CMS Prior Authorization Rules for Medicare Advantage Plans

CMS-0057-F, the Interoperability and Prior Authorization Final Rule, took effect January 1, 2026, and it rewrites how Medicare Advantage plans have to handle prior authorization decisions. It is a distinct rule from CMS-0062-P, the proposed drug prior authorization rule still working through comment, and the two get conflated constantly in practice management circles. That confusion has a cost. Practices that don't separate what's binding from what's still proposed end up building workflows around requirements that don't exist yet, or missing the ones that already do.

The rule regulates payers, not providers. Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan issuers on the federal exchanges are collectively the "impacted payers" under CMS's language. A physician's office has no compliance obligation under CMS-0057-F. But that legal distinction doesn't buy practices any operational slack, because every timeline, every denial-notice requirement, and every gold-carding provision changes what shows up in a practice's inbox and how fast it has to respond to it. The obligations sit with the payer. The consequences land on the provider.

The four changes the rule imposes that practices will feel first

Four provisions matter most, and all four are framed in the rule as payer duties with direct downstream effects on how a practice runs its authorization queue.

The first is timeline compression. Standard prior authorization requests now require a decision within 7 calendar days, down from a baseline that had stretched to 14 days under prior norms. Expedited or urgent requests must be decided within 72 hours. For a practice scheduling a procedure two or three weeks out, that means either building in a buffer or not needing one. CMS projects, and this is a projection, not a measured outcome, that the combined effect of faster decisions and electronic processing will save the system approximately $15 billion over ten years by cutting administrative waste. CMS's projected $15 billion in savings may or may not materialize, but the January 1, 2026 timeline itself is already in effect. It is, as of January 1, 2026.

The second is specificity in denials. Payers can no longer issue a denial with a generic code or boilerplate language. They have to state the actual clinical reason. This sounds like a paperwork nuance, but an appeal built on informed argument succeeds where an appeal built on guesswork does not. A practice that knows why a claim was denied can resubmit with the missing documentation or challenge the clinical rationale directly. A practice staring at a form-letter rejection is stuck reverse-engineering the payer's logic.

Third, and tied directly to that specificity requirement, is mandatory gold-carding. MA plans now have to exempt providers with strong approval histories from routine prior authorization review. The thresholds and criteria are payer-defined, but they have to be published. A practice can actually go find out where the bar sits. Gold-carding doesn't apply itself. A provider has to track approval rates and make the case for exemption. The rule creates the pathway for gold-carding relief, but nobody at the payer is proactively flagging high-performing practices for it.

Fourth: the rule includes protections against retroactive denials and requires public reporting of denial and approval data, making the data discussed below possible to analyze.

The API compliance split: what is live in 2026 versus what is coming in 2027

Not everything in CMS-0057-F arrived on the same clock. The behavioral requirements, faster decisions, specific denial reasons, gold-carding, retroactive-denial protections, and public reporting, took effect January 1, 2026, and are binding now. The technical infrastructure requirements did not.

Four FHIR API mandates, Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization APIs, were originally slated for January 2026 as well. CMS pushed all four back to January 1, 2027 after stakeholder comments made clear the industry needed more runway to build the electronic infrastructure. That delay matters enormously for how practices should read the current landscape: MA plans are legally required, right now, to hit the 7-day and 72-hour clocks and to issue specific denials, but they are not yet required to have the electronic prior authorization API infrastructure in place to make that process automated. A lot of the friction practices report in 2026, phone calls, faxes, portals that don't talk to each other, is a direct consequence of that gap. The behavioral obligation exists without the technical scaffolding to support it efficiently.

Layered on top of that timeline is CMS-0062-P, the proposed rule covering drugs, which would extend electronic prior authorization to medical-benefit drugs and, for certain payers, pharmacy-benefit drugs, starting October 1, 2027, a proposed date on a proposed rule with nothing final yet. That's a proposed date on a proposed rule. Nothing about it is final.

What the first public denial-rate data reveals about how MA plans behave

The public reporting provision of CMS-0057-F produced its first real payoff in March 2026, when publicly reported data showed an average Medicare Advantage prior authorization denial rate of 7.7%. That figure serves as the industry benchmark, but the spread beneath it is enormous, which makes it close to meaningless on its own.

Elevance came in at 5%. UnitedHealth came in at 17%. That's more than a threefold difference between two major MA payers operating under the same federal rule, the same timeline requirements, and, in theory, the same clinical evidence base. A denial rate that varies by a factor of three depending on which insurer issued the plan is not a clinical finding. It's a business practice finding.

The variation isn't confined to Medicare Advantage. A KFF analysis found that denial rates across Medicare Advantage, Medicaid managed care, and ACA marketplace plans ranged from 12% to 18% for standard prior authorization requests in 2025. Geography compounds it further. Analysis of the CMS public data shows average denial rates ran highest in Delaware (13.3%), Arkansas (13.2%), and Kentucky (13.0%), and lowest in North Dakota (3.6%), California (4.2%), and Hawaii (5.3%), among states with at least three reporting MA plans. A patient's odds of getting a procedure approved on the first try depend measurably on which state they live in and which insurer sold them their plan, not on the clinical merits of the request itself.

The 2026 enrollment disruption: a new denial category the rule did not anticipate

CMS-0057-F was built to fix procedural friction inside a stable enrollment landscape. That landscape moved under it. Roughly 2.9 million beneficiaries were pushed into new MA plans in 2026 after a round of plan exits and service area reductions, and the rule has no mechanism for what happens next: prior authorizations issued under the old plan simply do not transfer to the new one.

That produces a specific, entirely avoidable failure mode. A patient shows up for a scheduled procedure holding an authorization that was valid under a plan that no longer covers them. Two things happen from there. Either the service gets cancelled on the spot, which delays care the patient may genuinely need, or the service goes forward anyway and generates a denial once the claim hits the new payer's system, a denial that was preventable if anyone had caught the authorization gap before the appointment. Practices operating in markets where a major MA plan exited are reporting denial spikes of 20 to 30 percent above their normal baseline, and the cause traces directly back to these authorization mismatches rather than to any change in clinical decision-making.

This is a structural gap CMS-0057-F didn't anticipate, because it's a coverage-continuity problem, not a processing-speed problem. Faster decision timelines don't help a practice whose patient never should have needed a new authorization request.

Why most denied MA prior authorizations are never appealed

Only 11.5% of denied MA prior authorization requests were ever appealed. That's the number that should stop most practice administrators mid-sentence, because it means nearly 9 out of 10 denials simply get absorbed: care delayed, resubmitted at a loss, or abandoned.

The reason that number matters so much is what happens on the rare occasions physicians do appeal. They won 80.7% of the time. That is not a modest edge. An overturn rate that high doesn't describe a system correctly screening out inappropriate requests, it describes a system that denies first and reconsiders only under pressure. Medicare Advantage posted a 66.4% appeal overturn rate in 2025, with that share of appealed denials reversed. Compare that to ACA Exchange plans, where appeals succeeded 41.3% of the time. MA's overturn rate sits well above that mark, which reinforces the same conclusion from a different angle: a meaningful share of MA denials are wrong on arrival, and they only get corrected when someone with enough time and staff capacity pushes back.

Most practices don't have that time. Appeals take documentation, staff hours, and a willingness to absorb the administrative cost of fighting a decision that might just get reversed anyway. The 11.5% appeal rate reflects the cost of finding out, not proof that most denials are justified. It's evidence that most practices can't afford to find out.

WISeR: how prior authorization is now entering traditional Medicare fee-for-service

Prior authorization has historically been a Medicare Advantage phenomenon, largely absent from traditional fee-for-service Medicare. That changed on January 1, 2026, when CMS launched the Wasteful and Inappropriate Service Reduction Model, WISeR, a six-year initiative introducing prior authorization requirements into fee-for-service Medicare for a defined set of services CMS considers at elevated risk for fraud, waste, and abuse.

The model runs in six states: Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington. It covers four specific service categories: percutaneous image-guided lumbar decompression for spinal stenosis, arthroscopic lavage and debridement for osteoarthritic knee, and epidural steroid injections for pain management (excluding facet-joint injections), among other defined service categories. It applies across hospital outpatient departments, ambulatory surgery centers, home settings, and physician offices, but hospital inpatient care is excluded.

WISeR matters beyond its narrow scope because of what it signals. Fee-for-service Medicare has long been the alternative providers pointed to when MA's authorization burden got heavy: traditional Medicare, for all its own complexity, didn't make you ask permission first for these kinds of services. That's no longer categorically true, even if it's true for most services in most states right now. A six-year model with defined geography and a defined service list is a pilot, and pilots that succeed by CMS's internal metrics tend to expand.

Drug prior authorization under the proposed CMS-0062-P rule

Despite its reach, CMS-0057-F explicitly excluded drugs from its electronic prior authorization requirements. CMS-0062-P is the rule built to close that gap, and it remains proposed, not final. The public comment period for CMS-0062-P closed June 15, 2026.

The proposal would extend electronic prior authorization to drugs covered under a medical benefit, with a compliance date of October 1, 2027 for impacted payers. For a specific subset of payers, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the federally facilitated exchanges, the rule also proposes electronic prior authorization for pharmacy-benefit drugs, built around standardized electronic transaction formats, on that same October 2027 timeline.

None of it is locked in. CMS-0062-P could shift, narrow, or delay between now and finalization, the same way CMS-0057-F's own API deadlines slid a year once comments came in. Practices building compliance roadmaps around CMS-0062-P should treat every date in it as provisional until CMS issues a final rule, and should keep it entirely separate, in their own planning documents and in their own thinking, from the CMS-0057-F obligations that are already law.