For impacted payers, within 72 hours for urgent requests and seven calendar days for standard ones. CMS's fact sheet for the Interoperability and Prior Authorization final rule (CMS-0057-F) says impacted payers (excluding QHP issuers on the FFEs) must send prior authorization decisions "within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests." The rule covers specific payer types that CMS names. It doesn't cover all commercial plans.

Who the rule covers: "impacted payers"

CMS names the payers covered by the final rule:

"Medicare Advantage (MA) organizations, state Medicaid and Children's Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs)" (CMS, CMS-0057-F fact sheet)

CMS calls these, collectively, "impacted payers." The rule doesn't cover all commercial plans, so check which of your payers are impacted payers.

The decision timeframes

"We are requiring impacted payers (excluding QHP issuers on the FFEs) to send prior authorization decisions within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests." (CMS, CMS-0057-F fact sheet)

Note the exclusion inside that sentence: QHP issuers on the FFEs are left out of the timeframe provision.

On timing, CMS says:

"Impacted payers must also implement certain operational provisions, generally beginning January 1, 2026." (CMS, CMS-0057-F fact sheet, January 17, 2024)

A specific reason for denials

"Beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request." (CMS, CMS-0057-F fact sheet)

CMS adds that "this provision does not apply to prior authorization decisions for drugs."

Prior authorization APIs: 2027

CMS says impacted payers have until compliance dates "generally beginning January 1, 2027, to meet the API development and enhancement requirements in this final rule." CMS also notes that "The exact compliance dates vary by the type of payer."

At a glance

| question | what the CMS fact sheet says | |---|---| | Who's covered? | "impacted payers" (MA, state Medicaid and CHIP FFS, Medicaid managed care, CHIP managed care, QHP issuers on the FFEs); not all commercial plans | | Expedited (urgent) decisions | "within 72 hours" (excluding QHP issuers on the FFEs) | | Standard (non-urgent) decisions | "seven calendar days" (excluding QHP issuers on the FFEs) | | When do operational provisions start? | "Impacted payers must also implement certain operational provisions, generally beginning January 1, 2026." | | Denial reason | "a specific reason for denied prior authorization decisions" beginning in 2026; not for drugs | | APIs | "generally beginning January 1, 2027"; dates vary by payer type |

Desk habit: one payer list

This part is an operating habit, not CMS text. Keep one list of your payers, each marked impacted or not, and check your contracts for anything beyond the rule.

FAQ

How fast do impacted payers have to send prior authorization decisions?

CMS says impacted payers (excluding QHP issuers on the FFEs) must send prior authorization decisions "within 72 hours for expedited (i.e., urgent) requests and seven calendar days for standard (i.e., non-urgent) requests."

Which payers does CMS-0057-F cover?

CMS lists "Medicare Advantage (MA) organizations, state Medicaid and Children's Health Insurance Program (CHIP) Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs)" as "impacted payers." It doesn't cover all commercial plans.

Do payers have to give a reason for a prior authorization denial?

CMS says, "Beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions, regardless of the method used to send the prior authorization request." CMS says this "does not apply to prior authorization decisions for drugs."

When do the prior authorization API requirements start?

CMS says compliance dates are "generally beginning January 1, 2027" and "The exact compliance dates vary by the type of payer."

Related resources

Know what's moving, what's stuck, what happens next. Start with one queue.

This page is run by RxRev.

RxRev is not affiliated with CMS.

Source: CMS, Fact Sheet: CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) (January 17, 2024; checked October 13, 2026). All quotes above are from this fact sheet.

This page is general information, not billing or legal advice.