Prior Authorization Paperwork: What the 2027 Deadline Changes

What the 2027 deadline does and does not change

The rule behind the 2027 date is CMS-0057-F, the Interoperability and Prior Authorization final rule from the Centers for Medicare and Medicaid Services. It covers a defined group of health plans: Medicare Advantage organizations, state Medicaid and CHIP programs, managed care plans under those programs, and qualified health plan issuers on the federal exchanges. The rule calls them impacted payers. Employer-sponsored group plans do not appear on that list, so the rule's clocks may not reach the commercial plans your practice bills. Check each payer contract and each state's insurance rules before you assume a commercial payer will follow the same timelines.

The 2027 date is a build deadline. CMS gave impacted payers until primarily January 1, 2027, to meet the application programming interface (API) requirements. The API work is the payer's job. Your practice does not have to build an interface by that date to keep submitting requests.

The decision clocks did not wait for 2027. Since January 1, 2026, impacted payers other than QHP issuers on the federally facilitated exchanges have had to send decisions on standard prior authorization requests within seven calendar days and on expedited requests within 72 hours. Two details matter for your staff. The clock counts calendar days, not business days, so a request submitted on a Friday runs through the weekend. The second is that the 7-day and 72-hour clocks do not cover every payer. QHP issuers on the federal exchanges are excluded from them, which means a practice should check each payer's plan type before it plans around a deadline.

Two other parts of the rule affect the paperwork. For covered non-drug requests, impacted payers must give a specific reason when a prior authorization request is denied. That gives your team a reason to work from when a denial comes in, rather than a generic notice. Drugs sit outside this package for now. A separate proposal, CMS-0062-P, would extend similar requirements to drug prior authorization, but it is not a finalized requirement.

The one practice-facing date in the rule is on the reporting side. Starting with the 2027 performance period, eligible clinicians and hospitals attest under the Medicare Promoting Interoperability program that they requested at least one prior authorization electronically through a Prior Authorization API. That attestation is a reporting item for Medicare-participating clinicians. It does not require a new system by itself, but it does mean your team should know whether your electronic submission route qualifies.

Why this costs money

The American Medical Association's 2025 prior authorization physician survey, published in 2026, gives the clearest national baseline. Physicians complete an average of 40 prior authorizations per week. Prior authorization consumes an average of 13 hours of physician and staff time each week, and two in five physicians employ staff dedicated exclusively to prior authorization tasks. That 13 hours is per physician, and it mixes clinical and clerical time.

The paperwork is also getting harder to win. Three-quarters of physicians report that denials have increased over the past five years, according to the same AMA survey. Every denial adds a second round of work: pulling the reason, gathering records, and deciding whether to resubmit or appeal.

To turn the 13 hours into a dollar figure, use the wage basis. The U.S. Bureau of Labor Statistics reported a 2025 median pay of $51,140 for medical records specialists, the occupation that most closely matches prior authorization clerical work. Dividing that by 2,080 working hours gives about $24.59 an hour. Thirteen hours a week for a full year is about 676 hours. Priced at that median wage, the whole 13 hours would come to roughly $16,600 per physician per year before benefits and payroll costs. Because part of the 13 hours is physician time, a realistic clerical share is lower. If half the time is clerical, the figure is near $8,300 per physician per year. Your own numbers will differ, and the free audit measures them.

The manual way and the automated way

Most of the cost sits in four routine jobs: gathering the documents, checking where each request stands, chasing the decision, and recording what happened. The table below shows the split. The clinical decisions stay on the right-hand column in both versions.

How to automate it, step by step

The work below can be built with tools a practice already uses or can buy as standard software. Start with the first two steps before you buy anything.

1. Map every prior authorization path. List each payer, each service that needs approval, and where the answer arrives: portal, phone, fax, email or letter. Mark which payers are Medicare Advantage, Medicaid or CHIP, because those are the plans where the 7-day and 72-hour clocks apply.

2. Build one request log. A shared spreadsheet is enough to start, or a table inside your practice management system if it supports one. Keep fields for a patient reference number rather than a name, the payer, the service code, the submission time, an urgent flag, the due date counted in calendar days, the current status, and a named owner.

3. Connect the intake. A workflow tool such as Microsoft Power Automate, Zapier or Make can watch the shared prior authorization mailbox and copy new messages into the log. Faxed replies can be routed to an email inbox by your fax provider, then read by an OCR service such as Amazon Textract or Google Document AI. OCR pulls out the reference number, decision date and denial reason. Any field the OCR is unsure of goes to a person.

4. Automate status checks and reminders. Where a payer offers electronic status checks, the AI worker runs them on a schedule and writes results to the log. Where it does not, the worker creates a call task for a staff member. Set reminders from the submission time, not from the day someone notices the request.

5. Draft follow-ups for approval. An LLM can draft a status request or a missing-documents note from the log entry. A staff member reads it and sends it through the approved channel. Patient messages about a pending authorization should avoid clinical detail. If you consider WhatsApp for patient contact, confirm your compliance officer approves it first and that the messaging provider will sign a business associate agreement if any protected health information is involved.

6. Route denials and clinical questions to a clinician. The AI worker attaches the denial reason, the relevant note and the payer's stated criteria. The clinician decides whether to resubmit, request a peer-to-peer call or appeal.

7. Sign the agreements before any data moves. HIPAA requires a business associate agreement with any vendor that creates, receives, maintains or transmits protected health information for your practice. If an AI vendor creates, receives, maintains, or transmits PHI on your behalf as a business associate, require a signed BAA before data flows. The HHS publishes sample provisions that you can use as a checklist when you review the vendor's draft.

What breaks and how to prevent it

Automation in this area fails in predictable ways. Plan for each one before go-live.

• OCR misreads a reference number, and a request is matched to the wrong patient. Require a person to confirm any extracted number before it updates a patient record, and check a sample of matches every week during the first month.

• Payer portals change their layouts or login steps. A status check that worked last month may stop working. Assign one staff member to review failed checks each morning, and keep the phone path open as a fallback.

• Staff stop reading alerts. An alert channel with dozens of messages a day gets ignored. Send only the items that are due or overdue, and group them by owner.

• Clocks are miscounted. The 7-day and 72-hour limits are calendar-based. Build the due date from the submission time in the log so that weekends are counted correctly.

• Protected health information goes to a tool without a agreement. Public consumer chat tools do not sign business associate agreements, so staff must not paste patient details into them. Put that rule in writing, and block those tools on work devices if your IT team can do it.

• The automation makes a clinical call by accident. A summary written by an LLM can read as a judgment. Label every generated summary as a draft, and keep the clinician sign-off step on every denial and appeal.

When not to automate

Automation is not worth building in every case. If your practice sends only a handful of prior authorizations a month, a shared checklist and a weekly review may cost less effort than a workflow. If most of your requests go through payers that only accept paper, or through portals that change every quarter, the upkeep may outweigh the gain until those channels settle. If nobody has written down the current steps for each payer, automating the chaos only speeds up the mistakes, so write the steps first.

There is also work an AI worker should never own. It cannot make a medical-necessity determination, cannot argue a clinical appeal, and cannot make a payer respond faster than its own rules allow. It can track the request, check what can be checked, and put the right information in front of the right person at the right time. Results depend on your own volumes, payer mix and staffing, which the free audit measures.

What it typically takes

The main cost is people's time rather than software. Expect several working sessions with your billing lead to map payers and agree on the log fields. Your office manager will need time to review the alert rules and test them against recent requests. A clinician must agree on the denial routing before anything goes live. Someone on your side needs to be the contact for the vendor, the fax provider and the payer portals, and that person should be able to decide on access and data-sharing questions.

The time needed depends on how many payers you deal with and how many of their channels are electronic. A practice with two payers and one fax line will move faster than a group that deals with a dozen portals. Your first step is the mapping exercise in the steps above. Once you know the payer count and the monthly request volume, you can decide whether the build is worth the effort.