Does CMS-0057-F apply to my practice?

The rule directly regulates certain payers, not practices. It affects you through faster payer decisions, required denial reasons and, by January 1, 2027, payer APIs your EHR may connect to.

Does it cover every insurance plan?

No. It applies to specified payers such as Medicare Advantage, Medicaid and CHIP managed care and certain exchange plans, and it excludes drugs. Most employer commercial plans are outside the rule.

What are the decision timeframes?

For impacted payers, 72 hours for expedited requests and 7 calendar days for standard requests. Qualified health plan issuers on the federal exchanges are excluded from this timeframe requirement.

CMS-0057-F Prior Authorization Rule Explained

CMS-0057-F requires impacted payers to decide prior authorization requests within 72 hours (expedited) or 7 calendar days (standard), give a specific reason for denials, and publicly report metrics, with those operational provisions beginning January 1, 2026. Most API requirements, including a Prior Authorization API, are due January 1, 2027.

By Bill For You RCM · Published October 23, 2026. Educational information, not legal, coding or tax advice. Rules change; confirm with CMS and each payer.

Who is covered

The rule applies to specified payers: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and qualified health plan issuers on the federal exchanges. It covers medical items and services, not drugs. Many employer-sponsored commercial plans are outside the rule.

Key dates

January 1, 2026: shorter decision timeframes, specific denial reasons, and annual public reporting of prior authorization metrics (first reports due March 31, 2026) apply to impacted payers.
January 1, 2027: payer APIs are due, including the Prior Authorization API, Provider Access API and payer-to-payer exchange.
CY 2027 MIPS: an Electronic Prior Authorization measure under the Promoting Interoperability category asks eligible clinicians to attest to a prior authorization request through a payer API, or claim an exclusion.

What practices should do

Track every request with submit date, urgency and the payer’s response date, so late decisions can be escalated.
Capture denial reasons in a structured way; payers must now give a specific reason, which makes appeals stronger.
Ask your EHR vendor about readiness to submit authorizations through payer APIs in 2027.
Know which of your payers are covered and which are not, since timelines differ.
Keep appeal deadlines visible and use the payer’s stated reason in the appeal.

We verify benefits and manage authorizations as part of our revenue cycle services.

Sources and where to verify

CMS fact sheet: CMS Interoperability and Prior Authorization final rule (CMS-0057-F)
Confirm each payer’s current requirements and portals directly.

CMS-0057-F Prior Authorization Rule: What Practices Should Know