Proposed Prior Auth Regulatory Requirements for Payers and Health Plans Summary

This is a summary of the “Improving Prior Authorization Processes” section of the Proposed Rule: Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes for Medicare Advantage Organizations, Medicaid Managed Care Plans, State Medicaid Agencies, Children's Health Insurance Program (CHIP) Agencies and CHIP Managed Care Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, Merit-Based Incentive Payment System (MIPS) Eligible Clinicians, and Eligible Hospitals and Critical Access Hospitals in the Medicare Promoting Interoperability Program. Here’s the link to the full rule.

D. Improving Prior Authorization Processes

1. Background

• The proposed rule aims to streamline prior authorization in healthcare by integrating technical and operational changes. These changes build upon the Center for Medicare and Medicaid Services (CMS) Interoperability and Patient Access final rule to enhance health information exchange and interoperability.
• Scope and Exclusions: The rule applies to decision-making by payers on prior authorization requests based on coverage guidelines. It excludes drugs, outpatient drugs, physician-administered drugs, and those used in hospitals or pharmacies. Medicare Fee-for-Service (FFS) is not directly affected but might align with these changes.
• Prior Authorization Challenges: Prior authorization is vital but challenging, leading to provider burnout and potential health risks due to delays. Issues include varying payer policies, workflow difficulties, inconsistent electronic standards, and technical barriers. The 21st Century Cures Act and Office of the National Coordinator for Health Information Technology (ONC) workgroup focused on reducing these burdens, highlighting problems like unpredictable decision times and inefficient communication methods.
• Stakeholder Input and Surveys: Input from American Medical Association (AMA) surveys and the American Hospital Association (AHA) indicates significant burdens on physicians and hospitals due to current prior authorization processes. Extensive time and resources are dedicated to managing these requests.
• Industry and Federal Advisory Committee Insights: Hearings by Health Information Technology Advisory Committee (HITAC) and National Committee on Vital and Health Statistics (NCVHS) revealed the need for improvements in technology, transparency, and provider workflows for prior authorization. America's Health Insurance Plans (AHIP) studies and reports support these findings.
• Proposed Changes and Implementation: The proposed rule suggests various changes, including a new combined Prior Authorization Requirements, Documentation, and Decision (PARDD) Application Programming Interface (API). The implementation date for most proposals is January 1, 2026, with some Medicaid Fair Hearings and notice proposals effective earlier.
• Required Actions for Health Plans:
  1. Implement and maintain an API for streamlined prior authorization.
  2. Respond to prior authorization requests within specified timeframes.
  3. Provide clear reasons for prior authorization denials.
  4. Publicly report prior authorization approvals, denials, and appeals.
  5. Align with the proposed rule's standards and timelines, including potential early adoption for some Medicaid-specific proposals.
  6. Standardize documentation requirements across payers.
  7. Make information about coverage and potential denials available to patients and providers.
  8. Adopt electronic communication methods to reduce reliance on phone calls and faxes.
  9. Consider implementing the PARDD API for streamlined processing and decision-making.
  10. Address the unique needs of hospitals and provider offices in managing prior authorizations.

2. Electronic Options for Prior Authorization

• Current Situation: Many payers and providers do not utilize the standard set by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) for electronic prior authorization transactions, namely the X12 278 Version 5010. Instead, they often use proprietary interfaces and resort to inefficient methods like phone calls or faxes.
• Challenges: Providers struggle with understanding which services require prior authorization and the necessary documentation. The current standard does not effectively address these barriers.
• HIPAA-Adopted Standards: The standards adopted under HIPAA for prior authorization include:
  • National Council for Prescription Drug Programs (NCPDP) Telecommunication Standard Implementation Guide Version D.0 for retail pharmacy drugs.
  • ASC X12 Version 5010x217 278 (X12 278) for dental, professional, and institutional requests for review and response.
  • These standards are not fully adopted by the industry, with many entities still using manual or non-standard electronic processes.
• CAQH Index Report Findings: Reports indicate low adoption rates of the X12 278 standard among health plans and providers, with incremental increases observed over the years. Barriers to using the HIPAA standard include lack of vendor support and inconsistencies in data usage.
• Proposed Enhancements: The rule proposes requiring impacted payers to implement an HL7 Fast Healthcare Interoperability Resources (FHIR) Application Programming Interface (API), to work in conjunction with the HIPAA transaction standard. This is aimed at supporting greater use of the X12 278 standard and automating the prior authorization process.
• Operating Rules under HIPAA: The Department of Health and Human Services (HHS) has adopted operating rules for certain HIPAA transactions, with more under consideration. These rules define necessary business guidelines for electronic information exchange not covered by the standard.
• Testing of Alternative Standards: In 2021, HHS approved an exception for testing an alternative standard for prior authorization using the HL7 FHIR standard without the X12 278. This test aims to assess if this alternative could enhance efficiency.

Actions Required for Health Plans to Comply:

1. Utilize the X12 278 Version 5010 standard for electronic prior authorization transactions.
2. Implement the HL7 FHIR API to work alongside the X12 278 standard.
3. Participate in or adapt to new operating rules adopted by HHS for HIPAA transactions.
4. Be open to adopting alternative standards if proven efficient through industry testing.
5. Ensure compliance with HIPAA standards and operating rules for electronic prior authorization.

3. Proposed Requirement for Payers: Implement an API for Prior Authorization Requirements, Documentation, and Decision (PARDD API)

• Overview: Beginning January 1, 2026, certain payers are proposed to implement and maintain a Fast Healthcare Interoperability Resources (FHIR) PARDD API. This aims to streamline the prior authorization process between payers and providers.
• Functionality of PARDD API:
  • Allows providers to query if prior authorization is needed for specific items and services.
  • Identifies documentation requirements.
  • Automates data compilation for HIPAA-compliant prior authorization transactions.
  • Enables payers to provide status updates on prior authorization requests.
• Implementation Requirements:
  • Use of specific Implementation Guides (IGs) adopted at 45 Code of Federal Regulations (CFR) 170.215.
  • Consistency in documentation and access requirements across all proposed APIs.
  • Adoption of HL7 FHIR Da Vinci IGs, namely Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS).
• API Workflow:
  • FHIR interface communicates with a clearinghouse or payer to convert requests to HIPAA-compliant X12 278 transactions.
  • Providers receive payer responses via FHIR, indicating approval, denial, or need for additional information.
• Exclusions: The PARDD API does not apply to any drugs.
• Challenges and Considerations:
  • Significant effort in identifying and programming prior authorization policies for the API.
  • Consideration of a phased implementation strategy, though ultimately not proposed due to potential complexities for providers.
• Proposed Compliance Dates:
  • Payers required to implement the PARDD API for all non-drug items and services by January 1, 2026.
  • Medicaid managed care plans, Children's Health Insurance Program (CHIP) managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs) to comply by the rating period or plan years beginning on or after January 1, 2026.
• Potential Benefits:
  • Streamlines prior authorization processes.
  • Reduces manual tasks and denials or appeals.
  • Facilitates information accessibility and transparency.
• Federal Funding for State Medicaid and CHIP Expenditures:
  • Federal financial participation (FFP) available for state expenditures on implementing the PARDD API.
  • Expenditures eligible for 90% or 75% enhanced FFP for design, development, or operation of mechanized claims processing and information retrieval systems.
• Medicaid Expansion CHIP Programs:
  • Medicaid requirements apply to Medicaid Expansion CHIP programs.

Actions Required for Health Plans to Comply:

1. Implement and maintain the FHIR PARDD API by January 1, 2026.
2. Ensure the API provides information on prior authorization requirements and documentation for non-drug items and services.
3. Utilize specific Implementation Guides and maintain HIPAA compliance.
4. Enable the API to communicate with clearinghouses or payers for converting requests into HIPAA-compliant transactions.
5. Provide detailed responses to providers, including approval, denial reasons, or requests for additional information.
6. Participate in HL7 workgroups for refining IGs related to prior authorization.
7. Prepare for potential operational and procedural changes in customer service due to the API implementation.
8. Make prior authorization information more accessible and understandable to providers and patients until the API is fully operational.

4. Requirement for Payers To Provide Status of Prior Authorization and Reason for Denial of Prior Authorizations

• Communication Improvement: The proposal emphasizes enhancing communication between payers and providers, particularly in providing specific reasons for denying prior authorizations.
• Reason for Denial:
  • Payers deny prior authorizations for various reasons like lack of medical necessity, exceeding limits, or inadequate documentation.
  • Clear communication of denial reasons can assist providers in taking corrective actions or finding alternatives.
• Implementation Timeline:
  • Starting January 1, 2026, impacted payers must provide specific reasons for denied prior authorization decisions. This excludes decisions related to drugs.
  • Applies to Medicaid managed care plans, Children's Health Insurance Program (CHIP) managed care entities, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs).
• Method of Communication:
  • Information about denial reasons can be sent electronically or through other methods.
  • Use of consistent technology and terminology is encouraged to mitigate operational inefficiencies.
• Existing Program-Specific Notice Requirements:
  • Certain payers already have obligations under Federal and state laws to notify providers and patients about adverse decisions.
  • This proposal reinforces existing Federal and state requirements but does not alter or replace them.
• Specific Requirements for Different Programs:
  • Medicaid Managed Care Plans and CHIP: Written notice requirements to enrollees remain unchanged.
  • Medicare Advantage (MA) Program: Specific rules for form and content of written notices to enrollees in case of partial or full denial.
  • Applicable Integrated Plans: Requirements for denial notices issued to enrollees are governed by existing regulations.
  • Qualified Health Plan (QHP) issuers on FFEs: Obligated to provide specific reasons for adverse benefit determinations.

Actions Required for Health Plans to Comply:

1. Provide specific reasons for denied prior authorization decisions, excluding those related to drugs, starting January 1, 2026.
2. Ensure communication of denial reasons to providers using consistent technology and terminology.
3. Comply with existing Federal and state notice requirements to patients or providers in case of adverse decisions.
4. For Medicaid managed care plans and CHIP managed care entities, comply with written notice requirements to enrollees.
5. For Medicare Advantage plans, comply with detailed notice requirements including explanation of denial reasons and appeal rights.
6. For QHP issuers on the FFEs, ensure culturally and linguistically appropriate communication of denial reasons.
7. Integrate the provision of denial reasons with the use of the PARDD API, where applicable.

5. Requirements for Prior Authorization Decision Timeframes and Communications

a. Impact of Delays in Prior Authorization Decisions: Background and Overview of Current Decision Timeframes

• Background: Delays in prior authorization decisions by payers can lead to healthcare access delays, posing medical risks.
• Current Timeframes for Decision Making:
  • Medicare Advantage and Applicable Integrated Plans:
    • Expedited Prior Authorization: Decision within 72 hours.
    • Standard Prior Authorization: Decision within 14 calendar days.
    • Extension: Enrollees can request or payers can initiate a 14-day extension if additional information is needed.
  • Medicaid Managed Care:
    • Expedited: Decision as quickly as required by health condition, within 72 hours.
    • Standard: Decision within state-established timeframes, up to 14 calendar days.
    • Extension: Requested by beneficiary/provider or initiated by payer for additional information.
  • Children's Health Insurance Program (CHIP) Managed Care:
    • Expedited: Decision within 72 hours if urgent.
    • Standard: Decision within 14 calendar days.
    • Extension: 14-day extension available if needed.
  • CHIP Fee-for-Service:
    • No current Federal regulation for expedited decisions.
    • Standard: Decision within 14 calendar days.
  • Qualified Health Plan (QHP) Issuers on the Federally-facilitated Exchanges (FFEs):
    • Notification of benefit determination within 72 hours for urgent care claims; otherwise, within 15 calendar days.

Actions Required for Health Plans to Comply:

1. Provide expedited prior authorization decisions within 72 hours for urgent requests.
2. Provide standard prior authorization decisions within 14 calendar days.
3. Allow a 14-day extension if additional information is required for decision-making.
4. Implement clear communication strategies for notifying providers and patients of the decision status and reason for denials or approvals.

b. Prior Authorization Decision Timeframes and Communications

• Background: Delays in prior authorization decisions by payers can lead to healthcare access delays, posing medical risks.
• Current Timeframes for Decision Making:
  • Medicare Advantage and Applicable Integrated Plans:
    • Expedited Prior Authorization: Decision within 72 hours.
    • Standard Prior Authorization: Decision within 14 calendar days.
    • Extension: Enrollees can request or payers can initiate a 14-day extension if additional information is needed.
  • Medicaid Managed Care:
    • Expedited: Decision as quickly as required by health condition, within 72 hours.
    • Standard: Decision within state-established timeframes, up to 14 calendar days.
    • Extension: Requested by beneficiary/provider or initiated by payer for additional information.
  • Children's Health Insurance Program (CHIP) Managed Care:
    • Expedited: Decision within 72 hours if urgent.
    • Standard: Decision within 14 calendar days.
    • Extension: 14-day extension available if needed.
  • CHIP Fee-for-Service:
    • No current Federal regulation for expedited decisions.
    • Standard: Decision within 14 calendar days.
  • Qualified Health Plan (QHP) Issuers on the Federally-facilitated Exchanges (FFEs):
    • Notification of benefit determination within 72 hours for urgent care claims; otherwise, within 15 calendar days.

Actions Required for Health Plans to Comply:

1. Provide expedited prior authorization decisions within 72 hours for urgent requests.
2. Provide standard prior authorization decisions within 14 calendar days.
3. Allow a 14-day extension if additional information is required for decision-making.
4. Implement clear communication strategies for notifying providers and patients of the decision status and reason for denials or approvals.

6. Requirements for Timing of Notifications Related to Prior Authorization Decisions

This section proposes requirements for the timing of notifications sent by certain payers to patients regarding prior authorization decisions. This proposal also applies to most impacted payers. However, we are not proposing to address proposals for notifications to the QHPs on the FFEs, for the same reasons we provided in section II.D.5.b.

a. MA Organizations

Summary: Timing of Notifications for Prior Authorization Decisions

• Overview: This proposal sets forth requirements for the timing of notifications that certain payers must send to patients regarding prior authorization decisions, aiming to ensure timely communication.
• Medicare Advantage (MA) Organizations:
  • Currently, MA organizations must notify enrollees about coverage decisions, including prior authorizations.
  • Proposed changes require MA organizations to notify enrollees within 7 calendar days for standard requests for medical items or services.
  • The 72-hour timeframe for expedited requests remains unchanged.
  • MA organizations may still extend the decision timeframe by up to 14 additional calendar days under certain circumstances.
  • Written notices are required for enrollees if a prior authorization request is denied.
• Integrated Plans:
  • Similar requirements for enrollee notifications are proposed for integrated plans.
  • Notification of enrollee within 7 calendar days for standard pre-service organization determinations.
  • The 72-hour decision and notification requirements for expedited requests remain.
  • The 14-calendar day extension authority remains unchanged.
  • If an expedited determination is denied and automatically transferred to the standard timeframe, the integrated plan must make its determination within the new 7-calendar day timeframe.
• Medicaid Managed Care Organizations (MCOs):
  • The proposed amendments for MA organizations are consistent with changes proposed for Medicaid managed care plans at 42 Code of Federal Regulations 438.210(d)(1) and (2).
  • No changes proposed for the timeline for expedited integrated organization determinations or the notification requirements to enrollees.

Actions Required for Health Plans to Comply:

1. Notify enrollees of prior authorization decisions within 7 calendar days for standard requests and within 72 hours for expedited requests.
2. Maintain the option to extend the decision timeframe by up to 14 calendar days when necessary.
3. Ensure that electronic notifications of prior authorization decisions are sent to providers.
4. Continue to provide written notices to enrollees when a prior authorization request is denied, as per current regulations.
5. Adopt and adapt operational processes to meet the new proposed notification timeframes.
6. Evaluate and potentially update internal systems to automate notifications to meet the proposed timeframes efficiently.

b. Timing of Notifications for Prior Authorization Decisions in Medicaid Fee-for-Service

• Proposal Overview: The proposal sets timelines for notifications to providers about prior authorization decisions in the Medicaid Fee-for-Service (FFS) program, effective January 1, 2026.
• Notification Timeframes for Medicaid FFS:
  • Expedited requests: Notice must be communicated within 72 hours after receiving a request, unless state law specifies a shorter timeframe.
  • Standard requests: Notice must be given within 7 calendar days after receiving a request, with a possible extension of up to 14 calendar days if additional information is needed.
• Beneficiary Notice and Fair Hearings:
  • Existing Medicaid FFS beneficiary notice and fair hearing regulations apply to prior authorization decisions and remain unchanged by the new proposals.
  • Written notice of decisions is required, including information on the right to request a fair hearing for denied requests.
• Proposed Regulatory Revisions:
  • Amendments clarify the application of existing Medicaid FFS beneficiary notice and fair hearing regulations to prior authorization decisions.
  • Definition of "action" in 42 Code of Federal Regulations 431.201 will include termination, suspension, or reduction in benefits or services with a current approved prior authorization.
  • New provisions will state that Medicaid FFS prior authorization decisions are subject to notice and fair hearing rights, aligning with managed care.

Actions Required for Health Plans to Comply:

1. Notify providers within 72 hours for expedited prior authorization decisions and within 7 calendar days for standard decisions.
2. Offer an extension of up to 14 calendar days for standard requests if additional information is required.
3. Provide written notices to beneficiaries about the decisions on prior authorizations, including the right to request a fair hearing if denied.
4. Clarify existing Medicaid FFS beneficiary notice and fair hearing regulations to confirm their application to prior authorization decisions.
5. Ensure compliance with the proposed revisions and additions to the Medicaid FFS regulations regarding notice and fair hearing rights.

c. Medicaid Managed Care

• Introduction: The proposal introduces new timeframes for Medicaid managed care plans to notify providers of prior authorization decisions.
• New Timeframes Starting January 1, 2026:
  • Standard (Non-Expedited) Requests:
    • Notification of authorization decisions within 7 calendar days from receipt of request.
    • This timeframe must comply with any state-established timeframes that may not exceed the proposed 7 days.
• Regulatory Revisions:
  • Revision of 42 Code of Federal Regulations 438.210(d)(1) to accommodate the new 7-day timeframe.
  • Redesignation of sections for clarity and readability regarding authorization decision timeframes and extensions.
  • Confirmation that the failure to issue a decision within the required timeframe is considered an adverse benefit determination eligible for appeal.
• Existing Regulations and Appeals:
  • Current regulations on appeal rights remain applicable.
  • Definition of “adverse benefit determination” includes failure to make an authorization decision within regulatory timeframes.
• Coverage and Prior Authorization of Outpatient Drugs:
  • No changes to current regulations regarding coverage and prior authorization of covered outpatient drugs as per section 1927 of the Social Security Act.
• Expedited Requests:
  • No proposed changes to the 72-hour timeframe for expedited decisions.
  • Open comment sought on potentially shortening the timeframe to 48 hours.
  • Retention of the authority for a 14-day extension if additional information is needed.
• CHIP Managed Care Entities:
  • The proposal for Medicaid managed care applies equally to CHIP managed care entities due to cross-referencing in current regulations.

Actions Required for Health Plans to Comply:

1. Implement the new 7-calendar day notification requirement for standard prior authorization requests by January 1, 2026.
2. Maintain compliance with state-established timeframes, ensuring they do not exceed the new federal 7-day limit.
3. Continue to provide expedited decision notifications within the current 72-hour timeframe, unless future changes are determined based on comments received.
4. Prepare to potentially accommodate a shorter timeframe for expedited decisions, subject to further rulemaking.
5. Recognize that a failure to meet the decision timeframe constitutes an adverse benefit determination, prompting appeal rights.
6. Ensure alignment with the proposed regulatory revisions for standard and expedited decision timeframes.

d. CHIP Fee-for-Service and Managed Care

• Medicare Advantage (MA) and Integrated Plans:
  • Standard Notifications: Enrollees must be notified within 7 calendar days of the decision.
  • Expedited Notifications: Enrollees must be notified as quickly as health conditions require, not exceeding 72 hours.
• Medicaid Fee-for-Service (FFS):
  • Notice of decisions on expedited and standard prior authorization requests must be given within the same timeframes proposed for MA.
• Medicaid Managed Care:
  • Notice of standard prior authorization decisions must be given within 7 calendar days.
  • Expedited decision notifications must occur as needed by health conditions, not exceeding 72 hours.
  • Extensions of up to 14 calendar days are allowed if more information is needed.
• Children's Health Insurance Program (CHIP) Managed Care and FFS:
  • The same timeframes for decision notifications as Medicaid managed care will apply.
  • If state law is more stringent, states can enforce shorter timeframes.
• Regulatory Changes:
  • Modification to headers for clarity in Medicaid FFS notices.
  • Revision of the definition of "action" to include current approved prior authorizations.
  • Addition of prior authorization decisions to situations requiring fair hearings.
  • Inclusion of a notice for denial or changes in benefits or services in Medicaid FFS notices.
  • Clarification that beneficiary notice of prior authorization decisions and fair hearing rights are required.

Actions Required for Health Plans to Comply:

1. Notify enrollees within 7 calendar days for standard prior authorization decisions and within 72 hours for expedited decisions, effective January 1, 2026.
2. Align with updated Federal regulations, removing the option for states to follow their own laws regarding prior authorization, unless state laws are more stringent.
3. Provide fair hearing rights for beneficiaries as per existing regulations without change.
4. Apply and enforce updated timeframes for prior authorization decisions and notifications across Medicare Advantage, Medicaid, and CHIP managed care plans.
5. Comment on potential unintended consequences of the proposed policy changes to improve decision or notification timeframes for prior authorizations.

7. Extensions, Exemptions, and Exceptions

a. Extensions and Exemptions for Medicaid and CHIP FFS Programs

• Objective: Implement Patient Access and Provider Directory Data (PARDD) Application Programming Interface (API).
• Extension Opportunity: State Medicaid Fee-For-Service (FFS) and Children's Health Insurance Program (CHIP) FFS programs can request a one-year extension to implement the PARDD API.
• Reasons for Extension: States might face challenges like funding, legislative timelines, procurement processes, hiring skilled staff, and the impact of the COVID-19 public health emergency.
• Application for Extension: States can apply for extension via their annual Advanced Planning Document (APD) for Medicaid Management Information System (MMIS) operations, including a justification, report of efforts, and a comprehensive implementation plan.
• Approval Criteria: The Centers for Medicare and Medicaid Services (CMS) will approve extensions based on the justification and implementation plan provided.

Exemptions

• Criteria for Exemption: States can request an exemption if over 90% of Medicaid or separate CHIP beneficiaries are enrolled in managed care.
• Rationale: Low enrollment in FFS programs may not justify the implementation costs.
• Application for Exemption: States must submit documentation with their annual APD, showing compliance with exemption criteria and an alternative plan for electronic exchange and accessibility of prior authorization information.
• Exemption Expiry: The exemption expires if managed care enrollment falls below 90% for 2 out of 3 years or if a state plan amendment leads to a significant shift from managed care to FFS enrollment.
• Post-Exemption Compliance: States must comply with PARDD API requirements within two years of exemption expiry.

Managed Care

• No Extension for Managed Care: Not proposed due to ongoing IT development and economies of scale in managed care plans.
• Comment Request: CMS seeks comments on the necessity and criteria for a potential extension process for managed care plans.

Compliance Requirements for Health Plans

1. Implement the PARDD API as per compliance timelines.
2. If needed, apply for a one-year extension providing necessary documentation and a comprehensive plan.
3. For states with over 90% managed care enrollment, apply for an exemption, providing enrollment data and an alternative plan for electronic information exchange.
4. In case of exemption expiry, comply with PARDD API requirements within two years.
5. Continuously assess managed care enrollment percentages to determine if exemption status changes.
6. Provide CMS with timely notifications regarding changes in exemption status.
7. Managed care plans should prepare to comply without extensions, considering potential future rulemaking discussions.

b. Exception for Qualified Health Plan (QHP) Issuers on Federally-facilitated Exchanges (FFEs)

Overview

• Proposal: An exception process for QHP issuers on FFEs regarding the Patient Access and Provider Directory Data (PARDD) Application Programming Interface (API).
• Applicability: Targets QHP issuers applying for certification to offer plans through an FFE who cannot meet the PARDD API requirements as per 45 CFR 156.223(b).

Exception Process

• Application Requirements: QHP issuers must include in their application:
  • A narrative justification detailing why they cannot satisfy the PARDD API requirements.
  • The impact of non-compliance on providers and enrollees.
  • Current or proposed methods for providing health information to providers.
  • Solutions and a timeline for achieving compliance with the requirements.
• Criteria for Granting Exception: The FFE may grant an exception if:
  • It's in the interest of qualified individuals in the state(s) where the FFE operates.
  • The exception permits the issuer to offer QHPs through the FFE.
• Consistency with Previous Rules: Aligns with the exception process for the Patient Access API in the CMS Interoperability and Patient Access final rule.
• Special Considerations: Applicable particularly to small issuers, financially vulnerable issuers, or new entrants to FFEs who face significant barriers in deploying Fast Healthcare Interoperability Resources (FHIR) API technology.

General Proposal for Extensions, Exemptions, or Exceptions

• Impacted Payers: State Medicaid and CHIP Fee-For-Service programs and QHP issuers on FFEs.
• Approval Process: Submit and obtain approval for an extension, exemption, or exception as part of established processes.
• Submission Requirements: Must include specific documentation as identified in regulatory citations in Table 7.

8. Public Reporting of Prior Authorization Metrics

Requirements for Payers

• Payers affected by this proposal are required to publicly report aggregated metrics about prior authorization.
• Reporting levels: Medicare Advantage (MA) at the organizational level, Medicaid and Children's Health Insurance Program (CHIP) Fee-For-Service (FFS) at the state level, Medicaid and CHIP managed care at the plan level, and Qualified Health Plan (QHP) issuers on Federally-facilitated Exchanges (FFEs) at the issuer level.

Purpose of Reporting

• To provide meaningful data for patients and providers regarding the performance of entities on prior authorization approval timeframes, volumes of denials, and appeals.
• To assist providers in choosing payer networks based on prior authorization performance trends.
• To aid patients in making informed decisions during open or special enrollment based on transparency and accessibility of prior authorization processes.

Reporting Data

• Aggregated for all items and services, excluding drugs covered by the payers, such as outpatient drugs.
• Annual reporting of the following metrics is required:
  • Complete list of items and services requiring prior authorization.
  • Approval, denial, and appeal percentages for standard and expedited prior authorization requests.
  • Average and median times from request submission to determination for both standard and expedited requests.

Format and Accessibility

• The format for presenting data is not specified, but readability and accessibility are emphasized.
• Stakeholders, including payers, providers, and consumers, are invited to comment on the most useful and meaningful data presentation methods.

Impact and Enforcement

• Initial data will reflect current practices; over time, improvements are anticipated due to the proposed rule.
• Compliance will be enforced according to existing policies for the impacted payers.
• Future rulemaking may incorporate these data into quality measures for quality star ratings, particularly for MA and QHP issuers on FFEs.

Changes to Current Provisions

• For Medicaid managed care, this proposal replaces a 2016 provision clarifying the applicability date for previous requirements.
• Applies to CHIP managed care entities by cross-reference in existing regulations.

Solicitation of Comments

• CMS requests comments on the types of data to include in the report, aggregate reporting by items and services, reporting timeframe, number of reports, and other potentially useful data types.
• Comments are also requested on the timing for adding metrics for prior authorization requests received via the PARDD API to evaluate the growth of API-facilitated requests over time.

Actions Required for Health Plans to Comply

1. Publicly report the required prior authorization metrics annually by March 31st, reflecting the previous year's data.
2. Ensure that reports are accessible on the payer's website or via a publicly accessible hyperlink.
3. Include in the report all items and services requiring prior authorization and the respective aggregated data for approvals, denials, and appeals.
4. Maintain readability and accessibility of the reported data for patients and providers.
5. Monitor and report the average and median times for prior authorization decisions.
6. Respond to CMS's requests for comments and incorporate feedback into reporting practices.

9. “Gold-Carding” Programs for Prior Authorization

Concept of "Gold-Carding"

• "Gold-Carding" refers to programs that reduce or eliminate prior authorization requirements for providers who consistently comply with payer’s rules and demonstrate appropriate utilization of services.

Advantages and Implementation

• Stakeholders highlight significant efficiency and cost-effectiveness gains if "gold-carding" is widely adopted.
• Medicare Advantage (MA) organizations can already develop "gold-carding" within their plans.
• The Centers for Medicare & Medicaid Services (CMS) has a similar approach in the Medicare Fee-For-Service Review Choice Demonstration for Home Health Services, rewarding agencies with high affirmation or approval rates.

Encouragement by CMS

• CMS encourages payers to adopt "gold-carding" programs to reduce provider burden and support timely, value-based care.
• States have begun implementing "gold-carding" to improve access to healthcare services.

Seeking Comments for Future Rulemaking

• CMS is soliciting comments on measuring the effectiveness of "gold-carding" in reducing burdens and improving patient services.
• There is an interest in ensuring these programs benefit diverse populations, including rural residents, individuals with disabilities, those with chronic illnesses, small and minority providers, and those serving minority and underserved communities.

Potential Inclusion in Quality Ratings

• CMS is considering incorporating "gold-carding" as a measure in quality ratings for MA organizations and Qualified Health Plans (QHPs) to improve their quality star ratings.

Comments on Structure and Potential Requirements

• CMS is contemplating making "gold-carding" a requirement in prior authorization policies and is seeking comments on the structure of such programs to meet potential future requirements.

Actions Required for Health Plans to Comply

1. Implement "gold-carding" programs to reduce prior authorization requirements for compliant providers.
2. Report on the effectiveness of these programs in reducing administrative burdens and improving patient services.
3. Ensure the inclusion of diverse populations in the benefits of "gold-carding" programs.
4. Consider feedback from CMS and stakeholders to refine and enhance "gold-carding" practices.
5. Prepare for the potential incorporation of "gold-carding" measures into future quality star ratings.

10. Statutory Authorities To Require Improvements in Prior Authorization Processes, Decision and Notification Timeframe Proposals

a. Medicare Advantage

Regulatory Standards and Authorities

• Medicare statute Part C and Section 1856(b) of the Act mandate regulatory standards for Medicare Advantage (MA) organizations.
• MA plans must cover necessary Part A and Part B benefits with reasonable promptness and disclose rules on prior authorization or review requirements.
• Written notice is required for MA plan enrollees if coverage is denied, and determinations must be timely per Section 1852(g)(1)(A) of the Act.
• Expedited determination notifications must be within 72 hours as per Section 1852(g)(3)(B)(iii) of the Act.

Proposed Requirements for MA Organizations

• Implement Application Programming Interfaces (APIs) that clarify coverage and documentation for prior authorization (Patient Access and Provider Directory Data [PARDD] API).
• Respond to prior authorization requests with status updates, indicating approval or denial with reasons.
• Meet specific timeframes for making decisions on prior authorization requests to ensure access to coverage and improve patient care.

Disclosure and Efficiency

• The PARDD API aligns with Section 1852(c)(1)(G) of the Act by providing the same information to providers as is generally required for enrollees.
• It will enable providers to submit accurate and complete prior authorization requests and receive timely responses, reducing appeals, denials, and requests for additional documentation.

Timeframes for Decisions

• The proposal includes improving timeframes for both standard and expedited decisions to prevent care abandonment and reduce administrative burdens.
• Shorter timeframes aim to enhance enrollee access to care and reduce follow-up inquiries from providers.

Reporting Requirements

• Section 1857(e)(1) of the Act allows for additional reporting requirements by MA organizations.
• Proposed public reporting of prior authorization metrics will help CMS and MA plans assess the impact of new policies, including API use and decision timeframes, and inform potential operational adjustments.

Actions Required for Medicare Advantage Health Plans to Comply

1. Implement the PARDD API as per CMS standards.
2. Provide timely status updates on prior authorization requests.
3. Adhere to the stipulated timeframes for decision-making on both standard and expedited prior authorization requests.
4. Publicly report prior authorization metrics to demonstrate compliance and impact assessment.

b. Medicaid

Statutory Basis for Proposals

• Sections 1902(a)(4), (8), and (19) of the Act require Medicaid plans to administer properly and efficiently, provide services promptly, and ensure care is provided simply and in the best interests of recipients.
• Section 1902(a)(7) of the Act and 42 CFR 431.302(c) mandate confidentiality safeguards for Medicaid applicant and beneficiary information.
• Programs must comply with standards for the release and use of information (42 CFR 431.306) and restrict access to those with comparable confidentiality standards (42 CFR 431.306(b)).

Proposed Improvements

1. Patient Access and Provider Directory Data (PARDD) Application Programming Interface (API):
   • States must implement the PARDD API in Medicaid Fee-For-Service (FFS) programs and Medicaid managed care plans.
   • The PARDD API will indicate whether prior authorization is required and the necessary supporting documentation, leading to a more efficient process.
2. Status of Prior Authorization and Denial Reasons:
   • Payers must inform providers about the status of prior authorization requests.
   • Providers will be notified if a request is approved, denied, or if additional information is needed, along with reasons for denials.
3. Decision Timeframes and Notifications:
   • The proposal shortens the timeframe for Medicaid managed care plans to make prior authorization decisions from 14 calendar days to 7 calendar days.
   • Explicit regulation text will confirm that notice and fair hearing requirements apply to Medicaid FFS prior authorization decisions (42 CFR part 431, subpart E).
4. Public Reporting of Prior Authorization Metrics:
   • Medicaid FFS programs and managed care plans will be required to publicly report prior authorization metrics on their websites or via publicly accessible hyperlinks.
   • Public reporting supports timely access to services by identifying process weaknesses and enabling corrective actions.

Compliance Requirements for Medicaid Health Plans

1. Implement the PARDD API to streamline prior authorization processes.
2. Provide clear and timely updates to providers on the status of prior authorization requests.
3. Comply with the new shortened decision timeframes for prior authorization requests.
4. Publicly report prior authorization metrics to improve transparency and accountability.
5. Ensure that any corrective actions identified through public reporting or external quality reviews are implemented to improve the prior authorization process.

c. CHIP

Legal Authority

• The authority for these proposals in the Children's Health Insurance Program (CHIP) is derived from Section 2101(a) of the Act, which emphasizes effective and efficient coordination of health assistance for uninsured, low-income children.

Patient Access and Provider Directory Data (PARDD) API

• Implementing the PARDD Application Programming Interface (API) as outlined in the proposed rule aims to rectify the current process's deficiencies.
• The PARDD API will allow providers to electronically ascertain whether prior authorization is needed and understand the documentation requirements, reducing administrative burdens and enhancing care provision.

Efficiency and Access to Care

• The PARDD API will enable providers to submit prior authorization requests more rapidly and accurately, expediting patient treatment.
• Real-time responses to authorization requests via the PARDD API will improve service delivery efficiency.

Safeguards and Privacy

• CHIP must adhere to privacy protections similar to Medicaid, ensuring the confidentiality of beneficiary information during data exchanges via the PARDD API (42 CFR 457.1110 and 42 CFR 431.306).

Decision Timeframes

• The rule proposes specific timeframes for CHIP Fee-For-Service and managed care entities to make prior authorization decisions.
• These timeframes aim to eliminate uncertainty and delays, thus improving access to care for patients, especially those with chronic conditions or complex health needs.

Public Reporting of Metrics

• CHIP Fee-For-Service and managed care entities will be required to publicly report prior authorization metrics.
• Reporting metrics support state oversight, indicate API utilization, and reflect changes in authorization numbers, denials, and appeals.

Compliance Requirements for CHIP Health Plans

1. Implement the PARDD API to streamline the prior authorization process.
2. Ensure privacy and confidentiality standards are met during the information exchange.
3. Adhere to proposed timeframes for expedited and standard prior authorization decisions.
4. Publicly report prior authorization metrics, providing transparency and aiding in program evaluation.

d. QHP Issuers on the FFEs

Legal Authority

• Authority for new requirements comes from Section 1311(e)(1)(B) of the Affordable Care Act, granting Federally-facilitated Exchanges (FFEs) the discretion to certify Qualified Health Plans (QHPs) that serve the interests of qualified individuals.

Improvement in Efficiency and Quality

• The implementation of APIs is expected to enhance the efficiency of QHP issuers on FFEs, benefiting both providers and patients.
• Prompt and accurate service delivery is anticipated with the adoption of the Patient Access and Provider Directory Data (PARDD) API.

Patient Access and Provider Directory Data (PARDD) API

• QHP issuers on FFEs are proposed to implement the PARDD API to communicate prior authorization requirements effectively.
• Providers will be able to determine the necessity for prior authorization and the associated documentation requirements through the API.
• The PARDD API could lead to more accurate prior authorization requests, improving patient service delivery.

Communication and Understanding

• QHP issuers must provide reasons for the denial when responding to prior authorization requests.
• Better communication is expected to facilitate efficient resubmission or appeal, enhancing patient care delivery.

Public Reporting of Metrics

• QHP issuers are required to publicly report prior authorization metrics, promoting transparency and accountability.
• The reporting may assist QHP issuers in evaluating and improving their administration and use of APIs.

Compliance Requirements for Qualified Health Plan Issuers on Federally-facilitated Exchanges

1. Implement the PARDD API to streamline prior authorization processes.
2. Provide clear reasons for denials of prior authorization requests to aid providers in understanding and addressing issues.
3. Publicly report prior authorization metrics to demonstrate performance and accountability in program administration.

E. Electronic Prior Authorization for the Merit-Based Incentive Payment System (MIPS) Promoting Interoperability Performance Category and the Medicare Promoting Interoperability Program

Background

• In 2020, CMS sought comments on incentivizing the use of electronic prior authorization through the Quality Payment Program (QPP) and the Merit-based Incentive Payment System (MIPS).
• Stakeholders supported the use of health information technology to improve the efficiency of prior authorizations.
• The American Medical Association (AMA) survey indicated significant delays in patient care and increased provider burnout due to prior authorization processes.
• The Office of the National Coordinator for Health Information Technology (ONC) recommended leveraging health IT for standardizing data and processes around prior authorizations.

Promoting Interoperability

• CMS is proposing a new measure for MIPS eligible clinicians and hospitals under the Promoting Interoperability performance category to encourage the use of electronic prior authorization.
• The proposed measure, titled “Electronic Prior Authorization,” will be part of the Health Information Exchange (HIE) objective.
• The measure is aimed at addressing low provider utilization of Application Programming Interfaces (APIs) established by payers for electronic prior authorization.

Proposed Measure for MIPS Eligible Clinicians

• Clinicians must electronically request prior authorization for at least one medical item or service using data from Certified Electronic Health Record Technology (CEHRT) excluding drugs.
• The measure requires reporting a numerator (electronic requests made) and a denominator (total requests) or claiming an exclusion if no services requiring prior authorization were ordered.

Proposed Measure for Eligible Hospitals and CAHs

• Hospitals must electronically request prior authorization for at least one hospital discharge and medical item or service, excluding drugs.
• Reporting requirements and exclusions are similar to those for MIPS eligible clinicians.

Compliance Requirements for MIPS and Medicare Promoting Interoperability Programs

1. Implement and utilize the PARDD API for prior authorization requests.
2. Electronically request prior authorization using data from CEHRT for at least one medical item or service.
3. Report the measure's numerator and denominator or claim an exclusion if applicable.
4. Understand that the measure will not be scored in 2026 but failure to report or claim an exclusion will result in a zero score.
5. Prepare for potential future scoring methodology for the measure in upcoming rulemaking.
6. Factor in payer's API technology availability when determining the denominator of the measure.

Public Comments Sought

• CMS invites comments on the proposed measure specifics, the implementation challenges, and the possible need for alternate timeframes based on ONC Health IT Certification Program updates.