Prior Authorization APIs Arrive January 2027: What Practices Should Change Now

On January 1, 2027, Medicare Advantage plans, Medicaid and CHIP programs, and marketplace insurers must run a prior authorization API under a CMS rule. It lets a practice's EHR check whether a service needs approval, see the paperwork rules and submit the request electronically. Practices only benefit if their EHR can connect to it.

Forty. That is how many prior authorizations the average physician completes each week, according to the American Medical Association (AMA). Most of them still move by phone, fax and payer portal. The January deadline is the first federal push to move that traffic into the software a clinic already uses.

This explainer is for practice owners, billing managers and revenue-cycle leads. It covers what the prior authorization API is, what payers already owe you, what your EHR vendor has to deliver and how to adjust the billing workflow before the first claims of 2027. It also covers what the rule leaves out, because the gaps matter as much as the deadline.

What changes for prior authorization on January 1, 2027?

Impacted payers must have a working Prior Authorization API by January 1, 2027. The API must list which items and services need approval, name the documentation each one requires and accept requests and responses electronically. Every answer must come back as an approval with an end date, a denial with a reason or a request for more information.

The requirement comes from the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F). The Centers for Medicare & Medicaid Services (CMS) also set January 2027 deadlines for three related data feeds. These cover the Patient Access API, a Provider Access API and a Payer-to-Payer API.

The Provider Access API is the sleeper for billing teams. It lets in-network providers pull claims, encounter data and prior authorization history for patients they treat, unless the patient opts out. A front desk that can see a patient's past approvals spends less time asking the payer what was already decided.

The impacted payers are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federally facilitated exchanges. Traditional Medicare fee-for-service is not on that list.

What Payers Already Owe Your Billing Team Since 2026

Some of the rule is already live. Since January 1, 2026, impacted payers must decide expedited prior authorization requests within 72 hours and standard requests within seven calendar days. Marketplace plans on the federal exchanges are exempt from those decision timeframes.

Payers must also give a specific reason for every denied prior authorization, however the request was sent. They had to post their first set of prior authorization metrics on their websites by March 31, 2026. Those public numbers are worth pulling. A plan with a high denial rate for one service line tells you where to tighten your documentation.

The table below lines up each requirement in the CMS rule with its start date, so your team can see what is already enforceable.

Here is how we would use these rights today. Track the date and time each request goes out, and log the date each decision comes back. Any decision that misses the 72-hour or seven-day window is a pattern to raise with the plan's provider relations team. A vague denial like "not medically necessary" with nothing else attached is worth a written request for the specific reason the rule requires.

Why the Phone Still Wins Prior Authorization Today

The API deadline lands on a process that is mostly manual. The AMA's 2025 prior authorization physician survey of 1,000 physicians found that the weekly load of about 40 requests takes roughly 13 hours of physician and staff time.

The same AMA survey reported that physicians most often use the phone for medical service authorizations. Only 24% said their EHR offers electronic prior authorization for prescriptions. About 32% said requests are often or always denied.

Thirteen hours a week is about a third of one full-time employee. For a billing manager, that is the real budget line behind the API. If even half of those requests move into the EHR, a practice can shift hours toward denials and appeals, which is where money is actually recovered.

A simple worked example shows the stakes. A three-physician practice at the AMA average handles about 120 requests a week. At roughly 20 minutes of staff time per request, that is 40 hours, or one full-time person doing nothing but prior authorization. Every request that moves into the EHR gives part of that time back.

Staffing pressure is not limited to prior authorization. Practices that run remote monitoring programs face a separate 2027 change, covered in our guide to preparing for the proposed rule on outsourced RPM staffing. Plan both changes with the same headcount in mind.

What Your EHR Needs for the Prior Authorization API

A payer's API is only half the connection. Your EHR has to speak the same standard. The Assistant Secretary for Technology Policy (ASTP), formerly the Office of the National Coordinator for Health IT, added three electronic prior authorization criteria to its certification program in the HTI-4 final rule.

The ASTP overview of HTI-4 key dates names the three criteria. They cover coverage requirements discovery, documentation templates and rules, and prior authorization support. Ask your vendor in writing whether your product is certified to all three and when the functions will be switched on for your account.

There is also a quality-program reason to care. CMS added an Electronic Prior Authorization measure to the MIPS Promoting Interoperability category, starting with the 2027 performance period. To meet it, a clinician attests to sending at least one non-drug prior authorization through a Prior Authorization API using certified EHR technology, or claims an exclusion.

New connections also move protected health information in new directions. Add each payer API connection to your HIPAA security risk analysis so the data flow is documented before it starts.

A Prior Authorization Billing Checklist for December

December is the right month to set up the workflow, before volume spikes with new deductibles in January. These are the steps in the order a billing team should take them:

The log in step four does double duty. It shows whether the payer meets the decision timeframes, and it gives you a before-and-after measure once the API is live.

Keep the appeals path in view too. A specific denial reason is only useful if someone reads it, matches it to the chart and responds. At doctor.ebiz, we think a short weekly review of every denied request, sorted by reason, is the cheapest habit a billing team can add this year.

What the Prior Authorization Rule Leaves Out

The rule is real progress, but it has clear limits. Drug prior authorizations are excluded from the API, decision-time and denial-reason requirements. Pharmacy benefit requests will keep running through their own channels.

Coverage is the second gap. Commercial employer-sponsored plans outside the exchanges are not on the impacted payer list, so those requests keep their current rules. Traditional Medicare is also outside it.

The third gap is uptake. A payer can publish a compliant API on January 1 and still see few requests if EHR vendors lag. The CMS page for the final rule says payers have until "primarily" January 1, 2027, for the API requirements, which leaves room for some later dates. Expect a slow ramp through 2027, not a switch that flips overnight.

Bottom Line for Practices Before January 2027

The practical answer is that the prior authorization API helps only the practices that connect to it. Confirm your EHR's certification, start logging every request now and use the 2026 decision-time rules you already have.

doctor.ebiz covers the business side of healthcare, from claims and coding to compliance and health IT. Our editors will follow how quickly the big Medicare Advantage plans turn their APIs on. For Monday morning, the first task is simple: email your EHR vendor and ask for a go-live date in writing.

Fact-checked as of October 30, 2026, against CMS and ASTP sources by doctor.ebiz's billing desk.