6 min read
Updated 2026-06-07
The 2027 CMS prior authorization rule, explained
By 2027, payers must expose prior-authorization requirements through standardized APIs. Here is what that changes for procedural practices.
Short answer
The 2027 CMS prior authorization rule requires affected payers to expose requirements and status through standardized APIs, which narrows the information gap but does not assemble the work for a practice.
The CMS Interoperability and Prior Authorization final rule pushes the hidden checklist into the open. It requires affected payers to expose documentation requirements and prior-authorization status through standardized APIs, with the prior-authorization API requirements taking effect in 2027.
The three Da Vinci APIs to know
The rule builds on the HL7 Da Vinci implementation guides. Three matter most for procedural care.
- CRD (Coverage Requirements Discovery): surfaces a payer’s requirements at the point of ordering.
- DTR (Documentation Templates and Rules): turns those requirements into a structured template the practice completes.
- PAS (Prior Authorization Support): submits the request and returns the decision, electronically.
What it changes, and what it does not
The rule narrows the information gap by standardizing how requirements are published and how status is returned. It does not make the requirements simple, and it does not assemble the documentation for the practice. The clinical criteria, step-therapy proof, and code alignment still have to be right.
Practices that prepare to consume these APIs, and that close the information gap now rather than waiting for the deadline, keep approvals that others lose in the transition.
How Upstream builds to it
Upstream builds to consume CRD, DTR, and PAS, and bridges the gap today with requirements intelligence drawn from payer policy at the source. The platform is ready for the standardized APIs as payers expose them, without waiting for the mandate to force the change.