View all text of Subpart C [§ 422.100 - § 422.138]
§ 422.122 - Prior authorization requirements.
(a) Communicating a reason for denial. Beginning January 1, 2026, if the MA organization denies a prior authorization request (excluding request for coverage of drugs as defined in § 422.119(b)(1)(v)), in accordance with the timeframes established in §§ 422.568(b)(1) and 422.572(a)(1), the response to the provider must include a specific reason for the denial, regardless of the method used to communicate that information.
(b) Prior Authorization Application Programming Interface (API). Beginning January 1, 2027, an MA organization must implement and maintain an API conformant with § 422.119(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that—
(1) Is populated with the MA organization's list of covered items and services (excluding drugs, as defined in § 422.119(b)(1)(v)) that require prior authorization;
(2) Can identify all documentation required by the MA organization for approval of any items or services that require prior authorization;
(3) Supports a Health Insurance Portability and Accountability Act (HIPAA)-compliant prior authorization request and response, as described in 45 CFR part 162; and
(4) Communicates the following information about prior authorization requests:
(i) Whether the MA organization—
(A) Approves the prior authorization request (and the date or circumstance under which the authorization ends);
(B) Denies the prior authorization request; or
(C) Requests more information.
(ii) If the MA organization denies the prior authorization request, it must include a specific reason for the denial.
(5) In addition to the requirements of this section, an MA organization using prior authorization polices or making prior authorization decisions must meet all other applicable requirements under this part, including § 422.138 and the requirements in subpart M of this part.
(c) Publicly reporting prior authorization metrics. Beginning in 2026, following each calendar year that it offers an MA plan, an MA organization must report prior authorization data, excluding data on drugs as defined in § 422.119(b)(1)(v), at the MA contract level by March 31. The MA organization must make the following data from the previous calendar year publicly accessible by posting them on its website:
(1) A list of all items and services that require prior authorization.
(2) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.
(3) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.
(4) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.
(5) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.
(6) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.
(7) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.
(8) The average and median time that elapsed between the submission of a request and a determination by the MA plan, for standard prior authorizations, aggregated for all items and services.
(9) The average and median time that elapsed between the submission of a request and a decision by the MA plan for expedited prior authorizations, aggregated for all items and services.