CMS-0057-F compliance deadlines: the 2024–2028 timeline

CMS-0057-F timeline at a glance

Sources: Federal Register, CMS fact sheet, CMS electronic prior authorization overview, and CMS comparison document.

2026: process requirements

The first requirements to take effect changed how impacted payers handle prior authorization, without requiring new technology. Payers must decide expedited requests within 72 hours and standard requests within 7 calendar days, and must give a specific reason for every denial (CMS fact sheet). QHP issuers on the federally facilitated exchanges are excluded from the decision timeframes, because the final rule did not change their existing timelines (CMS FAQ).

Payers must also post prior authorization metrics on their websites once a year. The first set covered calendar year 2025 and was due March 31, 2026 (CMS fact sheet). See decision timeframes and denial reasons for what the metrics include.

2027: API requirements

The API requirements apply by January 1, 2027 for MA organizations and state Medicaid and CHIP fee-for-service programs; by the rating period beginning on or after January 1, 2027 for Medicaid managed care plans; and for plan years beginning on or after January 1, 2027 for QHP issuers on the FFEs (Federal Register). Because rating periods and plan years vary, some managed care and Marketplace plans may go live later in 2027 than MA plans.

Each impacted payer must stand up four APIs: Prior Authorization, Provider Access, Payer-to-Payer, and an expanded Patient Access API. The Prior Authorization API guide explains what each does and which standards apply.

2027–2028: the provider-side measure

CMS-0057-F added an "Electronic Prior Authorization" measure for clinicians in the MIPS Promoting Interoperability category and for hospitals and critical access hospitals in the Medicare Promoting Interoperability Program. It is an attestation measure: you attest yes or no to requesting prior authorization electronically through a payer’s Prior Authorization API, or claim an exclusion (CMS fact sheet).

The original rule made the measure required starting with the CY 2027 reporting period. CMS has since changed that. For hospitals and critical access hospitals, the FY 2027 inpatient final rule made it an optional bonus measure for CY 2027 and required starting CY 2028 (CMS). For MIPS clinicians, the CY 2027 Physician Fee Schedule final rule did the same: the measure is optional and worth 10 bonus points for CY 2027, and required starting CY 2028. From CY 2028, MIPS clinicians must also report a new Electronic Prior Authorization for Prescription Drugs measure (Federal Register).

Proposed: CMS-0062-P dates

The April 2026 proposed rule CMS-0062-P would add new requirements, including drug prior authorization timeframes and mandatory version 2.2 implementation guides, with most compliance dates on October 1, 2027. These dates are proposals only. CMS had not finalized the rule as of November 4, 2026, and final dates can differ (CMS).

How to prepare

1. List which of your patients’ plans are impacted payers (MA, Medicaid, CHIP, federal Marketplace) and which are not (commercial, employer, traditional Medicare).
2. Check each major payer’s posted prior authorization metrics to see where approvals are slowest or denials highest.
3. Ask your EHR vendor and prior authorization vendors when they will support payers’ Prior Authorization APIs.
4. For hospitals and MIPS clinicians, track the Electronic Prior Authorization measure: optional in 2027, required from 2028.

Saga handles prior authorization through payer portals today, so practices don’t have to wait for 2027 APIs to clear their backlog. See prior authorization automation.