FHIR APIs, faster decisions and the operating changes that will determine whether reform works at the point of care.
Built for leaders preparing for 2027
For health plans, the 2027 prior authorization deadline is no longer an abstract compliance milestone. It is an operating test. Payers must translate policy rules into data, connect those rules to provider workflows and return decisions with enough speed and clarity to change the experience for clinicians and patients.
The regulatory foundation is already in place. CMS-0057-F introduced shorter decision timeframes, specific denial reasons, public performance reporting and FHIR-based application programming interfaces for impacted payers. The API requirements generally take effect Jan. 1, 2027. Meanwhile, participating health plans have made voluntary commitments that extend beyond federal requirements, including a goal of answering at least 80% of electronic prior authorization approvals with complete clinical documentation in real time during 2027.
Taken together, those changes move prior authorization from a series of disconnected transactions toward a shared digital workflow. The organizations that make the transition successfully will have more than functioning endpoints. They will have policies, teams, vendors and provider partners aligned around a faster route to appropriate care.
The 2027 Test
Can a complete request move from the provider’s workflow to a clear payer decision without a fax, a phone call or a second portal?
The 2027 Deadline Is Only One Part of the Reform Story
Payers are working across requirements that arrive in stages.
Under the CMS Interoperability and Prior Authorization Final Rule, Medicare Advantage organizations, state Medicaid and CHIP programs, Medicaid managed care plans, CHIP managed care entities and Qualified Health Plan issuers on the Federally Facilitated Exchanges are among the impacted payers. The rule focuses on medical items and services and excludes drugs from its prior authorization API and process requirements.
| Timing | Requirement or signal | What it means for health plans |
|---|---|---|
| In force during 2026 | Decision timeframes plus denial reasons and public prior authorization metrics | Impacted payers must meet 72-hour expedited and 7-day standard decision timeframes. QHP issuers on the Federally Facilitated Exchanges are excluded from these CMS-0057-F timeframes. |
| Generally Jan. 1 2027 | Prior Authorization API plus expanded Patient Access and Provider Access and Payer-to-Payer APIs | Coverage rules and documentation and requests and responses and authorization information must move through interoperable workflows. |
| 2027 market commitment | At least 80% of electronic approvals with complete documentation answered in real time | This is a voluntary industry commitment and not a CMS-0057-F mandate. It raises the benchmark for automation and adoption. |
| Watch item | CMS-0062-P proposes extending electronic prior authorization reforms to drugs | The proposal was still not final as of Aug. 25 2026. Recheck the rule status before publication. |
CMS also requires payers to publish approval, denial, appeal, extension and turnaround-time metrics. The first reports, covering calendar year 2025, were due March 31, 2026. These data give leaders a baseline for measuring whether digital implementation changes performance after the APIs go live.
The API Must Fit the Workflow
Technical conformance is necessary; operational fit determines adoption.
Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS) describe connected parts of the electronic prior authorization journey. CRD can surface whether authorization is required and what the payer needs. DTR helps assemble the supporting documentation. PAS carries the request and response. Treating each implementation guide as a separate project risks recreating the handoffs reform is meant to remove.
That lesson came through clearly in the HIMSS26 session Operationalizing Prior Authorization Across a Payer Continuum. Srihari Muthyala, director of Health Care Solutions and Interoperability at Cambia Health Solutions, urged organizations to “start small and actually learn faster.” He described provider-workflow study, implementation-guide maturity, data quality, EHR-instance variation and delegated-vendor alignment as practical implementation issues that can decide whether an API succeeds outside a test environment.
CMS is reaching the same conclusion through its Electronic Prior Authorization Acceleration initiative. In May 2026, the agency announced 29 early adopters across health systems, physician practices, EHR developers, networks and digital health companies. Their work is aimed at workflow gaps, technical handoffs, status visibility and the manual processes that persist between systems.
HIMSS26 Perspective
“We’re trying to be a conduit to appropriate care in a timely fashion as opposed to a roadblock.” — Timothy Law, Chief Medical Officer, Highmark Blue Cross Blue Shield
Real Time Is an Operating Model
Automation should accelerate straightforward cases while preserving clinical review where it adds value.
CMS has clarified in its Prior Authorization API FAQ that CMS-0057-F does not require real-time decisions. Some requests can be answered immediately; others still require evaluation by a clinical reviewer. The strategic task is to distinguish those paths early and move each request to the right one.
Gold carding is one way to reduce unnecessary review for clinicians or organizations with a strong record of appropriate requests. During the HIMSS26 discussion, Law described Highmark’s approach as getting out of the way of physicians whose requests are consistently approved, supported by an audit program. The larger principle applies across automation: remove routine friction, make policy logic explicit and direct clinical expertise toward exceptions and complex cases.
The market benchmark is also moving. A 2026 industry update reported an 11% reduction in prior authorization volume across participating plans—about 6.5 million fewer authorizations—and reaffirmed the goal of real-time responses for at least 80% of electronic approvals with complete documentation in 2027. These are voluntary industry commitments, so health plans should distinguish them clearly from federal compliance requirements while planning for the service expectations they create.
Five Decisions Health Plans Need to Make Now
Readiness becomes measurable when ownership, workflow and proof are explicit.
Utilization management and medical-policy leaders should identify the data and documentation needed for the highest-volume services, then determine which complete requests can follow an automated path. Proof of readiness: priority policies are digitized, version-controlled and testable against real request data.
Interoperability and product teams should map the entire provider journey—from discovering whether authorization is required to receiving the determination—before optimizing individual transactions. Proof of readiness: end-to-end testing succeeds across priority EHR and network pathways without a portal detour.
Vendor-management leaders should confirm that delegated utilization-management partners use compatible standards, data fields, endpoint conventions and response logic. Proof of readiness: contracts, service levels and escalation paths cover the electronic workflow, not only the legacy channel.
Provider-network and change-management teams should treat electronic prior authorization as a behavior change. Proof of readiness: leaders can see electronic-submission share, provider activation, abandoned fax and phone volume, incomplete-request rates and time to decision by channel.
Compliance and analytics teams should connect required reporting to operational dashboards for approvals, denials, appeals, extensions and turnaround times. Proof of readiness: the organization can compare pre-API performance with 2027 results and explain where automation improved—or failed to improve—the experience.
What Payer Leaders Should Test at HIMSS27
The strongest conversations will move past the demo and into the operating environment.
At HIMSS27, payer leaders can compare how peers, providers, EHR companies and technology partners are turning the new requirements into working infrastructure. The most useful questions are specific:
- Can the solution show whether authorization is required while the clinician is placing the order?
- Which CRD, DTR, PAS and FHIR versions are supported, and how are upgrades managed?
- How does the workflow handle attachments, incomplete documentation and requests that require clinical review?
- Can it connect delegated utilization-management partners and discover provider and payer endpoints at scale?
- What does the provider see after submission: status, requests for more information, specific denial reasons and appeal options?
- How are gold carding, automated approval, auditing and policy governance represented in the same workflow?
- Which metrics prove that the implementation reduced manual work and time to care?
HIMSS27 takes place April 5–8, 2027, at McCormick Place in Chicago. Explore the payer experience at HIMSS27 and connect prior authorization strategy with the broader conversations shaping interoperability, AI, care management and payer-provider collaboration.
The Measure of Reform Is What Happens at the Point of Care
A compliant interface is the beginning. A dependable workflow is the outcome.
Prior authorization reform will be judged in the moment a patient needs care: whether the requirement is clear, whether the right documentation is available, whether the request reaches the correct decision path and whether the answer is understandable.
Health plans have an opportunity to turn a long-standing source of friction into a more accountable operating capability. The work reaches across medical policy, interoperability, provider relations, vendor management, analytics and clinical operations. When those disciplines move together, 2027 can become more than a deadline. It can mark the point when prior authorization begins to move at the speed of care.