today: how fast they must decide, what they must say when they deny, and what they must publish about their prior authorization programs. The second requires those payers to build standards-based APIs so that prior authorization requirements, requests, and decisions can move electronically between payers, providers, and patients (CMS fact sheet).

CMS estimated the rule would save about $15 billion over ten years (CMS press release).

Which payers does it apply to?

The rule calls the payers it covers "impacted payers." They are:

• Medicare Advantage (MA) organizations
• State Medicaid and CHIP fee-for-service programs
• Medicaid managed care plans and CHIP managed care entities
• Qualified Health Plan (QHP) issuers on the federally facilitated exchanges (FFEs)

It does not apply to health insurance issuers or group health plans outside the federal exchanges, which covers most employer and commercial coverage. Its requirements also do not directly apply to traditional Medicare fee-for-service (Federal Register). In October 2026, several large employers signed a voluntary statement asking for electronic prior authorization capabilities to be extended to self-funded plans, but that is not a requirement (CMS press release).

What changed in 2026

Starting in 2026, impacted payers must follow three business-process requirements:

• Decision timeframes. Decisions within 72 hours for expedited requests and 7 calendar days for standard requests. QHP issuers on the FFEs are excluded from these timeframes (CMS FAQ). See decision timeframes and denial reasons.
• Specific denial reasons. Payers must give a specific reason for every denied prior authorization, however the request was submitted (CMS fact sheet).
• Public metrics. Payers must post prior authorization metrics on their websites every year. The first report, covering calendar year 2025, was due March 31, 2026 (CMS fact sheet).

What’s coming in 2027

Impacted payers must have four APIs in place by January 1, 2027 for MA organizations and Medicaid and CHIP fee-for-service programs, by the rating period beginning on or after January 1, 2027 for Medicaid managed care plans, and for plan years beginning on or after January 1, 2027 for QHP issuers on the FFEs (Federal Register).

The APIs must use HL7 FHIR R4 and related required standards. CMS recommends, but does not require, the HL7 Da Vinci Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS) implementation guides (CMS fact sheet). See the Prior Authorization API guide.

What it means for practices and health systems

For providers, the rule mostly changes what payers owe you rather than what you must do. In practice:

• For covered plans, you can expect decisions within the 72-hour or 7-day windows and a specific reason with every denial, which makes appeals and resubmissions faster to prepare.
• Payers’ public metrics show approval rates and average decision times, which help you see which plans and services cause the most delays.
• Until payers’ Prior Authorization APIs are live and your EHR or vendor can use them, most requests will still go through payer portals, fax, or phone.
• Commercial and employer plans, traditional Medicare, and drug prior authorizations follow their own rules, so the same practice will keep handling several different processes.

There is also a provider-side measure. CMS created an "Electronic Prior Authorization" attestation measure for the MIPS Promoting Interoperability category and the Medicare Promoting Interoperability Program for hospitals. For hospitals and critical access hospitals, CMS has since finalized it as an optional bonus measure for 2027 and a required measure starting in 2028 (CMS). For MIPS clinicians, the CY 2027 Physician Fee Schedule final rule made the same change: optional for 10 bonus points in 2027 and required from 2028, when a new Electronic Prior Authorization for Prescription Drugs measure is also required (Federal Register). See compliance deadlines.

Related changes: the 2025 payer pledge and WISeR

In June 2025, HHS and CMS announced a voluntary pledge from health plans covering nearly 8 in 10 Americans. Plans committed to standardize electronic prior authorization on FHIR APIs, reduce the services that need prior authorization, honor existing authorizations for a period when patients change plans, and provide real-time approvals for most electronic requests by 2027. The pledge reaches commercial plans that CMS-0057-F does not, but it is voluntary (CMS press release).

Separately, the CMS WISeR Model added prior authorization for selected services in traditional Medicare, such as skin and tissue substitutes, electrical nerve stimulator implants, and knee arthroscopy for knee osteoarthritis. It runs from January 1, 2026 through December 31, 2031 in New Jersey, Ohio, Oklahoma, Texas, Arizona, and Washington, and does not affect Medicare Advantage (WISeR FAQ; CMS press release).

What’s next: CMS-0062-P

In April 2026, CMS proposed a follow-on rule, CMS-0062-P, published at 91 FR 19890. It would bring drugs under the prior authorization API and decision-timeframe requirements, apply the 72-hour and 7-day timeframes to QHP issuers on the FFEs, require version 2.2 of the CRD, DTR, and PAS implementation guides, and add new metrics. Most proposed compliance dates are October 1, 2027. Comments closed June 15, 2026, and the rule was not final as of November 4, 2026 (CMS; Federal Register).

How Saga fits

Saga’s AI agents handle prior authorization for practices today, whether or not a payer has an API yet. They assemble the documentation each payer requires from the chart, submit requests through payer portals, track each request to a decision, and record approvals, denials, and reference numbers in the EHR, with denials and appeals routed to staff for approval. That gives your team a record of when each decision arrived and why. See prior authorization automation.