Prior authorization now runs on a federal clock

Since January 1, prior authorization in Medicare Advantage runs on a federal clock. The time a plan may take to answer a routine request fell from 14 calendar days to 7, and urgent requests must be decided within 72 hours. The same limits now bind state Medicaid and CHIP programs, including the managed care plans that deliver most of their benefits. Every payer covered by the new rules also has to give a specific reason when it denies a request.

These are the first requirements of the Interoperability and Prior Authorization Final Rule (CMS-0057-F) from the Centers for Medicare & Medicaid Services (CMS) to reach the field. CMS released the rule in January 2024. According to the published final rule, it took effect in April 2024. Its compliance dates are staged across 2026 and 2027. The decision deadlines and the denial-reason requirement come first, followed by public metrics due by March 31. The application programming interfaces (APIs) meant to move requests and decisions electronically are due in January 2027.

This analysis looks at what the 2026 requirements change and where they leave room. It also sets out what the first public reports will and will not be able to show. It draws on the rule and its fact sheet, along with the regulatory text for Medicaid managed care, which spells out the extension and reporting rules in the most detail.

Key takeaways

• Routine requests get 7 calendar days, urgent requests 72 hours. The limits apply to Medicare Advantage organizations and to Medicaid and CHIP, in both fee-for-service and managed care. For both Medicare Advantage and Medicaid managed care, the 7-day limit replaces a ceiling of 14 days.
• The clock can still stretch. A plan may extend a decision by up to 14 more calendar days when the enrollee or provider asks, or when it can justify needing more information. In Medicaid managed care, a decision that misses its deadline counts as a denial the enrollee can appeal.
• Every denial needs a specific reason. The requirement covers all payers subject to the rule, including qualified health plan issuers on the federal exchanges, which are otherwise outside the new deadlines.
• Drugs are excluded. None of the rule’s prior authorization provisions apply to drugs.
• Employer plans keep a slower routine clock. Group health plans still have up to 15 days for pre-service claims under the federal claims procedure rule.
• The first public metrics, due March 31, will describe 2025. They will show approval rates and decision times from the year before the deadlines took effect.

The deadlines reach most public coverage but not exchange plans

The rule applies to a defined set of “impacted payers.” According to the CMS fact sheet, 5 kinds of payers are covered.

• Medicare Advantage (MA) organizations
• State Medicaid and CHIP fee-for-service programs
• Medicaid managed care plans
• CHIP managed care entities
• Qualified health plan (QHP) issuers on the federally facilitated exchanges (FFEs)

The new decision deadlines apply to all of them except the QHP issuers. QHP issuers remain under the existing claims and appeals rules for individual and group coverage, which the final rule cites at 45 CFR § 147.136. Employer plans and other commercial coverage outside these programs are not touched by CMS-0057-F at all. For most commercially insured patients, January 1 changed nothing.

Where the rule does apply, the volume is large. MA plans made 49.8 million prior authorization determinations in 2023, according to a KFF analysis of plan-reported data, and denied 6.4% of them. Only 11.7% of those denials were appealed. A shorter clock applies to every one of those requests, the approvals as well as the denials.

For Medicaid managed care, the regulation at 42 CFR § 438.210(d) shows the change directly. For rating periods that began before January 1, 2026, states set standard decision timeframes of no more than 14 calendar days. For rating periods beginning on or after that date, the maximum is 7. Because the requirement attaches to rating periods rather than to the calendar, a plan whose contract year starts in July moves to the new limit in July.

Medicaid fee-for-service programs and CHIP are covered by parallel requirements. The fact sheet describes the 72-hour and 7-day limits as applying to these programs as well. Their regulatory paragraphs sit in other parts of title 42 and are not quoted in this analysis.

A 7-day limit with a 14-day extension

The 7-day figure is a ceiling, not a target. The Medicaid managed care rule requires a decision as quickly as the enrollee’s condition requires, and in any case within the limit. It also keeps an extension. A plan may add up to 14 more calendar days to a standard decision if the enrollee or the provider asks, or if the plan justifies a need for more information and shows the delay is in the enrollee’s interest. Expedited decisions can be extended under similar conditions. The MA rules contain a comparable extension of up to 14 calendar days.

An extension is not invisible. Under 42 CFR § 438.404(c)(4), a Medicaid managed care plan that extends a standard decision must give the enrollee written notice of the reason and of the right to file a grievance. And a decision that does not arrive in time is treated as a decision. Under 42 CFR § 438.404(c)(5), a service authorization not decided within the required timeframe “constitutes a denial and is thus an adverse benefit determination,” with notice due on the date the timeframe expires. The enrollee can appeal it.

That design puts weight on a question the rule does not fully answer, which is when the clock starts. The timeframe runs from receipt of the request. How a plan treats a request that arrives without the documentation its criteria call for, whether as received and pending or as incomplete, will shape how often a 7-day clock stretches into the extension period in practice. The extension notice and the public metrics described below are the 2 places where that practice will show.

What counts as urgent is still a clinical call

The expedited track is meant for cases where waiting for a standard decision could put the enrollee’s health at risk. The 72-hour limit is not new for these requests. What changed in 2026 is the standard track, which handles most of the volume. For clinicians, the practical question is whether plans accept a provider’s indication that a case is urgent or second-guess it, because that classification decides which clock applies.

Employer plans still work on a slower clock

The new limits make Medicare Advantage and Medicaid faster on routine requests than most employer coverage. Group health plans follow the Department of Labor’s claims procedure rule. Under 29 CFR § 2560.503-1(f)(2), a plan must decide an urgent care claim within 72 hours of receipt. For a pre-service claim, which is how a prior authorization request is treated, the limit is a reasonable period and no later than 15 days, with one extension of up to 15 days when matters beyond the plan’s control require it.

The same rule covers care already underway. When a patient asks to extend an approved course of urgent treatment at least 24 hours before it ends, the plan must answer within 24 hours. A decision to cut short an approved course of treatment counts as an adverse benefit determination, and the plan must give notice early enough for the patient to appeal and get a decision before the care stops.

Compiled from the CMS fact sheet and the regulations at 42 CFR § 438.210(d) and 29 CFR § 2560.503-1(f)(2).

The urgent limit is the same in both systems. The routine limit is not. A practice whose patients are split between Medicare Advantage and employer coverage will now see the same kind of request answered on 2 clocks, one less than half as long as the other. State insurance laws can set different limits for fully insured coverage, so the size of the gap varies by state and by plan type.

Denials now have to explain themselves

Starting in 2026, impacted payers must give a specific reason when they deny a prior authorization request. The fact sheet says this applies however the request was sent and however the decision is delivered, from a portal message to a phone call. Unlike the deadlines, this requirement extends to QHP issuers on the exchanges.

Medicare Advantage enrollee notices were already required to state the specific reasons for a denial. The new requirement matters most for the other half of the transaction, the clinician or practice that submitted the request and needs to know whether to resubmit or appeal. A denial that says only “not medically necessary” leaves the provider guessing which criterion the case failed. A denial that names the missing finding, or the coverage policy section the request did not meet, turns into a fix.

The fact sheet describes the requirement without prescribing a format or code set for denial reasons. That leaves room for wide variation in how specific “specific” turns out to be. The 2027 Prior Authorization API, which must give a specific reason with any denial it returns, will push toward structured reasons. Until then, the quality of explanations will depend on each payer’s notices and portals.

A 7-day clock with a 14-day extension, and a reason that can be a single sentence, will only change practice if someone can see how often each one happens.

The first public reports will measure the old rules

The rule’s third 2026 requirement is public reporting. Each impacted payer must post prior authorization metrics on its website every year, with the first set due by March 31, 2026. The Medicaid managed care regulation, 42 CFR § 438.210(f), lists what plans must report at the plan level, and the list mirrors the metrics CMS describes for the other payers.

From 42 CFR § 438.210(f), as it applies to Medicaid managed care plans. Data on drugs are excluded.

The reports due in March cover the previous calendar year, 2025. That year ran under the old timeframes, so the first numbers will be a baseline rather than a test of the new limits. Reports measuring a full year under the 7-day standard arrive in 2027.

Even as a baseline, the metrics will be hard to compare across payers. The rule does not standardize the services that require prior authorization, so a plan that requires it for 40 low-risk services will report a different denial rate than one that requires it for 10 high-cost ones. Approval shares say nothing about partial approvals or about requests withdrawn after a payer asked for more information unless the definitions say so. Average decision times can be pulled down by a large volume of quick automated approvals while slower cases wait. The median helps with that, which may be why the rule asks for both.

What the metrics will show clearly is the extension rate. The share of standard requests approved after a timeframe extension is the closest public measure of how often the 7-day limit is functioning as a 7-day limit.

What the 2026 requirements do not change

The requirements now in force govern the process around a prior authorization request. They do not govern which services require one or which clinical criteria a plan applies.

Compiled from the CMS fact sheet and the final rule.

Drugs are the largest exclusion. The fact sheet states that the rule’s prior authorization policies, including the denial-reason requirement and the API provisions, do not apply to drugs. Prior authorization for prescription drugs continues under the separate rules that govern pharmacy benefits.

The electronic infrastructure also arrives later than the deadlines. Until the Prior Authorization API is live, many requests will continue to move by portal and fax, and the 7-day clock will run on top of those channels. CMS has said it will use enforcement discretion for the HIPAA X12 278 transaction standard, so payers may build their APIs on FHIR alone or on FHIR alongside X12. On the provider side, a new Electronic Prior Authorization attestation measure begins with the 2027 performance period for clinicians in the Merit-based Incentive Payment System (MIPS) and the 2027 EHR reporting period for hospitals.

What the clock changes for practices and review teams

The burden the deadlines target

Physician surveys give a sense of what the deadlines are meant to relieve. In a December 2024 survey of 1,000 physicians by the American Medical Association, 93% said prior authorization delays patient care and 29% said it had led to a serious adverse event for a patient in their care. Respondents reported handling an average of 39 prior authorizations a week, at a cost of about 13 hours of physician and staff time. Survey results are self-reported and come from a panel, so they describe physicians’ experience rather than measured outcomes.

The new limits address one part of that experience, the waiting. They do nothing directly about the 39 requests a week, which depend on how many services plans subject to prior authorization. A practice that gets every answer within 7 days still has to submit every request. The 2027 APIs, and the plan-level lists of services that require authorization, are the parts of the rule aimed at volume and effort rather than at time.

Inside a review team

For the plans now bound by the 7-day limit, the clock changes operations in ways the rule does not spell out. Calendar days include weekends and holidays, so a request received on a Friday afternoon before a long weekend has used several of its 7 days by the time most staff return. Plans that ran review on a business-day rhythm need weekend intake, or at least a triage step that catches requests likely to need clinical review before they sit.

Requests that arrive incomplete create the hardest choice, and each of the plan’s options has a cost.

• Ask for more information. The request stays open, but the days keep running.
• Take the extension. The plan must send written notice to the enrollee, and the extension shows up in the public metrics.
• Decide on the record as it stands. A decision on an incomplete record is more likely to be a denial, and more likely to be reversed once the missing documentation arrives.

The peer-to-peer conversation, in which a reviewing physician and the ordering clinician discuss a case, also has to fit inside the window. Say a reviewer flags a request on day 4 and offers a call, and the ordering physician cannot take it until day 7. The plan then has to decide on the same day as the call, with no room to act on what the conversation reveals. A 7-day limit rewards moving clinical questions to the start of the process instead of leaving them for the end.

Automation helps most at the front of the process. A request that arrives complete and clearly meets a plan’s criteria can be approved in minutes, which leaves more of each reviewer’s week for the cases that need judgment. The extension rate and the median decision time, once they are public, will show which plans used the new clock to redesign their process and which simply ran the old one faster.

What to watch in 2026

Extension rates. The share of standard requests approved after an extension, reported in 2027 for 2026, will show whether the 7-day limit holds or whether extensions become routine.

Missed deadlines in Medicaid managed care. Because a late decision counts as a denial, plans that miss deadlines will generate adverse benefit determinations and, potentially, appeals. State Medicaid agencies, which oversee these contracts, may track this before CMS does.

Actual decision times. The average and median time to decision will show whether plans decide well inside the ceiling or cluster near it. A median of 1 day and a median of 6 days both comply, but they describe very different experiences for patients.

The 2027 build. The Prior Authorization API is what would let a clinician learn at the point of ordering whether authorization is required and what documentation the plan wants. Without it, the 2026 deadlines speed up answers to requests that are still assembled by hand.

Other initiatives starting the same day. January 1 also brought a new CMS Innovation Center model that adds prior authorization for selected services in traditional Medicare in 6 states, and voluntary commitments by many insurers to reduce prior authorization. Those efforts run alongside the federal deadlines but are separate from them.

About this analysis

Basis. This analysis relies on the CMS fact sheet for CMS-0057-F and the final rule as published in the Federal Register in February 2024 (89 FR 8758). For deadlines and notices, we used the regulatory text of 42 CFR § 438.210 and § 438.404 for Medicaid managed care, along with 29 CFR § 2560.503-1 for employer group health plans. Provisions for the other covered programs are described from the fact sheet and the rule’s summary. Their specific regulatory paragraphs were not reviewed for this analysis, except the MA extension and notice provisions in the version of the MA rules in effect before 2026.

Data notes.

• KFF’s figures are counts of prior authorization determinations reported by MA plans for 2023. They are not counts of patients, and they exclude Part D drugs.
• The AMA survey reflects a panel of 1,000 practicing physicians surveyed in December 2024. Its percentages describe what respondents reported.
• The peer-to-peer example is illustrative, not drawn from any plan’s data.
• Compliance dates for managed care plans and QHP issuers depend on rating periods and plan years, so some plans reach a given requirement after the calendar date shown.

Sources

• CMS, CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) fact sheet, January 2024
• Federal Register, Advancing Interoperability and Improving Prior Authorization Processes, final rule, 89 FR 8758, February 2024
• eCFR, 42 CFR § 438.210, Coverage and authorization of services
• eCFR, 42 CFR § 438.404, Timely and adequate notice of adverse benefit determination
• Legal Information Institute, 29 CFR § 2560.503-1, Claims procedure
• KFF, Medicare Advantage prior authorization requests and denials
• AJMC, AMA survey highlights growing burden of prior authorization on physicians, patients, February 24, 2025

Frequently asked questions

What prior authorization deadlines took effect on January 1, 2026?

Medicare Advantage organizations must decide standard prior authorization requests within 7 calendar days and expedited requests within 72 hours. Medicaid and CHIP programs follow the same limits, with managed care plans moving to them in their first rating period on or after January 1, 2026.

Do the new prior authorization deadlines apply to prescription drugs?

No. CMS-0057-F excludes drugs from all of its prior authorization provisions, including the deadlines.

Do employer health plans have the same prior authorization deadlines?

No. Group health plans follow the federal claims procedure rule, which allows up to 15 days for pre-service claims with one 15-day extension, and 72 hours for urgent care claims.

When do payers have to publish prior authorization metrics?

The first public reports are due by the end of March 2026 and cover 2025. They include approval and denial rates, along with average and median decision times.