On January 18, 2024, CMS released a pre-publication version of a final rule (the Final Rule) that will require Medicare Advantage organizations (MA or Part C), Medicaid and the Children’s Health Insurance Program (CHIP) fee-for-service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and issuers of Qualified Health Plans (QHPs) on the Federally-Facilitated Exchanges (FFEs)(collectively “impacted payers”) to implement a standards-based Patient Access API. According to CMS, the Final Rule changes are designed to improve the electronic exchange of health care data and streamline processes related to prior authorization and medical care. Impacted payers have until compliance dates in 2027 to meet the API requirements in the Final Rule. The Final Rule is scheduled to be published on February 8, 2024.

Patient Access API

The Final Rule will require impacted payers to implement a standards-based Patient Access API and information about certain prior authorizations to the data available via that Patient Access API. CMS believes that the Final Rule changes will improve patients’ understanding of their payer’s prior authorization process and its impact on their care.

Provider Access

The Final Rule also will require impacted payers to implement and maintain a Provider Access API to share patient data with the patient’s in-network providers, and to make the following data must be made available via the Provider Access API: Individual claims and encounter data (excluding provider remittances and enrollee cost-sharing information); data classes and data elements in the United States Core Data for Interoperability (USCDI); and prior authorization information (excluding those for drugs).

The Final Rule will also require impacted payers to maintain an attribution process to associate patients with their in-network or enrolled providers and to allow patients to opt out of having their data available to providers. The Final Rule will require impacted payers to provide patients with plain language information about the benefits of API data exchange with their providers and their ability to opt out.

Payer-to-Payer API

In addition, the Final Rule will require impacted payers to implement and maintain a Payer-to-Payer API to make available claims and encounter data (excluding provider remittances and enrollee cost-sharing information), data classes and data elements in the USCDI data set and information about certain prior authorizations (excluding those for drugs). According to CMS, this will help improve care continuity when a patient changes payers. Impacted payers will be required to provide patients with plain language information about the benefits of Payer-to-Payer API data exchange and their ability to opt in.

Prior Authorization Processes

Prior Authorization Decision Timeframes: Impacted payers must send prior authorization decisions within 72 hours of receipt for expedited requests and seven calendar days for standard requests.

Provider Notice, Including Denial Reason: Beginning in 2026, impacted payers must provide a specific reason for denied prior authorization decisions via portal, fax, email, mail, or phone. This requirement does not apply to prior authorization decisions for drugs. According to CMS, this requirement is intended to facilitate communication and transparency between payers, providers, and patients, and to improve providers’ ability to resubmit prior authorization requests.

Prior Authorization Metrics: Impacted payers must publicly report certain prior authorization metrics annually by posting them on their website.

CMS is finalizing these policies with a compliance date starting January 1, 2026, and the initial set of metrics must be reported by March 31, 2026.

Electronic Prior Authorization Measure for MIPS Eligible Clinicians and Eligible Hospitals and Critical Access Hospitals (CAHs)

The Final Rule will add a new measure (Electronic Prior Authorization) to the Health Information Exchange (HIE) objective for the MIPS Promoting Interoperability performance category and the Medicare Promoting Interoperability Program. MIPS eligible clinicians will report the Electronic Prior Authorization measure by attestation beginning with the Calendar Year (CY) 2027 performance period/CY 2029 MIPS payment year, and eligible hospitals and CAHs will be required to report the measure beginning with the CY 2027 EHR reporting period.

Required Standards for APIs

The required standards and implementation specifications in this final rule include the following:

• United States Core Data for Interoperability (USCDI)
• HL7® Fast Healthcare Interoperability Resources (FHIR®) Release 4.0.1
• HL7 FHIR US Core Implementation Guide (IG) Standard for Trial Use (STU) 3.1.1
• HL7 SMART Application Launch Framework Implementation Guide Release 1.0.0
• FHIR Bulk Data Access (Flat FHIR) (v1.0.0: STU 1)
• OpenID Connect Core 1.0

Recommended Implementation Guides for APIs

CMS encourages impacted payers to use the following guides to increase interoperability:

• HL7 FHIR CARIN Consumer Directed Payer Data Exchange (CARIN IG for Blue Button®) IG Version STU 2.0.0
• HL7 SMART App Launch IG Release 2.0.0 to support Backend Services Authorization
• HL7 FHIR Da Vinci Payer Data Exchange (PDex) IG Version STU 2.0.0
• HL7 FHIR Da Vinci PDex US Drug Formulary IG Version STU 2.0.1
• HL7 FHIR Da Vinci PDex Plan-Net IG Version STU 1.1.0
• HL7 FHIR Da Vinci Coverage Requirements Discovery (CRD) IG Version STU 2.0.1
• HL7 FHIR Da Vinci Documentation Templates and Rules (DTR) IG Version STU 2.0.0
• HL7 FHIR Da Vinci Prior Authorization Support (PAS) IG Version STU 2.0.1

The unpublished Final Rule is available here. The CMS fact sheet is available here, and the CMS press release is available here.