Covered: Medicaid managed care
- Medicaid and CHIP managed care plans, including the behavioral health MCOs and ASOs that hold most therapy authorizations [1]
Guide · Prior authorization
Behavioral health prior authorization in 2027: what the API changes
Short answer: CMS-0057-F gives Medicaid managed care, CHIP and Medicare Advantage plans until January 1, 2027 to stand up a Prior Authorization API that says whether an auth is required, what documents it needs, and why it denied. The decision clocks already run. Here is what moves for therapy authorizations.
CMS-0057-F · released Jan 17, 2024
42 CFR 438.210 · 14 days to 7
90837 · H2019 · auth required?
Drugs excluded · CMS-0062-P proposed
Rule
CMS-0057-F
Effective
Jan 1, 2027
Payers
MCO · CHIP · MA
Codes
90837 · H2019
Clocks
72 h / 7 days
Excluded
Drug prior auth
Jan 12027
Compliance date for the Prior Authorization API under CMS-0057-F [1]
7calendar days
Standard prior authorization decision limit for impacted payers since January 1, 2026 [1]
72hours
Expedited decision limit, with a specific reason required for any denial [1]
Mar 312026
First public prior authorization metrics posted by each impacted payer [1]
Six things the API must do, and why each matters for therapy
CMS-0057-F, released January 17, 2024, told Medicare Advantage organizations, state Medicaid and CHIP FFS programs, Medicaid and CHIP managed care plans, and QHP issuers on the Federally Facilitated Exchanges to build a Prior Authorization API by January 1, 2027 [1]. CMS's own summary is one line: request prior authorizations electronically beginning January 1, 2027 [2].
| Function | What the payer must expose | Why it matters for behavioral health |
|---|---|---|
| Covered items and services list | Which services carry a prior authorization requirement | Ends the phone call to ask whether 90837 or H2019 needs an auth under this plan |
| Documentation requirements | What the payer needs to approve the request | Treatment plan, diagnosis and frequency fields known before submission |
| Request and response | Electronic submission and decision through the API | No portal or fax for covered medical services |
| Approval detail | The date or circumstance under which the authorization ends | Unit and date limits land in your system, not in a letter |
| Denial detail | A specific reason for the denial | Appeal starts from the stated reason, not a generic code |
| Drugs | Excluded from the API and the denial-reason requirement | Medication prior auth stays on today's pharmacy channels |
Takeaway
The API is a payer obligation. Nothing in the rule requires your EHR to use it on day one, which is why the question for 2027 is whether your vendor, clearinghouse or billing partner will.
Fourteen days became seven, a year before the API
Since January 1, 2026, impacted payers (other than QHP issuers on the FFEs) must decide expedited requests within 72 hours and standard requests within seven calendar days, with a specific reason for any denial however the request arrived [1]. For rating periods starting on or after January 1, 2026, 42 CFR 438.210 caps Medicaid managed care standard decisions at state timeframes that may not exceed 7 calendar days, down from 14, with an extension of up to 14 additional days when the enrollee or provider asks or the plan justifies a need for more information [3].
Medicaid managed care authorization clocks, in hours
Old standard limit438.210 before 2026 rating periods
14 days336 h, 100%
New standard limitrating periods from Jan 1, 2026 [3]
7 days168 h, -50%
ExpeditedMA and Medicaid
72 h21% of the old limit
Possible extensionenrollee or provider request, or plan-justified
up to 14 days336 h on top of either clock
072 h168 h336 h
Old limitCurrent standardExpeditedExtension
The rule also made payers publish: certain prior authorization metrics on their websites annually, the first set due by March 31, 2026, so a plan's own approval and turnaround numbers are now a public document you can cite in an appeal or a contract conversation [1].
Medicaid managed care in, commercial employer plans out
Covered: Medicare Advantage
- MA organizations, including their behavioral health delegates [1]
Covered: state FFS and Exchange QHPs
- State Medicaid and CHIP fee-for-service programs and QHP issuers on the FFEs; the decision-time clocks do not apply to QHP issuers [1]
Not covered: commercial employer plans
- Self-funded and fully insured commercial plans are outside CMS-0057-F; their authorization rules still come from the contract and state law
The expertise ruleUnder 438.210(b)(3), any Medicaid managed care denial, or approval in a lesser amount, duration or scope than requested, must be made by an individual with appropriate expertise in addressing the enrollee's medical, behavioral health or long-term services and supports needs [3].
Authorizations fail in three places; the rule reaches all three
Nobody knew one was needed; the request sat in a queue past the units already delivered; the denial came back without a reason the clinician could answer. The 2027 API addresses the first and third directly, and the 2026 clocks address the second.
1
Build the auth-required check at intake
When the API is live, the covered services list answers "does this plan require an auth for this code" at scheduling. Until then, keep the payer grid current and verify at the first visit.
2
Submit from documentation, not memory
The documentation-requirements function tells you what the plan wants before you send. Map your treatment plan template to those fields once per payer.
3
Time-stamp every request
The 72-hour and 7-day clocks only help if you can prove when the request was received. Log the submission time and the decision time on every authorization [1].
4
Appeal from the stated reason
A denial must now carry a specific reason. Route it to the clinician who can answer that reason, and keep the plan's published metrics beside the appeal [1].
5
Track units against the end condition
Approvals must state the date or circumstance under which the authorization ends. Load that into the schedule so the last covered unit triggers the next request [1].
Our mental health billing services team runs authorization tracking as part of the front end; the psychiatry billing services page covers the medication-management side, where drug prior authorization stays outside this rule; the behavioral health billing services overview covers Medicaid managed care and CCBHC programs.
CMS-0057-F milestones
- 1Jan 17, 2024CMS-0057-F released; rule effective April 8, 2024 [2]
- 2Jan 1, 202672-hour and 7-calendar-day decision clocks; specific denial reasons required [1]
- 3Mar 31, 2026First annual public prior authorization metrics posted by payers [1]
- 4Apr 10, 2026CMS-0062-P proposed, covering drug prior authorization (proposed) [2]
- 5Jan 1, 2027Prior Authorization API, Provider Access API and Payer-to-Payer API due [1]
- 6CY 2027MIPS Electronic Prior Authorization attestation measure begins for eligible clinicians [1]
Five checks before the API arrives
Ask your EHR, clearinghouse or billing partner one questionWill you connect to each payer's Prior Authorization API, and when?
Pull each plan's published metrics pageDue since March 31, 2026; keep the URL with the appeal template.
Add submission and decision timestamps to the auth logThen compare each plan to 72 hours and seven days; the CMS-0057-F deadline clock tracks the dates.
Check authorization leakage in the eight KPIsThe eight KPIs show whether authorizations are leaking, and the 2027 buyer's guide has the prior authorization section.
Keep medication prior auth on its own pathDrugs are excluded; CMS-0062-P remains proposed.
Frequently asked questions
Which plans must have a Prior Authorization API on January 1, 2027?
Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the Federally Facilitated Exchanges. Commercial employer plans are not covered by CMS-0057-F.
Does the API cover medication prior authorizations?
No. The CMS fact sheet says prior authorization information, the Prior Authorization API and the specific denial-reason requirement all exclude prior authorizations for drugs. CMS proposed a separate drug prior authorization rule, CMS-0062-P, on April 10, 2026.
How fast must a Medicaid managed care plan decide a therapy authorization?
For rating periods starting on or after January 1, 2026, 42 CFR 438.210 caps standard decisions at state timeframes that may not exceed 7 calendar days, with 72 hours for expedited requests. Either clock may be extended by up to 14 additional calendar days when the enrollee or provider requests it or the plan justifies a need for more information.
Do I have to change my EHR to use the API?
The rule obligates payers, not providers. Whether you benefit on day one depends on whether your EHR, clearinghouse or billing partner connects to the payer's API. CMS does add a MIPS Electronic Prior Authorization attestation measure starting with the CY 2027 performance period.
- CMS fact sheet: Interoperability and Prior Authorization Final Rule, CMS-0057-F (January 17, 2024)
- CMS: Electronic Prior Authorization overview (page updated October 21, 2026)
- 42 CFR 438.210, Coverage and authorization of services (Medicaid managed care), govinfo.gov
- CMS: CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) program page
Checked October 25, 2026. Confirm against the source; items marked proposed may change in the final rule.
Where are your authorizations leaking today?
Send 90 days of authorization denials and we return a payer-by-payer read: missing auths, expired units and denials without a stated reason, with the 2026 clocks applied.