With an estimated $15 billion in savings over the next decade, the rule aims to reduce administrative burden and improve care coordination. Impacted payers must fully comply with the API provisions by January 1, 2027, allowing time to prepare for this shift.
For providers, these changes may seem long overdue. Each year, millions of patients face delays in care due to inefficient PA processes. A system intended to manage costs has instead become a bottleneck, burdening providers with time-consuming workflows and administrative complexity. Whether in small practices or large health systems, staff spend countless hours securing approvals—with denied requests often leading to lost revenue, disrupted care plans, and waste in time and resources.
What to Expect: Key Changes in 2026 and 2027
Beginning January 1, 2026, payers will be required to enhance transparency, speed up decision timelines, and improve patients’ access to their PA information.
- Faster decision timelines
- Standard PA requests must be processed within seven calendar days and urgent requests within 72 hours.
- This addresses the inconsistency in current response times, which can often lead to care delays.
- Greater transparency and accountability
- Payers must provide specific reasons for PA denials, allowing providers to address documentation or medical necessity gaps more effectively.
- Public reporting of PA metrics—including approval rates, denial rates, and response times—will promote accountability and encourage performance improvement.
- Improved patient access
- Patients will gain direct access to their PA status and history through payer APIs, helping them make more informed healthcare decisions.
By January 1, 2027, the transition to fully electronic PA will take effect, requiring impacted payers to implement FHIR-based APIs for seamless automation.
- Mandatory electronic prior authorization (ePA)
- Payers must adopt FHIR-based APIs to facilitate electronic PA requests, reducing manual processes and improving efficiency.
- Providers will be able to submit, track, and receive PA responses electronically in real time, streamlining workflows and minimizing administrative burden.
How to Prepare
While this rule appears to be a good-faith effort to reduce administrative burden and create a win-win for providers and payers alike, it will only benefit organizations that are prepared. Greater data transparency and interoperability will reshape the payer-provider dynamic, offering new efficiencies while also shifting control over information.
To maximize benefits, providers must rethink PA workflows, invest in automation, and proactively engage with payers. Those who adapt early and follow the action steps below will be better positioned to streamline operations, strengthen financial performance, and enhance their negotiating power in an increasingly data-driven landscape.
1. Modernize IT Tools and API Workflows
To modernize PA infrastructure, providers must reassess their current IT strategy and identify opportunities to reduce workflow fragmentation. This begins with evaluating the existing technology stack and adopting solutions that support automation and API integration.
- Familiar platforms like Availity and Waystar offer ePA tools powered by robotic process automation (RPA) and artificial intelligence (AI). Availity's AuthAI™ uses AI to interpret clinical documentation and generate real-time decisions, minimizing manual reviews and shortening turnaround times. Waystar's Authorization Manager automates submissions and status tracking across payers, cutting initiation time by over 50% and improving workflow efficiency.
- Specialty benefits management vendors such as Xsolis and Cohere Health are contracted by payers to streamline high-cost and complex authorizations. These tools use predictive analytics to align clinical and financial criteria, reducing administrative burden and enabling real-time collaboration with providers. Integrations with platforms like Epic allow for end-to-end automation. Cohere Health's early results show that up to 83% of PA requests can be auto-approved, and urgent requests resolved in less than 24 hours.
- With new CMS regulations mandating FHIR-based APIs, EHR vendors such as Epic and Cerner are expanding their interoperability capabilities. Epic's Payer Platform enables seamless, bidirectional data exchange between payers and providers, centralizing authorization workflows, document submissions, and real-time status updates.
As payers continue to lead in digital readiness, providers must invest in modern infrastructure and prepare their teams for more connected, streamlined workflows to remain competitive and compliant well beyond PA process.
2. Refine Payer Strategy
Payer variability will remain a key challenge, as the CMS rule only applies to Medicare Advantage, Medicaid managed care, CHIP managed care, and qualified health plans on the federally facilitated exchanges. Commercial insurers, employer-sponsored plans, and third-party administrators are not mandated to adopt these changes, limiting the potential for system-wide efficiency gains in multiplayer environments. This creates inconsistencies in workflow, forcing providers to maintain parallel processes—one for payers that follow the new rule and another for those that do not.
Providers will welcome the new time frames for payers to respond to PA requests, as well as the requirement for payers to provide specific reasons for authorization denials. However, the regulations do not require payers to approve more authorization requests, particularly for drugs or post-acute facility care (e.g., long-term acute care and inpatient rehabilitation), which providers say is rarely authorized and increases lengths of stay at acute hospitals, particularly for members of Medicare Advantage plans. The requirement that payers publish PA approval rates and related statistics could theoretically pressure plans to authorize more services, as patients may select plans with higher approval rates. Providers can also use the publicly available PA statistics to argue for higher reimbursement from plans with high denial rates to offset the administrative burden associated with frequent denials.
The API requirements for payers will likely make them more aggressive in demanding access to providers' EHRs in managed care contracts. While there are certainly potential benefits to providers from offering EHR access to payers—including streamlining the PA process—many providers are understandably concerned about data security and about payers using information from their EHRs for less mutually beneficial purposes (e.g., initiating claims denials). Providers should not agree to language in managed care contracts that offers payers unconditional access to their EHRs; rather, providers and payers should reach agreement on parameters and use cases before offering EHR access.
In determining the proper go-forward strategy, it's important to note that payers will continue to prioritize cost containment and uphold strict medical necessity criteria with more equipped technology on their side. Public reporting may offer providers new influence in negotiating rates or policy adjustments, but payers remain focused on controlling costs. As such, providers must approach these changes with a realistic understanding of where efficiencies can be gained—and where friction may persist.
3. Improve Patient Access and Communication
With the CMS mandate requiring ePA capabilities by 2027, now is the time for organizations to evaluate where and how to embed ePA into their scheduling and EHR workflows. Building this infrastructure early allows providers to identify high-volume services that routinely require PA and streamline the submission process at the point of order. Automating key steps—such as submission, status checks, and documentation uploads—not only accelerates approvals but also reduces manual work and delays that disrupt clinic operations. Investing in tools that integrate with EHRs and support real-time updates will also improve patient communication and reduce care deferrals tied to unclear PA status.
In parallel, organizations should begin using denial data and payer behavior insights to adopt a more confident "schedule-before-auth" approach for certain services. With improved transparency and historical trends on approval likelihood, revenue cycle teams can make more informed scheduling decisions without waiting for full authorization. Establishing criteria and payer-specific rules to guide this approach will help maintain compliance while enhancing patient access. By acting now, providers can move beyond reactive compliance and create a more efficient, patient-centered PA model ahead of the federal deadline.
4. Optimize Staffing
To fully realize the benefits of ePA, organizations should proactively assess how automation will reshape staffing models and workflow structures. As core tasks like documentation uploads, payer portal navigation, and follow-up calls shift to automated processes, existing staff can be reassigned to higher-value functions such as patient engagement, exception handling, and denial prevention. This transition offers an opportunity to reduce reliance on administrative labor, reallocate FTEs strategically, and potentially avoid future hiring needs.
At the same time, revenue cycle and utilization management teams must be prepared for changes in role scope and expectations. As automation replaces routine manual functions, staff will need training on new tools, real-time dashboards, and workflows embedded in the EHR. Providers should also evaluate existing vendor contracts—particularly those that handle authorizations manually—as some of these services may become redundant with API-based automation. Anticipating this shift and creating clear change management plans will help ensure that teams remain engaged, productive, and aligned with the organization's modernization strategy.
An Opportunity Long Overdue
The CMS ruling offers a long-overdue opportunity to transform prior authorization from a persistent bottleneck into a streamlined, patient-centered process. Historically, delays in approvals have disrupted care, strained staff capacity, and eroded patient trust. The new rule directly targets these issues.
Although payers are often more digitally prepared, this moment creates a clear path for providers to catch up. By modernizing workflows, clarifying payer relationships, and prioritizing automation, organizations can shift from compliance to strategy. Those who act now—through thoughtful planning and collaboration—will be best positioned to capture long-term gains in operational efficiency, financial performance, and patient outcomes.
