The First Mandatory Prior-Auth Disclosures Are Out

In January 2024, CMS finalized the Interoperability and Prior Authorization rule, CMS-0057-F. Most of the attention went to its technology mandate — a set of FHIR APIs due in 2027. The nearer deadline mattered more: by March 31, 2026, the payers covered by the rule had to post prior authorization metrics for calendar year 2025 on their own websites.¹ That deadline has now passed. For the first time, there is a mandatory public record of how often American insurers approve and deny prior authorization requests — and the record is worth reading precisely, both for what it contains and for what it was never designed to contain.

Start with who reports. The rule's “impacted payers” are Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges.¹ Employer-sponsored coverage — including the self-funded plans that cover most working Americans — is not on that list, and neither are off-exchange commercial plans. Every prior-auth provision in the rule also excludes drugs. The new transparency regime is real, but it opens a window onto a specific slice of the market.

The rule works in two waves. The operational wave arrived first, generally on January 1, 2026: decision clocks of 72 hours for expedited requests and seven calendar days for standard ones (a requirement that, notably, does not extend to QHP issuers on the exchanges), plus an obligation to give providers a specific reason for every prior-auth denial, whatever channel the decision travels through.¹ The technology wave lands in 2027, when the same payers must stand up the APIs that make prior authorization machine-readable end to end.

The reports are findable, if you know where to dig. UnitedHealthcare maintains a dedicated page publishing its calendar-year 2025 prior authorization data across Medicare Advantage, Medicaid, and exchange lines of business.⁴ Cigna posts its individual and family exchange disclosure as a static PDF on cigna.com.⁵ Aetna's Medicaid subsidiaries publish state-by-state PDFs — one for Oklahoma Medicaid, another for Pennsylvania CHIP, and so on.⁶ There is no central repository. The rule requires each payer to post on its own website, so the first mandatory disclosure regime in the history of American prior authorization arrived as a scattering of PDFs and legal-notice pages, each formatted differently, none indexed in any common place. The fragmentation is not an accident of sloppy compliance; it is what the rule asks for.

KFF's first read of the disclosures used UnitedHealthcare as its worked example: approval rates of roughly 80% in its ACA Marketplace plans, 92% in Medicaid, and 95% in Medicare Advantage.³ Those three numbers already say something the industry rarely concedes — that the same insurer runs materially different approval regimes for different populations. But they also illustrate the structural limit of the data. An aggregate approval rate cannot tell a cardiologist whether advanced imaging is the service carrying the denials, and a 95% approval rate invites the opposite question: if nearly everything is approved, what is the review for?

The sharper models already exist at the state level. KFF points to Washington and Massachusetts, which publish prior-auth analyses broken out by service category and include drugs.³ The federal floor, in other words, is well below the demonstrated ceiling. What to watch next: whether payers converge on CMS's recommended reporting format or keep the first wave's scatter, and whether the 2027 APIs — which must expose prior-auth status and specific denial reasons in machine-readable form — let third parties build the service-level picture the public reports omit.

For a practice appealing a denial today, the immediate value is narrower and more concrete: since January, an impacted payer's prior-auth denial must state a specific reason, and its appeal-reversal share is now a published number. Both belong in the appeal file.