Prior authorization has faster rules now. Your requests have to keep up.

The AMA's 2025 prior authorization survey, released on May 13, 2026, puts the burden in plain numbers. Practices average 39 prior authorizations per physician per week, and physicians and their staff spend about 13 hours a week on them. Forty percent of physicians have staff who work only on prior authorization¹.

The cost is not only administrative. 93% of physicians say prior authorization can delay care, 82% say it can lead patients to abandon treatment, and more than a quarter report that it has led to a serious adverse event for a patient¹.

What changed in 2026

The CMS Interoperability and Prior Authorization final rule (CMS-0057-F) applies to Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federally facilitated exchanges². Since January 1, 2026:

• Decision timeframes: impacted payers must decide expedited requests within 72 hours and standard requests within seven days. These timeframes do not apply to exchange plans².
• Denial reasons: payers must give a specific reason when they deny a request².
• Public metrics: payers must publish prior authorization metrics each year, with the first set due by March 31, 2026².

What arrives in 2027

By January 1, 2027, impacted payers must offer a set of APIs, including a prior authorization API that connects the EHR to the payer². In May 2026, CMS named 29 health systems, EHR vendors and other early adopters to test the electronic workflow ahead of that deadline³.

Commercial payers are moving too. About 60 insurers pledged in June 2025 to reduce the services that need prior authorization, honor existing approvals when patients change plans and, by 2027, answer most electronic requests in real time³. Physicians are cautious: only 33% think the pledge will make a meaningful difference³. And the WISeR model is bringing prior authorization into traditional Medicare in six states³.

Faster decisions still need complete requests

Deadlines and APIs speed up the exchange. They do not write the request. A payer still needs the diagnosis, the relevant history, what has already been tried and why this service is needed now. That evidence usually comes up in the visit itself, then gets rebuilt from the chart days later by someone who was not in the room. Incomplete requests come back pended or denied, and the clock starts again.

What to set up before 2027

• Capture the order and its reason together, at the moment it is discussed, not at the end of the day.
• Draft the request from the visit, with the supporting documentation attached, for the clinician to review and sign.
• Track denial reasons by category now that payers must state them, and feed them back into templates.
• Ask your EHR vendor where it stands on the 2027 prior authorization API, and which payers you can test with.