This bill adds a new subsection to the Medicare Advantage statute that controls how plans use prior authorization. It requires plans to implement an electronic prior authorization (ePA) program, meet specific enrollee-protection standards, and provide a package of transparency data about prior authorization decisions and appeals.
The bill also gives HHS authority to set timeframes for plan responses and requires multiple reports from CMS, MedPAC and GAO analyzing use and outcomes.
For compliance officers and plan executives, the bill creates concrete operational requirements (electronic transmission standards, annual data submissions and public disclosures) and staged deadlines. For providers and vendors, it forces clearer, machine-readable criteria and exposes the prevalence and outcomes of prior authorization decisions to public review and federal evaluation.
At a Glance
What It Does
The bill requires Medicare Advantage plans that use prior authorization to (1) implement an interoperable electronic prior authorization program, (2) submit annual, itemized transparency data on prior authorization requests, approvals, denials and appeals, and (3) adopt enrollee-protection standards and periodic reviews of authorization policies. It also authorizes the Secretary to set response timeframes for prior authorization decisions.
Who It Affects
Medicare Advantage organizations, contracted providers and suppliers who submit prior authorization requests, health IT vendors that supply ePA solutions, and federal agencies (CMS, Office of the National Coordinator, MedPAC, GAO) that must collect, publish, and analyze data.
Why It Matters
This creates the first statutory interoperability and public-reporting requirements tied to prior authorization in Medicare Advantage, changing how utilization management is operationalized and monitored. The bill pushes plans toward automation and measurable accountability while generating datasets that regulators and researchers will use to evaluate access and disparities.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill inserts a dedicated subsection into the Medicare Advantage statute that governs any plan that uses prior authorization for covered items or services (explicitly excluding Part D drugs). It phases in transparency requirements beginning with plan years starting January 1, 2027, and requires plans to implement a standards-based electronic prior authorization program beginning with plan years starting January 1, 2028.
The ePA program must support secure electronic transmission of requests, responses, and supporting documentation and must meet technical standards specified by the Secretary; the bill forbids treating fax, proprietary payer portals that fail to meet the Secretary’s standards, or simple electronic forms as compliant ePA transmissions.
On transparency, plans must file an annual package of metrics with the Secretary and make specific operational materials available to contracting providers and enrollees. The required metrics include itemized lists of services subject to authorization, counts and percentages of approvals and denials at initial determination and appeal levels, how often automated decision-support or AI tools were used and their approval rates, average and median decision times (excluding incomplete requests), the number of grievances tied to prior authorization, and instances where intra-procedural changes in care required new approvals.
CMS must publish much of this information on its public website at the plan level.The bill also sets out enrollee-protection standards that require plans to develop transparent authorization programs in consultation with providers and enrollees, allow waiver or modification of authorizations for providers that demonstrate compliance with evidence-based guidelines, and require annual review of services subject to prior authorization using prior-year data and stakeholder input. Separate reporting mandates direct MedPAC to analyze and recommend improvements three years after data collection begins, require a GAO implementation evaluation by January 1, 2032, and require CMS and ONC to issue a report by January 1, 2028 defining "real-time decision," identifying routinely approved items potentially eligible for real-time handling, and analyzing automation and AI impacts on access and disparities.Finally, the statute amends existing authority for CMS to set timeframes for plan responses to authorization requests.
The Secretary may set response windows — for example 24 hours for certain decisions — and requires that existing organization determination timing rules be applied consistent with any new timeframes the Secretary adopts. That gives CMS leverage to demand faster turnarounds for expedited requests, real-time decisions for routine items, and other categories the Secretary defines.
The Five Things You Need to Know
Plans must meet the bill’s transparency requirements beginning with plan years starting January 1, 2027, and must implement an ePA program beginning with plan years starting January 1, 2028.
The statute explicitly excludes covered Part D drugs from the definition of an "applicable item or service," so prior authorization rules for drugs are not affected.
The bill disallows fax, proprietary payer portals that don't meet Secretary-specified standards, or simple electronic forms from qualifying as the required electronic transmission for ePA.
CMS and the Office of the National Coordinator must publish by January 1, 2028 a report defining "real-time decision," identifying routinely approved services eligible for real-time handling, and assessing automation and AI impacts on access and disparities.
The Comptroller General must deliver to Congress a GAO evaluation of implementation by January 1, 2032, and MedPAC must report three years after reporting begins with descriptive analysis and recommendations.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Overall prior authorization regime for Medicare Advantage
This new subsection is the umbrella that ties together ePA, transparency, enrollee protections, and reporting. It applies whenever an MA plan imposes prior authorization on any covered item or service (non-drug). Practically, it transforms prior authorization from an operational choice into a regulated activity with phased deadlines and multiple federal touchpoints, which will affect how plans design utilization management and how CMS monitors it.
Electronic prior authorization (ePA) program requirements
The bill defines ePA as secure electronic transmission of requests, responses, and supporting documentation, and it requires compliance with technical standards adopted by the Secretary. It expressly excludes fax, nonconforming proprietary portals, and simple electronic forms. That pushes plans and vendors toward standards-based interfaces (likely leveraging ONC and CMS transaction standards) and creates a compliance test: if your portal isn't standards-based, it won't satisfy the statute.
Transparency data elements and disclosure obligations
Plans must annually submit to CMS a detailed dataset: which services required prior authorization, approval/denial rates at initial and appeal levels (itemized), the share of decisions using AI/decision-support and their outcomes, median and average decision times (with exclusions for incomplete submissions), grievance counts tied to prior authorization, and cases where intra-procedural care changed. Plans must also provide contracting providers with the list of prior-authorized services, policy materials, decision criteria and required documentation; enrollees can request access to criteria used for their care. CMS will post plan-level data publicly and may aggregate it.
Enrollee protection standards and periodic review
The bill requires plans to develop transparent programs in consultation with enrollees and contracting providers, to allow waivers or lighter touch requirements for providers who demonstrate adherence to evidence-based guidelines, and to conduct annual reviews of which services require authorization. Operationally, that calls for documented stakeholder processes, look-back analyses using submitted data, and a pathway for providers to earn authorization exemptions or simplified workflows.
Secretary authority to set timeframes for responses
The statute amends the existing organization-determination timing framework so the Secretary may establish specific timeframes (the bill cites 24 hours as an example) for responses to expedited requests, real-time decisions for routine services, and all other prior authorization requests. This is a compliance lever: CMS can compel faster turnarounds and tie enforcement to those timeframes once promulgated, creating pressure on plan staffing and automation.
MedPAC, CMS/ONC, and GAO reporting duties
Three distinct federal evaluations are required. MedPAC must analyze the data and recommend improvements roughly three years after reporting starts. CMS and ONC must deliver an early report (by Jan 1, 2028) defining "real-time decision" and assessing which routinely approved services might qualify, along with AI impact analysis. GAO must evaluate implementation and issues by Jan 1, 2032. These reports are meant to inform future rulemaking and policy adjustments.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Medicare Advantage enrollees — faster and more transparent access: The bill targets shorter authorization turnaround and public visibility into denial and appeal outcomes, which should reduce unexpected barriers and clarify why care is denied.
- Clinical providers and suppliers — clearer criteria and potential fewer ad hoc denials: Providers get access to the plan criteria and required documentation and a pathway to waiver or streamlined handling if they demonstrate guideline adherence.
- Health IT and ePA vendors — market opportunities: The push for standards-based electronic transmission and reporting creates demand for interoperable ePA platforms, integrations with EHRs, and analytics tools to generate the required disclosures.
- Policy analysts and researchers — richer datasets: CMS public posting and MedPAC/GAO analyses produce plan-level data on prior authorization use, approvals, denials and AI usage that will enable evaluation of access and disparities.
Who Bears the Cost
- Medicare Advantage plans and issuers — implementation and reporting costs: Plans must build or contract for standards-compliant ePA systems, capture granular metrics, and publish plan-level data, creating IT, staffing and compliance expenses.
- Smaller plans and provider-sponsored plans — disproportionate burden: Entities with limited IT budgets face higher per-member costs to implement interoperable ePA and to prepare annual disclosures compared with large national plans.
- Providers and suppliers — administrative and contract risks: While transparency may clarify expectations, providers must still collect and submit required documentation on time, and may face new contractual performance standards tied to waivers or exemptions.
- CMS and HHS offices — oversight and rulemaking workload: The statute forces CMS and ONC to develop standards, definitions (e.g., "real-time decision"), and enforcement guidance, expanding regulatory responsibilities without explicit appropriation in the bill.
Key Issues
The Core Tension
The central dilemma is between speeding access to care through standardization and automation, and preserving careful, individualized clinical review. Faster, standardized electronic workflows reduce delays and administrative cost, but they also incentivize greater reliance on automated decision tools and put pressure on plans and providers to conform to machine-friendly workflows — potentially trading clinical nuance and equity for speed and efficiency.
The bill pushes MA plans toward automation and public accountability but leaves several implementation choices to the Secretary and to future rulemaking. Key operational questions remain: which technical transaction standards will be mandated, how interoperability will be enforced across disparate EHRs and payer systems, and whether smaller plans will receive transition support.
The ePA exclusion of fax and proprietary non-standard portals is meant to force standardization, but without phased technical guidance this could create vendor lock-in or temporary access disruptions.
The statutory requirement to report AI and automated decision-support usage increases transparency but does not impose substantive limits or validation requirements on those technologies. That means plans could escalate reliance on automation to meet faster timeframes without parallel requirements to audit algorithms for bias or to ensure human review where clinically necessary.
Similarly, the Secretary’s authority to set response timeframes is a blunt tool: short deadlines improve access for routine cases but could incentivize superficial approvals or push complex clinical decisions into appeals rather than initial determinations.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.