Skip to content
AI in Healthcare

Article

Prior authorization AI — the payer battle and CMS's 2026 interoperability rule

CMS's Interoperability and Prior Authorization Final Rule, state-level PA reform, algorithmic-denial litigation, and the provider-side automation counterplay. Where the payer AI fight actually stands.

By AI in Healthcare Editorial Updated
  • CMS
  • prior-authorization
  • payer-AI
  • regulation
  • interoperability
  • FHIR
  • litigation
  • policy

Prior authorization is the corner of U.S. healthcare where AI became a political problem before it became a clinical one. In the same window that ambient scribes were still being piloted, health plans had been running machine-learning systems at scale to triage, adjudicate, and (in many cases) auto-deny prior-authorization requests for years. Investigative reporting, class-action litigation, and Congressional oversight caught up with that reality through 2023–2025. The regulatory response landed in 2024, took effect through 2026, and reshaped the operational envelope for every payer and every provider AI vendor working the PA transaction. This is where that stack sits today.

Why prior auth became the AI flashpoint

Two things happened at once. On the payer side, ML-driven prior-authorization systems were quietly deployed at scale — some plans made initial denial decisions on hundreds of thousands of requests without meaningful human review at the first pass. Investigative pieces from STAT and ProPublica surfaced concrete pattern-of-denial cases, and the class-action bar noticed. On the provider side, generative AI made it dramatically easier for hospital revenue-cycle teams to submit more PA requests, on average better-supported, at higher levels of service — the PwC health-plan cost-inflator analysis projected this as a material medical-loss-ratio driver through 2027.

The result is an AI arms race with a policy layer sitting on top of it. Regulators are trying to constrain both directions: reining in fully-automated denials on the payer side while forcing electronic-PA interoperability so provider-side systems can plug into a standardized pipe rather than the fax-and-portal chaos of the past decade.

The CMS Interoperability and Prior Authorization Final Rule

The federal centerpiece is CMS-0057-F, the Interoperability and Prior Authorization Final Rule, finalized in January 2024 and implemented on a staged timeline through 2026–2027. It reaches Medicare Advantage, Medicaid and CHIP fee-for-service, Medicaid managed care, CHIP managed care, and qualified health plans on the federally facilitated exchanges. In practice, that is most of the covered lives in the U.S.

The mechanics that matter:

  • Electronic prior-authorization API. Impacted payers must implement an HL7 FHIR-based Prior Authorization API that supports the full end-to-end PA transaction — coverage-requirements lookup, documentation submission, status query, decision return. The technical foundation is the DaVinci implementation guides (PAS, CRD, DTR).
  • Shortened decision windows. Standard PA decisions must be returned within 7 calendar days; expedited decisions within 72 hours. Prior industry norms — 14 days or longer, depending on plan — are compressed sharply.
  • Denial-rationale requirements. Payers must provide a specific reason for denial, not a boilerplate code, and disclose that reason in a form that supports appeal.
  • Public metrics reporting. Impacted payers must publicly report aggregate PA metrics: request volume, approval rate, denial rate, average decision time, appeals overturned. That reporting is what changes the political-economy math — denial-rate data will be public and comparable across plans.
  • Patient Access API expansion. Patient-facing APIs required under earlier CMS interoperability rulemaking are extended to include PA information — patients can see, via a third-party app under USCDI, what their plan authorized, denied, and why.

Every impacted plan has some form of AI system somewhere in its PA pipeline. The Final Rule does not directly regulate the algorithm, but it reshapes the incentives around it: shorter decision windows push more determinations to the automated layer, while public denial-rate reporting and specific-rationale requirements raise the cost of the automated layer getting it wrong.

Sources cited

State PA reform: the parallel track

Federal rulemaking is only half the picture. A growing patchwork of state laws has moved to restrict fully-automated denials and require physician review before adverse determinations. The pattern varies but the direction is consistent:

  • Texas SB 3459 (2021, in effect through 2026) exempts high-approval-rate physicians from PA requirements for many services — a “gold card” scheme that reshaped the calculus for both providers and payers.
  • California SB 1120 (2024) requires that any adverse determination in utilization review be made by a licensed physician competent to evaluate the specific clinical issue, and that AI or algorithmic tools cannot be the basis of the denial. That is the sharpest statute on the books and has become a template for other states.
  • Similar bills have moved through legislatures in New York, Illinois, Washington, and several other states through 2025–2026, with a common thread: humans-in-the-loop for denials, transparency about algorithmic use, and audit rights.

The state track matters because it constrains the algorithm directly — where the Final Rule constrains the pipe, state law constrains what can be automated inside that pipe. For a multi-state payer, the operational reality is that the most restrictive state defines the compliance floor.

The litigation layer

The third track is plaintiff-side litigation. Class actions filed since 2023 against major MA plans and their delegated utilization-management vendors have targeted the specific claim that algorithmic tools were being used to auto-deny claims without meaningful individual review, allegedly violating Medicare rules, ERISA fiduciary duties, or state UM statutes. Several of the cases have survived motions to dismiss and moved into discovery. Settlement is a possibility on some tracks; a definitive appellate ruling is a possibility on others.

Independent of the outcome, discovery in these cases is already a policy input. Internal decision-time metrics, denial-rate targets, and vendor contract language surfaced through litigation feed directly into the next round of state legislation and CMS oversight. Payers with well-instrumented, defensible ML pipelines will fare better than payers with opaque, unaudited ones.

ACA §1557 and algorithmic-bias enforcement

ACA §1557 non-discrimination requirements — recently updated by HHS-OCR — now explicitly reach automated decision tools used in coverage determinations, particularly where those decisions bear on race, sex, age, disability, or other protected characteristics. Enforcement is early but the framework is now legibly in place: a plan using an ML tool that produces disparate denial rates across protected classes has an affirmative obligation to audit and mitigate. This intersects directly with the model-card and drift-monitoring expectations that mature AI governance programs are building around, and it is the corner of PA regulation most likely to escalate quickly.

The provider-side counterplay

None of this is happening while providers stand still. The provider-side prior-auth automation market has grown rapidly through 2025–2026: vendors like Rhyme, Cohere Health, Waystar, and a wave of well-funded startups sell AI systems that ingest clinical notes, assemble PA packets, submit through the appropriate portal or API, monitor status, and (increasingly) draft appeals for denials. The mature deployments plug into Epic and Oracle Health via FHIR, auto-populate the PA request from the encounter note, and cut per-request clinician time from tens of minutes to single-digit minutes.

The interesting equilibrium question — the one health-policy economists are starting to ask out loud — is what the system looks like when both sides are augmented. Do algorithmic denials meet algorithmic appeals in a productive equilibrium that eliminates administrative overhead, or does the whole thing net out to more overhead, higher costs, and worse patient experience? The honest answer is that we do not yet know. What we do know is that the equilibrium will not be set by the technology; it will be set by how CMS, state legislators, and courts choose to referee it through 2027.

What to watch through 2027

  • First public denial-rate reports under the Final Rule land in early 2027. Expect substantial variance across plans and a corresponding political reaction. Some MA plans will have denial rates that turn into headlines.
  • The first ACA §1557 enforcement action against a PA algorithm producing disparate outcomes. When it happens, it will define the audit expectation for the whole industry.
  • Consolidation on the provider-side automation vendor list. The category is over-funded relative to the durable revenue pool. Consolidation is coming.
  • Whether “human-in-the-loop” holds up as a compliance concept. The California SB 1120 model requires physician review, not just physician sign-off. Whether that distinction survives payer-side implementation is the definitional question.