The QHP Carve-Out: Why Marketplace Plans Got Different CMS-0057 Rules

Read a summary of CMS-0057-F and you will meet the phrase "impacted payers (excluding QHP issuers on the FFEs)" exactly once — attached to the decision timeframes. Every other headline provision names QHP issuers without qualification. That asymmetry is not sloppy drafting; it is a deliberate carve-out with a specific regulatory rationale, and it creates a compliance matrix that marketplace plans — and especially multi-line payers running MA, Medicaid, and exchange products off shared UM infrastructure — need to get precisely right. Getting it wrong in either direction is expensive: assume the 72-hour clock applies and you may re-engineer turnaround operations you were not required to change; assume "we're carved out" too broadly and you miss API, denial-reason, and metrics obligations that absolutely do apply.

What the carve-out actually is

CMS-0057-F requires impacted payers — excluding QHP issuers on the FFEs — to send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests, beginning in 2026. That is the entire carve-out. QHP issuers on the FFEs remain impacted payers for everything else in the rule.

CMS's reasoning, stated in the final rule's comment-and-response discussion, is that the exchange market already has a decision-timeframe framework. Regulations at 45 CFR 147.136 impose internal claims and appeals standards — incorporating the ERISA claims-procedure timelines — on non-grandfathered group and individual market coverage. Under that framework, issuers must notify a claimant of a pre-service benefit determination within 15 days for standard requests and within 72 hours for urgent requests. CMS said plainly that it believes the current standard adequately protects patient interests, and that it did not propose — and was not finalizing — any change to QHP timeframes. Commenters pushed back, arguing marketplace enrollees deserved the same 7-day standard as everyone else; CMS held the line, noting that rewriting the individual-market claims framework was outside the scope of the rulemaking. One practical enforcement wrinkle follows: penalties for violating 45 CFR 147.136 deadlines generally sit with state regulators, not CMS.

So the operative QHP timeframes are 15 calendar days standard and 72 hours urgent — under a different regulation, enforced through a different channel, with different case law and market-conduct history behind it. The expedited clocks happen to align at 72 hours; the standard clocks do not.

What QHP compliance teams still owe

The carve-out removes one obligation. The rest of the rule lands with full force, on the QHP-specific compliance cadence of "plan years beginning on or after January 1" rather than fixed calendar dates.

• Specific denial reasons. For plan years beginning on or after January 1, 2026, QHP issuers must provide a specific reason for a denied prior authorization decision regardless of how the request was submitted — portal, fax, phone, mail, or X12 278. Drugs are excluded, as they are from the rule's PA provisions generally. Note how this layers rather than replaces: CMS's fact sheet is explicit that impacted payers already subject to existing denial-notice requirements — and QHP issuers are, through the 147.136 adverse-benefit-determination framework — keep those obligations unchanged. The new duty is about specificity and channel-independence of the reason itself, on top of whatever written notices you already send. Map the two requirements onto one letter and one workflow, or your intake channels will drift apart.
• Public prior authorization metrics. QHP issuers report at the issuer level and post the specified aggregate metrics on their websites, with the first report due March 31, 2026 — the same scorecard as every other impacted payer, covered in detail in the metrics article. Note the trap: your published "average time to decision" will be read side by side with MA and Medicaid plans operating under a 7-day mandate, with no footnote explaining that your regulatory clock allows 15.
• The four APIs. Patient Access enhancements, Provider Access, Payer-to-Payer, and the Prior Authorization API all apply, for plan years beginning on or after January 1, 2027. The Prior Authorization API must list PA-requiring items and services, identify documentation requirements, and communicate decisions with specific denial reasons.

Two QHP-only nuances in the rule text are worth flagging. First, scope: stand-alone dental plan issuers are excluded from the rule's references to QHP issuers, as are FF-SHOP issuers. And QHPs on State-based Exchanges — including SBE-FPs, whose enrollees use HealthCare.gov but whose exchanges are not FFEs — are outside the rule entirely, though CMS encouraged those states to adopt similar requirements. Second, the exceptions valve: the rule finalizes a process under which a QHP issuer on the FFEs can seek an exception from the API requirements, conditioned on CMS's annual approval of a narrative justification. That is a real mechanism, but a narrow one — it covers the APIs, not denial reasons or metrics, and it renews annually rather than being granted once.

The multi-line problem: one UM shop, two clocks

For a payer running exchange products alongside Medicare Advantage or Medicaid managed care, the carve-out poses an operational design question: do you run one turnaround standard or two?

The case for two clocks is cost: the QHP book legally has 15 days for standard decisions, and holding it to 7 spends review capacity the regulation does not demand. The case for one clock is nearly everything else. A single turnaround-time policy at the strictest applicable standard means one SLA configuration, one escalation ladder, one training story, and no intake-routing defect where a case lands in the wrong queue and blows a deadline that did apply. It also reads better in public: when your MA line publishes a 5-day average and your QHP line publishes 12, the comparison gets made by journalists and network negotiators, not by regulators who understand the framework difference. Most multi-line payers we see reason their way to a single internal standard with line-of-business reporting dimensions — treating the QHP 15-day allowance as headroom for surge management rather than as a design target.

Whichever you choose, make it an explicit, documented decision. The worst position is the accidental hybrid: a UM platform configured to 7 days because "that's the CMS rule," while denial letters and provider communications cite the 147.136 timeline, and nobody can say which standard governs a given case. Auditors from two different regimes — CMS program audits on one side, state market-conduct exams on the other — will each expect internal consistency with the framework that applies to them.

Why this carve-out is worth understanding, not just memorizing

The QHP timeframe exclusion is the clearest example of a pattern that runs through CMS-0057-F: the rule layers new obligations onto existing regulatory frameworks rather than replacing them, and the layering is different per program. Medicaid managed care already had timeframe rules at 42 CFR 438.210 that the rule tightens; MA had its own at 42 CFR part 422; QHPs had 147.136, which the rule leaves alone. Compliance teams that internalize the why — CMS regulates each program through its own statutory machinery, and the individual market's machinery already had a clock — will correctly predict how future rulemaking treats the QHP book, including the possibility that a later rule harmonizes the timeframes after all. Teams that memorize "QHPs: no 72-hour rule" as a freestanding fact will keep getting surprised.

Verify the QHP provisions against the CMS-0057-F rule text (89 FR 8758), the CMS fact sheet, and 45 CFR 147.136 — compliance dates for QHP issuers run on plan years, and the exceptions process has specific annual filing mechanics a summary can't carry.