CMS-0057-F Prior Authorization APIs Go Live January 1, 2027: What Genetic Testing Labs Should Do Now
Short answer: Under CMS-0057-F, impacted payers must have standardized prior authorization APIs running by January 1, 2027. The rule covers Medicare Advantage, Medicaid, CHIP, and federal-exchange plans, with 72-hour and 7-day decision limits. It does not cover most employer-sponsored commercial plans, so labs still need payer-specific workflows for the rest of their mix.
What the rule requires, and by when
CMS states that impacted payers "have until primarily January 1, 2027, to meet the application programming interface (API) requirements" in the Interoperability and Prior Authorization Final Rule, known as CMS-0057-F. According to CMS's electronic prior authorization overview, the required APIs are the Patient Access API, Provider Directory API, Provider Access API, Payer-to-Payer API, and a Prior Authorization API. Other provisions of the rule took effect earlier, on January 1, 2026.
The earlier provisions matter to labs right now. Per Firely's CMS-0057-F compliance summary, impacted payers must decide expedited requests within 72 hours and standard requests within 7 calendar days, must give specific reasons for denied non-drug prior authorizations, and were due to post their first prior authorization metrics on their websites by March 31, 2026. Those published metrics are a free benchmark: they show how each payer actually performs on approvals, denials, and turnaround.
Which payers are in scope, and which are not
The impacted payer types listed in the Firely summary are Medicare Advantage organizations, Medicaid and CHIP programs (both fee-for-service and managed care), and qualified health plan issuers on the federally facilitated exchanges. Prior authorization requirements under the rule explicitly exclude drugs. Employer-sponsored commercial plans are not among the payer types listed, and neither is traditional fee-for-service Medicare.
That gap is the practical point for a genetic testing lab. A single test menu can run across a Medicare Advantage plan that must expose a standardized API, an exchange plan that must do the same, and a commercial plan that follows its own portal rules. Commercial payers are moving on their own timeline: as we covered in our UnitedHealthcare prior authorization update, UnitedHealthcare added twelve genetic and molecular test codes to its prior authorization list in 2026 alone, and a missed authorization there means a denied claim the lab cannot balance-bill. CMS-0057-F will not standardize that experience for you.
Why this is a revenue-cycle story, not just an IT story
CMS's own overview puts a price on the problem: prior authorization requests cost providers "$20-50 per hour" in staff time and consume approximately "700 hours annually" per provider, roughly $34,000 per year in administrative costs. Those are CMS estimates for providers generally, not lab-specific figures, but the direction is clear. The rule's bet is that structured, electronic requests replace phone, fax, and portal re-keying.
CMS is also pushing the requesting side. Two proposed rules released April 10, 2026 address prior authorization: the CY 2027 Medicare Physician Fee Schedule proposal includes electronic prior authorization measures for eligible clinicians, and CMS-0062-P addresses prior authorization for prescription drugs using National Council for Prescription Drug Programs standards. Separately, the FY 2027 IPPS final rule makes an electronic prior authorization measure mandatory for eligible hospitals and critical access hospitals beginning in calendar year 2028, with an optional bonus in 2027. Ordering health systems that do not yet send electronic requests will be under pressure to start.
What genetic testing labs and RCM teams should do now
First, split your payer mix by whether the rule applies. Tag every payer as Medicare Advantage, Medicaid or CHIP, exchange, or outside the rule, and expect API-driven prior authorization only for the first three groups. Second, pull the public prior authorization metrics those payers posted this year and rank them by denial rate and turnaround on the services you bill. Third, audit your own intake data. An API request is only as good as the structured data behind it, so the diagnosis codes, test identifiers, and clinical documentation you capture at order entry need to be complete and consistent. Our guide to prior authorization for genetic testing covers the documentation packet in detail.
Fourth, do not let the new API stand in for the molecular-specific identifiers payers still require. A prior authorization approval does not replace a registered test identifier, a point we explain in our DEX Z-code guide. Fifth, use the specific-denial-reason requirement operationally: log the stated reason for every denied non-drug request and feed it back into order-entry rules, the same discipline we recommend in why genetic testing claims get denied. Finally, ask your ordering partners and any intake platform how they plan to connect, since the API will be built on the payer side while the data originates on yours. Teams evaluating that intake layer can look at the workflow on the ScreenMyGene homepage.
What to watch between now and January 2027
Three signals are worth tracking over the next quarter. The first is whether the payers in your mix publish their API documentation and onboarding steps, since a payer that is ready will say so and a payer that is not will go quiet. The second is whether the CY 2027 Physician Fee Schedule electronic prior authorization proposal survives into the final rule, because it shapes how much pressure ordering clinicians feel to send structured requests. The third is your own denial log: if a payer's stated denial reasons start to look more specific after the rule's 2026 provisions, that is evidence the transparency requirements are working, and you can use it to tighten documentation before the API arrives.
FAQ
When must payers have prior authorization APIs live?
CMS says impacted payers have until primarily January 1, 2027 to meet the API requirements in CMS-0057-F. The rule requires a Prior Authorization API alongside Patient Access, Provider Directory, Provider Access, and Payer-to-Payer APIs. Some other provisions took effect January 1, 2026.
Which payers does CMS-0057-F apply to?
Per Firely's compliance summary, it applies to Medicare Advantage organizations, Medicaid and CHIP programs, and qualified health plan issuers on federally facilitated exchanges. Employer-sponsored commercial plans are not among the listed payer types, so labs should not assume the rule standardizes those payers.
How fast must payers decide prior authorization requests?
Firely's summary states 72 hours for expedited requests and 7 calendar days for standard requests. Payers must also give specific reasons when they deny non-drug prior authorizations. Drugs are excluded from these prior authorization requirements, and separate proposed rule CMS-0062-P addresses drug prior authorization.
Does the rule replace payer-specific genetic test authorization lists?
No source we reviewed says it does. The rule standardizes how covered payers exchange prior authorization data and decisions; it does not change which tests a payer chooses to require authorization for. Labs must still check each payer's policies, such as UnitedHealthcare's genetic test list.
Is there a cost estimate for the prior authorization burden?
CMS's electronic prior authorization overview estimates requests cost providers $20 to $50 per hour and consume about 700 hours annually per provider, roughly $34,000 per year. These are general provider estimates, not lab-specific, and actual burden varies by payer mix and test menu.
This article is provided for general educational and business-decision-support purposes for laboratory, revenue-cycle, and clinical-ordering professionals. It is not legal, coding, or reimbursement advice for any specific claim, and payer and CMS requirements are subject to change. Verify current rules directly with CMS and each payer, and consult qualified compliance or billing counsel for your organization.
Sources: CMS.gov, "CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F)"; CMS.gov, "Electronic Prior Authorization" overview (2026); Firely, "CMS-0057-F: Interoperability and Prior Authorization Final Rule" compliance summary (2026); ScreenMyGene, "UnitedHealthcare Genetic Testing Prior Authorization 2026."