Standards & regulation

The rules and standards behind electronic prior authorization.

Federal rules are moving prior authorization onto FHIR APIs with hard decision timeframes. PriorPilot is designed around those standards today, and bridges the legacy channels payers still use.

Regulatory timeline

CMS-0057-F and what comes next.

The CMS Interoperability and Prior Authorization Final Rule applies to Medicare Advantage, Medicaid and CHIP, and QHP issuers on the federal exchanges.

  1. Jan 1, 2026

    Decision timeframes & transparency

    Impacted payers must decide within 72 hours for expedited and 7 calendar days for standard requests, give a specific reason for denials, and publish annual PA metrics (first report due Mar 31, 2026).

    Source

  2. Jan 2026 – Dec 2031

    WISeR model

    CMS Innovation Center tests technology-enabled prior authorization in Original Medicare in NJ, OH, OK, TX, AZ, and WA.

    Source

  3. Oct 1, 2026

    Certified ePA versions

    ONC certification for electronic prior authorization adopts Da Vinci CRD 2.2.1, DTR 2.2.0, and PAS 2.2.1.

    Source

  4. Jan 1, 2027

    Prior Authorization API

    Medicare Advantage, Medicaid and CHIP, and QHP issuers on the federal exchanges must operate FHIR Prior Authorization, Provider Access, and Payer-to-Payer APIs.

    Source

  5. 2027

    Real-time approvals pledge

    Health plans committed to answering at least 80% of electronic prior authorization approvals in real time.

    Source

  6. Proposed · Apr 14, 2026

    CMS-0062-P

    Proposes extending prior authorization requirements to drugs and adopting FHIR-based CRD, DTR, and PAS as the HIPAA prior authorization standard.

    Source

HL7 Da Vinci burden reduction

The three Da Vinci guides.

STU 2.2.1Spec

Coverage Requirements Discovery (CRD)

CDS Hooks service that tells the clinician, at the point of ordering, whether coverage rules or documentation requirements apply.

Defines six hooks, appointment-book, encounter-start, encounter-discharge, order-dispatch, order-select, and order-sign. The primary hooks (appointment-book, order-sign, order-dispatch) must return coverage information.

STU 2.2.0Spec

Documentation Templates and Rules (DTR)

Payer-defined FHIR Questionnaires with CQL logic that pre-populate answers from the EHR and collect only what's missing.

Delivered as a SMART on FHIR app or natively in the EHR; produces a QuestionnaireResponse that travels with the request.

STU 2.2.1Spec

Prior Authorization Support (PAS)

FHIR-based prior authorization request and response, mapped to the HIPAA X12 278 where an intermediary is involved.

Client posts a Bundle to Claim/$submit with Claim.use = preauthorization; pended results arrive by Subscription and status is checked with $inquire. Synchronous responses target 15 seconds.

FHIR resources in play

PatientCoveragePractitionerOrganizationServiceRequestMedicationRequestDeviceRequestConditionObservationProcedureDocumentReferenceDiagnosticReportQuestionnaireQuestionnaireResponseClaimClaimResponseBundleSubscription

Profiles follow US Core and the Da Vinci IGs. Access is scoped through SMART on FHIR, user-launched for clinician review, backend services for asynchronous evidence gathering.

PAS · pended ClaimResponse (abridged)
{
  "resourceType": "ClaimResponse",
  "use": "preauthorization",
  "outcome": "queued",
  "item": [{
    "itemSequence": 1,
    "adjudication": [{ "category": { "coding": [{ "code": "submitted" }] } }],
    "extension": [{
      "url": "http://hl7.org/fhir/us/davinci-pas/StructureDefinition/extension-reviewAction",
      "extension": [{ "url": "code", "valueCodeableConcept": { "coding": [{ "code": "A4" }] } }]
    }]
  }]
}
// "A4" = pended. PriorPilot subscribes for the final decision
// and falls back to Claim/$inquire on a schedule.

Bridging today's channels

For payers that don't have an API yet.

X12 278 (005010X217)

HIPAA-named standard for health care services review requests and responses, typically exchanged through a clearinghouse.

X12 275

Additional information to support a request, used to send clinical attachments alongside a 278.

NCPDP SCRIPT ePA

Pharmacy-benefit electronic prior authorization transactions between prescribers, intermediaries, and processors.

Payer portals & fax

Still the dominant channels for many payers and services; handled by supervised automation and structured intake.

State law

Gold carding and human review requirements.

State rules shape when authorization is required and who may decide. Our policy engine tracks them alongside payer policy.

Texas

HB 3459 exempts providers from prior authorization for a service when 90% or more of their requests were approved over a six-month evaluation period.

Source

California

SB 1120 requires that medical-necessity denials, delays, or modifications be decided by a licensed physician or qualified health professional, not by AI alone.

Source

Preparing for the 2027 API deadline?

We'll map your payer mix to the channels each payer supports today and after January 2027.

Book a demo