CMS-0057-F Compliance Checklist

Interoperability and Prior Authorization Final Rule. All three parts covered: Prior Authorization API + decision process, Patient/Provider/Payer-to-Payer API expansions, and public reporting metrics. For Medicare Advantage, Medicaid Managed Care, CHIP Managed Care, and ACA Exchange-issuer payers. Self-assess against the rule before TAP scoring.

Part 1 of 3

Prior Authorization API + Decision Process

PA API live by 2027-01-01 · Decision-timeline operational requirements live by 2026-01-01

Prior Authorization API (DaVinci PAS)

PAS FHIR endpoint deployed and conformance-tested against the DaVinci PAS Implementation Guide (45 CFR 156.223 / 422.122 / 431.80)

CRD (Coverage Requirements Discovery) CDS Hooks endpoint live; provider EHR can ask "is PA required?" before service ordering

DTR (Documentation Templates and Rules) SMART on FHIR app launchable from provider EHR; CQL execution returns auto-populated QuestionnaireResponse

Payer Questionnaire and Library FHIR resources published; tied to current medical-policy criteria (InterQual / MCG / proprietary)

PAS Bundle and Claim resources validate against base profiles; mapped to X12 278 backend where legacy adjudication still runs

Authentication via OAuth 2.0 / SMART on FHIR with least-privilege scoping (patient-in-context only)

Decision-Timeline SLAs (Operational)

Standard PA decisions issued within 7 calendar days of receipt (was 14 days) (§ 422.122(b)(1)(i))

Expedited PA decisions issued within 72 hours of receipt (§ 422.122(b)(1)(ii))

Workflow capacity tested for surge volume (provider rollout, drug-class expansion, new IGs) without missing the SLA

Intake-timestamp + decision-timestamp logged for every PA request; auditable trail in audit-ready storage

Auto-approval path for clean clinical evidence; no auto-denial (machine cannot deny without clinical review)

Denial Reason Structure

Denial reasons returned in structured FHIR format (CodeableConcept with specific reason code), not free text

Each denial includes the specific clinical-policy citation that was not met

Appeals process surfaced to provider EHR via standardized response, not separate portal

Part 2 of 3

Patient, Provider, and Payer-to-Payer API Expansions

All three APIs live by 2027-01-01

Patient Access API (expanded to include PA)

Patient Access API extended to expose PA request status, decision, and supporting clinical-criteria evidence

Excludes drugs as required; covered items/services only (§ 422.119(b)(2))

Member-app authorization flow supports SMART on FHIR / OAuth 2.0

Provider Access API (NEW under CMS-0057)

Provider Access API endpoint live; in-network providers can pull member claims, encounters, clinical, and PA data

Member opt-out mechanism implemented; provider-attribution check before data release

Provider Directory exposes which providers are in-network for the attribution check

Authentication: payer-controlled OAuth client registration for in-network provider organizations

Payer-to-Payer API (expanded to include PA)

P2P API exchanges claims, encounters, clinical, and now PA data with previous and concurrent payers

Member opt-in mechanism implemented at enrollment

Bulk FHIR $export supported for batch member data transfer between payers

Data-source identification: receiving payer can tell which source-payer each data element came from

Part 3 of 3

Public Reporting Metrics

First public report due 2026-03-31 (covering CY 2025 data); annually thereafter

Aggregated PA Metrics Published Annually

Number of PA requests broken out by approved / denied / approved-after-appeal

Average and median time for standard PA decisions

Average and median time for expedited PA decisions

Percentage of PA requests approved at first review (no appeal)

Percentage of denials overturned on appeal

Reporting broken out by service / item category (procedure, medication if covered, DME, etc.)

Public-facing webpage with the metrics published and dated

Operational Tracking Infrastructure

Data warehouse (PostgreSQL, BigQuery, Snowflake, or equivalent) captures every PA transaction with timestamps, decision, and category

Quarterly internal review cadence to surface drift before annual public-report deadline

Audit log retention sufficient for CMS oversight requests (multi-year retention)

Not sure where you stand? TAP audits your live FHIR endpoints against all three parts of CMS-0057-F and synthesizes a citation-level scorecard with quantified penalty exposure. Starter Audit Guarantee: refund if zero critical or high findings.

Book a Call