Your UM committee still meets. It still must review, at least annually, all utilization-management policies and procedures -- including prior-authorization policies -- and ensure that those policies remain consistent with applicable Medicare coverage criteria and current clinical guidelines. If someone on your medical staff heard that CMS "eliminated" the annual UM review requirement, correct them now, before it shapes a compliance decision. It did not happen. What did happen is narrower, and understanding exactly which piece moved -- and which two did not -- is the difference between a UR department that reads the regulatory environment correctly and one that either over-relaxes or wastes a quarter chasing a requirement that no longer applies.

What 422.137 Still Requires, In Plain Terms

The baseline obligation sits at 42 CFR 422.137(d)(1): an MA organization's utilization management committee, led by the plan's medical director, must "at least annually, review the policies and procedures for all utilization management, including prior authorization, used by the MA plan," checking them against the services they cover, against Traditional Medicare coverage rules including NCDs and LCDs, and against current clinical guidelines. Since January 1, 2024, a plan cannot use a UM policy that has not been through that committee review. None of that changed. It is not under enforcement discretion, it was not proposed for repeal, and it does not appear in any suspension notice CMS has issued. If your compliance calendar has been built around this obligation, keep building around it.

What did move is a narrower, newer provision layered on top of it: 422.137(d)(6), added in the CY2025 MA and Part D final rule, which requires the UM committee to "annually conduct a health equity analysis of the use of prior authorization." That provision added three related elements: a UM committee member with health-equity expertise; a plan-level annual health-equity analysis of PA policies and procedures, including analysis of approval and denial patterns for enrollees receiving the Part D low-income subsidy, dual-eligible enrollees, and enrollees with disabilities; and public availability of the final analysis report on the MA organization's website. According to Georgetown University's Medicare Policy Initiative, in a piece published November 19, 2025, CMS issued an HPMS memo on June 16, 2025, announcing it would not enforce those specified elements -- particularly the health-equity-expertise committee-member requirement and plan-level, population-stratified approval-and-denial reporting. That is enforcement discretion, not a change to the Code of Federal Regulations -- 422.137(d)(6) still reads the way it did when it was finalized. [verify: whether CMS has since narrowed, extended, or reversed that non-enforcement posture between June 2025 and this writing]

That distinction matters operationally. Your UM committee composition and your PA policy review cadence are governed by (d)(1), which is fully live. The annual health-equity-analysis requirement remains in the regulation. CMS's non-enforcement policy, as described by Georgetown, applies to specified implementation elements -- particularly the health-equity-expertise committee-member requirement and plan-level, population-stratified approval-and-denial reporting. The scope of any continuing enforcement discretion should be checked against the operative HPMS memo before treating the entire 422.137(d)(6) obligation as unenforced.

Do not assume that enforcement discretion for specified composition and reporting elements eliminates the broader annual health-equity-analysis expectation in the regulation. Maintain a documented analysis process unless CMS's operative guidance clearly states otherwise. A future administration or a court challenge to the non-enforcement memo could reactivate those specific elements without new rulemaking.

A Second, Separate Rollback: The Appeals Dataset Goes Voluntary

Conflating the health-equity suspension with a different, newer initiative is where analysis of this area often goes wrong, and it is worth being precise about why. Separately from the 422.137(d)(6) enforcement discretion, CMS had finalized a mandatory requirement -- approved by the Office of Management and Budget in September 2025, according to LeadingAge -- that would have required MA plans to report service-level information on initial coverage determinations and plan-processed appeals, including the service, decision, and appeal outcome. That is the dataset closest to what providers actually wanted to see, because it would have shown denial-and-overturn patterns at a level of detail CMS and the public had not previously had.

CMS did not fully suspend that one either. Instead, per a December 16, 2025 memo, CMS converted the mandatory requirement into what it is calling the Service Level Data Collection for Initial Determinations and Appeals -- a voluntary pilot running in 2026 with a limited set of participating MA plans, with a January 9, 2026 enrollment window for plans that opted in, and an intent, not a commitment, to expand it to all MA plans in 2027. LeadingAge's reading of the shift -- that it represents another step in the agency's rolling back MA requirements and casts doubt on whether full implementation ever arrives -- is its interpretation, not a CMS statement, and is worth treating as exactly that: one advocacy organization's read on the trajectory. [verify: whether CMS has published participation numbers or a list of pilot plans since the January 2026 enrollment deadline]

What Still Has to Be Submitted, On Schedule

Two other obligations are moving forward without modification, and they are the ones your compliance calendar should actually be built around this cycle.

First, the Part C Utilization Management Annual Data Submission (CMS-10913) requires every MA organization to submit the internal coverage criteria -- not outcomes data, but the actual criteria -- used by the plan or its delegated entities to process Part C prior authorizations, including for Part B drugs. Criteria used only for concurrent or payment review are excluded. The collection covers criteria used by the MA organization, its delegates, or vendors supplying or applying internal coverage criteria, such as InterQual, MCG, or eviCore where applicable. The initial submission, covering the 2026 coverage year, was due April 30, 2026; subsequent annual submissions are due February 28, 2027. Notably, CMS declined to finalize a proposed audit protocol alongside this submission, citing concern about duplicative audit activity -- a detail worth flagging to your compliance team if you were bracing for a parallel audit track. [verify: the proposed-audit discussion against the September 30, 2025 HPMS memo or final collection materials before using this sentence]

Second, CMS-0057-F, the Interoperability and Prior Authorization final rule, carries its own public transparency component that has nothing to do with either 422.137 or the CMS-10913 submission. Impacted payers generally must issue expedited decisions within 72 hours and standard decisions within seven calendar days, with a distinct treatment for FFE QHP issuers, effective January 1, 2026. The same rule requires those payers to publicly report certain prior authorization metrics annually on their websites. For MA organizations, state Medicaid/CHIP fee-for-service agencies, and FFE QHP issuers, the first public reports were due by March 31, 2026. Medicaid and CHIP managed-care entities have rating-period-based reporting timelines. Those metrics are not vague volume counts; they include: the percentage of standard PA requests approved, the percentage of standard PA requests denied, the percentage of expedited PA requests approved, the percentage of expedited PA requests denied, average and median time from receipt to decision for standard requests, average and median time from receipt to decision for expedited requests, the percentage of appeals that result in overturning a PA denial, and a list of all items and services subject to PA, excluding drugs. The rule's API-build obligations -- the Prior Authorization API, updates to the Patient Access API, and the Provider Access and Payer-to-Payer APIs -- carry a later runway, with compliance pushed to January 1, 2027 after CMS heard from commenters that the original build timeline was too compressed.

The Question Worth Tracking

Four separate requirements and initiatives, four different statuses: the annual UM committee review remains mandatory; specified health-equity composition and reporting elements are subject to CMS enforcement discretion; the service-level determinations-and-appeals collection is in a voluntary 2026 pilot; and the Part C UM submission and CMS-0057-F public-transparency requirements continue on their own schedules.

The practical test for your UM program this quarter is not whether CMS "rolled back transparency" in the abstract. It is whether your compliance calendar distinguishes the completed April 30, 2026 criteria submission, the annual February 28, 2027 updates that follow, payer-type-specific public-metrics reporting dates, and the annual committee review that never stopped. Pull your UM committee minutes from the last cycle. Did the review actually evaluate whether PA policies remained consistent with Medicare coverage criteria and current clinical guidelines, or did it become a formality because everyone assumed the framework was going away? That answer will tell you more about audit exposure than a shorthand description of CMS policy. If the organization also conducted health-equity or access-impact analysis, identify which portions were maintained despite CMS's enforcement discretion.

Sources: 42 CFR 422.137, Electronic Code of Federal Regulations (current); Georgetown Medicare Policy Initiative, "CMS Suspends New Medicare Advantage Prior Authorization Transparency Rules Amid Public Concerns About Care Denials," November 19, 2025; CMS, Part C Utilization Management Annual Data Submission guidance; CMS, Interoperability and Prior Authorization Final Rule CMS-0057-F fact sheet; LeadingAge, Service Level Data Collection reporting.