ONC, CMS open prior auth testing before 2027 API deadline

Payers, providers, EHR developers and intermediaries have until Nov. 20 to sign up for a new federal test of electronic prior authorization, per ONC. Medicare Advantage, Medicaid, CHIP and federal exchange plans must run a Prior Authorization API starting Jan. 1, 2027, under CMS rule CMS-0057-F.

ONC and CMS, both part of the Department of Health and Human Services, announced the initiative on Nov. 12. Testing runs in 10 to 12 week sprints in production-like environments. Each participant uses its own workflow to see how a prior authorization request and decision move across connected systems, per ONC.

“Regulations and industry standards have laid important groundwork for ePA but real work remains to put this policy into practice,” ONC’s Molly Prieto and Ashley Hain wrote.

How the testing works

The sprints use the HL7 FHIR Da Vinci guides for Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support. Those three cover the full loop: what needs approval, what paperwork the payer wants, and the request and answer. Scenarios are built on high-volume clinical services that require prior authorization, per ONC.

The MITRE-led Health Federally Funded Research and Development Center and Drummond Group handle recruitment, readiness talks, participant matching and test coordination. Drummond Group runs FHIRplace, the virtual environment where developers, providers, payers and intermediaries test with their trading partners.

First-round space is limited. Participation is voluntary. ONC says the testing is not certification under its Health IT Certification Program and not a finding of compliance with CMS requirements.

“With our colleagues at CMS, we are bringing partners together to advance the next phase of implementation testing to accelerate ePA progress in the near term,” National Coordinator for Health IT Tom Keane said, Fierce Healthcare reported.

What the 2027 rule requires

The rule covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities and qualified health plan issuers on the federal exchanges, per CMS.

Each payer’s Prior Authorization API must list the items and services that need approval, show the documentation required, and take a request and send back an answer. The answer must say approved, with the date the approval ends, denied, with a specific reason, or that more information is needed. Drugs are excluded.

The rule’s process requirements started Jan. 1, 2026, including specific denial reasons and public prior authorization metrics. Providers have their own deadline. MIPS clinicians and hospitals attest to an Electronic Prior Authorization measure for the 2027 performance and reporting periods, per CMS.

Why it matters

The API date is less than two months away. CMS, which wrote the rule, and ONC now say the payer and provider connections still need end to end testing. Findings may lead to clarified standards, new implementer guidance or education for developers and hospitals, per ONC.

For payers, a passed sprint does not count as compliance. For providers, the attestation measure only works if the EHR can send a request through the payer’s API.

What to do with this

• Payers, EHR developers, intermediaries and providers that want a first-round slot can express interest through ONC by Nov. 20.
• Ask your EHR vendor and your largest payer partners which of the three Da Vinci guides they support in production today.
• Hospitals and MIPS clinicians can add the 2027 Electronic Prior Authorization attestation to next year’s reporting plan.