(a) Communicating a reason for denial. Beginning January 1, 2026, if the State denies a prior authorization request (excluding a request for coverage of drugs as defined in § 431.60(b)(6)), in accordance with the timeframes established in § 440.230(e)(1) of this chapter, the response to the provider must include a specific reason for the denial, regardless of the method used to communicate that information.

(b) Prior Authorization Application Programming Interface (API). Unless granted an extension or exemption under paragraph (c) of this section, beginning January 1, 2027, a State must implement and maintain an API conformant with § 431.60(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that—

(1) Is populated with the State's list of covered items and services (excluding drugs, as defined in § 431.60(b)(6)) that require prior authorization;

(2) Can identify all documentation required by the State for approval of any items or services that require prior authorization;

(3) Supports a HIPAA-compliant prior authorization request and response, as described in 45 CFR part 162; and

(4) Communicates the following information about prior authorization requests:

(i) Whether the State—

(A) Approves the prior authorization request (and the date or circumstance under which the authorization ends);

(B) Denies the prior authorization request; or

(C) Requests more information.

(ii) If the State denies the prior authorization request, it must include a specific reason for the denial.

(c) Extensions and exemptions—(1) Extension. (i) A State may submit a written application to request a one-time, 1-year extension of the requirements in paragraph (b) of this section for its Medicaid FFS program. The written application must be submitted as part of the State's annual APD for MMIS operations expenditures described in part 433, subpart C, of this chapter; and approved before the compliance date in paragraph (b) of this section. It must include all the following:

(A) A narrative justification describing the specific reasons why the State cannot satisfy the requirement(s) by the compliance date and why those reasons result from circumstances that are unique to the agency operating the Medicaid FFS program.

(B) A report on completed and ongoing State activities that evidence a good faith effort towards compliance.

(C) A comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(ii) CMS grants the State's request if it determines, based on the information provided, that—

(A) The request adequately establishes a need to delay implementation; and

(B) The State has a comprehensive plan to meet the requirements no later than 1 year after the compliance date.

(2) Exemption. (i) A State operating a Medicaid program in which at least 90 percent of the State's Medicaid beneficiaries are enrolled in Medicaid managed care organizations, as defined in § 438.2 of this chapter, may request an exemption for its FFS program from the requirements in paragraph (b) of this section.

(ii) The State's exemption request must:

(A) Be submitted in writing as part of a State's annual APD for MMIS operations expenditures before the compliance date in paragraph (b) of this section.

(B) The State's request must include both of the following:

(1) Documentation that the State meets the threshold for the exemption, based on enrollment data from the most recent CMS “Medicaid Managed Care Enrollment and Program Characteristics” (or successor) report.

(2) An alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iii) CMS grants the exemption if the State establishes to CMS's satisfaction that the State—

(A) Meets the threshold for the exemption; and

(B) Has established an alternative plan to ensure that enrolled providers will have efficient electronic access to the same information through other means while the exemption is in effect.

(iv) The State's exemption expires if either—

(A) Based on the 3 previous years of available, finalized Medicaid Transformed Medicaid Statistical Information System (T-MSIS) managed care and FFS enrollment data, the State's managed care enrollment for 2 of the previous 3 years is below 90 percent; or

(B)(1) CMS has approved a State plan amendment, waiver, or waiver amendment that would significantly reduce the percentage of beneficiaries enrolled in managed care; and

(2) The anticipated shift in enrollment is confirmed by the first available, finalized Medicaid T-MSIS managed care and FFS enrollment data.

(v) If a State's exemption expires under paragraph (c)(2)(iv) of this section, the State is required to do both of the following—

(A) Submit written notification to CMS that the State no longer qualifies for the exemption within 90 days of the finalization of annual Medicaid T-MSIS managed care enrollment data that demonstrates that there has been the requisite shift from managed care enrollment to FFS enrollment resulting in the State's managed care enrollment falling below the 90 percent threshold.

(B) Obtain CMS approval of a timeline for compliance with the requirements in paragraph (b) of this section within 2 years of the expiration of the exemption.

[89 FR 8979, Feb. 8, 2024]