CMS-0057-F Payer Readiness Tracker for Behavioral Health
A payer-by-payer tracker for the January 1, 2027 Prior Authorization API deadline, with the questions to ask each plan and what to do when the answer is vague.
On this page: Direct answer
Direct answer
CMS-0057-F readiness tracker: what operators need to know
A payer-by-payer tracker for the January 1, 2027 Prior Authorization API deadline, with the questions to ask each plan and what to do when the answer is vague. The API compliance date is primarily January 1, 2027, but the exact trigger varies: rating periods for Medicaid and CHIP managed care, plan years for exchange issuers.
The CMS Interoperability and Prior Authorization Final Rule gives impacted payers until primarily January 1, 2027 to stand up the APIs it requires, including a Prior Authorization API that lets a provider ask whether authorization is needed, learn what documentation is required, submit the request, and receive the decision electronically. Two of those four capabilities are the ones behavioral-health operators spend their week on, and the deadline is now close enough to plan against rather than watch.
The rule binds payers, not you. That is precisely why a tracker is the right artifact: your exposure is not compliance, it is readiness — knowing which of your payers will actually expose these endpoints, what your EHR will do with them, and which of your manual workflows survive into 2027. This guide is a set of questions and a sheet to record the answers in.
Key takeaways
The short version
- The API compliance date is primarily January 1, 2027, but the exact trigger varies: rating periods for Medicaid and CHIP managed care, plan years for exchange issuers.
- Decision timeframes are already in force — 7 calendar days standard and 72 hours expedited for the impacted Medicare and Medicaid programs.
- The rule does not reach every payer. Commercial employer-sponsored plans are outside it, which means your manual workflow does not disappear.
- Ask each payer four questions: which APIs, what date, what onboarding, and what happens to the portal.
- Ask your EHR or clearinghouse the same questions, because a payer endpoint you cannot reach changes nothing for your staff.
- Track the answers in writing. A verbal 'we're working on it' in October 2026 is not a plan you can staff against.
Take the template with you
Free to copy · no email required
Payer API readiness tracker
One row per payer and line of business, with the four questions, the delegate question, onboarding state, your system's support, and a dated next check-in.
payer,line_of_business,impacted_by_cms_0057,annual_auth_volume,bh_delegate_name,api_in_scope_prior_auth,api_requirements_discovery,stated_live_date,date_trigger_basis,onboarding_steps,onboarding_lead_time_weeks,portal_retirement_plan,bh_levels_of_care_covered,our_system_supports,structured_fields_stored,fallback_if_unavailable,contact_name,answer_source_and_date,next_check_in,readiness_rating [payer],Medicare Advantage,yes,1200,[delegate or none],yes/no/unknown,yes/no/unknown,2027-01-01,calendar date / rating period / plan year,registration + test environment,8,portal continues through 2027,"IOP, PHP, residential",EHR roadmap Q3 2027,"auth number, level, units, span, expiry",payer portal,"[name], call 2026-10-18",2027-01-15,red/amber/green [payer],Commercial employer-sponsored,no,2400,[delegate or none],not applicable,not applicable,not applicable,outside the rule,not applicable,,unchanged,all,manual workflow retained,manual entry,existing portal and fax,[name],[date],2027-04-01,manual by design
Saves as cms-0057-payer-readiness-tracker.csv
1. What the rule requires, and of whom
The rule reaches Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid and CHIP managed care entities, and qualified health plan issuers on the federally facilitated exchanges. It does not reach employer-sponsored group health plans, which is the single most consequential fact for a provider planning its workflow — a large share of behavioral-health volume sits outside the rule entirely.
For impacted payers, four APIs are in scope: Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization. The Prior Authorization API is the one that changes a work queue, because it is meant to carry requirements discovery, documentation requirements, submission, and the decision. Alongside the APIs, the rule added operational duties that are already in effect, including specific denial reasons and shortened decision timeframes.
| Payer type | API compliance trigger | Metrics reporting basis |
|---|---|---|
| Medicare Advantage organizations | January 1, 2027 | 42 CFR 422.122(c), contract level, by March 31 |
| State Medicaid fee-for-service | January 1, 2027 | 42 CFR 440.230(e), state level |
| Medicaid managed care plans | Rating period beginning on or after January 1, 2027 | 42 CFR 438.210(f), plan level |
| State CHIP fee-for-service | January 1, 2027 | 42 CFR 457.732(c), state level |
| CHIP managed care entities | Rating period beginning on or after January 1, 2027 | CHIP managed care rules in 42 CFR part 457 |
| QHP issuers on federally facilitated exchanges | Plan year beginning on or after January 1, 2027 | 45 CFR 156.223(c), issuer level |
| Employer-sponsored group health plans | Not impacted by this rule | Not applicable |
2. The four questions to ask every payer
- 01
Which APIs are you implementing, and is prior authorization among them?
Some payers will prioritise Patient Access and leave Prior Authorization late. Ask specifically about the Prior Authorization API and about requirements discovery, which is the capability that saves your staff the most time.
- 02
What is your date, and what triggers it?
For managed care and exchange issuers the trigger is a rating period or plan year, so the calendar date differs by contract. Get the date for your contracts, not the rule's general date.
- 03
What does provider onboarding involve?
Registration, credentials, testing environment, attestations, volume limits. An endpoint that exists but takes three months to be approved for is not available on January 1.
- 04
What happens to the portal and the fax line?
Ask whether existing channels continue, and for how long. If a payer plans to retire a portal workflow your staff depend on, you need that in writing now.
- 05
Which behavioral-health services are in scope?
Ask whether the API covers the levels of care you bill, and whether a behavioral-health delegate or carve-out administrator handles them. Delegated behavioral health is where provider-facing capability most often diverges from the parent payer's roadmap.
- 06
Who is the named contact?
Record a person and a date for the next check-in. 'Provider relations' is not a contact.
3. The questions for your own systems
A payer endpoint is only useful if something you own can call it. For most behavioral-health groups that means the EHR, a practice management system, or a clearinghouse, and the honest answer in late 2026 is often that nobody has asked. Ask now, while there is time to plan around a no.
- Does the vendor intend to support the Prior Authorization API, and on what timeline relative to January 2027?
- Will requirements discovery surface inside the clinical or admissions workflow, or only as a separate lookup?
- Where will the authorization number, approved level of care, approved units, and date span be stored as structured fields?
- How will an electronic decision reach the person who needs to act on it, and what happens on a pend or a request for additional information?
- What is the fallback when an API call fails, and does it leave an auditable record?
- If the vendor will not support it, what is the interim plan: clearinghouse, payer portal, or staffing?
4. Plan for what stays manual
The most expensive planning error available here is assuming 2027 ends manual authorization work. It will not, for three reasons that are visible now.
First, employer-sponsored plans are outside the rule, and for many behavioral-health groups that is a large share of volume. Second, the rule's API scope excludes drugs, which matters for medication-centred psychiatric work. Third, adoption will be uneven: an endpoint that technically exists behind a long onboarding queue, with partial behavioral-health coverage, is not a workflow your staff can rely on in the first months.
| Workflow | Likely 2027 state | What to do now |
|---|---|---|
| Medicare Advantage prior authorization | API available for impacted contracts; onboarding dependent | Track per contract; ask about behavioral-health delegates |
| Medicaid managed care authorization | Varies by rating period and plan | Get the date for each of your plans in writing |
| Commercial employer-sponsored authorization | Unchanged by this rule | Keep the manual workflow and staff it; do not plan reductions here |
| Medication prior authorization | Outside the API scope in this rule | Keep existing electronic prescribing and portal routes |
| Concurrent review and continued stay | Depends on payer implementation depth | Ask explicitly; requirements discovery for continued stay is rarely first in scope |
| Appeals | Not an API requirement in this rule | Expect appeals to remain manual; invest in the letter and tracking workflow |
5. How to run the tracker
- Seed it with your top ten payers by authorization volume, not by revenue. The tracker is about staff time.
- One row per payer and line of business, because the same insurer will have different dates for its Medicare Advantage and Medicaid books.
- Record the answer, the date, and who gave it. A dated name is what makes a follow-up possible.
- Re-check quarterly until January 2027, then monthly through the first quarter of live operation.
- Use the published metrics as a cross-check: payers already post prior authorization statistics annually, so a payer claiming a smooth process has numbers you can read.
- Report one number upward: the share of your authorization volume covered by a payer with a confirmed date and a workable onboarding path. That is your readiness, and it starts near zero.
Common questions
Answers before you build.
Does CMS-0057-F require anything of us as a provider?+
No. The rule's obligations fall on impacted payers. Your interest is readiness rather than compliance: knowing which payers will expose the APIs, whether your systems can use them, and which workflows stay manual. Nothing here creates a provider filing or attestation duty.
Has the January 1, 2027 date moved?+
As of this writing the CMS materials continue to point to primarily January 1, 2027 for the API requirements, with the precise trigger varying by payer type. Because this is a date worth planning against, confirm it on the CMS pages rather than relying on any secondary summary, including this one.
Will this reduce our authorization staffing?+
Not in 2027, and planning on it would be a mistake. Employer-sponsored plans are outside the rule, drugs are outside the API scope, appeals are unaffected, and early adoption will be uneven. The realistic gain is less time spent discovering requirements and chasing decisions on the covered share of volume.
What is requirements discovery and why does it matter most?+
It is the ability to ask a payer, electronically, whether a given service needs authorization and what documentation it requires. It matters most because it removes the part of the work that is pure lookup — the portal hunting and phone calls that happen before any clinical thinking starts.
What should we do about payers that delegate behavioral health?+
Track the delegate as its own row. Ask the parent payer whose API would serve behavioral-health requests, and ask the delegate the same four questions. Delegated behavioral health is the most common place where a payer's public roadmap and your actual workflow diverge.
Practical closeout
Use this operator checklist.
- The API compliance date is primarily January 1, 2027, but the exact trigger varies: rating periods for Medicaid and CHIP managed care, plan years for exchange issuers.
- Decision timeframes are already in force — 7 calendar days standard and 72 hours expedited for the impacted Medicare and Medicaid programs.
- The rule does not reach every payer. Commercial employer-sponsored plans are outside it, which means your manual workflow does not disappear.
- Ask each payer four questions: which APIs, what date, what onboarding, and what happens to the portal.
- Ask your EHR or clearinghouse the same questions, because a payer endpoint you cannot reach changes nothing for your staff.
- Track the answers in writing. A verbal 'we're working on it' in October 2026 is not a plan you can staff against.
Continue through the cluster
Verified customer case studies are added only with customer permission and supporting evidence; none is implied by these operational examples.
Sources & methodology
Trace the operational claims.
Marsa Health Editorial reviewed the primary and research sources below on October 18, 2026. We translate them into workflow controls, distinguish proposals from final rules, and flag where plan, program, state, contract, or clinical requirements vary.
- 01CMS Interoperability and Prior Authorization Final Rule CMS-0057-F Centers for Medicare & Medicaid ServicesThe fact sheet listing which payers are impacted, the four required APIs, the denial-reason duty, and the compliance dates.Accessed or rechecked October 18, 2026
- 02Electronic Prior Authorization Centers for Medicare & Medicaid ServicesCMS's provider-facing readiness guidance for the January 1, 2027 API requirements, including what to ask an EHR vendor.Accessed or rechecked October 18, 2026
- 03Prior Authorization API workflow (CMS-0057-F) Centers for Medicare & Medicaid ServicesCMS's diagram of the requirements-discovery, documentation, submission, and decision exchange the Prior Authorization API must support.Accessed or rechecked October 18, 2026
- 0442 CFR 422.122: Prior authorization requirements Electronic Code of Federal RegulationsParagraph (c) requires Medicare Advantage organizations to post prior-year prior authorization metrics at the contract level by March 31, beginning in 2026.Accessed or rechecked October 18, 2026
- 0542 CFR 438.210: Coverage and authorization of services Electronic Code of Federal RegulationsParagraph (d) sets 7-calendar-day standard and 72-hour expedited decision limits for rating periods beginning on or after January 1, 2026; (c) governs notice of adverse benefit determination.Accessed or rechecked October 18, 2026
- 0645 CFR 156.223: Prior authorization requirements Electronic Code of Federal RegulationsApplies the prior authorization API and public-metrics requirements to qualified health plan issuers on the federally facilitated exchanges.Accessed or rechecked October 18, 2026
- 07Minimum Necessary Requirement U.S. Department of Health and Human ServicesHIPAA guidance on limiting uses, disclosures, and requests for protected health information when the standard applies.Accessed or rechecked October 18, 2026
Organizational author. Editorial review covers source accuracy, search intent, workflow boundaries, and human-oversight requirements. This material is educational and does not provide clinical, legal, coding, or coverage advice.
No named clinical or legal expert reviewer is attributed to this version. Marsa Health does not invent reviewer credentials.
Read our editorial methodRevision history
What changed and when
October 18, 2026
Initial publication, source review, and operational editing.