Prior Auth for Part B Drugs vs the Drug Exclusion: Scoping CMS-0057 Correctly

Every CMS-0057-F program plan contains a line like "drugs are excluded," and nearly every implementation team eventually discovers that nobody wrote down what the line means operationally. Does it exclude the oncology infusion, or just the drug on the infusion claim? Is a buy-and-bill Part B biologic "medical" enough to fall inside the rule? Does the 72-hour expedited clock apply to a request that bundles a procedure with the drug it delivers?

The scoping question is answerable — the final rule is more precise than the summaries — but the answer forces process decisions that belong in a documented scoping policy, not in the heads of your intake staff. Here is what the rule actually says, where drug PA obligations still live, and how to run the two regimes side by side without misclassifying requests.

What the exclusion actually says

The CMS-0057-F preamble (89 FR 8762) is blunt: the rule's prior authorization policies "do not apply to drugs of any type," which CMS spells out as any drugs an impacted payer could cover — "prescription drugs that may be self-administered, administered by a provider, or that may be dispensed or administered in a pharmacy or hospital." The rule text repeats the point with program specificity: the exclusion covers Medicaid covered outpatient drugs and Medicare Part B or Part D drugs covered by an MA plan alike.

So the frequently asked boundary question — are medical-benefit / Part B drugs in or out? — has a clear answer under the rule as finalized: out. The exclusion is defined by what the product is (a drug), not by which benefit adjudicates it. A provider-administered biologic billed on a medical claim is still a drug, and still excluded.

CMS's stated rationale is worth internalizing because it predicts the future: the standards and processes for drug prior authorization differ from those for medical items and services — pharmacy PA runs on NCPDP standards and PBM infrastructure, and existing program rules already impose drug-specific timelines. CMS did not decide drugs need no reform; it decided drugs need separate rulemaking. That arrived in April 2026 (more below).

Two clarifications that trip teams up:

• Claims data still flows. The exclusion is from the prior authorization provisions. Prescription and other drug claims remain in the data payers must serve through the Patient Access API; it is the drug prior authorization information that the four APIs are not required to carry.
• Voluntary inclusion is allowed. CMS notes (89 FR 8859) that payers may voluntarily incorporate their drug PA business rules into the Prior Authorization API. Nothing stops you from one front door; the rule just doesn't require it.

What the exclusion removes — and what it doesn't

For a request that is in scope of the exclusion (a drug), none of the rule's PA provisions attach: not the 72-hour expedited / 7-calendar-day standard timeframes, not the specific-denial-reason requirement, not inclusion in the public prior auth metrics, not the Prior Authorization API capabilities. Your denial letter for a Part B drug is governed by the program rules it always was — which for Medicare Advantage are tighter on time, not looser.

That is the part that surprises people: excluded does not mean relaxed. Under long-standing MA rules, an expedited organization determination for a Part B drug is due within 24 hours (42 CFR 422.572) and a standard one within 72 hours (42 CFR 422.568) — both faster than the CMS-0057-F clocks for medical services. Part D coverage determinations run on their own clocks (42 CFR 423.568 and 423.572). Medicaid programs carry drug-specific response requirements for covered outpatient drugs, and state UM statutes increasingly impose their own turnaround and transparency rules on commercial and managed-care drug PA. The exclusion removed drugs from this rule, not from regulation.

The genuinely gray edge: drug-adjacent services

Where the boundary does get ambiguous is not the drug itself but the services around it. The infusion administration code, the facility fee, the site-of-care determination, the port placement — those are items and services, and nothing in the rule excludes them. A single clinical event (patient needs an infused biologic) can therefore generate one excluded authorization (the drug) and one in-scope authorization (the administration and setting) with different timeframes, different denial-reason obligations, and different metrics treatment.

CMS's published guidance does not map every HCPCS code to a side of the line, and reasonable payers have drawn the line differently for bundled requests. This is the place to make a documented scoping decision: define how your organization classifies mixed drug-plus-service requests, which code ranges you treat as "drug" for exclusion purposes, and who owns exceptions. A written rubric you can hand to a regulator beats a consistent-ish practice you'd have to reverse-engineer from queue data.

CMS-0062-P: the exclusion's expiration notice

In April 2026 CMS published the Interoperability Standards and Prior Authorization for Drugs proposed rule (CMS-0062-P, published in the Federal Register April 14, 2026; comments closed June 15, 2026). If finalized as proposed, the two-regime era gets a defined merge plan, with a benefit-based split that did not exist in CMS-0057-F:

• Medical-benefit drugs would be incorporated into the existing FHIR Prior Authorization API — coverage and documentation requirements included — by October 1, 2027.
• Pharmacy-benefit drugs would run electronic PA on NCPDP SCRIPT transactions (PAInitiationRequest through PANotification), with formulary-and-benefit and real-time prescription benefit standards alongside.
• Decision timelines for drugs: no later than 24 hours for urgent and 72 hours for standard requests, per the CMS press release.
• Drug PA data would be added to the Patient Access, Provider Access, and Payer-to-Payer APIs, and drug-specific public metrics would be reported separately from the non-drug metrics you publish today.

Note the categorization rubric CMS proposed: a drug is "medical benefit" or "pharmacy benefit" based on the system through which its claims are processed — and CMS itself requested comment on drugs that may not fit either category cleanly. Until a final rule lands, treat 0062's dates and definitions as proposals, not obligations. But the direction is clear enough that a scoping policy written today should be written to survive the merge: classify by benefit path now, and the 2027-era split falls out of data you already keep.

Running two scoping regimes without hurting yourself

Practical implications for the systems and the program:

• Classify at intake, not at reporting time. Every PA request needs a scope flag — in-scope service, excluded drug, mixed — assigned when the request is created, because the flag drives the clock, the denial template, and metrics inclusion. Deriving scope retroactively for the March metrics report is how excluded drug denials leak into your published denial rate, or worse, in-scope services leak out.
• Two clocks, one queue discipline. A Part B drug request at 24 hours expedited is tighter than the medical 72-hour clock. If your UM system supports one SLA scheme per request type, the drug exclusion is the forcing function to make deadlines data, not configuration.
• Mixed requests need a splitting rule. Decide whether a bundled drug-plus-administration request is split into two authorizations (clean scoping, more provider friction) or handled as one with the strictest clock (simpler for providers, messier metrics). Document whichever you choose.
• Don't build the exclusion into the schema. Payers that hard-coded "drugs don't exist" into their PA data model in 2025 will pay for it when a 0062-shaped final rule brings drugs into the same APIs and metrics machinery. Model scope as an attribute of a request, not as a wall between systems.

The drug exclusion is real, it is broader than "retail pharmacy," and it is temporary. Scope precisely, write the rubric down, and build as if the two regimes will become one — because CMS has now proposed exactly that.

Verify against the CMS-0057-F rule text (89 FR 8758, esp. 8762 and 8859), 42 CFR 422.568/422.572 and 423.568/423.572, and the CMS-0062-P proposed rule and comment guide on cms.gov; the drug rulemaking is still in flight.