Onyx Blog
CMS-0062: Why Drug Prior Authorization Is Only Part of the Story
If you’ve only skimmed the trade-press coverage of CMS-0062, you’d think the rule is about one thing: extending CMS-0057’s prior authorization framework to drugs covered under the medical benefit. That extension is real and it matters. It isn’t the story.
The story is what CMS is doing around it. Assuming of course, that the rule is finalized in broad alignment with the proposed rule.
CMS-0062 reaches deeper into payer operations than any rule since the Interoperability and Patient Access Final Rule. It rewires how new versions of implementation guides get adopted, replaces X12 transactions with FHIR for two more workflows, pulls QHPs and state Medicaid into faster prior authorization windows, expands the metrics regime, and forces every impacted payer to publish their FHIR endpoints directly to CMS. Most of this is targeted for compliance around October 1, 2027.
If your compliance roadmap was built around “we’ll do drug prior auth in 2028,” you have a planning gap.
A faster on-ramp for new standards. CMS-0062 points to ONC rulemaking that streamlines how new versions of FHIR implementation guides and named standards can be adopted. Every IG update today triggers a regulatory bottleneck. Under the proposed pathway, payers and developers can move to current versions without waiting years for the next big rule. That changes the calculus on when to invest in upgrades, and removes a favorite reason to defer. The forcing function: certain currently-adopted standard versions in 45 CFR 170.215 are proposed to expire on January 1, 2028.
Eligibility and referrals leave X12. The proposed rule moves eligibility checks and referral transactions to FHIR. X12 270/271 and 278 have been the spine of these workflows for thirty years. They’re not going away tomorrow, but the regulatory direction is set, and dual-stack operations are a real line item in your 2027–2028 plan.
Da Vinci CDex becomes the attachment standard for prior authorization. Attachments have been the friction point in every prior auth project to date. CMS is naming Da Vinci CDex as the path. If your PA program assumed CDA-on-Direct or fax escalation as the long-tail solution, that assumption is on a clock.
CMS-0057 IG versions are getting bumped. The implementation guides referenced in the existing rule will be updated to current versions and become required. That’s more than a paperwork change. It ripples into vendor contracts, conformance test plans, and any FHIR connectathon prep already commissioned.
You will publish your FHIR endpoints to CMS. This is the change that quietly reshapes the market. Once endpoints are centrally listed, ecosystem participants (providers, third-party apps, other payers, regulators) can find and exercise them programmatically. Half-built APIs and “we’re working on it” answers will be visible. So will the leaders. Endpoint quality stops being an internal compliance metric and becomes a public one.
QHPs and state Medicaid get pulled to faster timeframes. QHPs will be required to meet the same 7-day standard and 72-hour expedited window that other plans already shoulder for non-drug prior authorization. For drugs, QHPs face 72 hours for standard requests and 24 hours for expedited. State Medicaid FFS, Medicaid managed care, and CHIP managed care entities align to the existing covered-outpatient-drug timeframe of 24 hours after the PA request is received for drug PAs, with non-drug items and services on the 7-day standard and 72-hour expedited clocks. State CHIP FFS gets the 24-hour clock for prescription drugs with Federal Financial Participation. These are operational changes that touch staffing, escalation pathways, and after-hours coverage, not just systems.
Prior authorization metrics get sharper, and now cover drugs. The proposed metrics add numeric counts (not just percentages), introduce “remain denied after appeal” and “extended timeframe denied” categories, and beginning in 2028 for the 2027 reporting period extend the regime to drug prior authorizations across MA, Medicaid and CHIP FFS, Medicaid and CHIP managed care, and QHP issuers on the FFEs.
Drug prior authorization reporting rides on the Access APIs. This is an architectural decision with downstream consequences. Drug PA isn’t getting a separate pipe; it flows through the Patient Access, Provider Access, and Prior Authorization APIs you’ve been building. The implication: your API platform needs the drug data model and the clinical context to support it, not just the transactional plumbing.
NCPDP standards land on pharmacy-benefit drug PA. The medical-benefit drug PA story is the headline. The rule also pulls Medicaid and CHIP FFS, Medicaid and CHIP managed care, and QHP issuers on the FFEs onto three NCPDP standards by October 1, 2027: SCRIPT, Formulary & Benefit, and Real-Time Prescription Benefit. That aligns them with what Medicare Part D sponsors already do, and adds new operational work for the rest of the impacted-payer set.
Denied prior authorizations are exempt from Payer-to-Payer exchange. A welcome operational clarification. Plans don’t have to ship denied PAs across the Payer-to-Payer API. Confirm your current implementation reflects it.
Medicaid and CHIP managed care reporting moves to 90 days after each rating period. The reporting clock changes. Programs that scoped their data and analytics builds around the prior cadence need to re-plan. Other impacted payers (MA, state Medicaid and CHIP FFS, QHP issuers on the FFEs) report by March 31 of the following year.
FF-SHOP inherits the full API stack. FF-SHOP plans are pulled into the same API requirements. Most FF-SHOP issuers also operate QHPs, so the infrastructure should already be there. Coverage, attestations, and testing scope still need to be confirmed for SHOP lines of business, not assumed.
The headline compliance date, drug prior auth in 2028 for the 2027 reporting period, has been the anchor in every executive summary in the trade press. The rule’s structural changes — endpoint publishing, IG version updates, FHIR for eligibility and referrals, faster QHP and Medicaid timeframes — point to an effective date of final rule and a practical implementation horizon around October 1, 2027.
| Milestone | Proposed compliance window |
| Structural changes (endpoint publishing, IG version bumps, FHIR for eligibility and referral, faster QHP and Medicaid timeframes) | Effective date of final rule. Practical horizon around October 1, 2027. |
| New and revised non-drug PA metrics | Effective date of final rule |
| Drug prior authorization metrics | Beginning in 2028 for the 2027 reporting period |
| Drug PA data exposed via Patient, Provider, and Payer-to-Payer APIs | October 1, 2027 |
| Medicaid & CHIP managed care reporting cadence | No later than 90 days after end of each rating period |
| New API usage metrics (Provider Access, Payer-to-Payer, Prior Authorization APIs) | Begin reporting in 2028 from 2027 reporting period |
| API endpoint reporting to CMS (centralized list) | Within 60 days of final rule effective date (existing payers); 60 days before covering patients (new payers) |
| HIPAA AdminSimp: FHIR for eligibility & referral, Da Vinci CDex for attachments | 24 months after final rule effective date (36 months for small health plans) |
| Currently-adopted standard versions in 45 CFR 170.215 expire | January 1, 2028 |
That’s roughly seventeen months from now. One budget cycle. Not enough time to discover the gap.
Audit your FHIR endpoints as if the list were public tomorrow. Under the proposed rule, it will be. If a third party can see that your Patient Access endpoint returns empty bundles, that becomes a public fact. Inventory the endpoints, the data behind each one, and the gap between current state and what an external observer will conclude.
Treat the X12-to-FHIR transition as a portfolio decision, not a project. Eligibility and referrals are joining prior authorization on the FHIR side of the house. Plan the dual-stack period, decide which X12 transactions you’ll keep and for how long, and budget the sunset.
Walk the PA operational model against the new clocks and the CDex attachment path. Staffing, escalation, attachments, drug carve-outs each need a stress test against the new timeframes. The expanded metrics will make weaknesses visible whether you fix Audit your FHIR endpoints as if the list were public tomorrow. Under the proposed rule, it will be. If a third party can see that your Patient Access endpoint returns empty bundles, that becomes a public fact. Inventory the endpoints, the data behind each one, and the gap between current state and what an external observer will conclude.
Treat the X12-to-FHIR transition as a portfolio decision, not a project. Eligibility and referrals are joining prior authorization on the FHIR side of the house. Plan the dual-stack period, decide which X12 transactions you’ll keep and for how long, and budget the sunset.
Walk the PA operational model against the new clocks and the CDex attachment path. Staffing, escalation, attachments, drug carve-outs each need a stress test against the new timeframes. The expanded metrics will make weaknesses visible whether you fix tAudit your FHIR endpoints as if the list were public tomorrow. Under the proposed rule, it will be. If a third party can see that your Patient Access endpoint returns empty bundles, that becomes a public fact. Inventory the endpoints, the data behind each one, and the gap between current state and what an external observer will conclude.
Treat the X12-to-FHIR transition as a portfolio decision, not a project. Eligibility and referrals are joining prior authorization on the FHIR side of the house. Plan the dual-stack period, decide which X12 transactions you’ll keep and for how long, and budget the sunset.
Walk the PA operational model against the new clocks and the CDex attachment path. Staffing, escalation, attachments, drug carve-outs each need a stress test against the new timeframes. The expanded metrics will make weaknesses visible whether you fix them or not.
The same FHIR API surface CMS is making public in 2027 is also the data path that supports risk adjustment, quality measurement, prior auth analytics, and provider directory accuracy. Payers who treat 2027 as the year their compliance project becomes a data platform will end the decade owning more than a compliance project.
The rule is proposed, not final. Comment now by June 15th, 2026. Plan as if October 1, 2027 is the date that matters, because in most of the ways that affect your roadmap, it is.
CMS-0062 is a reminder that payer interoperability requirements are continuing to evolve. The APIs, workflows, and data foundations being built for CMS-0057 will need to support more use cases, more reporting, more public visibility, and more operational pressure over time.
Onyx’s complimentary CMS-0057 Readiness Check helps payer teams evaluate current-state readiness across the required APIs, identify implementation gaps, assess partner and workflow dependencies, and understand whether today’s roadmap is building a foundation that can scale beyond compliance.
Request a Readiness Check here
