CMS-0057-F for Medicaid Managed Care Plans
Draft — pending verification
This reference entry has not yet been verified against its authoritative source (CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), 89 FR 8758 — verify against rule text and current CMS FAQs). Do not rely on it for production configuration until this notice is removed.
Who is covered
Medicaid managed care plans — MCOs, PIHPs, and PAHPs contracted with states. Obligations flow through both federal regulation and state contract amendments, so plans typically see requirements twice: once from CMS and once, with state-specific detail, from each state Medicaid agency.
Deadlines and requirements
| Date | Requirement | Detail |
|---|---|---|
| 2026-01-01 | Prior authorization decision timeframes | Expedited requests within 72 hours, standard requests within 7 calendar days. Medicaid managed care already operated under decision-timeframe regulation (42 CFR 438.210); CMS-0057-F aligned the standard timeframe downward to 7 calendar days. Verify current 438.210 text for the plan's exact obligations — state contracts may be tighter. |
| 2026-01-01 | Specific denial reasons | Denials must carry a specific reason, on top of existing Medicaid notice requirements (which are already stricter than most commercial norms in terms of member notices and fair-hearing rights). |
| 2026-03-31 | First public PA metrics report | Annual public posting of prior-authorization metrics on the plan's website, first report due by March 31, 2026. Plans operating in multiple states need a reporting approach that satisfies each state's expectations about plan-level vs. state-program-level figures. |
| 2027-01-01 | Prior Authorization API (FHIR) | FHIR-based PA API with documentation-requirement lookup and request/decision support; Da Vinci CRD/DTR/PAS recommended. Multi-state plans should expect states to layer contract requirements (timelines, certification evidence) on top of the federal floor. |
| 2027-01-01 | Provider Access API | FHIR API for in-network providers covering claims, encounters, USCDI clinical data, and prior authorizations, with attribution and member opt-out handling. |
| 2027-01-01 | Payer-to-Payer API | FHIR data exchange with previous/concurrent payers. Medicaid churn makes this operationally significant: members cycling between Medicaid plans, or between Medicaid and Marketplace coverage, generate ongoing exchange volume. |
| 2027-01-01 | Patient Access API enhancements | Prior-authorization information added to the Patient Access API; API usage metrics reporting to CMS begins in 2026. |
Nuances worth knowing
- State fee-for-service Medicaid programs (a separate impacted-payer category) can seek extensions or exemptions for some API requirements — managed care plans should not assume those flexibilities extend to them; verify the exact scope in the rule text.
- Behavioral health and other carve-outs complicate API completeness: a member's PA history may be split across the MCO and carve-out vendors, and the state, which matters for Payer-to-Payer and Patient Access data quality.
- Because 42 CFR 438 already regulated turnaround times, the operational lift for 2026 was often smaller than for MA — the 2027 API stack is where the heavy investment concentrates.
Frequently asked questions
Do state contracts or CMS-0057-F govern our turnaround times?
Both. CMS-0057-F sets the federal floor (72 hours expedited / 7 calendar days standard); state contracts frequently impose shorter timeframes or additional notice requirements. Configure UM SLAs to the tightest applicable rule per state.
Does the rule apply to fee-for-service Medicaid too?
Yes — state Medicaid FFS programs are a separate impacted-payer category with their own (partially flexible) compliance pathway, including possible extensions or exemptions for certain API requirements that managed care plans do not get.