CMS-0057-F requires impacted payers to implement a Prior Authorization API by January 1, 2027. The required standard is FHIR R4.0.1. The Da Vinci PAS Implementation Guide STU 2.0.1 — the spec that makes those endpoints interoperable — is listed under “Recommended Implementation Guides.” Recommended is not required. A compliant payer in January 2027 can build a proprietary schema that forces every EHR vendor to write bespoke integration logic. The administrative friction doesn’t disappear; it moves from the fax machine to the integration layer. The first public PA metrics (March 2026) showed 50.2 million MA determinations, a 7.7% denial rate, and 80.7% of appealed denials overturned. Faster and electronic doesn’t fix that.
The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), published January 17, 2024, requires impacted payers to implement a Prior Authorization API by January 1, 2027. The required technical standard is HL7 FHIR Release 4.0.1. The specification that makes those APIs interoperable across payers — the HL7 Da Vinci Prior Authorization Support (PAS) Implementation Guide STU 2.0.1 — appears in a separate list in the same document, under the heading “Recommended Implementation Guides.”
Recommended is not the same as required. That distinction will determine whether the January 2027 deadline produces a coherent electronic prior authorization ecosystem or a collection of compliant-but-incompatible endpoints.
Before the API deadline, the rule’s first phase took effect. Impacted payers — Medicare Advantage organizations, Medicaid and CHIP managed care plans, and marketplace plan issuers on the federal exchanges — now face binding decision timeframes: 72 hours for expedited requests, seven days for standard ones (cut from 14). Denials must include a specific clinical rationale, not a generic coverage policy citation.
By March 31, 2026, those same payers were required to publish their first-ever aggregated prior authorization data publicly — what they approved, what they denied, how often contested denials were overturned, and how long decisions took, drawn from calendar year 2025 activity. The disclosure was mandated, not voluntary. It is the first time this data has been available at the plan level.
CMS-0057-F specifies six required technical standards: FHIR R4.0.1, US Core STU 3.1.1, SMART App Launch 1.0.0, FHIR Bulk Data Access v1.0.0, USCDI, and OpenID Connect 1.0. In a separate table, the rule lists eight recommended IGs — including Da Vinci PAS STU 2.0.1, Da Vinci Coverage Requirements Discovery (CRD) STU 2.0.1, and Da Vinci Documentation Templates and Rules (DTR) STU 2.0.0.
CRD, DTR, and PAS form a linked workflow chain. CRD checks whether a service requires prior authorization and what documentation a payer needs. DTR collects that documentation inside the EHR. PAS submits the request and receives the decision. When all three are implemented, a clinician can initiate, track, and receive a prior authorization decision without leaving the EHR workflow.
When only FHIR R4.0.1 is implemented — which is all the rule requires — the Prior Authorization API has a valid FHIR endpoint but no standard request or response schema. EHR vendors who want to offer in-workflow electronic prior authorization must write custom integration logic for each payer that skips the Da Vinci IGs. One standard versus many bespoke integrations: the administrative friction moves from the fax machine to the integration layer.
The rule does extend one flexibility on the HIPAA side: payers implementing an all-FHIR Prior Authorization API will not be enforced against for omitting the X12 278 transaction standard. That removes one compliance barrier to FHIR-native implementation. It does not make the Da Vinci PAS IG required.
The March 31, 2026 disclosure covered Medicare Advantage’s calendar year 2025 activity — and for context, MA insurers processed roughly 50.2 million prior authorization determinations in 2024, at an aggregate denial rate of 7.7%. That rate has risen from 5.7% pre-pandemic, through 6.4% in 2023. Of the denials that were contested through appeal, roughly 80.7% were reversed.
The plan-level spread was more informative than the aggregate. Elevance Health ran 2.7–3.0 prior auth requests per enrollee and denied 4.1%–4.2% of them. UnitedHealth Group ran 0.9–1.0 requests per enrollee and denied 12.6%–12.8%. High volume with low denial rates on one side; narrow scope with high denial intensity on the other. Both strategies are observable now in a way they were not before March 2026.
The 80.7% reversal rate on appeal is what the API deadlines do not address. A denial that is reversed when contested represents a process outcome, not a clinical disagreement. Faster turnaround times (seven days instead of 14, 72 hours for expedited) and electronic submission paths do not change the underlying accuracy of the initial determination. The operational mandates in the rule’s first phase accelerate the process. Whether the process is producing accurate first decisions is a separate question.
The market moved before the January 2027 API deadline. One month after the first public disclosure, UnitedHealthcare announced a roughly 30% cut to its prior authorization scope by year-end 2026, removing surgical outpatient procedures, echocardiograms, and select therapies from the required list. AHIP reported that 48 health insurers collectively cut medical prior authorization volume by 11%, with Medicare Advantage seeing a 15% reduction.
Two observable indicators over the next six months:
CMS-0062-P. A proposed rule published in April 2026 would replicate the CMS-0057-F framework for drug prior authorizations, with an effective date of October 2027 and the same payer scope: MA organizations, Medicaid and CHIP managed care, and marketplace plan issuers on the federal exchanges. If finalized, it will likely prompt a fresh look at whether the Da Vinci PAS IG remains merely recommended — because the pharmacy prior authorization workflow is more tightly constrained and the IG’s mapping to pharmacy benefit structures is less mature than for medical services.
IG version tracking. CMS-0057-F cites Da Vinci PAS STU 2.0.1. The current published standard is v2.1.0, which supersedes 2.0.1; a v2.2.0 ballot is open. The rule allows flexibility for updated versions that do not disrupt end-user access. Whether payer implementations target the rule-cited version or the current published standard will affect conformance testing results. The difference between 2.0.1 and 2.1.0 is not cosmetic — the IG is at trial-use maturity level 3, meaning implementation experience is still feeding back into the specification.
What FHIR implementation consultants report from active payer engagements is consistent with the public disclosure data: most regulated plans are building their Prior Authorization API infrastructure from a phone-and-portal baseline, not from an existing electronic workflow. Six months is a short runway for a greenfield API build. The implementation choice—FHIR R4.0.1 minimum versus the full CRD-DTR-PAS workflow chain—will determine whether the rule produces interoperable electronic prior authorization or a more efficient version of the current fragmented landscape.
Discover how Addie helps health systems, post-acute providers, and payers improve throughput, reduce avoidable days, and deliver better transitions of care.
Get Started
