How CMS’s proposed rule will speed up the prior authorization process

The Centers for Medicare & Medicaid Services’ (CMS) has recently demonstrated a focus on promoting patient care by removing unnecessary obstacles to prior authorization. Prior authorization is a payer-established process that requires health care providers, such as hospitals, clinics, or doctors, to obtain advance approval of products and services to be paid by insurers.

The comment period closed for CMS’s proposed new rule regarding prior authorization of health care services and products closed on March 13, 2023.

Relatedly, on April 5, 2023, CMS approved a final rule streamlining prior authorization requirements for Medicare Advantage enrollees and requiring that a granted prior authorization approval remain valid for as long as medically necessary.  The Medicare Advantage rules are intended to complement the proposals in CMS’ prior authorization rule, which we address here.

Prior authorization

Payers use prior authorization requirements to help control costs by verifying that a particular item or service is medically necessary for the patient, meets coverage criteria, and is consistent with standards of care.  However, prior authorization requirements also place significant burdens on providers, and in turn on payers themselves.

Indeed, as CMS noted in the proposed rule, prior authorization requires providers to expend resources to identify payer prior authorization requirements that can vary across payers and then navigate the submission and approval process for each request.

Payers often do not clearly communicate the reasons why they deny a prior authorization request, making it difficult for providers to correct any issues and successfully re-submit the request.

Following a denial, a provider may be required to engage in a further appeal process, potentially exacerbating the associated burdens and causing additional delay.  Prior authorization is thus a “major source of provider burnout,” according to CMS.

The current system of prior authorization processes often results in significant delays—and consequently worse outcomes for patients.

Related: UnitedHealthcare, Cigna, Aetna revamping prior authorization ahead of CMS rule

For example, until a patient obtains prior authorization, she cannot start a particular treatment regimen—or in some cases obtain a necessary-but-expensive diagnostic test such as an MRI or CT scan.  While waiting for the diagnostic test to occur, her condition could worsen, contributing to worse health outcomes and potentially costlier, more difficult, or riskier medical treatments later on.

These problems may be compounded when a complex course of treatment requires multiple prior authorizations for various products or services.  Insured patients may therefore choose to pay out-of-pocket just to avoid the insurer’s prior authorization process and receive treatment more quickly, or conversely may abandon the treatment altogether when prior authorization is delayed because they cannot afford the out-of-pocket cost or simply due to frustration with the process.

The proposed rule

The new rule proposed by CMS is intended to improve the electronic exchange of health care data and streamline processes related to prior authorization of health care services and products for covered programs and entities.

Importantly, the new rule would require impacted payers to send prior authorization decisions within 72 hours for expedited, urgent requests and seven calendar days for standard, non-urgent requests, with an extension of up to 14 days in certain limited circumstances when additional information or documentation is required or at a patient’s request.

If payers deny a prior authorization request, they would be required to include a specific reason to facilitate better understanding of the request and successful re-submission.  Payers would also be required to publicly report certain prior authorization metrics.

The proposed rule also requires a variety of application programming interfaces (APIs) to improve patient and provider access and data exchange between payers, as well as to automate the process for providers to determine if prior authorization is required and what information and documentation is required.  If finalized, the prior authorization policies and APIs would take effect Jan. 1, 2026.

It should be noted that the proposed rule does not apply to any prior authorization processes related to prescription medications, although CMS solicited comments on requiring payers to include information about prior authorizations for medications via the APIs.

Payers and their pharmacy benefit managers (PBMs) often use prior authorization in the prescription medication context.  And, as in the health care services and non-medication contexts, prior authorization delays can lead to worse health outcomes, as the House Committee on Oversight and Reform has noted both in a 2021 report and in letters the Committee recently sent to PBMs.

Impact

Facilitating timely and transparent decisions on prior authorization plainly inures to the benefit of all.  Patients get access to critical medical care faster; providers can more easily submit successful requests and focus on the provision of medical care to patients, rather than spending significant resources on administrative processes; and insurers will pay less in total cost of care when patients’ health conditions are addressed earlier.

Indeed, the changes encompassed by the CMS rule are long overdue.  In many cases, there is little reason why it should take even seven days to approve common services.  For example, diagnostic imaging like MRIs and CT scans are used to identify a wide variety of common and potentially serious conditions, from torn ligaments and bone fractures to cancerous tumors.  Approving such scans should not be onerous or time-consuming, and delays could have serious impacts on patient health.

The proposed APIs also hold significant promise to make the prior approval process more efficient and transparent.  Patients and their providers would have greater insight into the prior approval process, making the process easier to use and understand.

Payers would also have greater insight into their patients’ medical care and history on a longitudinal basis.  Further, as prior approval data becomes more accessible and interoperable, big data analytics can be leveraged to further improve and automate the prior approval process.  For example, predictive analytics could be used to determine when prior approval decisions can automatically be made and identify more limited circumstances when further review might be required—a more efficient process for everyone, including payers.

Indeed, in many cases, the prior approval could likely be given even more quickly than the current CMS proposed rule requires with only limited risk of incorrect or costly decisions. As noted above, the CMS proposed rule doesn’t apply to prescription medications.  But, given that access to appropriate medications can be an important component of medical care, there seems to be little reason not to use the APIs being developed to their fullest extent to support patient care.

Reactions

While patients and providers unsurprisingly support the proposed rule, major payers have also generally signaled support of the reduced timeframes for prior authorization decisions and APIs.  However, in their comments on the proposed rule a number of payers have also raised several concerns that, depending on how such concerns are addressed, could undermine the goals of the proposed prior authorization rule.

For example, several payers sought clarity on when the time period for a decision commences and whether member notification must also occur within the timeframe.  Clarity to ensure that payers do not run afoul of the rule is useful, but some payers further recommended that the timeframes begin to run only when all of the required documentation has been submitted.

Under the proposed rule, payers can receive an extension of up to 14 days if the payer determines additional information is needed.  But (a) if payers make the documentation requirements clear and easily findable in advance (either as part of a required API or otherwise), and (b) if the timeframes do not begin to run at all until the documentation is complete, then payers would not need to utilize the extension in the first place.

Without specifying the required documentation and identifying missing documentation in an insured’s request, prior authorization requests could continue to languish in the system without a decision.

Some major payers also recommended that the shortened response timeframes be applied only after electronic APIs are fully implemented due to the additional challenges involved with requests made by fax or phone, rather than a standardized electronic request.  While such a concern does not seem facially unreasonable, major payers have also expressed serious concerns about the feasibility of rolling out APIs by Jan. 1, 2026.

Adopting the payers’ recommendation to the response timeframes could mean further delay in implementing those shortened timeframes if technical challenges arise and API implementation is delayed.  Keeping the effective date of the response timeframes separate from successful API rollout will incentivize payers to develop and implement APIs as expeditiously as possible, as well as to develop policies that allow them to respond to prior authorization requests within the required timeframes.

Additionally, several payers recommended making the non-urgent period seven business days, rather than calendar days, to account for weekends when office hours and staff are more limited.  But such a rule could result in unintentionally long delays: for example, a request submitted on a Friday a week before a holiday weekend could result in a decision being delayed for more a week and a half.

In contrast, under the proposed rule of seven calendar days, requests will typically span a weekend in any event, and the payer will typically have five business days to address it.  In light of the application of APIs allowing payers to receive prior authorization requests electronically, there seems to be little reason to adopt such a business-day rule.

A calendar-day rule will afford more predictability and more timely decisions for patients and their providers attempting to address health conditions exist regardless of whether it is a weekday or weekend.

CMS’s proposed prior authorization rules are long overdue.  Ahead of the CMS rule, major insurers – UnitedHealthcare, Cigna and Aetna – are taking steps to revamp their prior authorization processes.

While CMS should consider practical and administrative concerns raised by payers and others and provide clarity where warranted, patients deserve to receive decisions on prior authorization requests as soon as is practicable.  Care should be taken in considering any adjustments to the proposed rule to ensure all involved are incentivized to reduce prior authorization delays and to ensure patients receive appropriate care on a timely basis.

Katherine Cheng is counsel at Goodwin in the firm’s complex litigation and dispute resolution practice and its life sciences disputes group and antitrust and competition practice. William Jackson is a partner in the firm’s complex litigation & dispute resolution practice and also a member of the firm’s life sciences disputes group.