Prior Authorization APIs in 2027: A Guide for Practices

Prior authorization is still one of the most manual jobs in a medical practice. Staff check whether a service needs approval, log in to a payer portal, re-key chart details, attach notes, then call back for status. In 2027, impacted health plans must offer a standard electronic alternative.

The short answer: under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), Medicare Advantage, Medicaid, CHIP and federal Marketplace plans must generally offer a FHIR-based Prior Authorization API starting January 1, 2027, with exact dates varying by plan type. Practices are not required to build anything themselves, but they will only benefit if their EHR, billing tools and workflows are connected to those APIs. The work to get ready starts now, with your vendors and your own process data.

What Is Changing in Prior Authorization in 2027?

CMS-0057-F arrived in two stages. The first is already in force. Since January 1, 2026, impacted payers must decide urgent requests within 72 hours and standard requests within seven calendar days, give a specific reason for every denial, and publish annual prior authorization metrics (the first set was due March 31, 2026), according to the CMS fact sheet (January 17, 2024). Marketplace plans are excluded from the decision-time requirement.

The second stage is technical. Generally starting January 1, 2027, the same payers must offer:

• A Prior Authorization API that lists the items and services needing approval, states documentation requirements, accepts requests and returns an approval, a denial with its reason, or a request for more information.

• A Provider Access API that lets in-network providers who have a treatment relationship with the patient retrieve a patient's claims, clinical data (USCDI) and prior authorization history.

• A Payer-to-Payer API so history follows patients who switch plans.

Two limits matter for clinics. Prescription drugs are excluded from the rule's prior authorization policies, including the API and denial-reason requirements. And the rule does not cover employer-sponsored commercial plans or traditional Medicare, as Medical Economics (October 2026) points out. Fax and portals will not disappear; plans add the new channel alongside the old ones.

There is also a reporting angle. The original rule added an Electronic Prior Authorization attestation to MIPS Promoting Interoperability starting with the 2027 performance year. CMS's CY 2027 Physician Fee Schedule proposed rule (July 14, 2026) would make that measure optional in 2027, with 10 bonus points available, and required from 2028, as summarized by Applied Policy. Check the final 2027 fee schedule rule, expected in November 2026, before planning your MIPS strategy.

Why Faster Payer Deadlines Haven't Fixed the Practice Workload

Shorter decision windows have not translated into shorter work for practices. In a September 2026 MGMA Stat poll, 44% of medical groups said prior authorization turnaround was slower in 2026 than in 2025, 40% said it was about the same and only 7% said faster. Respondents pointed to status checks, peer-to-peer reviews and heavier documentation.

MGMA's explanation is useful for planning. The payer's clock covers the decision. The practice's work starts earlier, deciding whether approval is needed, choosing a channel and assembling records, and continues after, with information requests, appeals and follow-up. The same MGMA piece cites a March 2026 poll in which 61% of practices had staff using seven or more payer portals every week.

The physician view is similar. The AMA's 2025 prior authorization survey (published May 18, 2026) found physicians complete an average of 40 prior authorizations a week, consuming about 13 hours of physician and staff time. Forty percent have staff who work exclusively on prior authorization, and the phone remains the most common way to request approval for medical services.

So the API is not a finish line. It removes some re-keying and phone calls, but only for the payers and services it covers, and only if the request starts inside your workflow.

What Does a Prior Authorization API Actually Do?

A Prior Authorization API is a standard, machine-to-machine connection between the system that places an order and the payer's approval system.

FHIR (Fast Healthcare Interoperability Resources) is the data standard most modern EHR APIs use. Separately, ONC's HTI-4 final rule adopted certification criteria for electronic prior authorization in health IT, Healthcare IT News reported (August 4, 2025). That gives EHR developers a defined target, but certification and a working connection to your specific payers are not the same thing.

Illustrative scenario: A four-physician orthopedic practice in Texas orders an MRI for a Medicare Advantage patient. With CRD and DTR connected, the EHR flags that approval is required and pre-fills most of the payer's questions from the visit note. A staff member reviews and submits. The approval, or a specific denial reason, returns to the order. For a commercial-plan patient the next hour, the same order still goes through the payer's portal, because that plan is outside the rule. The practice now runs two workflows, and its process has to handle both.

What Should a Practice Ask Its EHR and Billing Vendors?

Payers carry the legal obligation. Your practice depends on vendors to use it. Before January, get written answers to these questions:

1. Which of our top payers will be connected to our ordering workflow on January 1, 2027, and on what date for the rest?
2. Is electronic prior authorization included in our current version and license, or is it a paid add-on?
3. Can you demonstrate a live request to one of our payers before go-live?
4. Does the tool pull documentation from the chart automatically, or does staff re-enter it?
5. Do status updates, decisions and denial reasons flow back into the chart and work queues?
6. When a request stalls, who owns it: the EHR vendor, the clearinghouse or the plan?
7. Will you use the Provider Access API to show a patient's prior authorization history at the point of care?

These questions follow the vendor checklist published by Medical Economics. The answers tell you where your own integration or workflow work is needed.

Prior Authorised Readiness Checklist

Baseline the work. By payer, record weekly request volume, staff hours, turnaround from order to decision, and denial and appeal rates. Without a baseline you cannot tell whether 2027 helped.

Rank payers by impact. List which impacted plans (Medicare Advantage, Medicaid managed care, Marketplace) generate the most requests for your specialty.

• Map the current workflow. Note every hand-off: order, eligibility check, portal entry, document attachment, follow-up call, appeal.

• Collect vendor commitments in writing, using the questions above.

• Decide what stays manual. Drug authorizations, commercial plans and traditional Medicare will still need today's process.

• Use the new payer data. Payers' published prior authorization metrics, required since March 2026, show approval and denial patterns you can use when comparing payers and in contracting discussions.

• Plan the MIPS decision once the final 2027 fee schedule rule is out.

Risks and Implementation Considerations

• Uneven payer readiness. Compliance dates vary by payer type, and early implementations may differ in which services and documentation rules they expose. Pilot with one or two payers first.

• Two parallel workflows. Covered and non-covered plans will coexist for years. A work queue that tracks every request, whatever its channel, matters more than the API alone.

• Data quality. Pre-filled questionnaires are only as good as the chart. Missing diagnosis detail or unstructured notes still create manual work and denials.

• Security and access. New connections carry protected health information. Confirm business associate agreements, access controls and audit logging for every component in the chain.

• Clinical judgment stays human. Automation can gather and submit information. Decisions about care and what documentation is clinically appropriate remain with clinicians.

How Softnotions Can Help

Regulatory deadlines only pay off when the new connection fits the way your staff already work. For prior authorization, Softnotions typically helps with:

• Workflow discovery: measuring the current process by payer and identifying where requests stall.

• Integration engineering: connecting EHR, practice management and billing systems to payer FHIR APIs and building the work queues that track every request, through our healthcare interoperability services.

• Automation: using AI agents for healthcare to assemble documentation, check status and prepare appeals for staff review, with humans approving every submission.

• Security and governance: designing access, logging and vendor controls around the new data flows.

We usually work through Forward Deployed Engineering, with engineers alongside your staff, so the workflow is built and tuned in your real environment.

The 2027 APIs are a real opportunity to take phone calls and re-keying out of prior authorization, but only for practices that connect them to their own workflow. Practices that baseline their numbers, press vendors for specific dates and plan for the payers outside the rule will see the benefit first.

If you'd like to review your prior authorization workflow before January, book a free 30-minute Expert Connect with our team.