CMS Tightens Prior Authorization Reporting Rules After AMA Flags Insurer Transparency Gaps

The Centers for Medicare & Medicaid Services has strengthened its guidance on prior authorization reporting after the American Medical Association found that some Medicare Advantage plans were making required information difficult to access or understand.

Under the updated guidance, insurers cannot meet the federal transparency requirement by placing prior authorization metrics behind passwords or in sections of their websites that cannot be reached through normal navigation. Plans must also publicly identify all medical items and services that require prior authorization and disclose when entire categories of care are omitted.

CMS also clarified that disclosures must be understandable and that turnaround-time measures must state a clear unit of time.

AMA Review Found Problems in 15 Plans

The changes follow a May 22, 2026, letter from the AMA to CMS after the organization reviewed 15 Medicare Advantage contracts.

The AMA found several problems with how plans were implementing the transparency requirements. Some disclosures were hidden behind login systems or difficult-to-find links. Other plans published extensive billing-code lists without explanations that physicians and patients could readily understand.

The review also found omissions of entire categories of care and problems with turnaround-time reporting, including figures that lacked clear time units.

The AMA said it brought those findings to CMS, which then issued the updated guidance.

First Reporting Deadline Passed in March

The reporting requirements come from CMS’s Interoperability and Prior Authorization Final Rule, issued in 2024.

Affected payers were required to publish their first set of prior authorization metrics by March 31, 2026, based on calendar-year 2025 data. CMS required plans to publish the information on their own public-facing websites rather than through a central federal reporting portal.

The reporting level depends on the type of payer. Medicare Advantage organizations report by contract, Medicaid and CHIP fee-for-service programs by state, managed care plans by plan, and Qualified Health Plan issuers on federally facilitated exchanges by issuer.

What the Public Reports Must Show

The CMS framework requires plans to publish core information about how they handle prior authorization requests.

This includes:

• total prior authorization requests received;
• approval and denial outcomes;
• requests approved after appeal;
• mean and median decision times;
• and the percentage of extended reviews that were ultimately approved.

The reporting framework covers medical items and services rather than prescription drugs.

Separate operational requirements require affected payers to make decisions within 72 hours for expedited requests and seven calendar days for standard requests, while denied requests must include a specific reason.

CMS Wants Information That Can Actually Be Used

The updated guidance addresses more than whether insurers technically publish data.

A list that requires a password, a service category that is missing, or hundreds of unexplained codes may satisfy a narrow interpretation of disclosure while still leaving patients and physicians unable to determine what their plan requires.

CMS’s clarification therefore puts greater emphasis on public accessibility, complete service listings, and understandable reporting.

AMA President Willie Underwood III, M.D., welcomed the change but said the information ultimately needs to be accurate, accessible, understandable, and comparable across health plans.

2027 Brings the Next Major Requirement

The reporting changes are part of the wider CMS-0057-F prior authorization reforms. The next major phase begins January 1, 2027, when additional interoperability requirements, including FHIR-based APIs, take effect for affected payers.

Those requirements are aimed at moving prior authorization information and transactions into more standardized electronic workflows.

For the immediate reporting issue, however, CMS has now made its expectation clearer: prior authorization information must not merely exist somewhere online. Patients and physicians must be able to find it, understand it and determine what a health plan requires.