Is CMS-0057-F actually final, or still a proposal?
It's final. CMS published the final rule on January 17, 2024, and it took effect as law shortly after. What's still ahead is the compliance deadlines, not the rule itself.
Does this apply to Traditional Medicare (fee-for-service)?
No. CMS-0057-F applies to Medicare Advantage organizations, not Traditional Medicare FFS, which CMS administers directly and addresses through separate initiatives like Blue Button 2.0.
Does this apply to employer-sponsored or fully-insured commercial plans?
Not under this rule. CMS-0057-F's obligated payers are Medicare Advantage organizations, Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federally-facilitated exchanges.
Are prescription drugs covered by the Prior Authorization API?
No. CMS excluded drugs covered under a patient's pharmacy benefit from the Prior Authorization API requirements; they're generally handled through NCPDP SCRIPT standards instead, not the Da Vinci PAS/DTR/CRD stack described on this site.
What counts as an "urgent" prior auth request for the 72-hour clock?
CMS uses the existing Medicare Advantage / Medicaid definition of urgent: when a standard timeframe could seriously jeopardize the member's life, health, or ability to regain maximum function. Plans still apply their existing urgent-vs-standard criteria; the rule just tightens the clock once something is urgent.
Do we have to expose a member's full history, or just data from after the rule takes effect?
For the Payer-to-Payer API, obligated payers must exchange claims and clinical data going back up to five years (including data predating the compliance deadline) when the member consents and requests it.
Can we get an extension past January 1, 2027?
CMS built limited exceptions into the rule for specific circumstances, such as systems changes tied to a change in ownership, but there is no blanket extension. Assume the deadline is the deadline unless your specific situation clearly matches a named exception in the rule text.
Does a small or regional plan get any relief on scope or timeline?
No. The rule doesn't scale requirements by plan size or member count. A regional plan with 40,000 members has the same API and turnaround-time obligations as a national carrier with 4 million, which is exactly why scoping this efficiently matters more for smaller plans, not less.
What's the penalty for missing the deadline?
CMS-0057-F doesn't specify a single fixed penalty schedule the way HIPAA does; noncompliance is generally addressed through each program's existing oversight and enforcement mechanisms (MA contract compliance actions, Medicaid/CHIP oversight, QHP certification requirements). The practical risk is usually contractual and reputational before it's a specific fine.
Is PayerNetwork.org affiliated with CMS?
No. This is an independent resource published by Health Chain. It is not affiliated with, endorsed by, or reviewed by CMS or HHS. Always verify anything here against the Federal Register final rule text before making a compliance decision.
Still have questions?
Ask Health Chain directly. No forms, no gatekeeping, nobody puts you on a call list for asking.