Prior authorization decision timeframes and denial reasons under CMS-0057-F

The 72-hour and 7-day rule

Starting in 2026, impacted payers must send prior authorization decisions within 72 hours for expedited (urgent) requests and within 7 calendar days for standard (non-urgent) requests (CMS fact sheet).

QHP issuers on the federal exchanges are excluded because the final rule did not change their existing prior authorization timelines (CMS FAQ). The proposed rule CMS-0062-P would apply the 72-hour and 7-day timeframes to them, but it was not final as of November 4, 2026 (CMS).

Specific reasons for denials

Impacted payers must give a specific reason when they deny a prior authorization request, whatever method was used to send the request: portal, fax, phone, or API (CMS fact sheet). Once payers’ Prior Authorization APIs are live in 2027, the API response must either approve the request and say when the authorization ends, deny it with a specific reason, or ask for more information (CMS FAQ).

A specific reason makes it faster to decide what to do next: correct a coding or documentation gap and resubmit, request a peer-to-peer review, or file an appeal.

What payers must publish

Impacted payers must post prior authorization metrics on their websites every year. The first report covered calendar year 2025 and was due March 31, 2026 (CMS fact sheet). Metrics are reported in aggregate, exclude drugs, and include (CMS FAQ):

• A list of all items and services that require prior authorization
• The percentage of standard requests approved, denied, and approved after appeal
• The percentage of requests approved after the review timeframe was extended
• The percentage of expedited requests approved and denied
• The average and median time between submission and decision, for standard and expedited requests

Medicare Advantage organizations report per contract, Medicaid and CHIP fee-for-service programs per state, managed care plans per plan, and QHP issuers per issuer (CMS FAQ).

What isn’t covered

• Drugs. The timeframes, denial-reason, and metrics requirements do not apply to drug prior authorizations (CMS fact sheet).
• Employer and commercial plans. Plans outside the federal exchanges are not covered (Federal Register).
• Traditional Medicare. The requirements do not directly apply to Medicare fee-for-service (Federal Register).

Many commercial plans signed a voluntary 2025 pledge to improve prior authorization, including real-time approvals for most electronic requests by 2027, but that pledge is not a regulatory deadline (CMS press release).

Questions to ask your payers

The rule sets the outer limits, but each payer decides how it runs its process. Provider relations teams can usually answer:

• Where on your website are your annual prior authorization metrics posted, and which contract or plan do they cover?
• What makes a request expedited, and how should we flag one when we submit it?
• How do you send the specific reason for a denial: in the portal, by fax, or by letter?
• If you request more information, does the clock restart, and how do we see that status?
• When will your Prior Authorization API be available to providers, and which implementation guide versions will it support?

Keeping the answers in one place makes it easier to route each request correctly and to raise delays with evidence.

Using the timeframes in your practice

1. Record the submission date and time for every prior authorization, and mark whether it was expedited.
2. Track when each decision arrives, so you can see which payers regularly approach or exceed the 72-hour and 7-day windows.
3. Capture the denial reason with each denial; it determines whether to resubmit, request a peer-to-peer, or appeal.
4. Compare your experience with each payer’s published metrics when you raise delays with their provider relations team.

Saga tracks each prior authorization to a decision and writes the outcome, reference number, and denial reason back to the EHR, so this record builds itself. Denials and drafted appeals go to staff for approval. See prior authorization automation.