CMS-0057-F: Why Interoperability Demands More Than Compliance

CMS-0057-F is the CMS Interoperability and Prior Authorization Final Rule, issued in January 2024. It sets faster prior authorization decision timeframes and public reporting requirements that began in 2026, and it requires impacted payers to implement four FHIR-based APIs, with most API requirements starting January 1, 2027.

Healthcare has spent a considerable amount of time and resources trying to make the exchange of patient information easier across the ecosystem. However, moving data between systems is only part of the problem. What's more complicated is what happens to that information once it arrives.

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) sharpens the focus on this issue and seeks to address it. With new requirements for prior authorization decisions already taking effect in 2026 and major application programming interface (API) requirements approaching in 2027, health plans are being asked to improve both access to information and the administrative processes that depend on it.

For payers, the immediate priority is regulatory compliance, which is just the first step. The implications of the rule extend into how they manage information, coordinate workflows, evaluate technology, and use artificial intelligence (AI). The rule arrives at a time when many health plans are still operating with fragmented systems. That is why the timing of the CMS-0057-F is important because it will be a litmus test for how well healthcare technology can support the work it was built to manage.

What does CMS-0057-F mean for health plans?

CMS-0057-F means most impacted health plans must decide prior authorization requests within 72 hours (expedited) or seven calendar days (standard), publicly report prior authorization metrics, and add FHIR-based APIs for patients, providers, and other payers. Meeting these requirements depends on how well eligibility, benefits, clinical information, and utilization management work together.

CMS-0057-F introduces requirements intended to improve healthcare interoperability, reduce administrative burden, and make prior authorization processes more efficient, faster, and more transparent.

The rule applies to five categories of payers: Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children's Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans and CHIP managed care entities, and Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges (FFEs). Commercial insurance plans outside the FFEs, including employer-sponsored group health plans, are not directly subject to CMS-0057-F.

Its rollout is spread over two major timelines.

Prior authorization process requirements began January 1, 2026. For medical items and services excluding drugs, MA organizations, Medicaid and CHIP FFS programs, Medicaid managed care plans, and CHIP managed care entities must issue decisions as quickly as the patient's medical condition requires, with maximum timeframes of:

• 72 hours for expedited or urgent prior authorization requests.
• Seven calendar days for standard prior authorization requests.

The clock starts when the payer receives the prior authorization request, regardless of whether it arrives through an API, portal, fax, telephone, or another channel. Requesting additional documentation does not automatically stop or restart that clock. Extensions of up to 14 additional calendar days are permitted for specified request categories when the conditions established under the relevant Medicare Advantage, Medicaid, or CHIP regulations are satisfied. They are not available for every request. QHP issuers on the FFEs are excluded from these new decision timeframes, although they remain subject to other CMS-0057-F requirements.

Beginning in 2026, all five categories of impacted payers must provide a specific reason when denying a prior authorization request for medical items or services, excluding drugs. They are also now mandated to publicly report prior authorization performance metrics.

The first reporting deadline was March 31, 2026, covering the calendar year 2025. Required measures include approval and denial percentages, approvals after appeal, the percentage of extended requests subsequently approved, and average and median decision times for standard and expedited requests.

The major API requirements begin January 1, 2027. CMS-0057-F requires three new FHIR-based APIs and expands the existing Patient Access API:

API	What it does	Applies from
Patient Access API (expanded)	Adds prior authorization information to what members can access through patient-authorized apps	January 1, 2027
Provider Access API (new)	Lets in-network providers with a treatment relationship access relevant patient information	January 1, 2027
Payer-to-Payer API (new)	Supports payer to payer data exchange of specified patient information when members move between health plans	January 1, 2027
Prior Authorization API (new)	Provides electronic access to prior authorization requirements and supports submission and processing of requests	January 1, 2027

Patient Access API

The Patient Access API already exists. CMS-0057-F expands it to include prior authorization information, which members can access through patient-authorized applications. Payers must also report Patient Access API usage metrics to CMS annually.

Provider Access API

The Provider Access API enables in-network providers with a treatment relationship to access relevant patient information, subject to applicable requirements. It is a new API requirement for impacted payers beginning January 1, 2027.

Payer-to-payer data exchange (Payer-to-Payer API)

The Payer-to-Payer API supports payer to payer data exchange: when members move between health plans, specified patient information can move with them. Because the exchange depends on data already being consistent inside each plan, it quickly exposes gaps in member and clinical records.

Prior Authorization API

The Prior Authorization API enables electronic access to prior authorization requirements and supports the submission and processing of requests. It is the technical backbone for electronic prior authorization, working alongside the decision timeframes described above.

The FHIR mandate: FHIR R4 and Da Vinci implementation guides

The FHIR mandate behind these APIs is specific. CMS-0057-F requires HL7 FHIR Release 4.0.1 (FHIR R4) for its API requirements. CMS also recommends, but does not require, HL7 Da Vinci implementation guides, including Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS), to support prior authorization workflows.

How CMS-0057-F affects health plan operations

The rule is expected to affect several interconnected functions of health plans. Prior authorization relies on eligibility records, benefit configurations, clinical information, coverage policies, utilization management processes, and provider communication. Meeting these requirements means ensuring that these functions can support the stipulated timelines and information exchange protocols. What this also means is that, come January 2027, health plans are looking at substantial revisions of their operations, especially for processes that are spread across multiple legacy systems.

Why does CMS-0057-F require more than data interoperability?

Meeting the CMS-0057-F API requirements is not enough because APIs move data without making the data behind a decision consistent. CMS-0057-F compliance requires health plans to exchange information and meet decision timeframes, yet a plan can do both and still lose days to disconnected eligibility, benefit, clinical, and utilization management records.

An electronic prior authorization request reaches a health plan in seconds, but processing it takes days.

Take the case where a provider submits a request. What happens after that? The payer may need to confirm the member's coverage, check benefit limitations, retrieve supporting clinical documentation, apply medical necessity criteria, and determine whether additional review is required. In many healthcare organizations, these activities are carried out across different applications. Some systems exchange information automatically, while others depend on manual updates, separate work queues, or employees retrieving information from multiple sources. The request may have arrived electronically, but much of the work behind the scenes remains disconnected.

Furthermore, the rule does not prescribe a single administrative architecture. Health plans can meet their obligations through different technology setups, but they will be hard-pressed to connect their systems as per the implicit requirements of the rule.

As a result, payer interoperability is now closely tied to the quality and efficiency of everyday administration. Health plans will need to examine where information is lost, where work stalls, and how much effort is spent reconciling data that already exists in some corner of some system or workflow in the organization.

These problems are not new; they predate CMS-0057-F. What the rule does is give healthcare organizations a stronger and stricter reason to address them.

How will CMS-0057-F impact the healthcare technology industry?

The implications of the rule will be felt across the healthcare technology market, particularly for companies developing administration platforms, electronic health records (EHRs), utilization management (UM) systems, and payer interoperability solutions. The rule reinforces the importance of standardized information exchange, with HL7 FHIR playing a central role in its API requirements.

For EHR vendors, electronic prior authorization needs to be integrated with the workflows providers already use. Requiring clinicians to discard their existing systems, reenter information, or use separate portals for tracking requests can undermine the benefits of electronic exchange.

In case of utilization management technology providers, the challenge will be to connect incoming requests with coverage criteria, supporting documentation, review processes, and decision communication, while payer administration vendors will need to keep records related to prior authorization consistent and accessible since claims adjudication decisions will now be subject to tighter timelines.

The upcoming requirements are also likely to influence purchasing decisions. Health plans have traditionally evaluated the utility of software based on the capabilities of individual applications. Claims systems, for instance, are assessed for their claims processing efficiency, while utilization management platforms are gauged for their ability to handle authorization workflows.

At the same time, the CMS-0057-F also raises the expectations on AI providers. An AI application that summarizes documents or classifies requests may improve one operation. However, its real value depends on whether the results can be used reliably within the systems responsible for completing the work. The rule is designed to push healthcare technology companies to demonstrate tangible operational value alongside technical functionality.

What role will AI play in prior authorization under CMS-0057-F?

AI holds tremendous potential in terms of streamlining payer-to-payer data exchange processes and reducing the administrative work that prior authorization requests entail, even if CMS-0057-F does not require health plans to adopt the technology.

In truth, much of the opportunity for AI lies in the operations surrounding claims review. Requests often arrive with supporting documents that need to be checked, organized, and compared against relevant information. Missing records can trigger follow-ups, and inconsistencies may get flagged and need to be investigated. On the other hand, cases that need to be reviewed by a specialist must reach the appropriate reviewer.

AI can assist with these activities by separating incomplete submissions from the complete ones, extract case-relevant details from the available documents, surface inconsistencies, and route cases toward the appropriate workflow. It can also help teams analyze recurring delays and understand why certain requests require repeated intervention. These are useful applications because administrative effort accumulates across the entire prior authorization process. Improving the final review stage alone will not have the desired impact if requests continue to arrive with missing information or waste time getting handed off from one team to another.

For health plans, the real return on AI is upstream triage, keeping nurses and medical directors from burning hours on incomplete chart notes so they can focus on timely clinical determinations. In all of this, what must be remembered is that an AI model is only as effective as the information and processes that support it. A system reviewing a request needs access to current eligibility information, applicable benefit rules, relevant clinical documentation, and the right coverage criteria. If those sources are in any way inaccurate, incomplete, or inconsistent, the AI may produce misinformed recommendations that will require further investigation, resulting in additional work. Thus, the quality of the underlying data and the controls governing its use matter as much as the sophistication of the AI model, if not more. In the age of agentic AI, this gains even more significance as AI agents can coordinate tasks and initiate permitted actions across workflows.

How will CMS-0057-F shape the future of healthcare interoperability?

The way CMS-0057-F has been worded and formulated will likely influence how health plans define successful interoperability. Technical measures such as API availability, standards adoption, and data exchange volumes will remain critical. The problem is that they provide only a partial view of whether information exchange is improving administration. A provider may be able to submit a request electronically and still encounter delays due to incomplete records or disconnected review processes. A health plan may receive accurate information but may still require it to be transferred manually between applications.

Neither situation delivers the full benefit that interoperability is intended to provide. However, operational measures can split the difference.

Health plans can examine how frequently requests require additional documentation, how long cases remain in review queues, how often staff must reconcile information across systems, and whether decisions can be traced back to the relevant records and criteria. These measures offer a more practical view of what happens after information is exchanged, while also bringing the focus on the architecture supporting health plan administration.

When eligibility, benefits, utilization management, and other administrative functions operate with separate records and disconnected workflows, even routine activities can require substantial coordination. Improving information exchange helps, but it does not necessarily eliminate those dependencies. A more connected operating environment can make it easier to maintain consistent information and carry context through successive administrative steps.

This is the operational foundation of the HealthAxis Enterprise Healthcare Operating System (EHOS). Rather than layering temporary middleware over legacy cores, EHOS unifies core administrative processing, utilization management, and provider interactions within a single operational framework. Supported by Aipass™—the embedded intelligence layer. The platform automates missing-document triage, surfaces discrepancies, and routes clean cases contextually to lower cost-per-authorization while safeguarding decision timelines.

Going far beyond any single rule or regulation, the relevance of this approach cannot be ignored. Healthcare administration involves thousands of decisions and transactions that depend on information remaining accurate and accessible as work moves between functions. CMS-0057-F simply ups the urgency to the already pressing need for better operational coordination in healthcare. It also gives health plans an opportunity to assess whether their interoperability investments are improving their broader administrative environment or just adding new connections between systems that remain operationally separate.

What comes after CMS-0057-F compliance?

Meeting CMS-0057-F requirements is an important milestone for health plans. The new decision timelines, transparency mandates, and API requirements establish expectations with clarity on how information should be exchanged and how prior authorization should operate.

But compliance does not settle every argument related to administrative efficiency. Health plans will still need to manage complex benefit structures, changing coverage policies, clinical documentation, exceptions, and the coordination required across different systems and teams. The organizations that stand to gain the most from investing in interoperability will be those that deploy information exchange systems that measurably improve these everyday processes.

For healthcare technology providers, this means supporting more than standards-based connectivity. Their systems must help health plans access and use exchanged information reliably within the workflows responsible for processing requests and communicating claims decisions.

CMS-0057-F has established stringent requirements for how healthcare information needs to be shared between workflows, information systems, and stakeholders. For COOs and Utilization Management executives of health plans, real progress is not defined by compliant API endpoints, but by preserving clinical capacity and downsizing administrative spend.