Prior authorization means a health plan requires approval before it will cover certain services, tests, procedures, equipment or other care. It is not a guarantee of payment, but it is an important step in the coverage process for many patients. In 2026, federal rules change several parts of that process for affected payers.
CMS finalized the Interoperability and Prior Authorization rule (CMS-0057-F) in 2024. Operational requirements begin in 2026, while the major application-programming-interface requirements generally begin in 2027. The rule affects Medicare Advantage organizations, state Medicaid and Children’s Health Insurance Program programs and managed-care entities, and certain Qualified Health Plan issuers on the federally facilitated exchanges, although not every provision applies to every payer type.
The 2026 decision timeframes
For impacted payers subject to the new timeframe requirement, prior-authorization decisions for medical items and services must be sent as quickly as the patient’s condition requires and no later than:
| Request type | Maximum timeframe under CMS-0057-F | Key limitation |
|---|---|---|
| Expedited / urgent | 72 hours | Clinical urgency can require a faster response |
| Standard / non-urgent | 7 calendar days | Some program-specific rules allow limited extensions under stated conditions |
CMS says these particular decision timeframes do not apply to Qualified Health Plan issuers on the federally facilitated exchanges under this final rule. The deadlines are measured in calendar time, not business days. They also apply regardless of whether the request arrives through an API, portal, fax, phone or another accepted channel.
Denials must be more specific
Beginning in 2026, impacted payers must provide a specific reason for a denied prior-authorization request. That matters because a generic denial makes it difficult for the provider and patient to understand whether the problem was missing documentation, medical-necessity criteria, an out-of-network issue or another coverage condition. A specific reason can make resubmission or appeal more focused.
What the rule does not mean
- It does not eliminate prior authorization. Plans can still require authorization where permitted.
- It does not apply to every health plan. Employer plans, state rules and other federal programs can follow different requirements.
- It does not cover drug prior authorization under CMS-0057-F. The 2024 final rule’s prior-authorization requirements addressed medical items and services while excluding drugs.
- It does not guarantee coverage. Approval and payment can still depend on eligibility, benefit limits, network rules and other policy terms.
- It does not mean every electronic API is live in 2026. The major API implementation date under this rule is generally January 1, 2027.
Original Medicare vs. Medicare Advantage
Medicare’s own comparison guidance says that under Original Medicare, you usually do not need prior authorization for covered services and supplies, while Medicare Advantage plans may require approval before covering certain services or supplies. This distinction is useful when comparing Medicare options because network and utilization-management rules can affect how quickly care is arranged.
What to do when prior authorization is delayed
- Ask the provider whether the request is standard or expedited. A request should be expedited when the clinical situation meets the applicable urgent criteria.
- Confirm the plan received the request. Missing attachments or incorrect member information can stop the clock before review begins.
- Ask what documentation the plan requires. Clinical notes, test results, prior treatment history or a letter of medical necessity may be important.
- Request the exact denial reason in writing. Keep the decision and any reference number.
- Use the appeal or grievance process in your plan documents. Deadlines and levels of review vary by program and plan.
- Escalate urgent access problems. Your provider, health plan, state insurance or Medicaid agency, Medicare resources or other regulators may have complaint pathways depending on the coverage.
Why the 2027 API deadline still matters in 2026
The rule also requires affected payers to build and enhance standardized interfaces that can exchange prior-authorization and health information. The main API compliance date is generally January 1, 2027. For patients, the long-term goal is less manual paperwork and better visibility into authorization status and historical decisions, but 2026 should be understood mainly as a process-and-timeliness year rather than the completion of every technology change.
Frequently asked questions
Does every insurer have seven days to decide a standard prior authorization?
No. The federal CMS rule applies to specific affected payers and services, with exceptions. Other plans may be governed by different federal or state deadlines.
Are prescription-drug prior authorizations covered by the 2024 CMS final rule?
The prior-authorization provisions in CMS-0057-F exclude drugs. Drug authorization standards are addressed through other rules and programs.
What if my health condition cannot safely wait seven days?
Ask the treating provider and plan about expedited review. CMS requires affected payers to act as quickly as the patient’s condition requires, subject to the applicable program rules.
Sources & further reading
Reviewed against CMS and Medicare guidance on October 5, 2026. Health-plan rules are highly specific to the payer, service and state; use your plan’s current documents for an individual decision.
