Prior authorization requirements

(b) Prior Authorization Application Programming Interface (API). Unless granted an extension or exemption under paragraph (d) of this section, beginning January 1, 2027, a State must implement and maintain an API conformant with § 457.730(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that—

(1) Is populated with the State's list of covered items and services (excluding drugs as defined in § 457.730(b)(6)) that require prior authorization;

(2) Can identify all documentation required by the State for approval of any items or services that require prior authorization;

(3) Supports a HIPAA-compliant prior authorization request and response, as described in 45 CFR part 162; and

(4) Communicates the following information about prior authorization requests:

(i) Whether the State—

(A) Approves the prior authorization request (and the date or circumstance under which the authorization ends);

(B) Denies the prior authorization request; or

(C) Requests more information.

(ii) If the State denies the prior authorization request, it must include a specific reason for the denial.

(c) Publicly reporting prior authorization metrics. Beginning in 2026, a State must annually report prior authorization data, excluding data on drugs as defined in § 457.730(b)(6), at the State level by March 31. The State must make the following data from the previous calendar year publicly accessible by posting them on its website:

(1) A list of all items and services that require prior authorization.

(2) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.

(3) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.

(4) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.

(5) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.

(6) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.

(7) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.

(8) The average and median time that elapsed between the submission of a request and a determination by the State, for standard prior authorizations, aggregated for all items and services.

(9) The average and median time that elapsed between the submission of a request and a decision by the State for expedited prior authorizations, aggregated for all items and services.

(d) Extensions and exemptions—(1) Extension. (i) A State may submit a written application to request a one-time, 1-year extension of the requirements in paragraph (b) of this section for its CHIP fee-for-service program. The written application must be submitted and approved as part of the State's annual Advance Planning Document (APD) for Medicaid Management Information System (MMIS) operations expenditures described in part 433, subpart C, of this chapter, and approved before the compliance date in paragraph (b) of this section. It must include all the following:

(A) A narrative justification describing the specific reasons why the State cannot satisfy the requirement(s) by the compliance date and why those reasons result from circumstances that are unique to the agency operating the CHIP fee-for service program;

(B) A report on completed and ongoing State activities that evidence a good faith effort toward compliance.

(C) A comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(ii) CMS grants the State's request if it determines, based on the information provided, that—

(A) The request adequately establishes a need to delay implementation; and

(B) The State has a comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(2) Exemption. (i) A State operating a separate CHIP in which at least 90 percent of the State's CHIP beneficiaries are enrolled in CHIP managed care organizations, as defined in § 457.10, may request an exemption for its fee-for-service program from the requirements in paragraph (b) of this section.

(ii) The State's exemption request must:

(A) Be submitted in writing as part of a State's annual APD for MMIS operations expenditures before the compliance date in paragraph (b) of this section.

(B) Include both of the following:

(1) Documentation that the State meets the threshold for the exemption, based on enrollment data from section 5 of the most recently accepted CARTS.

(2) An alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iii) CMS grants the exemption if the State establishes to CMS's satisfaction that the State—

(A) Meets the threshold for the exemption; and

(B) Has established an alternative plan to ensure that its enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iv) The State's exemption expires if either—

(A) Based on the 3 previous years of available, finalized CHIP CARTS managed care and fee-for-service enrollment data, the State's managed care enrollment for 2 of the previous 3 years is below 90 percent; or

(B)(1) CMS has approved a State plan amendment, waiver, or waiver amendment that would significantly reduce the percentage of beneficiaries enrolled in managed care; and

(2) The anticipated shift in enrollment is confirmed by the first available, finalized CARTS managed care and fee-for-service enrollment data.

(v) If a State's exemption expires under paragraph (d)(2)(iv) of this section, the State is required to do both of the following:

(A) Submit written notification to CMS that the State no longer qualifies for the exemption within 90 days of the finalization of annual CARTS managed care enrollment data that demonstrates that there has been the requisite shift from managed care enrollment to fee-for-service enrollment resulting in the State's managed care enrollment falling below the 90 percent threshold.

(B) Obtain CMS approval of a timeline for compliance with the requirements in paragraph (b) of this section within 2 years of the expiration of the exemption.