CMS Issues Final Rule on Prior Authorization    

Situation Report | January 18, 2021

On January 15, the U.S. Centers for Medicare and Medicaid Services (CMS) issued a final rule that requires Medicaid and Children’s Health Insurance Program (CHIP) managed care plans or fee-for-service programs (FFS) as well as issuers of individual market Qualified Health Plans (QHPs) to implement application programming interfaces (APIs) to give providers better access to data about their patients and streamline the process of prior authorization.   

APIs are the foundation of smartphone applications. When integrated with a provider’s electronic health record (EHR), they can enable easy data access.  

Already established Patient Access APIs for the above plans and programs must now include claims and encounter data, including laboratory results, and information about the patient’s pending and active prior authorization decisions. These payers are also required to share this data directly with patients’ providers if they ask for it and with other payers as the patient moves from one payer to another.   

While Medicare Advantage plans are not included, and therefore not subject to this final rule, CMS is considering whether to do so in future rulemaking.  

The rule also requires Medicaid and CHIP FFS and managed care plans to meet reduced decision timelines for prior authorizations. These payers will now have a maximum of 72 hours to make prior authorization decisions on urgent requests and seven calendar days for non-urgent requests, and all payers subject to the rule are required to provide a specific reason for any denial, which will allow providers some transparency into the process beginning January 1, 2024 or the rating period that starts on or after January 1, 2024.