2026-2027 CMS FHIR Mandates for Payers

COMING SOON! Payers must comply with a sweeping set of CMS mandates.

Mandates and deadlines for the 2026-2027 implementations of HL7 FHIR standards have been released by the US Centers for Medicare & Medicaid Services (CMS) in its Interoperability and Final Rule (CMS-0057-F).

CMS-0057-F Implementation Deadlines

By January 1, 2026: Payers are mandated to provide specific reasons within required turnaround times for denied Prior Authorization decisions and report annual metrics to CMS regarding Patient Access API usage.

By January 1, 2027: Payers must comply with a more sweeping set of CMS–0057-F mandates, including support for FHIR-based APIs covering Patient Access, Provider Access, Payer-to-Payer Data Exchange and Prior Authorizations. API implementations must be live by January 1, 2027.

Who is Impacted by CMS-0057-F?

• Medicare Advantage organizations
• State Medicaid agencies (Fee-for-Service)
• Medicaid Managed Care Plans
• CHIP (Children’s Health Insurance Program) Managed Care Entities
• Qualified Health Plan (QHP) issuers on the Federally Facilitated Exchanges

Compliance is not optional for these payers—it’s federally mandated.

What Are the Risks of Non-Compliance with CMS-0057-F?

Failure to meet these CMS requirements may result in:

• Increased audit scrutiny from CMS
• Non-compliance penalties or corrective action plans
• Loss of contracts or program eligibility
• Brand and reputation damage due to failure to meet patient data access and transparency standards

Delays in preparing for CMS-0057-F could result in costly remediation efforts—or worse, regulatory action if deadlines are missed.

What Are the Specifics of CMS-0057-F for Patient Access, Provider Access, Payer-to-Payer Data Exchange and Prior Authorizations?

1. Patient Access API Enhancements

• Beginning January 1, 2026: Payers are required to report annual Patient Access API usage metrics to CMS to monitor and ensure effective patient data access.
• By January 1, 2027: Impacted payers must update their existing Patient Access APIs to include information about Prior Authorizations (excluding those for drugs). This requirement aims to provide patients with comprehensive access to their health data, including Prior Authorization details.

2. Provider Access API Implementation

• By January 1, 2027: Payers must implement and maintain a Provider Access API to share patient data with in-network providers who have a treatment relationship with the patient. This API should include claims and encounter data, USCDI data elements and specified information about Prior Authorizations (excluding those for drugs).

Patients must be informed about this data exchange and provided the option to opt out.

3. Payer-to-Payer Data Exchange API

• By January 1, 2027: Payers are required to establish a Payer-to-Payer API to facilitate the exchange of patient data, including claims, encounter data, USCDI data elements and specific information, with a date of service within five years of the request.

Patients must opt in for this data exchange and payers are obligated to provide educational resources about the benefits and process of opting in.

4. Prior Authorizations API Implementation

• Beginning January 1, 2026: Payers are mandated to provide specific reasons for denied Prior Authorization decisions, regardless of the method used to send the request. Standard Prior Authorization requests require a decision in 7 calendar days. Urgent, Prior Authorization expedited requests require a decision within 72 hours. This requirement aims to enhance transparency and facilitate better communication between payers, providers and patients.
• By January 1, 2027: Payers must implement a Prior Authorization API that provides a list of covered items and services requiring prior authorization, identifies documentation requirements and supports electronic prior authorization requests and responses. The API should communicate approval status, denial reasons, or requests for additional information. This creates a need to translate and interoperate between X12 278 transactions and FHIR-based resources.

What Are Stakeholder Responsibilities per CMS-0057-F for Payers, Providers and Patients?

• Impacted Payers: Payers must develop and maintain the specified FHIR APIs, ensure timely and accurate data sharing, provide clear communication regarding decisions and offer educational resources to patients about data exchange options and their rights to opt in or out.CMS-0057-F creates a mandated bridge between traditional EDI payer workflows, especially EDI 278 and modern FHIR-based APIs,
• Healthcare Providers: Providers should integrate with the Provider Access API to access patient data for treatment purposes, understand the processes facilitated by the new FHIR APIs and educate patients about their data-sharing options.
• Patients: Patients have the right to access their health information through the Patient Access API, opt in or out of data sharing via the Payer-to-Payer API and receive clear explanations for any decisions made.

How PilotFish Helps Payers Meet 2026-2027 CMS FHIR Mandates and Drive FHIR Interoperability Forward

PilotFish, a leader in healthcare integration and FHIR interoperability solutions, is exceptionally well-positioned to help payers comply with the CMS FHIR mandates and mission to unify traditional HL7 and EDI systems with modern, API-driven standards.

Don’t let a compliance delay put your organization at risk. Visit our PilotFish CMS-0057-F Mandates Solutions page to learn how we help payers cost-effectively comply with CMS-0057-F.

HL7 is the registered trademark of Health Level Seven International.
X12, chartered by the American National Standards Institute for more than 35 years, develops and maintains EDI standards and XML schemas.