For the first time, you can look up a Medicare Advantage organization's denial rate and its appeal-overturn rate before you sit down across from its medical director. That is new. Since April 1, MA organizations, Medicaid managed care plans, CHIP managed care entities, state Medicaid and CHIP fee-for-service programs, and QHP issuers on the federally facilitated exchanges have been required under CMS-0057-F to publish prior authorization metrics for the prior calendar year on their websites. The first tranche - calendar year 2025 data - was due March 31, 2026.

What has changed this month is the plumbing. In July 2026, CMS published an updated Prior Authorization Metrics Reporting — Overview & Template. The substantive move is that posting metrics somewhere a person cannot reach through ordinary navigation from the payer's public-facing website does not satisfy the requirement that the information be publicly accessible. Password-protecting the file does not count, and placing it only behind a provider- or member-portal login does not count. The CMS template itself is recommended rather than mandatory, but its clarification of the public-access standard is significant.

That is a real enforcement clarification, and it matters, because the reason most UM leaders have not used this data yet is that a meaningful share of it was functionally unfindable. But accessibility was never the interesting constraint. The interesting constraint is what the metric set is built to measure - and the answer is not what a physician advisor building a payer strategy needs it to be.

What the template actually requires

Read the CMS template rather than the trade summaries, because the requirement is narrower than the coverage suggests. For standard (non-urgent) requests, aggregated across all items and services, an impacted payer must publish the percentage approved during the calendar year, the percentage denied, the percentage approved after appeal, and both the mean and median elapsed time between the payer's receipt of the request and its determination. The same four apply to expedited requests, except that approval-after-appeal is optional there. Payers must also publish the percentage of requests where the review timeframe was extended under programmatic rules and the request was subsequently approved - for MA, that extension authority is 42 CFR 422.568(b)(2) and 422.572(b), up to fourteen days.

Three exclusions do most of the damage. First, the metrics exclude drugs entirely. Part B drug prior authorization sits inside the medical benefit and is captured; Part D is not, and the medical-items-and-services list a payer must publish is explicitly a non-drug list. If your denial pain is concentrated in specialty infusion, this data set will not see it.

Second, MA organizations report at the contract level. Not the plan level. A single MA contract can carry multiple benefit packages with materially different UM postures, and they are blended into one number. Compare that with the rules for other segments in the same template: Medicaid and CHIP managed care report at the plan level, and QHP issuers report at the issuer level. Medicare Advantage - the segment with the highest-stakes UM interface for most hospitals - got the coarsest reporting unit of the three.

Third, and most consequential for anyone trying to build an argument out of these numbers: payers are not required to publish counts, only percentages. The template supplies recommended denominators and CMS now says the specified numerators and denominators are "expected," but expected is not required. A 5% denial rate on an enormous request volume and a 5% denial rate on a small one describe entirely different operational realities for your UM staff, and the published data cannot distinguish them.

What the first year of data showed

KFF's analysis of the CY2025 filings - covering fourteen insurers representing roughly 25 million MA enrollees, about 69% of MA enrollment - found that MA organizations denied 12% of standard prior authorization requests and 10% of expedited ones. Medicaid managed care denied 14% of standard requests; ACA Marketplace insurers denied 18%.

The number that should reset your priors is the appeal outcome. Sixty-seven percent of appealed MA prior authorization denials were overturned. Two out of three. And the variation across carriers is enormous: Centene overturned more than 90% of appealed denials, while Kaiser Permanente overturned 40%. Denial rates spread similarly wide - 5% at Elevance to 17% at UnitedHealth Group on standard requests.

Median response times, meanwhile, were unremarkable. Across the six large MA insurers KFF examined, medians ran from under one day to two days for standard requests - comfortably inside the seven-calendar-day standard determination window that took effect January 1, 2026, and the 72-hour expedited window.

What you can operationalize, and what will mislead you

Here is the honest read. A high overturn rate is the most actionable single number in the file, because it is a statement about the quality of the initial determination, not about the clinical appropriateness of your requests. A contract overturning two-thirds of what it appealed is telling you its first-pass review is not doing the work. That is a defensible thing to put in front of a medical director, and it is a defensible thing to put in front of your own leadership when you are arguing for appeal-nurse FTEs - the marginal appeal at a high-overturn contract has an expected value that is not hard to compute.

A denial rate, taken alone, will mislead you. Two mechanisms do it. Gold-carding is the first: an MA organization that exempts its highest-approval-rate providers from prior authorization altogether has removed the easy approvals from its own denominator, and its published denial rate rises even as its actual friction falls. The second is volume, and you cannot correct for it, because the counts are not published. KFF's earlier work on MA determinations found that the number of determinations per enrollee ran inversely to denial rate - insurers requesting more denied a smaller share - with the result that absolute denials per enrollee looked similar across carriers with quite different published rates. A payer with a low denial rate can be denying more care than a payer with a high one.

And do not read a median response time as a compliance signal. Half of all determinations, by definition, took longer than the reported median. The template requires no range, no distribution, and no share exceeding the regulatory timeframe. Under the updated overview, medians below one day must at least now be reported in hours instead of rounded to "0 days" - a small fix to a metric that still cannot tell you how often a payer blew the clock.

What is coming

The 2026 CMS Interoperability Standards and Prior Authorization for Drugs proposed rule would close several of these gaps: mandatory numeric counts alongside percentages, standardized denominators rather than suggested ones, a new metric for requests that remain denied after appeal, and separate reporting for prescription drug prior authorization. It would not require breakouts by service category - which remains the single most valuable thing a UM team could be given and still is not.

Separately, CMS has stood up a voluntary pilot for MA organizations to submit more granular prior authorization data including service-category detail, with stated intent to make detailed reporting mandatory beginning with the 2027 plan year.

Until then, the practical move is narrow and worth making anyway: pull the published metrics for every MA contract you hold volume with, build a two-column view of denial rate against overturn rate, and find the contracts where both are high. That intersection - heavy denial, poor first-pass accuracy - is where your appeal capacity earns its keep. What is your overturn rate on the contracts you are not currently appealing aggressively?