CMS-0057-F for Medicare Advantage Organizations
Draft — pending verification
This reference entry has not yet been verified against its authoritative source (CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), 89 FR 8758 — verify against rule text and current CMS FAQs). Do not rely on it for production configuration until this notice is removed.
Who is covered
Medicare Advantage organizations offering MA and MA-PD plans. The rule's prior-authorization provisions cover items and services (including MA-covered Part B drugs are excluded — the rule's PA provisions exclude drugs generally); Part D pharmacy prior auth is out of scope.
Deadlines and requirements
| Date | Requirement | Detail |
|---|---|---|
| 2026-01-01 | Prior authorization decision timeframes | Expedited requests decided within 72 hours and standard requests within 7 calendar days of receipt. For MA these largely tightened the standard-decision window relative to the prior 14-day norm; MA plans also operate under the separate 2024 MA policy rule (CMS-4201-F) governing how coverage criteria are applied. |
| 2026-01-01 | Specific denial reasons | When a prior authorization is denied, the payer must provide a specific reason for the denial, regardless of the intake channel (portal, fax, phone, X12 278, or API). |
| 2026-03-31 | First public PA metrics report | Certain aggregated prior-authorization metrics must be posted publicly on the payer's website annually; the first report is due by March 31, 2026 (covering the prior calendar year). |
| 2027-01-01 | Prior Authorization API (FHIR) | A FHIR-based Prior Authorization API that can identify whether PA is required, list documentation requirements, and support sending requests and receiving decisions. CMS recommends (does not mandate) the HL7 Da Vinci CRD, DTR, and PAS implementation guides. HHS has stated it will exercise enforcement discretion regarding the HIPAA X12 278 standard for payers and providers using an all-FHIR PA workflow. |
| 2027-01-01 | Provider Access API | FHIR API making claims, encounter, USCDI clinical data, and prior-auth information available to in-network providers with a treatment relationship, with an attribution process and patient opt-out. |
| 2027-01-01 | Payer-to-Payer API | FHIR API exchanging the same data classes (claims, encounters, USCDI data, active/recent prior authorizations) with a member's previous or concurrent payers, with patient opt-in, at enrollment and at least quarterly thereafter. |
| 2027-01-01 | Patient Access API enhancements | Existing Patient Access API (from CMS-9115-F) must add prior-authorization information (status, dates, items/services, and related details, excluding drugs). Reporting of Patient Access API usage metrics to CMS begins earlier (annual reporting starting in 2026). |
Nuances worth knowing
- MA is the payer type where CMS-0057-F interacts most visibly with other regulation: the 2024 MA rule (CMS-4201-F) already constrained how MA plans apply coverage criteria and use prior authorization for continuity of care, and post-acute PA practices remain under active policy scrutiny.
- MA organizations have no extension or exemption pathway equivalent to the Medicaid/CHIP fee-for-service options — the compliance dates are the compliance dates.
- The 72-hour expedited clock is calendar time, not business time; UM staffing models built around business days need weekend coverage for expedited queues.
Frequently asked questions
Do the CMS-0057-F timeframes apply to Part D drugs?
No. The rule's prior authorization provisions exclude drugs. Part D and pharmacy-benefit PA continue under their own rules; medical-benefit items and services are what the timeframes and the Prior Authorization API cover.
Can an MA plan satisfy the 2027 API requirement and keep its X12 278 channel?
Yes — and most will. The API mandate adds a FHIR channel; it does not remove the HIPAA 278 obligation. HHS enforcement discretion applies only where both sides transact end-to-end via the FHIR API, so payers realistically run both rails.