New CMS Rule: Payers Must Report Prior Authorization Data Publicly

Initial Round of Required Data Holds Little Insight, According to KFF News

A new federal mandate requires government-managed plans to post prior authorization metrics publicly for the first time. The first reports were due on March 31, and an initial review reveals just how much work remains for insurance reform and accountability.

While the federally-mandated reporting excludes commercial insurance plans, Arizona is ahead of the curve. The physician community is championing legislation that would require commercial payers to report medical claim and prior authorization denials data to the state. Read more about this important local advocacy initiative. 

CMS's New Rule Addresses Prior Auth Transparency

For years, physicians and patients have navigated insurers' prior authorization processes with little transparency into the hows and the whys. This reality has bred frustration, life-threatening delays, and a weakened healthcare system.

However, under a new rule finalized by the Centers for Medicare & Medicaid Services in 2024, payers are now required to publicly post key prior authorization metrics — including denial rates, processing times, and appeal overturn rates.

The first reports, covering calendar year 2025, were due March 31. Unfortunately, an early analysis from KFF Health News suggests that the data has significant gaps and limited usability for physicians, patients, and hospitals.

What the Rule Requires

According to its website, the CMS Interoperability and Prior Authorization Rule "focuses on efforts to improve prior authorization processes through policies and technology, to help ensure that patients remain at the center of their own care."

The rule applies to Medicare Advantage plans, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and carriers on the federally facilitated ACA exchanges. Commercial medical insurance plans are not included.

Payers must annually post aggregated metrics on their public websites, covering approval rates, denial rates, decision turnaround times, and appeals outcomes for medical items and services. Medicare Advantage plans report at the contract level; Medicaid and CHIP programs at the state level; managed care and exchange plans at the plan or carrier level. Notably, prescription drugs are excluded from the reporting.

The rule also introduces new decision timelines. Beginning in 2026, Medicare Advantage, Medicaid, and CHIP plans must process standard prior auth requests within seven calendar days and urgent requests within 72 hours — down from a previous standard of up to 14 days. When denying a request, payers must provide a specific reason and communicate it to the clinician. ACA exchange plans are not subject to these requirements.

Additional API requirements will take effect in 2027, when payers must implement a prior authorization API capable of receiving and responding to requests electronically, expand patient access APIs to include prior authorization data, and launch provider access and payer-to-payer APIs to improve data exchange across the system.

The Problem With the Data

Despite the mandate, a KFF analysis found that early reports offer limited insight into what actually gets approved or denied. The data is difficult to locate and varies widely in format and presentation across payer websites. Some insurers aggregate reporting within a line of business; others require users to navigate multiple pages.

More significantly, the data is aggregated across all items and services, with no breakdown by service type. There is no way to assess which procedures or specialties face the highest denial rates — or why. Payers are not required to disclose reasons for denials, making it impossible to evaluate whether their decisions align with their own coverage policies.

Prior Auth: A Burden on Physicians & Patients

Administrative strain on physician practices is well-documented. According to a survey conducted by the American Medical Association, prior authorization paperwork consumed an estimated 13 hours per week in the average practice in 2024.

KFF data found that Medicare Advantage insurers rejected or partially denied more than 4 million prior authorization requests in 2024. Of those that were appealed, over 80% were reversed — a reversal rate that calls into question the denials into serious question.

On the commercial side, dozens of insurers made voluntary pledges in 2025 to improve the prior authorization process for fully insured health plans. Despite this public pledge, Arizona physicians have not yet seen meaningful changes take effect. Patients are still experiencing delays, and the administrative burden on our clinics remains unsustainable.

Arizona Physicians Are Taking Action

CMS's latest rules address government payers, but Arizona physicians face the same cumbersome prior authorization burdens from commercial insurers — without the same accountability requirements. The Arizona Medical Association is working to change that.

Senate Bill 1628, championed by ArMA and other healthcare stakeholders, would require commercial insurers to report data on medical claims and prior authorization denials to the Arizona Department of Insurance and Financial Institutions. DIFI would then publish an annual, publicly available report and share it with key legislative leadership — giving advocates the concrete data needed to drive future insurer reforms. The bill is advancing through the State Legislature with strong support.

ArMA and the Arizona Hospital & Healthcare Association have joined forces behind the measure, presenting a united front in the push to level the playing field between physicians and insurers, and most importantly, to improve health care for Arizona patients.

Information in this article was sourced from Becker's Hospital Review, KFF News, CMS, and the American Medical Association.