The CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), finalized in 2024, requires impacted US payers — Medicare Advantage, Medicaid, CHIP, and ACA exchange plans — to build FHIR APIs for patient access, provider access, payer-to-payer exchange, and, most notably, an electronic Prior Authorization API based on the HL7 Da Vinci implementation guides. With compliance dates in 2026–2027, it is the regulation pulling the payer and prior-authorization side of US healthcare onto FHIR.
CMS Interoperability & Prior Authorization Rule
Regulator guidance United States
The CMS Interoperability and Prior Authorization Rule — CMS-0057-F — is the regulation aimed at the part of US healthcare the Cures Act mostly left alone: the payers, the claims, and the prior-authorization paperwork. It requires impacted health plans to stand up a family of FHIR APIs, and it does the thing regulators too rarely do — it names the standard.
- Four APIs - Patient Access, Provider Access, Payer-to-Payer exchange, and an electronic Prior Authorization API.
- Da Vinci by name - The prior-auth API is built on the HL7 Da Vinci CRD/DTR/PAS guides, turning a fax-and-phone process into an API workflow.
- Phased compliance - Dates land in 2026–2027, so much of the build is still ahead of the market.
This rule is the clearest test in my healthcare series of whether naming a good standard is enough. CMS pointed prior authorization squarely at Da Vinci — and Da Vinci is the emptiest frontier I measured, with a single US provider explicitly conforming. The regulation is the right instrument aimed at a genuinely painful problem; whether it produces usable, agent-legible prior-auth APIs or another layer of gated compliance endpoints is exactly the question the next few years will answer, and the one my scoring will keep tracking.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
Da Vinci
CMS-0057-F names the Da Vinci CRD/DTR/PAS IGs for electronic prior authorization.
FHIR Bulk Data Access
Payer data exchange under the rule leans on bulk FHIR.
CARIN Blue Button
The Patient Access API exposes claims via CARIN Blue Button.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
content-location
mandated
in the contract
via fhir-bulk-data
Returns the polling location for an async bulk export.
prefer
mandated
in the contract
via fhir-bulk-data
`Prefer: respond-async` is how the FHIR async pattern is entered.
