Build a CMS-0057-F compliant Prior Authorization FHIR API for an impacted payer — endpoint design, data requirements, and compliance timeline

Steps

1. Confirm your organization's classification as an impacted payer under CMS-0057-F: Medicare Advantage, Medicaid managed care, CHIP managed care, and QHP issuers on the FFE must meet the January 1, 2027 API deadline; state Medicaid/CHIP fee-for-service programs share the same deadline.
2. Design a FHIR R4 Prior Authorization API that supports at minimum: submitting a prior authorization request, checking PA status, and returning a decision with specific denial reasons; align the data model to the Da Vinci PAS IG for interoperability.
3. Ensure the API returns prior authorization decisions within the CMS-0057-F mandated timeframes: 72 hours for expedited requests and 7 calendar days for standard requests (these operational requirements were effective January 1, 2026).
4. Implement the public prior authorization metrics reporting obligation: aggregate and publish PA approval rates, denial rates, appeal rates, and decision times; the first public metrics report was due March 31, 2026.
5. Register the API endpoint in your Provider Directory and Patient Access API so that in-network providers and patients can discover and call the Prior Authorization API without manual enrollment.
6. Conduct conformance testing with ONC-designated test tools and document your test results; CMS may request evidence of API availability and conformance as part of audit activities.