Last week CMS issued its final rule “CMS Interoperability and Prior Authorization” (CMS-0057-F), unchanged from its proposed rule in 2022, which addresses prior authorizations. Prior authorization, a “utilization management” technique, requires a health insurer to consent to a doctor’s proposed course of treatment for a patient before the insurer agrees to pay for any medical services the physician wishes to provide. See July 2023 Health Law Informer Article.

On January 17, 2024, CMS issued the rule which requires certain health plans to decide prior authorization requests within 72 hours for expedited requests and seven days for non-urgent appeals. The rule applies to Medicare, Medicare Advantage (MA), Medicaid, and Children’s Health Insurance Plans (CHIP), as well as qualified health plans on the Federally-Facilitated Exchanges (collectively, “Covered Entities”). [cite] In addition to the decision timeframe requirements, the rule also requires payers to provide a specific reason for denied prior authorization requests, and allows such decisions to be communicated via portal, fax, email, mail or phone. [cite] The rule does not apply to prior authorization decisions for drugs. [cite] 

Within the regulation, CMS included new data standards intended to facilitate interoperability for the prior authorization process, and also require Covered Entities to disclose their prior authorization statistics. [cite] For example, the rule adds new measures for Merit-based Incentive Payment System (MIPS) eligible clinicians, under MIPS’ Promoting Interoperability performance category. Similarly, the rule adds new measures for eligible hospitals and critical access hospitals (CAHs), under the Medicare Promoting Interoperability Program. [cite]

Physicians and physicians’ advocates provided emphatic support for the regulation in recent years, as the prior authorization process increases the amount of time physicians spend communicating with insurers and completing paperwork. [cite]  As stated by Health and Human Services Secretary Xavier Becerra,“‘[w]hen a doctor says a patient needs a procedure, it is essential that it happens in a timely manner . . . Too many Americans are left in limbo, waiting for approval from their insurance company.’” [cite]

In order to assist patients’ understanding of their payer’s prior authorization process, the rule requires impacted payers to add information about prior authorizations via available Patient Access Application Programming Interfaces (API). [cite] Specifically, impacted payers will be required to implement and maintain a Prior Authorization API, which contains a list of covered items and services, lists documentation requirements for prior authorization approval, and which supports question and answer. This requirement must be implemented beginning in 2027. [cite]

The regulation, which is over 800 pages, will take effect 60 days after it is published in the Federal Register (which is scheduled for February 8, 2024) and insurance companies and State Medicaid and CHIP programs will have to begin complying with the rule in 2026. [cite]