This week, our In Focus section reviews the Centers for Medicare & Medicaid Services (CMS) Interoperability and Prior Authorization Final Rule, published on January 17, 2024. This is CMS’s latest effort to flesh out regulations mandating payer interoperability and fully electronic prior authorization (PA) policies. The 2024 final rule also represents a new phase in the agency’s work to advance interoperability as it moves beyond policymaking focused on building interoperable systems to policies centered on the applications and usage of shared data.
The new requirements affect a large segment of the nation’s public health insurance programs, including Medicare Advantage (MA) organizations, state Medicaid fee-for-service (FFS) programs, state Children’s Health Insurance Program (CHIP) FFS programs, Medicaid managed care plans, CHIP managed care organizations, and qualified health plan (QHP) issuers on the federally facilitated exchanges (FFEs). These payers must implement and adhere to Health Level 7® (HL7®) Fast Healthcare Interoperability Resources® (FHIR®) application programming interfaces (APIs). These APIs were developed by the DaVinci project and the CARIN Alliance which are both HL7 FHIR accelerator programs. Leavitt Partners, an HMA company, leads the work of the CARIN Alliance.
The final rule demonstrates a commitment to information sharing across the industry landscape and confidence in the FHIR standard to support health data exchange across all required APIs. Ultimately, FHIR APIs are creating a more patient-centered data ecosystem that can provide a tangible return on investment.
Following are details about the requirements, opportunities, and next steps for stakeholders.
Prior Authorization API and Process
Payers must build and maintain PA APIs by January 1, 2027, allowing providers to ask payers whether PA is required for a patient’s procedure, what documents must be submitted to attain authorization, and to receive the final decision and reason for denied requests electronically within a specified timeframe (seven days for standard procedures and three days for expedited decisions).
The rule finalizes requirements for the PA process, regardless of whether the payer receives the PA request through the Prior Authorization API. Specifically, CMS is requiring that:
- Affected payers send notices to providers when they make a prior authorization decision, including a specific reason for denial when they deny a PA request
- Payers, other than QHP issuers on the FFEs, respond to prior authorization requests within specific timeframes
- Affected payers publicly report certain metrics about their PA processes
These prior authorization process requirements become effective January 1, 2026. The last 12 months of PA information also must be shared with patient, providers, and other payers when the member switches a plan through the respective APIs.
To promote adoption of electronic prior authorization processes, CMS is adding an Electronic Prior Authorization measure for Medicare clinicians who participate in the Merit-based Incentive Payment System (MIPS) and hospitals and critical access hospitals in the Medicare Promoting Interoperability Program as an attestation measure.
Payer to Payer FHIR API
To support continuity of care and value-based programs, payers must be able to send, receive, and incorporate enrolled member data from previous and concurrent payers if members are dually enrolled.
To comply with the new electronic data sharing, the final rule requires payers to build and use FHIR API by January 1, 2027. Payer-to-payer (P2P) data sharing will include the last five years of claims/encounters, clinical data, and the active and pending PA requests. The data collected through the P2P APIs will need to be available to the other APIs (i.e., provider, patient, and prior authorization). The rule requires payers to request data from previous payers within a week after the patient opts in to sharing data. For dually enrolled members, data sharing will incur at least quarterly.
Patients must opt in and agree to the P2P data sharing. To this end, health plans must adjust their enrollment administrative process to allow members to easily share previous and concurrent payer information and consent to data sharing. CMS allows Medicaid or CHIP agencies to contract with entities, such as Health Information Exchanges (HIEs), for the digital access and transfer of a patient’s medical records, which supports the Payer-to-Payer API.
Provider Access FHIR API
Payers also must build and maintain a Provider Access API to share patient data with in-network providers with whom the patient has a treatment relationship, enabling continuity and coordination of care, by January 1, 2027. Affected payers must maintain an attribution process to associate patients with the appropriate in-network providers responsible for the patient care. The data from the payer via the Provider Access API must be added to a provider’s electronic health record, practice management solution, or any other technology solution that a provider uses for treatment purposes.
The Provider Access API includes the same data covered in the Payer to Payer Access API (claims/encounters, clinical data, and prior authorizations). The payer has one business day to deliver the required information. Payers must offer a mechanism for members to opt out from making their data available to the attributed providers.
Patient Access FHIR API
The final rule further enhances patient access to data to improve their treatment and shopping experience. In addition to claims and clinical data, as of January 1, 2027, payers must make PA data available through the Patient Access API to inform patients on their plan’s PA process and the status of requests.
In addition, affected payers must report annual metrics about Patient Access API usage and data requests to CMS beginning January 1, 2026.
Key Considerations and Early Results
The rule presents a significant opportunity to improve patient experiences and outcomes and to address some of the administrative burden on clinicians. Though CMS made some adjustments to timeframes in the proposed rule, immediate attention is needed to evaluate technological solutions available to payers, assess gaps between current and future required state, and develop policies to comply with new requirements and measures reporting.
Commercial payers may also leverage the improved electronic data sharing but are not required to do so. CMS-funded payers must respond to any inquiries from commercial payers and must require commercial payers to provide the same information as affected payers. Commercial payers, state governments, and other stakeholders have an opportunity to collaborate around the electronic data exchange.
This rule may have positive downstream application to other areas beyond PA, including quality measurements, risk adjustment, and population health. Early adopters who have implemented the prior authorization APIs have, on average, recorded a 150% – 300% return on investment (ROI). The implementation of API-based prior authorization represents a demonstrable increase in efficiency and significantly reduced provider burden. Given the measurable ROI, state-based regional collaboratives being led by Leavitt Partners are forming between payers and providers to implement the core tenants of the CMS rule well in advance of the 2027 deadline.
Similar initiatives are taking place in the technology space, like the Digital Quality Implementers Community, which was recently convened by Leavitt Partners and National Committee for Quality Assurance (NCQA) to build industry readiness for transitioning to FHIR-based digital measurement that hinges on improved electronic data sharing
What to Watch
The HMA team will continue to analyze the CMS’s Interoperability and Patient Access rule in the context of other federal and state policy changes affecting MA organizations, Medicaid FFS programs, state CHIP FFS programs, Medicaid and CHIP managed care programs, and QHPs.
The work and opportunities afforded with the Interoperability and Patient Access final rule will be featured prominently at The HMA Spring Workshop: Getting Real About Transforming Healthcare Quality and Value, March 5-6. In addition to rich discussions, HMA and HMA companies, including Leavitt Partners and Wakely Consulting LLC, are available to support planning and implementation and related system redesign initiatives. If you have questions about these topics, contact our experts below.
