On April 10, 2026, the Centers for Medicare & Medicaid Services (CMS) issued the Interoperability Standards and Prior Authorization for Drugs proposed rule, along with a fact sheet and press release.

In recent years, CMS has issued a series of rules advancing interoperability and prior authorization processes; however, many policies have excluded drugs. CMS has received extensive stakeholder feedback recommending that policies apply to drugs and, accordingly, proposes policies to that effect in this rule. Impacted payers include Medicare Advantage (MA) organizations, state Medicaid and Children’s Health Insurance Program (CHIP) fee-for-service (FFS) programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs).

In the rule, CMS proposes the following policies, among other policies listed on page 3 of this summary:

• Expand and standardize electronic prior authorization (ePA) requirements for drugs;
• Improve denial communications by requiring state Medicaid, CHIP, and QHP issuers on the FFEs to provide specific reasons for all prescription drug prior authorization denials to providers;
• Update decision timeframes for prior authorization determinations across Medicaid, CHIP, and QHPs on the FFEs to require faster decisions;
• Enhance prior authorization public reporting requirements for non-drug items and services, and newly require prior authorization public reporting for certain drugs; and
• Define “failure to report”, which would allow CMS to impose a civil monetary penalty (CMP) on an entity that fails to provide the records needed for a CMS Open Payments program audit.

CMS also seeks public input on Requests for Information (RFIs) on five topics:

• Improving and expanding electronic events notifications for value-based care and care coordination;
• Increasing health care resiliency, given the increase in cybersecurity threats;
• Improving implementation and oversight of payer application programming interface (API) technology;
• Ways to streamline the step therapy process through technology and data sharing, including by allowing payers to access historical patient information; and
• Prior authorization for laboratory tests and durable medical equipment, prosthetics, orthotics, and supplies items (DMEPOS).

In addition to the proposals outlined in this summary, CMS also proposes to:

• Modify interoperability standards for the Provider Access, Payer-to-Payer, and Prior Authorization API (referred to as the interoperability APIs);
• Require payers to submit interoperability API usage metrics on an annual basis (see page 3 of the CMS metrics summary for more information);
• Require payers to report their API endpoints and associated information for CMS to publish in a central location;
• Modify existing Health Insurance Portability and Accountability Act (HIPAA) standards to require adoption of the Fast Healthcare Interoperability Resources (FHIR) standard and certain FHIR implementation guidelines for transactions related to prior authorization, among other proposals;
• Require issuers offering small group market qualified health plans on the federally-facilitated small business health options program exchanges; and
• Adopt health information technology standards and information by reference, allowing for faster adoption of newer versions of standards without additional rulemaking.

This proposed rule is scheduled to be published in the Federal Register on April 14, 2026, and comments are due on June 15, 2026.

ELECTRONIC PRIOR AUTHORIZATION FOR DRUGS

Pages 86-120 of the unpublished rule

CMS proposes a series of updates to expand and standardize ePA for drugs.

Expansion of the Prior Authorization API to Medical Benefit Drugs

CMS proposes to require impacted payers to expand the scope of the existing FHIR-based Prior Authorization API to include drugs covered under the medical benefit, such as provider-administered therapies reimbursed under Medicare Part B or analogous coverage pathways. Currently limited to non-drug items and services, the API would be enhanced to allow providers to determine whether prior authorization is required, access documentation requirements, submit requests, and receive decisions electronically within their electronic health record (EHR) or other health information technology (IT) systems. CMS emphasizes that this change would not require the development of a new API, but rather the incorporation of drug-specific coverage and documentation rules into existing infrastructure. The proposed compliance date for this expansion is October 1, 2027.

Standardization of Pharmacy Benefit Prior Authorization Using NCPDP SCRIPT

For drugs covered under the pharmacy benefit, CMS proposes to require Medicaid, CHIP, and QHP issuers on the FFEs to support an adopted version of the National Council for Prescription Drug Programs (NCPDP) SCRIPT standard for electronic prior authorization. This would align these payers with longstanding Medicare Part D requirements and establish a consistent, nationwide standard for transmitting prior authorization requests and responses for pharmacy-dispensed drugs. While CMS does not propose to mandate provider use of ePA, payers would be required to make the capability available and respond using the same standard. The proposed compliance date is October 1, 2027.

Adoption of Complementary NCPDP Standards to Support Real-Time Prescribing

To further streamline prescribing and reduce inefficiencies in prior authorization workflows, CMS proposes to require additional NCPDP standards that support real-time access to coverage information. Specifically, the Formulary and Benefit (F&B) standard would enable providers to view plan-level coverage and prior authorization requirements at the point of prescribing, while the Real-Time Prescription Benefit (RTPB) standard would deliver patient-specific information, including coverage status, alternative therapies, and expected out-of-pocket costs. Together, these standards are intended to reduce trial-and-error prescribing, minimize unnecessary prior authorization requests, and improve decision-making at the point of care. The proposed compliance date is October 1, 2027.

Clarification of Medical vs. Pharmacy Benefit Framework

CMS formalizes a functional distinction between drugs processed under the medical benefit and those processed under the pharmacy benefit, which determines the applicable electronic standard. Drugs administered in clinical settings and billed through medical claims systems (e.g., infusions, injections) would fall within the scope of the FHIR-based Prior Authorization API, while retail and self-administered drugs processed through pharmacy systems would continue to use NCPDP SCRIPT and related standards. CMS emphasizes that the categories of drugs are intended to be mutually exclusive and collectively exhaustive, ensuring that all drugs requiring prior authorization are supported through an electronic pathway without duplicative processes.

Refinement of Exceptions, Exemptions, and Implementation Flexibility

CMS proposes to modify existing flexibility policies to reflect the expanded scope and standardization of ePA requirements. Notably, the agency would eliminate the ability for state Medicaid and CHIP fee-for-service programs with small populations to obtain exemptions from Prior Authorization API requirements, citing potential conflicts with HIPAA standardization, if finalized. At the same time, CMS proposes to maintain and expand pathways for time-limited extensions based on implementation challenges, such as funding constraints or procurement timelines, and to establish a formal exception process for QHP issuers similar to other interoperability requirements.

COMMUNICATIONS AND DECISION TIMEFRAMES FOR PRIOR AUTHORIZATIONS

Pages 121-169 of the unpublished rule

Building on its 2024 Interoperability and Prior Authorization final rule¹, CMS proposes a comprehensive set of updates to prior authorization requirements for drugs and non-drug items and services across Medicaid, CHIP, and QHPs offered on the FFEs. The proposals focus on improving denial communications, standardizing decision timeframes, and enhancing transparency and alignment across payers.

Denial Reason Requirements

CMS proposes to require state Medicaid and CHIP FFS programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the FFEs to provide specific reasons for all prescription drug prior authorization denials to providers, aligning with requirements for non-drug services. This requirement would take effect on October 1, 2027.

Prior Authorization Decision Timeframes

CMS proposes to standardize and clarify prior authorization decision timeframes across payers. These changes would be effective October 1, 2027.

Decision Timeframes for Drugs

• State Medicaid FFS Programs, Medicaid Managed Care Plans, and CHIP Managed Care Entities: Covered outpatient drug (COD) under section 1927(k)(2) of the Social Security Act (the Act) are subject to statutory prior authorization timeframes (no later than 24 hours after receiving a request).² As drugs that are not CODs under section 1927(k)(3) of the Act³ do not have an applicable statutory decision timeframe, CMS proposes to require these entities to make prior authorization decisions for such drugs within 7 calendar days for standard requests and 72 hours for expedited requests, consistent with non-drug items and services. The agency explains that these drugs are often reviewed as part of a single prior authorization request that includes both the drug and associated services, and separate drug-specific timeframes could create conflicting standards within a single episode of care.
• State CHIP FFS Programs: CMS proposes to shorten the current 7-calendar-day standard and 72-hour expedited timeframe for prescription drugs for which federal financial participation (FFP) is available under section 2110(a)(6) of the Act to align with the Medicaid FFS timeframe for CODs. If finalized, CHIP FFS programs would be required to provide notice of prior authorization decisions as expeditiously as the enrollee’s medical needs require, but no later than 24 hours after receipt of a request.
• QHP Issuers on the FFEs: CMS proposes requiring notification of prior authorization decisions for drugs as expeditiously as the enrollee’s condition requires, but no later than 72 hours for standard requests and 24 hours for expedited requests.

The agency does not propose additional timeframe requirements for MA organizations (MAOs) or Part D sponsors, citing existing requirements for Part B and Part D drugs, but requests comment on whether certain Part A drugs not included in bundled services should be subject to prior authorization decision timeframes.

Decision Timeframes for Non-Drug Items and Services

• State Medicaid and CHIP FFS Programs: CMS proposes technical revisions clarifying that existing standards of 7 calendar days for standard requests and 72 hours for expedited requests represent maximum allowable timeframes for prior authorization decisions. States may adopt shorter timeframes but not exceed these limits.
• QHP Issuers on the FFEs: CMS proposes requiring notification of prior authorization decisions for non-drug items and services as expeditiously as the enrollee’s condition requires, but no later than 7 calendar days for standard requests and 72 hours for expedited requests.

Transparency and Reporting

CMS proposes standardizing public reporting of prior authorization metrics for both drugs and non-drug items and services to improve transparency and comparability across payers. See page 2 of the CMS metrics summary for further information.

• Non-Drug Items and Services: CMS would require reporting of numeric counts, in addition to percentages, for certain existing prior authorization metrics and would add new metrics, including denials after appeal and extended review periods. Reporting timelines would continue to vary by payer type: MAOs, state Medicaid and CHIP FFS programs, and QHP issuers on the FFEs would report by March 31 following the reporting year, while Medicaid and CHIP managed care entities would report within 90 days of the end of each plan’s rating period and would report metrics at both the program and plan levels. These reporting requirements would take effect beginning on the effective date of the final rule.
• Drugs: CMS proposes annual public reporting of prior authorization metrics for drugs (excluding Part D drugs⁴), beginning in 2028, using 2027 data, including approval and denial rates, counts and percentages, decision times, and lists of drugs subject to prior authorization. Reporting timelines would align with those for non-drug items and services.

OPEN PAYMENTS CIVIL MONETARY PENALTY FOR “FAILURE TO REPORT”

Pages 272-279 of the unpublished rule

The Open Payments program requires manufacturers of drugs, devices, biologicals, or medical supplies, and group purchasing organizations (GPOs) to submit information about payments made to healthcare providers and teaching hospitals on an annual basis. To improve CMS’s oversight of reporting compliance, including through audits, CMS proposes adding a definition of “failure to report” at 42 CFR 403.902, which would allow CMS to impose a civil monetary penalty (CMP) on an entity that fails to provide the records needed for a CMS audit. CMS proposes that a manufacturer or GPO failing to provide the information requested within 30 calendar days of an audit request would be considered a “failure to report”.

REQUESTS FOR INFORMATION

Pages 346-372 of the unpublished rule

Electronic Event Notifications for Value-Based Care and Care Coordination

In the 2020 CMS Interoperability and Patient Access Final Rule,⁵ CMS updated the Conditions of Participation (CoP) to require hospitals to make reasonable efforts to send electronic event notifications to post-acute care (PAC) providers, suppliers, and other entities involved in a patient’s care. In this proposed rule, CMS is seeking feedback on several key areas related to electronic event notifications:

• Use and content of patient event notifications: Current data standards, challenges to standardization, operational or technical barriers, privacy and data governance considerations, and whether additional data elements or process guidance are needed to improve notification quality.
• Type of providers and entities receiving patient event notifications: Which providers and entities receive notifications (including accountable care organizations (ACOs)), barriers to sharing notifications, processes for obtaining patient authorization, challenges faced by PAC providers, and opportunities to improve consistency and standardization.
• Complementary policy approaches: How CMS could collaborate with other agencies or leverage existing programs to strengthen and expand the use of patient event notifications.
• Technical approaches to patient electronic event notification: Current technologies hospitals use, which approaches provide the most value, and how policy could encourage or require adoption of more advanced capabilities.
• Enforcement mechanisms: Enforcement mechanisms CMS could implement, including guidance, technical assistance, or additional CoPs.

Increasing Healthcare Resiliency

Despite efforts to strengthen resilience across the healthcare system, cyberattacks remain frequent and pose serious risk as incidents can result in data breaches, loss of patient privacy, and significant disruptions for providers. To address these challenges, CMS seeks feedback on strategies for improving healthcare system resilience, including how it can use its authority to enhance regulations and guidance that support preparedness, response, recovery, and other capabilities for cyber threats. Specifically, CMS requests feedback on:

• Cybersecurity: How existing CMS regulations influence cybersecurity practices, potential new or revised requirements to better safeguard patient data, key challenges and barriers faced by healthcare providers, and best practices or solutions to strengthen organizational resilience.
• Standards and technologies: Which standards could CMS re-evaluate to better support the healthcare system, opportunities to improve interoperability, the potential role of Trusted Exchange Framework and Common Agreement (TEFCA) in enhancing resilience, and how current standards contribute to or hinder cybersecurity efforts.
• Point-to-point connections: Benefits and challenges of increasing point-to-point connections across the healthcare system, the role of clearinghouses, and options for streamlining transitions and improving connectivity.

Improving Implementation of Payer Application Programming Interface Technology

CMS has received reports from stakeholders of problematic API implementations, which may impede the security of electronic health information (EHI), patient safety, and interoperability. CMS is thus seeking feedback on:

• “Roadmap” for the consistent implementation of payer API technology: Oversight mechanisms, API implementation difficulties, aspects of API implementation that should be prioritized for testing conformance, existing and new API testing tools, and potential requirements for interoperability testing.
• Certification of payer API technology: Value of certification, whether certification should be mandatory or voluntary, and the certification criteria and process.

Step Therapy

While CMS permits the use of step therapy, CMS has found that requirements may lead to difficulties for beneficiaries, such as when an individual switches plans and may have to retry suboptimal medications due to step therapy requirements being re-imposed. As a result, CMS is seeking input on how increased interoperability of IT systems could enhance transparency in utilization management policies, such as step therapy, by giving payers access to historical drug regimens that patients have already tried and automating this reporting process to minimize provider burden. Specifically, CMS is soliciting input on:

• Technology and step therapy: How data sharing and technology, such as the Payer-to-Payer API, might streamline step therapy processes, and how interoperability could improve providers’ and patients’ understanding of step therapy criteria.
• Step therapy by the previous payer: How payers currently apply step therapy criteria to a new patient that is currently stable on a medication, how payers evaluate step therapy criteria from a previous payer and the determinations they make based on this criteria, appropriate timeframes for honoring a step therapy determination from a previous payer, and the information useful to make a decision about accepting a prior payer’s decision.

Prior Authorization for Laboratory Tests and Durable Medical Equipment, Prosthetics, Orthotics, and Supplies Items

CMS notes that prior authorization issues are complex and can involve delays in patient care, administrative burden on health care professionals, differing requirements across payers, and difficulties with coordination between the provider and the laboratory or DMEPOS supplier. CMS is seeking comments on:

• Patient care and provider burden: Current burden of prior authorization requirements for laboratory tests and DMEPOS items on patient care and providers.
• Test requisition form (TRF), denials, and laboratory benefit managers (LBMs): Possible outcomes of more payers allowing a TRF to be valid medical documentation to show that a laboratory test is reasonable and necessary, the frequency of denials when a request is submitted after specimen collection, and the role of LBMs in the prior authorization process.
• Process improvement, automation, and workforce: Opportunities for process improvement for prior authorization requirements, potential benefits of prior authorization automation, other issues that could be addressed by technology, and the impact of prior authorization on the health care workforce and retention.

Download a copy of this summary here.

---

This Applied Policy^® Summary was prepared by Emma Hammer with support from the Applied Policy team of health policy experts. If you have any questions or need more information, please contact her at ehammer@appliedpolicy.com or 202-558-5272