CMS-0057-F: what changes, for whom, and when
The CMS Interoperability and Prior Authorization Final Rule, CMS-0057-F, is the most consequential regulatory change in this area in years. It is also frequently described loosely. What follows is what the rule requires, of whom, and from when, with the source for each.
#Who it reaches
The rule applies to impacted payers: Medicare Advantage organisations, state Medicaid and CHIP fee-for-service programmes, Medicaid and CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges. It does not reach commercial plans generally, and it does not reach self-funded employer plans governed by ERISA.
That exclusion matters more than it first appears. A large share of commercially insured Americans are in self-funded plans, so a practice will be working under two regimes at once for the foreseeable future.
#What it requires
| Requirement | Detail | From |
|---|---|---|
| Expedited decisions | 72 hours. Excludes QHP issuers on the FFEs. | 1 January 2026 |
| Standard decisions | Seven calendar days. Same exclusion. | 1 January 2026 |
| Specific denial reason | A specific reason for denial, to enable resubmission or appeal. | 1 January 2026 |
| Public metrics | Prior authorization metrics published annually on the payer's website. Initial metrics due 31 March 2026. | 2026 |
| FHIR Prior Authorization API | An HL7 FHIR-based prior authorization API. | 1 January 2027 |
On the timeframes, the CMS fact sheet states that impacted payers, excluding QHP issuers on the FFEs, must send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests. Seven calendar days is explicit in the source; it is not seven business days.
#The FHIR API and what it does not do
The 2027 requirement is that impacted payers implement a FHIR-based prior authorization API. This is a genuine structural change and it is worth being precise about its limits.
- It does not retire the X12 278. Both rails will run concurrently for years, and every payer outside the rule remains on the existing one.
- It does not make authorization unnecessary. It changes how the question is asked, not whether it is asked.
- Payer implementations will differ in depth, as they have with every previous interoperability requirement.
The practical consequence for anyone building in this space is that a system which assumes a single rail will be wrong. Two transports, indefinitely.
#What it means for a practice
Timelines you can hold a plan to- For impacted payers, the decision windows are regulatory rather than contractual. That is a stronger position than most practices are used to, and it is only available where the plan is in scope.
Denials you can act on- A specific reason is the difference between an appeal and a guess.
Published metrics- Payer approval rates, denial rates and turnaround times become public. That is useful evidence in a contracting conversation and in deciding where to invest appeal effort.