On December 6, 2022, the Centers for Medicare & Medicaid Services (CMS) proposed a modernization of the prior authorization process for health insurance. The proposed rule seeks to require certain insurers to implement electronic prior authorization, shorten decision timeframes, and make the process more transparent and efficient.¹ The rule includes “five key provisions and five Requests for Information,” aiming to “improve patient and provider access to health information and streamline processes related to prior authorization for medical items and services.”² This Health Capital Topics article will review those provisions and requests for information, as well as stakeholder responses to the proposals.

Prior authorization requires providers to obtain approval from a patient’s health insurance plan for certain procedures and drugs before the procedure is performed or the drug is prescribed. While insurers assert that prior authorization serves an important function in containing costs, providers counter that the number of services and drugs, as well as the administrative hurdles involved, that require prior authorization have increased, causing excessive hardships for providers.³

This 2022 proposed rule is the latest agency guidance in a number of other regulatory rulemakings over the past couple years. In May 2020, CMS issued its Interoperability and Patient Access final rule, which mandated the establishment of various technologies and the sharing of data to facilitate interoperable and promote patient access to health information.⁴ Building upon this May 2020 final rule, CMS published in December 2020 a proposed rule that was nearly identical to the one proposed in December 2022.⁵ CMS finalized the proposals but withdrew it soon thereafter “after concerns about costs and a short deadline.”⁶ With the December 2022 proposed rule, CMS formally withdrew the December 2020 proposed rule, but incorporated the public feedback it received from that previous proposed rule.⁷ Importantly, the December 2022 proposed rule expands upon its 2020 predecessor by including Medicare Advantage plans.⁸

CMS introduced a number of major proposals to modernize the prior authorization process relating to:

1. Patient Access Application Programming Interface (API);
2. Provider Access API;
3. Payer-to-Payer Data Exchange on FHIR®;
4. Improving Prior Authorization Processes; and
5. Electronic Prior Authorization Measure for Merit-based Incentive Payment System (MIPS) Eligible Clinicians and Hospitals and Critical Access Hospitals (CAHs).⁹

First, the insurers targeted by the proposed rule – Medicaid, Medicare Advantage (MA), and health insurance exchange carriers – would be required to include additional information in their Patient Access API by January 1, 2026.¹⁰ APIs are “mechanisms that enable two software components to communicate with each other using a set of definitions and protocols.”¹¹ An example of an API is “[t]he weather app on your phone [which] ‘talks’ to [the weather bureau’s software] system via APIs and shows you daily weather updates on your phone.”¹² Insurers were already required to implement a Patient Access API pursuant to CMS’s 2020 final rule (discussed above);¹³ this proposed rule simply requires payors to add information related to previous prior authorization decisions and begin reporting certain metrics each year regarding patient use of the API. ¹⁴

Second, insurers would be required to build and maintain a Provider Access API (an API similar to that already implemented for patients) so that providers in the same network can share patient data. This API should include patient claims and encounter data and be up and running by January 1, 2026. CMS asserts that the implementation of this API will “better facilitate coordination of care, and support movement toward value-based payment models.”¹⁵

Third, CMS proposes requiring insurers build and maintain a Fast Healthcare Interoperability Resources^® (FHIR^®) API. The FHIR^® is a data standard that defines how healthcare information can be exchanged; this allows electronic health record (EHR) systems and other systems to be interoperable, i.e., through FHIR^®, so that payors or providers can exchange information even if different systems are utilized.¹⁶ Importantly, setting up an FHIR^® API will allow for electronic prior authorization. If finalized, this means that if a patient switches insurers, and gives their permission, the previous insurer must share the patient’s data with the new insurer through the FHIR^® API. Further, if a patient has two insurances, those payors must share the patient’s data with each other at least quarterly. CMS reasons that requiring this data sharing will “ensure a patient’s data can follow them throughout their health care journey.”¹⁷

Fourth, calling the current prior authorization process “a major source of provider burnout,” and recognizing that it “can become a health risk for patients if inefficiencies in the process cause care to be delayed,” CMS proposes a number of updates to make the process “more efficient and transparent.”¹⁸ For example, providers will be required to build and maintain a Prior Authorization Requirements, Documentation and Decision (PARDD) API, utilizing FHIR^® (discussed above) to streamline the process.¹⁹ Additionally CMS proposes cutting in half the amount of time that insurers have to respond to prior authorization requests, depending on their urgency. For urgent requests, insurers would be required to respond within 72 hours, while standard requests must be resolved within 7 days.²⁰ Insurers would also have to publicly report certain data related to their prior authorization decisions, and provide reasoning for any denials.²¹

Fifth, CMS proposes adding a new metric for Merit-based Incentive Payment System (MIPS) eligible providers to report.  In order to achieve the metric, which will be under the Promoting Interoperability performance category of MIPS, eligible providers will have to report the number of prior authorizations requested from a PARDD API. ²²

While CMS previously proposed, in its 2020 final rule, to require “the use of certain Implementation Guides (IGs) for the implementation of the APIs,” the agency ultimately decided not to move forward with requiring these IGs. However, CMS strongly recommends their use and will continue to observe their development for possible future rulemaking.²³

In totality, CMS estimates that these policies, if finalized, would save healthcare providers over $15 billion over a 10-year period.²⁴ In addition to those five key proposals, CMS also introduced a number of requests for information (RFI). Specifically, the RFI that CMS seeks include:

1. “Accelerating the Adoption of Standards Related to Social Risk Factor [e.g., housing instability, food security] Data” – specifically, CMS is interested in how it can “better standardize and liberate these data”;
2. “Electronic Exchange of Behavioral Health Information” – specifically, CMS “seek[s] comment on how CMS might leverage APIs, or other solutions, to facilitate electronic data exchange with behavioral health providers who have lagged behind other provider types in EHR adoption”;
3. “Improving the Electronic Exchange of Information in Medicare Fee-for-Service (FFS)” – specifically, CMS “seek[s] comment on how Medicare FFS might best support improvements to the exchange of medical documentation between and among providers/suppliers and patients, as well as how [CMS] might best inform and support the movement and consistency of health data to providers for their use to inform care and treat patients”;
4. “Advancing the Trusted Exchange Framework and Common Agreement (TEFCA)” – TEFCA has the goal of establishing “a universal floor for interoperability” throughout the U.S.²⁵ CMS is interested in “how enabling exchange under TEFCA can support these proposals…[and CMS’s] approach to incentivizing or encouraging payers to enable exchange under TEFCA.”
5. “Advancing Interoperability and Improving Prior Authorization Processes for Maternal Health” – CMS seeks public input “on evidence-based policies [the agency] could pursue that leverage health IT, data sharing, and interoperability to improve maternal health outcomes.”²⁶

In announcing the proposed rule, CMS Administrator Chiquita Brooks-LaSure stated “[t]he prior authorization and interoperability proposals…would streamline the prior authorization process and promote health care data sharing to improve the care experience across providers, patients, and caregivers – helping us to address avoidable delays in patient care and achieve better health outcomes for all.”²⁷

Industry stakeholders seemed to agree with CMS, lauding the proposed rule. The American Hospital Association (AHA) commended CMS on the rule, particularly in the inclusion of Medicare Advantage plans.²⁸ The Medical Group Management Association (MGMA) stated that “[a]n alarming number of medical groups report completing prior authorization requests via paper forms, over the phone, or through varying proprietary online payer portals…The onerous methods of completing these requests, coupled with the increasing volume is unsustainable.”²⁹ Consequently, “[t]his is a positive step forward for both medical groups and the patients they treat. We look forward to working with CMS to refine and finalize this rule.”³⁰ Insurer trade associations have also spoken positively on the rule. An MA advocacy group said that the proposed rule “complements our goals of protecting prior authorization’s essential function in coordinating safe, effective, high-value care.”³¹ AHIP, an insurer trade group, offered their support for the proposed rule, but warned that “a gap remains in our nation’s privacy framework” that needs to be addressed and bridged.³²

Stakeholders may now comment on the proposed rule, through March 13, 2023.