Prior authorization in 2026: the rules that just took effect
January 1 brought new decision timeframes, denial reasons and public metrics, plus a Medicare model that uses AI for prior auth review. What operations teams should automate first.
January 1, 2026 was a quiet but important date for anyone who works on prior authorization.
Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), impacted payers must now decide expedited requests within 72 hours and standard requests within seven calendar days. Operational provisions, including giving a specific reason for denials and publishing prior authorization metrics, apply from January 1, 2026, with initial metrics due by March 31. The API requirements, including a Prior Authorization API, generally follow on January 1, 2027.
The same day, CMS started the WISeR model in six states. Participants use technologies such as AI and machine learning to speed up prior authorization review for a preselected set of services in traditional Medicare, paired with human clinical review. CMS is explicit that all recommendations for non-payment are determined by appropriately licensed clinicians.
And the insurer pledge from last June committed participating plans to reduce the services subject to prior authorization by January 1, 2026.
What this means on the provider side
Faster clocks on the payer side do not remove work on the provider side. If anything, they reward the organisations that can respond quickly and completely. Three pieces of work stand out:
- Status chasing. Until the 2027 APIs are live and widely used, a lot of status checking is still phone and portal work. This is where voice and browser agents pay off first.
- Denial triage. Specific denial reasons are now required. A specific reason is structured input, which means an agent can classify the denial, check it against the payer's published policy and route it.
- Appeal drafting. Once a denial is classified, much of the appeal is assembling the right facts from the record and citing the right policy criteria. A document agent can draft it; a person reviews and signs.
The design principle regulators keep repeating
From the pledge to WISeR, one principle keeps appearing: technology can speed things up, but clinical judgment stays with qualified people. We build to the same rule. Agents gather, classify and draft. People decide.
Sources
- CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), fact sheet, CMS, January 17, 2024.
- WISeR (Wasteful and Inappropriate Service Reduction) Model, CMS Innovation Center.
- HHS Secretary Kennedy, CMS Administrator Oz Secure Industry Pledge to Fix Broken Prior Authorization System, CMS, June 23, 2025.