CMS-0057-F compliance is now a two-month problem for many payers. The CMS Interoperability and Prior Authorization Final Rule requires new FHIR APIs beginning January 1, 2027. The operational rules took effect this year. What remains is mostly a data problem, and data problems take the longest to fix.

This guide is for Medicaid agencies, managed care plans, and other impacted payers. It covers what the rule already requires, what the 2027 APIs must do, and a practical checklist for the weeks that remain.

What CMS-0057-F already requires in 2026

CMS finalized the rule in January 2024, and it was published in the Federal Register on February 8, 2024. It applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the Federally-facilitated Exchanges.

Since January 1, 2026, most impacted payers must send prior authorization decisions within 72 hours for expedited requests. Standard requests must be decided within seven calendar days. QHP issuers on the Exchanges are excluded from these timeframes. In addition, denials of non-drug requests must include a specific reason, no matter how the request arrived.

Payers also had to post their first prior authorization metrics publicly by March 31, 2026. In addition, they began reporting Patient Access API usage metrics to CMS as well. If those metrics were hard to produce, treat that as an early warning. The same decisions, dates, and reasons must flow through the new APIs next year.

The four API requirements for January 2027

API	Who receives the data	What it must include
Patient Access API (expanded)	Members, through apps they choose	Existing claims and encounter data, plus prior authorization information, excluding drugs
Provider Access API (new)	In-network providers with a treatment relationship	Claims and encounters without remittances or cost sharing, USCDI data, and prior authorization information. Members can opt out.
Payer-to-Payer API (new)	A member’s new payer	The same data types for dates of service within five years. Members opt in.
Prior Authorization API (new)	Providers and their EHRs	Covered items and services, documentation rules, request and response, and the decision with a reason

All of these APIs rely on HL7 FHIR Release 4.0.1 and the US Core implementation guide. SMART App Launch and Bulk Data are also required where they apply. CMS strongly recommends, but does not require, the Da Vinci guides for prior authorization: Coverage Requirements Discovery, Documentation Templates and Rules, and Prior Authorization Support. Exact compliance dates vary by payer type, so confirm yours in the final rule text.

Why CMS-0057-F compliance is a data governance project

Standing up a FHIR server is the easy part. Many vendors and cloud platforms offer one. The harder work sits behind the endpoint:

Member matching. The Payer-to-Payer API only works if you can identify a member who came from another plan. Weak matching returns missed records or the wrong person’s data.
Attribution. The Provider Access API requires a treatment relationship. Someone has to own the rules that decide which provider sees which member.
Consent. Provider Access uses opt-out, while Payer-to-Payer uses opt-in. Both choices must be captured, stored, and honored at the API layer.
Prior authorization lineage. Decisions often live in a utilization management system, a vendor portal, and a fax queue. The API needs one consistent record with status, dates, and reasons.
USCDI mapping. Clinical data from claims and encounters must map to US Core profiles, with current and validated code sets.

Each item needs an owner, a definition, and a quality measure. That is data governance, whether or not the program uses the term. For this reason, we recommend treating the 2027 deadline as a governance milestone, not only a technical one.

A 60-day CMS-0057-F compliance checklist

With about two months left, focus on what proves readiness rather than what looks finished.

Confirm your compliance date and scope. Document the determination and who approved it.
Inventory every source system that feeds the four APIs, including vendors that hold prior authorization records.
Name a data owner for member matching, attribution, consent, and prior authorization status.
Test end to end with realistic scenarios. For example, test a member who switches plans, a member who opted out, and a pended request that changes later.
Validate FHIR resources against the required profiles. Then record the implementation guide versions you support.
Monitor API availability, error rates, and usage, since usage metrics are already reportable to CMS.
Prepare provider and member communications, including how to opt in or opt out.
Keep a decision log. Auditors and oversight teams will ask why choices were made, not only what was built.

Programs that also plan to use AI in member services should review the same data controls. Our article on the regulatory floor for AI agents covers the governance side of that work.

What to watch next: drug prior authorization

On April 10, 2026, CMS released a proposed rule, CMS-0062-P, that would extend these requirements. It would add drugs covered under the medical benefit to the Prior Authorization API. It would also require NCPDP standards for pharmacy benefit drugs and shorter drug decision timeframes for Medicaid, CHIP, and QHP payers. Finally, HHS proposed FHIR-based HIPAA standards for prior authorization transactions.

Most of the proposed dates start October 1, 2027. Because this is a proposed rule, the details may change. Even so, it is a good reason to plan CMS-0057-F compliance work so drug data can be added later without rework.

Frequently asked questions

Does CMS-0057-F apply to employer health plans?

No. The rule applies to Medicare Advantage organizations, Medicaid and CHIP programs and their managed care plans, and QHP issuers on the Federally-facilitated Exchanges. The proposed CMS-0062-P would add small group QHP issuers on the FF-SHOPs.

Are the Da Vinci implementation guides required?

Not under the 2024 final rule. CMS requires FHIR Release 4.0.1, US Core, and other base standards. However, it strongly recommends the Da Vinci guides for prior authorization, and most vendors build to them because providers and EHRs expect them.

Do providers have new obligations too?

Yes. CMS added an Electronic Prior Authorization measure. As a result, MIPS eligible clinicians report it beginning with the CY 2027 performance period. Similarly, eligible hospitals and critical access hospitals report it beginning with the CY 2027 EHR reporting period.

How VTPMO can help

VTPMO has supported Medicaid modernization and CMS certification work for organizations such as Indiana FSSA. Our data governance and analytics team helps payers assign data ownership, map source systems, and build test evidence for CMS-0057-F compliance. Learn more about our healthcare work, or contact us to schedule a readiness review.

CMS-0057-F Compliance: The January 2027 API Checklist for Medicaid and Health Plans