The CMS Interoperability and Prior Authorization Final Rule, CMS 0057 F, requires impacted payers to decide expedited prior authorization requests within 72 hours and standard requests within 7 calendar days, effective January 1, 2026. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federally facilitated exchanges. It does not directly apply to commercial or employer-sponsored plans, and it does not cover prescription drug authorizations. The rule also requires a specific reason for every denial and public reporting of authorization metrics starting March 31, 2026. None of this changes how fast your clinic can submit a request. A payer that responds in 72 hours still adds days to your total cycle time if your own software takes days to gather documentation and complete the form.

What Is the CMS 72 Hour Prior Authorization Rule?

CMS 0057 F took operational effect on January 1, 2026, for most impacted payers, with Medicaid and CHIP managed care plans complying at the start of their first rating period on or after that date. The rule sets three requirements. Standard prior authorization decisions must be issued within 7 calendar days, down from as long as 14 days for some Medicare Advantage plans before the rule. Expedited or urgent decisions must be issued within 72 hours. Every denial must include a specific reason, communicated through the payer's chosen channel, whether portal, fax, email, mail, or phone.

A second deadline sits further out. By January 1, 2027, impacted payers must operate FHIR-based APIs covering Patient Access, Provider Access, Payer-to-Payer data exchange, and Prior Authorization itself, collectively known as the PARDD APIs. That deadline applies to payers, not providers, but a clinic's EMR or clearinghouse needs to support FHIR-based workflows to capture the efficiency gains once payers comply. Practices on legacy systems built around fax and manual portal entry will see less benefit from the API deadline than practices already running structured, connected documentation.

Does the CMS 72 Hour Rule Apply to Every Payer?

No. The rule's exclusions matter more than most compliance guides make clear, because a mixed payer panel means a clinic is operating under two different sets of rules at once for the same front desk workflow.

A clinic tracking one blanket turnaround expectation across every payer is building the wrong mental model. Software that cannot tell a covered Medicare Advantage request apart from an uncovered commercial one will either overpromise on timelines the payer has no obligation to meet, or underuse the leverage the rule actually provides on covered plans.

Commercial plans are not left out entirely, just not through CMS 0057 F itself. In June 2025, 48 health insurers, including UnitedHealthcare, Humana, Aetna, Cigna, and more than 30 Blue Cross Blue Shield entities, made a separate, voluntary industry commitment covering commercial, Medicare Advantage, and Medicaid managed care plans alike, affecting an estimated 257 million Americans. As of the plans' own reporting, that commitment has produced an 11% reduction in prior authorization volume, more than 6.5 million fewer requests, with reductions exceeding 15% in Medicare Advantage specifically, plus a standing commitment to honor a prior plan's existing authorization for 90 days when a patient switches insurers mid treatment. The insurers have also set their own 2027 target of answering at least 80% of electronic prior authorization requests in real time. This is a voluntary pledge, not a binding rule, and it is not enforced the way CMS 0057 F is, but it means a commercial plan behaving faster than the federal minimum may be acting on this commitment rather than any legal requirement, worth knowing before assuming a fast commercial response means your software gets credit it did not earn.

What Happens if a Payer Misses the Deadline?

The 7-day and 72-hour windows are obligations on the payer, not the provider, so a missed deadline is not something SPRY or any other software vendor enforces directly. When a covered payer misses its window, that is a compliance issue a clinic can escalate through the payer's own grievance process, and CMS's public reporting requirement, in effect starting with metrics posted by March 31, 2026, gives clinics a documented baseline to point to when a payer's actual turnaround does not match its public numbers. The practical value of the rule for a clinic depends on actually knowing when the clock started and whether it has been exceeded, which is a tracking problem the software has to solve, not something the rule solves on its own.

Is Your Software Actually Fast Enough to Benefit From This Rule?

A faster payer response only helps a clinic that submits complete requests quickly and keeps up with status changes. A practice that spends 3 to 5 days gathering documentation before submission will still see a 10-plus-day total cycle time even against a payer now bound to a 7-day window, because the payer's clock does not start until it has a complete request in hand.

Run your own workflow through this three-question check before assuming the rule is already working in your favor.

• Question one: submission speed. From the moment a therapist finishes documentation, how long does it take your team to assemble and submit a prior authorization request today? If the answer is measured in hours or days rather than minutes, the payer's faster decision window is being offset by your own front-end delay.
• Question two: tracking visibility. Can your front desk see, without opening a payer portal, which requests are still inside their decision window and which have already exceeded it? If status lives only in a portal someone has to remember to check, the rule's enforcement value is invisible to your own team.
• Question three: denial reason capture. When a request is denied, does your software capture the specific reason CMS now requires payers to provide, in a form your billing team can act on for a resubmission or appeal? A denial reason that arrives by fax and gets filed without review is a requirement the payer met and your clinic wasted.

SPRY's own published figures on this exact bottleneck: supported prior authorization requests move from a 20-plus-minute manual submission to about 90 seconds, and 80% of supported authorization requests are automated end to end. That is the software side of the equation the CMS rule does not touch.

What Should Your EMR Support Before the 2027 API Deadline?

The FHIR-based Prior Authorization API deadline lands January 1, 2027, a full year after the timeframe rules already in effect. That gap is deliberate breathing room, and clinics should use it rather than wait for it.

Confirm each of these directly with your current vendor. A platform that cannot answer the FHIR readiness question with a specific date is not necessarily behind, since the deadline is still more than a year out as of this writing, but the answer tells you how much runway your clinic has to plan around it.

How SPRY Helps Clinics Meet the New Timeline

SPRY identifies prior authorization requirements during eligibility verification, before the patient's first visit, and routes the case into the authorization workflow automatically. For requests through Carelon-administered or BCBS plans, UnitedHealthcare, and Humana, SPRY completes the required form, attaches documentation, and submits the request directly, with additional payer portals in progress. Approved visits, visits used, visits remaining, and expiration dates stay visible on the patient record rather than inside a portal someone has to remember to check, and exceptions that need manual review are routed with payer details, reference IDs, and documentation already attached.

Across 5,007 authorization cases checked for CAM Physical Therapy, a six-location Maryland practice, 4,028 required no authorization at all once checked, with only 25 denied or pending, a 97% overall approval outcome. Janesa Paver, VP of Finance at CAM Physical Therapy, described the change this way: before SPRY, one person handled benefits and authorization for all six locations without time to verify every visit, and with SPRY the team now gets daily verification and knows the benefits for every patient each morning. Motion PT, a three-location outpatient practice in Stockton and Morada, California, with five therapists, cut pre-authorization turnaround from 30 minutes to a few seconds after switching to SPRY. These are SPRY's own reported figures and should be read as such, not as guaranteed outcomes for every clinic. SPRY does not control payer decision timelines and does not guarantee approval. It shortens the part of the cycle that sits inside the clinic's own walls, which is the part the CMS rule leaves entirely up to the provider.

Frequently Asked Questions About the CMS 72 Hour Prior Authorization Rule

When did the CMS 72-hour prior authorization rule take effect?

The decision timeframe and denial reason requirements took operational effect January 1, 2026, for most impacted payers. Medicaid and CHIP managed care plans comply starting at the beginning of their first rating period on or after that date.

Does the CMS 72-hour rule apply to commercial insurance plans?

No. The rule covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federally facilitated exchanges. Commercial or employer-sponsored plans are not directly covered and may still operate on longer timelines.

Do Medicare Advantage plans still require prior authorization in 2026?

Yes. The rule does not remove prior authorization requirements. It compresses the decision window for covered payers to 7 calendar days for standard requests and 72 hours for expedited requests, and requires a specific reason for every denial.

What happens if my software cannot track which payers are covered by the rule?

You lose the practical benefit of the rule even where it applies. A blanket expectation across every payer means covered plans are not held to their actual faster timeline, and staff cannot tell a legitimate delay on an uncovered commercial plan apart from a compliance issue on a covered Medicare Advantage plan.

What is the FHIR Prior Authorization API deadline?

Impacted payers must operate FHIR-based Patient Access, Provider Access, Payer to Payer, and Prior Authorization APIs by January 1, 2027. The deadline applies to payers directly, but a clinic's own EMR or clearinghouse needs to support FHIR-based workflows to capture the resulting efficiency gain.

Can software make a payer respond faster than the CMS deadline requires?

No single software vendor controls a payer's internal decision process. What software can control is the clinic's own side of the cycle: submission speed, documentation completeness, and status visibility, which determines whether the payer's faster window actually shortens the total time to an approved visit.