Are You Paying Attention to Prior Authorization? Your Regulators Are.

With recent CMS mandates and state-level reforms, the healthcare industry faces a pivotal moment to improve prior authorization processes, ensuring timely access to care and integrating health equity considerations.

CMS Final Rules

Amidst mounting scrutiny from Congress, government watchdogs, and industry stakeholders, the Centers for Medicare and Medicaid Services (CMS) has introduced a number of new prior authorization (PA) requirements across three Final Rules:

• Contract Year 2024 Medicare Advantage and Part D Final Rule: CMS-4201-F
• Contract Year 2025 Medicare Advantage and Part D Final Rule: CMS-4205-F
• Interoperability and Prior Authorization Final Rule: CMS-0057-F

CMS has already taken immediate action in its audits to ensure compliance with the requirements of CMS-4201-F through focused audits, and similar attention can be expected on the requirements of CMS-4205-F and CMS-0057-F.

Each of these rules has presented new requirements for Medicare Advantage (MA) plans which includes provisions that already took effect January 1, 2024. Meanwhile, the Interoperability and Prior Authorization Final Rule outlines requirements for MA plans in addition to other impacted payers¹ who will collectively need to implement operational changes and technological enhancements starting January 1, 2026. The following timeline provides a high-level overview of key PA provisions from these Final Rules.

2024

CMS-4201-F outlines key requirements for MA plans, including provisions surrounding:

• The criteria used in PA decision-making, including when and how MA organizations can develop their own criteria.
• The duration of PA approvals.
• The use of 90-day approvals for transitions of care when members are in an “active course of treatment.”
• The composition and responsibilities of a plan's Utilization Management Committee.
• The proper use of Artificial Intelligence in clinical decision-making.

2025

CMS-4205-F expands on requirements from CMS-4201-F for MA plans and mandates: 

• The Utilization Management Committee includes a health equity expert to perform an annual health equity analysis of the use of prior authorization at the plan level.
• The health equity analysis is published on the plan’s website.

2026

CMS-0057-F discusses new requirements that plans will need to operationalize:

• Notification requirements when a PA determination is made, which includes communication of specific reasons for the denial when a PA request is denied by the payer.
• Timeframe requirements to respond to PA requests.²
• Reporting requirements for PA metrics.

2027

CMS-0057-F discusses the expansion of the existing Patient Access Application Programming Interface (API) and the implementation of three APIs: Provider Access API, Prior Authorization API, and Payer-to-Payer API. Key API attributes related specifically to PA include:

• Patient Access API requires the inclusion of information about certain prior authorizations to be accessible to patients via API that has not been available before under existing Patient Access API standards.
• Provider Access API will allow in-network providers with whom the patient has a treatment relationship to determine payer-specific prior authorization requirements for items and services (excluding drugs). 
• Prior Authorization API to sync provider and payer through the PA process by providing the payer’s list of covered items and services, the ability to query PA requirements (e.g., documentation), the submission of a PA request, and the corresponding response from the payer. The API will enable the payer to communicate approvals, denials, and requests for more information from the provider. 
• Payer-to-Payer API to provide patient-specific information about certain prior authorization(s) from previous payer(s) to a new payer.

State Legislation and Reforms

In parallel with CMS rulemaking, many states are proposing or enacting PA process reforms, including:

• Exemption of certain providers and services from PA requirements.
• Public accessibility of PA information.

Even in the absence of legislative reform, state regulators are leveraging existing oversight initiatives such as audits to dive deeper into plans’ PA processes and outcomes. 

Action Items

Operationalizing these complex and evolving PA requirements is an arduous task requiring advanced planning and close partnership between clinical, compliance/legal, and information technology partners. Organizations must thoroughly understand and assess the impact of these requirements on both internal and external (e.g., delegate) operations and begin acting now to ensure readiness by future compliance deadlines. New requirements bring enhanced oversight, monitoring, and governance programs to ensure all applicable programs are compliant with regulations and patient access to medically necessary care is delivered. 

Relevant Previous Publications

CMS Confirms New Prior Authorization Requirements for Medicare Advantage in 2024 Final Rule, Kelli Howe (ankura.com)

^{1 CMS has defined “impacted payers” as Medicare Advantage, Medicaid and Children's Health Insurance Program ("CHIP") Fee-for-Service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan ("QHP") issuers on the Federally Facilitated Exchanges.  Certain prior authorization process enhancements do not apply to QHPs.}

^{2 Except Qualified Health Plan issuers on the Federally Facilitated Exchange.}

^{© Copyright 2024. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.}