Prior authorization in 2026: what the CMS rule changes and where automation actually helps

In the AMA's physician survey, practices reported an average of 39 prior authorizations per physician per week and about 13 hours of physician and staff time spent on them. 93% of physicians said prior authorization delays care ^[1]. The work is mostly clerical: finding the right form, locating the clinical notes that satisfy the payer's criteria and chasing status.

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) applies to Medicare Advantage, Medicaid, CHIP and Qualified Health Plan issuers on the federal exchanges ^[2]. From January 2026, impacted payers must send decisions within 72 hours for expedited requests and seven calendar days for standard ones, give a specific reason for denials and publish prior authorization metrics. By January 2027 they must offer a Prior Authorization API, along with provider and payer-to-payer data access APIs.

The HL7 Da Vinci project defines three implementation guides that together cover the flow inside the EHR ^[3][4][5]:

• Coverage Requirements Discovery (CRD): while ordering, the EHR asks the payer whether authorization is needed and what documentation applies.
• Documentation Templates and Rules (DTR): the payer's questionnaire is filled, as far as possible, from data already in the record.
• Prior Authorization Support (PAS): the request is submitted and its status tracked through a FHIR interface.

The standards move data; they do not read it. Much of the evidence a payer asks for sits in free-text notes, imaging reports and scanned letters. Language models are well suited to locating that evidence, mapping it to the payer's criteria and pre-filling the questionnaire with a citation to the source note, so a coordinator reviews a complete packet instead of building one.

On the payer side, the same capability lets a reviewer see, for each criterion, the passage that satisfies it. Requests that meet every criterion with clear evidence can be fast-tracked for approval.

Denials based on medical necessity are clinical decisions and should be made by qualified clinicians, with the specific reason the CMS rule now requires. An automated system that can approve but never deny on its own, and that shows its evidence, is far easier to defend than one that does both.

Found this useful?

Share the key finding on X.