Prior authorization in 2026: new rules and a workflow that holds

The AMA's 2025 Prior Authorization Physician Survey found physicians complete an average of 39 prior authorizations per week and spend about 13 hours of physician-and-staff time on them. Ninety-three percent of physicians say prior authorization causes care delays, and 82% say it can lead patients to abandon treatment.

It is also a practice-operations problem: MGMA reports 92% of medical groups have hired or reassigned staff solely to handle prior-authorization volume. Manual prior authorization costs an estimated $3.41 per transaction versus $0.05 fully electronic, per the CAQH Index — which is exactly why the federal rules focus on automation.

The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) takes effect in two phases. Beginning January 1, 2026, impacted payers must decide expedited requests within 72 hours and standard requests within 7 calendar days — down from 14 — and must provide a specific reason for every prior-authorization denial.

The crucial limit: the rule applies to Medicare Advantage, Medicaid and CHIP, and qualified health plans on the federal marketplace. It does not cover commercial or employer-sponsored plans. For much of a typical payer mix, the old timelines still apply — so the rule helps, but it does not solve prior authorization on its own.

Phase two arrives January 1, 2027, when impacted payers must implement a FHIR-based Prior Authorization API alongside Patient Access, Provider Access, and Payer-to-Payer APIs, with public reporting of prior-authorization metrics beginning that year.

The readiness gap is wide. Only about 31–40% of medical prior authorizations are currently conducted fully electronically, and CAQH found just 9% of surveyed organizations can support the 2027 API mandate today. Most of the automation upside is a 2027 story — which means 2026 is a year to fix workflow, not wait for technology.

Until the APIs arrive, the practices that handle prior authorization well treat it as a staffed, measured workflow rather than spare-capacity work at the front desk. Maintain a payer-specific requirements library, because each payer's rules differ and change quarterly. Initiate authorizations at the point of scheduling, not the point of service.

Assign clear ownership so a request never stalls between people, batch and template common request types, and track turnaround against the clock. The 2026 timeframes give you firm deadlines — 72 hours and 7 days — to hold impacted payers to, and the new specific-denial-reason requirement makes targeted, fast resubmission possible.