Client Alert

Prior Authorization Provisions Implementation Timelines: Update

New prior authorization requirements for Medicaid and CHIP managed care plans take effect beginning in 2026 and 2027. States should prepare now to monitor compliance, reporting, and implementation.

5 minutes

Key Takeaways

New Medicaid prior authorization (PA) requirements under the Interoperability and Patient Access final rule (CMS-0057-F) will affect managed care organizations (MCOs) beginning with rating periods on or after January 1, 2026, and January 1, 2027. States should prepare to incorporate these requirements into MCO contracts and establish processes for monitoring compliance and reporting.

  • Beginning in 2026, MCOs must provide standard prior authorization decisions within seven calendar days and provide specific reasons for every denial.
  • MCOs must publicly report annual prior authorization metrics, including approval and denial rates and average decision times.
  • Beginning in 2027, MCOs must implement a Prior Authorization API to streamline PA requests, responses, documentation, and communication between providers and health plans.

What State Agencies Need to Know: At a Glance

States should consider incorporating the new prior authorization requirements into MCO contracts, including expectations for reporting, monitoring, auditing, and consequences for non-compliance. Early planning can help states identify operational challenges, strengthen oversight, and improve access to care for Medicaid and CHIP members.

Explore What We Do

Managed Care Monitoring

Support for states in monitoring MCO performance, prior authorization compliance, and reporting requirements.

Prior Authorization Expertise

Experience evaluating PA processes, denial rates, appeals, and compliance to help states strengthen managed care oversight.

Key Applicability Dates

What States Should Know

January 1, 2026

Faster PA Decisions

MCOs must provide standard prior authorization decisions within state-established timeframes that cannot exceed seven calendar days for non-expedited requests.

January 1, 2027

Prior Authorization API

MCOs must have a Prior Authorization Application Programming Interface (API) designed to streamline the exchange of PA requests and responses between providers and health plans.

What the API Must Support

The API must identify services requiring PA, specify documentation requirements, and support the exchange of requests, decisions, authorization dates, denial rationales, and requests for additional information.

Background

In 2024, CMCS issued an Informational Bulletin intended to help states and CMS strengthen monitoring and oversight of Medicaid managed care organizations. The guidance followed concerns about high prior authorization denial rates and comparatively low appeal rates among Medicaid beneficiaries.

These trends can create barriers to care and potentially affect the quality of health and human services programs for Medicaid members.

The Interoperability and Patient Access final rule builds on these efforts by establishing new requirements for Medicaid and CHIP managed care plans.

PA Provisions Beginning January 1, 2026

The 2026 requirements focus on timeliness, transparency, and reporting.

  • Standard PA decisions must be made within seven calendar days.
  • MCOs must provide specific denial reasons to providers.
  • Denial notices should clearly communicate appeal rights to beneficiaries.
  • MCOs must publicly report annual PA metrics.
  • States should establish processes to monitor the accuracy and timeliness of MCO reporting.
  • States should consider reviewing MCO model denial letters and conducting periodic audits.

States should also evaluate how MCOs plan to modify staffing, processes, vendor oversight, and downstream entity monitoring to meet the new requirements.

PA Provisions Beginning January 1, 2027

The 2027 requirements focus on technology and interoperability.

MCOs must implement a Prior Authorization API that enables providers and health plans to exchange information electronically. CMS extended the implementation timeline for these API requirements from 2026 to 2027 to provide additional time for payers to implement APIs, coordinate with EHR vendors, and develop provider outreach materials.

States should begin planning now, particularly those serving significant rural provider populations that may face additional technology adoption challenges.

Recommended Actions

Update MCO Contracts

States should establish clear expectations for MCO compliance with the new PA requirements.

  • Incorporate applicable PA requirements into MCO contracts.
  • Establish reporting and monitoring expectations.
  • Define consequences for non-compliance.
  • Establish expectations for denial notices and appeal information.
  • Consider state review and approval of MCO model letter language.

Strengthen PA Monitoring and Reporting

States should develop processes to evaluate MCO compliance and assess prior authorization performance.

  • Monitor PA decision timeframes.
  • Review denial reasons and member communications.
  • Monitor appeal rates and outcomes.
  • Validate publicly reported PA metrics.
  • Conduct periodic monitoring and audits.
  • Evaluate downstream entity and vendor compliance.

Prepare for API Implementation

States and MCOs should begin preparing for the 2027 API requirements.

  • Coordinate with EHR vendors and providers.
  • Identify technology and implementation barriers.
  • Develop provider outreach and education materials.
  • Engage rural providers and other stakeholders early.
  • Establish processes to monitor implementation and ongoing compliance.


How Myers & Stauffer Can Help

Managed Care Expertise
Myers & Stauffer has worked closely with CMS for more than 15 years to support monitoring of prior authorization compliance within the federal managed care program.
Medicaid Program Experience
Our team supports state Medicaid agencies with managed care monitoring, reporting, compliance, and program oversight.
Access + Program Integrity
We help states balance improved member access to care with the program integrity oversight needed to protect Medicaid programs and taxpayer dollars.
Prior Authorization Monitoring & Compliance

Myers & Stauffer can help states prepare for new PA requirements, strengthen MCO oversight, and develop monitoring and reporting processes.

Explore Related Services

Our team can support states with evaluating PA denials, monitoring MCO performance, reviewing compliance, and identifying potential program integrity risks.

  • MCO monitoring and oversight
  • Prior authorization compliance
  • PA denial and appeals analysis
  • Managed care reporting
  • Program integrity
  • Medicaid program consulting
Get in Touch

Partner With Our Experienced Team

Whether you have questions about our services or are looking for a customized solution, our team is here to help.

Judy Hatfield, CPA
Member

Email:jhatfield@mslc.com
Phone Number: 816-957-6310

Keith Sorensen, CPA, CFE
Member

Email: ksorensen@mslc.com
Phone Number: 919-829-7429

Mike Johnson, CPA, CFE
Member

Email: mjohnson@mslc.com
Phone Number: 404-524-0775