The journey towards this final rule has seen several important milestones. In 2020, a version of the rule was proposed but ultimately pulled back, with a newly proposed rule issued December 2022. After reviewing over 900 public comments CMS published the final regulation on January 17, 2024. This thoughtful process allowed CMS to incorporate industry feedback while balancing the imperative to advance data access, exchange and use for enhancing healthcare for patients.
Payers, including the following are obligated to comply with the final rule:
Providers:
Excluded parties:
The final rule excludes:
CMS finalized January 1, 2026, as the compliance date for impacted payers to:
CMS finalized January 1, 2027, as the compliance date for impacted payers to implement Provider Access, Payer-to-Payer, and Prior Authorization APIs.
The final rule included requirements to implement or modify the following APIs:
The required standards and implementation specifications in this final rule include the following:
Standards:
Recommended Implementation Guides (IGs):
One of the key features of the rule is the implementation of electronic prior authorization for medical services and products (excluding drugs) by January 1, 2027. The rule enforces the adoption of FHIR interoperability standards, enabling more seamless data exchange. The goals are to reduce burden on providers and payers while improving the patient access to care experience.
The rule also sets new prior authorization decision timeframes that payers must meet. The new timeframes are 7 days for standard requests and 72 hours for expedited requests. The compliance date is January 1, 2026
To ensure accountability, the regulation requires impacted payers to publicly report prior authorization metrics on their websites beginning January 1, 2026. The transparency of performance data is intended to highlight areas needing improvement. Additionally, prior authorization data and details must be made available through other adopted APIs - the Provider Access, Patient Access and Payer-to-Payer APIs. This expands access to authorization information beyond the specific Prior Authorization API.
An interesting inclusion in the accompanying press release references the National Standards Group announcement of "Enforcement Discretion" of existing HIPAA requirements for organizations wishing to provide a FHIR only solution.
The CMS Advancing Interoperability and Improving Prior Authorization Final Rule represents a transformative step towards a more interconnected healthcare landscape. Stakeholders seeking a deep understanding of its implications are encouraged to reach out to Point-of-Care Partners (POCP) by emailing me (kim.boyd@pocp.com) or Brian Dwyer (brian.dwyer@pocp.com ) to set up a discussion to explore your short and long-term strategic challenges and compliance requirements.
We encourage stakeholders who aren’t directly impacted or required to comply with this rule to consider the critical business transformation benefits of adopting APIs to support more timely and less burdensome data exchange both internally and with external partners.
Stay tuned for future content from POCP, delving into the nuanced details of this rule and anticipating future policy activities in the dynamic healthcare technology space.