On January 1, 2027, the next phase of requirements from CMS’ Interoperability and Prior Authorization final rule (CMS-0057-F) takes effect. In this phase, payors impacted by the rule must implement the required Prior Authorization Application Programming Interface (API).
While this is primarily a payor deadline, hospitals also have reason to prepare. In this article, we explore how hospitals can adapt to new Medicare Promoting Interoperability Program reporting requirements and transforming prior authorization workflows. These actions can also help hospitals prepare for further anticipated regulatory requirements and incentives supporting the use and standardization of API connections consistent with CMS’ broader goals around interoperability and standardized data exchange.
How Will Prior Authorization APIs Affect Medicare Promoting Interoperability Program Reporting?
Beginning with the 2027 reporting period, eligible hospitals and critical access hospitals (CAHs) have a new measure under the Medicare Promoting Interoperability Program tied directly to submitting a prior authorization through an API connection. The measure requires hospitals to attest that they used certified electronic health record (EHR) technology to request a prior authorization through a payor’s Prior Authorization API for at least one medical item or service, excluding drugs, during the reporting period. The measure starts in calendar year 2027, but will become mandatory in calendar year 2028.
What Can Hospitals Expect From Payor Prior Authorization APIs?
CMS requires payors to implement Prior Authorization APIs that allow providers to determine whether a payor requires prior authorization for an item or service, identify the payor’s documentation requirements, submit the authorization request, and receive the payor’s response electronically within the EHR system. The ability to achieve this functionality will be dependent on payor, provider, and EHR system capabilities and collaboration.
Hospitals should plan for a hybrid authorization workflow environment, as the API requirement does not apply to all payors. Even for payors who are impacted by the rule, adherence to the new requirements and provider infrastructure to support them will vary.
How Do API-Based Workflows Differ From Other Electronic Authorization Workflows?
Many hospitals already submit prior authorizations electronically today. Staff log into a payor portal, key in patient and service details, attach documentation, and check back for status. These processes are electronic in the traditional sense, but they are not API-based.
The key difference for API-based workflows under the CMS-0057-F Prior Authorization API requirements is that communication and important workflow steps can take place between hospitals and payors directly in the EHR, as outlined below:
| Key Workflow Step | Common Manual or Payor Portal Workflow | Prior Authorization API-Based Workflow |
|---|---|---|
| Determining Whether Authorization Is Required | Staff check payor websites, internal grids, or call the plan. | The system asks the payor and returns the answer in the EHR workflow. |
| Assembling Documentation | Staff locate records, then print, upload, or fax. | Payor requirements return electronically, and the clinical information can be incorporated into the request from the EHR. |
| Submitting the Request | Staff manually key the request into a separate portal, outside the EHR. | The request is sent from the EHR to the payor, without re-keying. |
| Receiving the Decision | Staff check the portal, fax, or phone for status. | The payor’s decision, or a request for more information, returns electronically. |
How Can Hospitals Prepare Their Operations for API-Based Workflows?
Hospitals that use the current and upcoming year to assess the impact of Prior Authorization APIs and build and test their operational response will be better prepared to comply with current and upcoming regulations and develop a plan for the future. Important focus areas include:
- Technology Readiness: Confirm when EHR and revenue cycle vendors will deliver electronic prior authorization capabilities that leverage the required Prior Authorization APIs. Key details include the cost and release date of the new capabilities, as well as the effort required to implement them.
- Payor Strategy: Determine the volume of plans in the payor mix that are subject to the Prior Authorization API requirements. Identify which plans are affected and open conversations about go-live timing, testing, and connection requirements.
- Revenue Cycle: Prepare for workflow transformation in the revenue cycle and other operational processes as authorization becomes more automated and exception-based, with increased focus on accurate and timely intake of patient information and clinical documentation.
Hospitals should also monitor regulatory updates and guidance as CMS-0057-F and related regulations continue to evolve and take shape.
How Forvis Mazars Can Help With Prior Authorization APIs
Our healthcare and revenue cycle professionals help hospitals prepare and adapt to prior authorization and interoperability changes and other evolving regulatory requirements. If you have questions about how the January 1, 2027 Prior Authorization API changes may affect your operations or how your organization can prepare, please reach out to our team today.