CMS Seeks to Expand Interoperability Requirements to Drug Pre-Authorization (FAQ)

On April 10, 2026, the Centers for Medicare and Medicaid Services (CMS) issued a proposed rule (2026 CMS Interoperability Standards and Prior Authorization for Drugs, or CMS-0062-P) outlining the agency’s plans to impose new interoperability requirements on payors participating in certain Medicare and Medicaid programs. As described by the agency in a recent press release, the proposed rule “builds on” prior rulemaking by clarifying and enhancing interoperability requirements for payors’ prior authorization processes, specifically those associated with coverage requests for pharmaceutical therapies.

If enacted, the proposed rule would:

• • Mandate that affected payors support digital prior authorization for drug-related coverage requests.
  • Define specific (shorter) turnarounds for authorization decisions.
  • Require impacted payors to provide greater transparency during the prior authorization process.
  • Compel impacted payors to update their health IT standards.
  • Present new reporting requirements regarding prior authorization performance metrics.

The proposed regulation would build upon a regulatory foundation set by existing regulations: the 2020 Interoperability and Patient Access final rule, which established basic interoperability requirements, and the 2024 final rule, which specified how those requirements applied to non-drug items and services. As drafted, the 2026 proposed rule seeks to close the existing regulatory gap by clarifying how federal interoperability requirements would apply to drug-related prior authorization requests submitted to certain federal health programs.

When Would the Proposed Rule Take Effect?

If finalized, most changes in the proposed rule would go into effect starting on October 1, 2027. However, CMS is currently seeking feedback on its proposals and plans to accept public comments until June 15, 2026. 

Interested in submitting a public comment? Crowell Health Care lawyers can assist with the ideating, drafting, and submission process.

Which Payors Would Be Impacted?

The proposed rule would apply to Medicare Advantage organizations, Medicaid and Children’s Health Insurance Program (CHIP) managed care entities, state Medicaid and CHIP programs, and qualified health plan (QHP) issuers operating on federal health exchanges.

What New Requirements Would the Proposed Rule Impose?

1. Impacted payors must set up electronic prior authorization systems for drugs, using different technical standards depending on whether the drug is covered under a medical benefit or a pharmacy benefit.

Drugs billed under the medical benefit would be handled through the existing Prior Authorization API using the Fast Healthcare Interoperability Resources (FHIR) standards — a broadly-used framework designed to support health information exchange — while drugs dispensed through the pharmacy benefit would need to align with data exchange protocols set by the National Council for Prescription Drug Programs (NCPDP). The two frameworks are designed to be non-overlapping and together address all drugs subject to the requirements.

2. Impacted payors must meet specific deadlines for making prior authorization decisions on drugs, with the exact timeframes varying based on the type of payor and how the drug is covered.

For QHP issuers on the federally facilitated exchanges, CMS proposes new decision notification timeframes based upon the urgency of the request:

• • One day for urgent drug requests.
  • Three days for routine (i.e., non-urgent) drug requests.
  • Three days for urgent non-drug items and services.
  • Seven days for routine non-drug items and services.

A 24-hour standard already applies to outpatient drugs currently covered by fee-for-service Medicaid and CHIP managed care programs; CMS proposes extending that same timeline to CHIP fee-for-service prescription drug decisions where no deadline currently exists.

3. Impacted payors must give providers a clear, individualized explanation whenever a drug prior authorization request is denied.

In the proposed rule, CMS notes that denial communications are currently inconsistent and may rely on vague or proprietary language, which can slow down a provider’s ability to appeal or resubmit a request on behalf of a patient. As drafted, the proposed rule would require payors to provide a denial explanation sufficiently detailed so that the provider could understand the basis for the denial and what would be needed to remedy it.

4. Impacted payors must make prior authorization request and decision information for drugs accessible to patients and providers through existing data-sharing systems.

CMS proposes requiring all information relating to prior authorization requests, including decision outcomes, relevant drug and dosage details, denial explanations, and supporting clinical documentation, to be made available through the Patient Access, Provider Access, and Payer-to-Payer APIs. As a contextual note, these three APIs form the core of CMS’s broader interoperability framework — each targets a different data-sharing relationship: plan to patient, plan to provider, and plan to plan, respectively.

The Payer-to-Payer API would carry the same data elements with one key difference: it would not include information about requests that were ultimately denied.

5. Payors must publish performance data on how they handle prior authorization, including a new set of metrics focused specifically on drugs.

CMS proposes requiring impacted payors to post drug-specific metrics on their websites as a new reporting obligation, separate from what is already required for non-drug items and services. However, the agency plans to exempt Medicare Advantage prescription drug (MA-PD) plans from the requirement, recognizing that prescription drugs covered under Part D are already governed by a distinct set of reporting rules; layering an additional set of requirements on top of those would impose unnecessary and redundant burdens on those plans. As such, MA-PD plans would be responsible for reporting drug prior authorization metrics only for drugs billed under Medicare Part B, and not for drugs covered through the Part D pharmacy benefit portion of their plan.

Reporting deadlines vary by payor type but are generally tied to the close of the preceding calendar year or rating period, with reporting beginning in 2028.

6. Payors must keep their health IT systems up to date with the most current federally recognized technical standards across all required data-sharing systems.

CMS proposes tying compliance to unexpired versions of the standards adopted in federal health IT regulations. In practice, this means that as the Office of the National Coordinator for Health Information Technology (ONC), the federal agency responsible for health IT policy and standards, updates and phases out older standards, payors would be required to transition accordingly. This framework would apply across all required interoperability APIs, including the NCPDP SCRIPT standard used for pharmacy-benefit drug prior authorization.

7. Payors must submit their system connection details and technical documentation to CMS for public posting and must keep that information current on an ongoing basis.

Impacted payors would be required to report their API endpoints and associated documentation URLs (which encompass areas such as authentication, authorization, and system registration) within two months of the rule taking effect, with updates due promptly following any changes and verification required on at least an annual basis. CMS intends to publish this information centrally to make it easier for developers and other stakeholders to locate and connect with these systems.

8. Health care entities covered by HIPAA must modernize their electronic workflow for certain prior authorization-related transactions.

CMS proposes replacing older electronic data interchange formats with FHIR-based standards and implementation guides for prior authorization transactions involving medical services, covering the full workflow from initial eligibility verification through to the authorization request itself and the submission of supporting clinical documentation. Covered entities would generally have two years after the rule is finalized to come into compliance, with a three-year window available for smaller health plans. These proposed standards would not apply to transactions involving drugs dispensed at retail pharmacies, which continue to be governed by a separate set of pharmacy industry standards.

9. Health insurers offering small-group coverage through the federal Small Business Health Options Program (SHOP) marketplace are newly required to comply with data-sharing and prior authorization rules that previously did not apply to them.

CMS proposes formally designating these issuers as an impacted payor category, explaining that the added compliance burden is manageable because all current FF-SHOP issuers already offer individual market plans on the federally facilitated exchanges and are therefore already working to implement the underlying requirements.

A later start date — plan years beginning on or after January 1, 2028 — would apply to certain already-existing API requirements, while the October 1, 2027, date would govern the new drug prior authorization standards.

10. Payors that meet certain criteria may request additional time or relief from specific electronic prior authorization requirements.

State Medicaid and CHIP fee-for-service programs could apply for extensions by demonstrating documented progress toward compliance and a credible plan for achieving full compliance before the relevant HIPAA deadline takes effect. QHP issuers on the federally facilitated exchanges could separately seek relief from the requirement to support pharmacy-benefit drug prior authorization standards through the annual plan certification process.

Implications and Next Steps

Taken as a whole, the proposed rule represents a significant expansion of federal interoperability and prior authorization requirements, extending existing frameworks to cover drug-related requests and introducing new obligations regarding transparency, timeliness, and technical standardization. Affected payors, health IT developers, and other stakeholders should carefully review the proposal and consider submitting public comments before the June 15, 2026, deadline; Crowell Health Care lawyers are available to assist with that process.