This bill adds a new, detailed subsection to Section 1852 of the Social Security Act that constrains how Medicare Advantage (MA) plans use prior authorization. It creates a statutory framework intended to speed beneficiary access to care by requiring standardized electronic prior authorization, expanded public reporting about how plans use prior authorization, and minimum protections for enrollees and providers.
For stakeholders—plans, providers, and regulators—the bill turns long-standing industry practices into enforceable obligations and tasks federal agencies with defining technical standards, publishing data, and setting timeframes for plan responses. That combination aims to reduce delays, improve transparency, and create a data trail regulators can use to evaluate whether prior authorization is functioning as a tool for clinical review or an access barrier.
At a Glance
What It Does
Creates a statutory requirement for Medicare Advantage plans to implement a secure electronic prior authorization program, submit annual transparency data to CMS, adopt enrollee protection standards, and comply with timeframes the Secretary may set for responding to prior authorization requests.
Who It Affects
Medicare Advantage organizations and their contracted providers and suppliers, CMS and HHS offices responsible for technical standards and oversight, and Medicare Advantage enrollees whose items and services (other than Part D drugs) are subject to prior authorization.
Why It Matters
It converts voluntary industry practice into federal law, standardizes how prior authorization transactions must flow, and forces public reporting that will let regulators, providers, and researchers measure frequency, timeliness, technology use, and appeal outcomes.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
The bill amends Section 1852 by adding a new subsection that imposes three linked obligations on Medicare Advantage plans: run a secure, standards-based electronic prior authorization (ePA) program; submit annual transparency data about prior authorization use and outcomes; and adopt enrollee protection practices tied to program governance and periodic review. The statute excludes covered Part D drugs from the definition of “applicable item or service,” so the new rules apply to medical and other benefits under MA plans.
The ePA requirement is purposely defined around secure electronic transmission of requests, responses, and supporting documentation. The bill expressly excludes facsimile, proprietary payer portals that do not meet Secretary-specified standards, and simple electronic forms from qualifying as the ePA transmission mechanism.
The Secretary must require compliance with applicable technical standards and promote standardized transactions, pointing agencies toward the existing federal technical standards ecosystem for health IT.On transparency, the bill requires plans to submit an annual dataset to the Secretary that covers which items and services were subject to prior authorization, approval and denial rates in initial determinations, the frequency of appeals and overturned denials, use of decision-support or AI technologies in determinations, average and median decision times (with an explicit rule for excluding requests missing required documentation), occurrences where intra-procedure changes were later sought and whether plans later approved them, and grievance counts related to prior authorization. The Secretary must publish plan-level data and can aggregate it.
The bill also directs MedPAC, GAO, and HHS components to analyze and report on the information, including identifying routinely approved items that could be eligible for “real-time” decisions and assessing the effects of automated decisioning on access and disparities.Finally, the bill gives CMS explicit enforcement authority to set timeframes for plan responses to prior authorization requests under Part C, amending the existing 1852(g) language so the Secretary can establish response windows (for example, a 24-hour target) for expedited requests, for real-time decisions for routinely approved services, and for other requests. The statute also requires plans to adopt enrollee protection standards such as transparent development processes (with input from enrollees and contracted providers), options to waive or modify requirements for high-performing providers, and annual reviews of listed prior authorization requirements that take into account stakeholder input and prior-year data.
The Five Things You Need to Know
The bill requires Medicare Advantage plans to implement a secure electronic prior authorization program that transmits requests, responses, and supporting documentation and explicitly disallows fax, noncompliant payer portals, and simple electronic forms as compliant ePA methods.
Plans must annually report to the Secretary, at the plan level, detailed prior authorization data including lists of items/services subject to prior authorization, approval/denial rates on initial determination, appeals and overturn rates, decision times (average and median), use of AI/decision-support, and grievance counts related to prior authorization.
The statute instructs CMS and the Office of the National Coordinator to define “real-time decision” and to produce, by January 1, 2028, a report and process identifying routinely approved items that could be handled in real time and analyzing effects on access and disparities.
The bill amends Section 1852(g) to give the Secretary authority to establish response timeframes for prior authorization determinations (including expedited requests and real-time decisions), signaling possible enforceable deadlines such as 24 hours for specific cases.
Implementation oversight is mandated: MedPAC must analyze prior authorization data and recommend improvements; GAO must evaluate implementation and issues by 2032; HHS must produce periodic reports to Congress on the submitted transparency data.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
High-level statutory duties for plans using prior authorization
This paragraph creates the statutory hook: any Medicare Advantage plan that uses prior authorization for an applicable item or service must (A) establish the electronic prior authorization program and meet enrollee protection standards and (B) meet transparency requirements. Practically, it converts policy expectations into an enforceable statutory obligation tied to plan years.
Defines the secure ePA and excludes legacy methods
The bill defines the ePA program around secure electronic transmission of requests, responses, and supporting documentation, and requires compliance with technical standards the Secretary sets. Importantly, it disqualifies fax, proprietary payer portals that do not meet Secretary standards, and simple electronic forms from counting as the required electronic transmission—pushing plans toward interoperable, standards-based transactions rather than bespoke portals.
Extensive plan-level reporting on prior authorization use and outcomes
Plans must annually submit a detailed list of items/services subject to prior authorization and numerous performance metrics: counts and percentages of approvals/denials on initial determination, appeals and overturns, decision times (average/median with exclusions for incomplete submissions), instances where intra-procedure changes were later requested, disclosures about AI/decision-support use, and grievances tied to prior authorization. The Secretary must publish plan-level data and may aggregate it; MedPAC is charged with a follow-up analysis and recommendations.
Governance, waivers for high-performing providers, and annual review
This provision requires plans to develop transparent prior authorization programs with input from enrollees and contracted providers, permit waivers or modification of requirements for providers demonstrating adherence to evidence-based practices, and conduct annual reviews of items/services subject to prior authorization using prior-year data and stakeholder input—creating a process for continuous refinement rather than static checklists.
Scope (non-Part D) and multiple federal reports
The statute defines applicable items/services to exclude covered Part D drugs, narrowing the reach to medical benefits under MA plans. It also mandates several reports: a GAO implementation evaluation (due by 2032), periodic HHS reports to Congress, and directs CMS/ONC to publish a real-time decision definition and analysis by January 1, 2028, including an assessment of AI-driven determinations and impact on disparities.
Secretary authority to set plan response timeframes
The bill amends the existing 1852(g) to allow the Secretary to establish timeframes for organization determinations on prior authorization requests—potentially setting specific windows (for example, 24 hours) for expedited requests, real-time decisions for routinely approved items, and other requests. It also ties existing expedited decision language to any Secretary-established timeframes for post-enactment requests.
This bill is one of many.
Codify tracks hundreds of bills on Healthcare across all five countries.
Explore Healthcare in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Medicare Advantage enrollees — Faster, more predictable access if plans meet ePA and response-time requirements; public reporting and grievance counts create more visibility into denial and appeal patterns that patients and advocates can use.
- Contracted providers and suppliers — Clearer criteria, standardized transmission standards, and published documentation requirements reduce guesswork and can cut administrative time lost to fax-based and portal-based workflows, particularly for high-volume, routinely approved services.
- Researchers, regulators, and policymakers — Plan-level data on approvals, denials, appeals, decision times, and AI usage create a new evidence base to evaluate the impact of prior authorization on access and outcomes and to design targeted reforms.
Who Bears the Cost
- Medicare Advantage plans — Must invest in interoperable ePA infrastructure, comply with new reporting flows, revise utilization management policies to meet enrollee-protection standards, and absorb short-term operational costs associated with system changes.
- Smaller providers and small MA plans — May face disproportionate implementation costs and technical complexity when integrating with standards-based ePA systems, and may need vendor support or third-party interfaces to comply.
- CMS and HHS (administrative burden) — Agencies must define technical standards, publish guidance, analyze large new datasets, run multiple statutorily required reports, and conduct oversight—requiring resources, staffing, and coordination across CMS, ONC, and other offices.
Key Issues
The Core Tension
The central dilemma is balancing faster, standardized access (through mandated ePA, disclosure, and response timeframes) against the operational and financial burden of rapid standardization and the risk that increased automation—especially AI-driven decisioning—may expedite decisions at the cost of individualized clinical judgment and unequal impacts on vulnerable beneficiary populations.
The bill pushes heavy implementation demands into the hands of agencies and the private sector without specifying funding or conversion assistance. Requiring standards-based electronic transmission and disallowing fax and proprietary portals forces interoperability but does not spell out transition timelines, certification pathways, or how legacy interfaces will be grandfathered.
That raises the prospect of uneven readiness among plans and providers and could produce temporary access disruptions if plans or providers cannot exchange prior authorization transactions cleanly.
The transparency provisions create a powerful dataset but also open the door to inconsistent reporting unless CMS tightly defines metrics, exclusions (for example, how to count requests missing documentation), and the handling of small-cell or suppressed data for privacy. The bill also requires plans to disclose AI and decision-support use, but it does not set standards for algorithmic validation, auditability, or how automated denials must be reviewed—raising questions about operational reliance on opaque models and the potential for disparate impacts on rural or low-income beneficiaries.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.