Medicare Advantage plans, Medicaid and CHIP programs and their managed care plans, and QHP issuers on the federal exchanges must have Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs live by January 1, 2027. The 2026 operational requirements are already in force. What each API does, the standards behind them, and how we would build on AWS.
CMS's Interoperability and Prior Authorization final rule (CMS-0057-F), published January 17, 2024, applies to Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the Federally Facilitated Exchanges. It has two waves.
Since January 1, 2026: prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard ones, and a specific reason for every denial.
By March 31, 2026: the first prior authorization metrics posted publicly on the payer's website, then annually.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
The rule builds on HL7 FHIR R4 and the standards ONC adopted for certified health IT (US Core, SMART App Launch, Bulk Data Access), and CMS recommends implementation guides for each API: CARIN Blue Button and Da Vinci PDex for data exchange, and Da Vinci CRD, DTR and PAS for prior authorization. CMS has also announced enforcement discretion for covered entities that run FHIR-based prior authorization without the X12 278 transaction.
A FHIR store: AWS HealthLake (managed, SMART on FHIR support, $0.27 per data store hour plus storage and queries) or a FHIR server you run, such as HAPI FHIR on ECS with Aurora PostgreSQL.
Mapping pipelines from claims, enrollment, utilization management and clinical systems into US Core and CARIN profiles. This is most of the work and most of the risk.
Authorization: member identity with SMART scopes for Patient Access; provider attribution and organization-level credentials for Provider Access; consent records for Payer-to-Payer.
Prior authorization services that answer CRD, serve DTR questionnaires and accept PAS submissions, wired to the utilization management system for decisions.
Bulk export for Provider Access and Payer-to-Payer, with throttling so a large request does not hurt member-facing APIs.
Monitoring and the metrics CMS asks for, from the same event stream.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
Integrating With EHRs as a Health Tech Startup: SMART on FHIR, USCDI v3 and What Takes Time
Certified EHRs must support USCDI v3 from January 1, 2026, and SMART on FHIR lets an app launch inside the EHR with the clinician's context. The standards are the easy part. The integration types, what each can and cannot do, and why the calendar is set by your customer's IT team rather than your code.
Read
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.