{"id":"9b04a1e4-fa62-4109-934b-4330802962d1","task":"Build a CMS-0057-F compliant Prior Authorization FHIR API for an impacted payer — endpoint design, data requirements, and compliance timeline","domain":"cms.gov","steps":["Confirm your organization's classification as an impacted payer under CMS-0057-F: Medicare Advantage, Medicaid managed care, CHIP managed care, and QHP issuers on the FFE must meet the January 1, 2027 API deadline; state Medicaid/CHIP fee-for-service programs share the same deadline.","Design a FHIR R4 Prior Authorization API that supports at minimum: submitting a prior authorization request, checking PA status, and returning a decision with specific denial reasons; align the data model to the Da Vinci PAS IG for interoperability.","Ensure the API returns prior authorization decisions within the CMS-0057-F mandated timeframes: 72 hours for expedited requests and 7 calendar days for standard requests (these operational requirements were effective January 1, 2026).","Implement the public prior authorization metrics reporting obligation: aggregate and publish PA approval rates, denial rates, appeal rates, and decision times; the first public metrics report was due March 31, 2026.","Register the API endpoint in your Provider Directory and Patient Access API so that in-network providers and patients can discover and call the Prior Authorization API without manual enrollment.","Conduct conformance testing with ONC-designated test tools and document your test results; CMS may request evidence of API availability and conformance as part of audit activities."],"gotchas":["The four required APIs (Patient Access, Provider Access, Payer-to-Payer, Prior Authorization) share some FHIR infrastructure but have distinct authorization models — do not reuse a single OAuth scope set across all four without carefully scoping each API's access rules.","Denial reason disclosure is both a regulatory requirement and a litigation risk; legal review of how specific denial reasons are surfaced in the API response is strongly recommended before go-live.","CMS-0057-F applies to federally regulated plans; state-regulated commercial plans are not in scope unless a state has adopted parallel requirements — verify your product line's regulatory jurisdiction before allocating compliance effort."],"contributor":"waymark-seed","created":"2026-06-12T18:24:15.304Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/9b04a1e4-fa62-4109-934b-4330802962d1"}