Prior Authorization Automation: How to Build It Before the 2027 API Deadline

Last updated: October 29, 2026

5 payer portals, a fax queue of clinical notes, and a patient waiting for approval. It’s a composite scene of the work your team has to get through. Prior authorization automation needs to carry each case through that workflow, with someone responsible for its next step.

Respondents to the AMA’s 2025 physician survey, released on 13 May 2026, reported 13 combined physician and staff hours each week on their own patients’ authorization work. That’s self-reported workload.

The 2025 CAQH Index, presented in April 2026, estimates 15 minutes of medical-provider handling saved per authorization exchange through X12 278 compared with fax, email, or mail.

Start with the case your staff must get through today. Software can handle lookup and assemble the evidence, then follow up on the case.

Staff and clinicians make the judgment calls and approve outgoing requests and appeals. Give the reviewer the chart sources alongside the draft so they can check what they’re approving.

Then give each case a route through the payer channels you can use now, with a path toward payer APIs as coverage becomes available.

How should providers automate prior authorization across their payer mix?

Connect chart evidence to payer requirements and assign someone to handle each case’s next step. Use AI for source-linked drafts, with staff approving submissions and clinicians handling clinical questions and appeal sign-off. Route approved packets through verified payer connections, with someone responsible when a connection fails; expand from a measured pilot that tracks staff work separately from elapsed decision time and follows the compliance periods for your selected plans.

Key Takeaways:

1. Give every unfinished case an owner. Assign responsibility from requirement checks through follow-up, including staff approval before submission and clinician review of clinical questions and appeals. Keep unsupported payer routes and unresolved evidence visible in the same case.
2. A draft earns approval through evidence checks. Put chart sources beside clinical claims and keep current payer criteria available. Check facts and coding before sending; measure draft edits separately from correctness.
3. Expand coverage from a measured pilot. Compare actual payer/service/EHR support before adding custom work. Freeze the cohort and metric definitions, and retain unresolved requests. Apply CMS milestones to the payer periods they govern.

Table of contents

1. The prior authorization workflow needs explicit staff approval points
2. AI prior authorization drafts need chart citations before approval
3. The CMS prior authorization rule (CMS-0057-F): separate 2026 duties from 2027 APIs
4. A prior authorization API needs a fallback for each payer
5. Build, buy, or use your EHR’s prior authorization tools
6. Implement prior authorization automation in 6 steps, then measure the results
7. HIPAA controls follow every prior authorization packet
8. Build prior authorization automation around your payers with Topflight Apps

The prior authorization workflow needs explicit staff approval points

Automated prior authorization uses software to check whether payer approval is needed, gather evidence, draft requests and appeals, submit requests and track status through follow-up. For launch, we recommend staff approval before submission, with clinicians signing appeals and leading peer-to-peer review calls.

Use deterministic checks for payer fields, RPA to work in an existing payer portal, and AI to read documents and draft text. Chen et al.’s radiation-oncology study in JAMA Network Open (December 2025) used rules-based software to flag missing payer-required fields for staff completion.

Decide who can approve the packet before you build the queue. Staff can check whether it’s complete, while clinical questions go to a clinician. If either reviewer changes it, save that reviewed version with the submission so you can trace what the payer received.

Build the prior authorization (PA) case around these assignments:

Under HL7’s March 2026 CRD guidance, missing ordering details or a missing response leave discovery unresolved; record the point-in-time assumptions and route exceptions to staff. CMS’s October 2026 FAQ supports keeping authorization scope and expiry with status. A status check should tell staff what happened and who needs to act next.

Review ownership stays visible as the case moves between software, staff, and clinicians.

Follow the payer’s escalation path

Evolent’s Medicare process (checked October 2026) puts peer-to-peer calls before final determination with a licensed provider-office clinician; Health Net California’s PPO manual (November 2024) disallows them after an appeal begins.

Check gold carding for the actual plan/service: UnitedHealthcare’s national program (checked October 2026) retains advance notification for qualified groups and designated services, while state programs can differ.

Before escalating, confirm who will handle the case and which next step the payer allows.

AI prior authorization drafts need chart citations before approval

AI prior authorization can use a large language model (LLM) for document extraction, clinical evidence matching, and letter drafting from unstructured notes. Our proposed prior auth AI agent prepares medical-necessity letters with chart citations; people verify evidence and approve outgoing requests, with clinical judgment assigned to qualified reviewers.

Keep evidence and policy beside the draft

Put the proposed sentence beside its open chart excerpt. Keep the applicable payer-policy reference and version visible when available, so the reviewer can compare the clinical assertion with both its source and the current criteria.

Mello and Stanford coauthors’ policy analysis in Health Affairs (January 2026) argues for meaningful human review: access to chart sources, current payer criteria, qualified reviewers for clinical questions and a way to return missing evidence to the work queue.

An open source pane gives reviewers something to check, but someone still has to compare the draft with the chart. Put the approval owner and clinical escalation route on the same screen so reviewers know which decisions they can make.

Before approving a draft:

• Verify clinical facts against the chart.
• Compare them with applicable current criteria.
• Resolve missing evidence.
• Route clinical judgments to a qualified reviewer.

Keep Approve, Edit and Send distinct, with the approved version attached to the submission. Unsupported clinical assertions create audit and denial risk: the reviewer must be able to trace each claim to the chart and check it against the applicable payer criteria.

Original illustrative design: each clinical claim opens its chart source before the reviewer approves the send.

Clinical questions go to a qualified reviewer, while an appeal needs clinician sign-off. Put those routes in the review queue before launch so clerical staff know when to hand the packet over.

Make the review count

Aiumtrakul et al.’s single-model medication-PA scenario evaluation (Frontiers in Digital Health, March 2026) found coding and reference errors in generated letters. Verify patient facts, codes and citations; the study establishes no production error rate.

Naderi et al. (npj Gut and Liver, February 2026) found that confidence elicited from a model was poorly calibrated on gastroenterology board questions. Validate any confidence score you use to route review against the actual task; independently calibrated extraction or matching scores are separate measures.

Decide before launch who checks coding and sources, and who takes over when the question is clinical. During the pilot, track staff edits and assess correctness separately: a draft can reach submission unchanged and still contain an error.

CMS’s WISeR model (October 2026) uses AI/ML with clinical review for selected Original Medicare services in 6 states; licensed clinicians determine non-payment recommendations. Medicare Advantage is excluded.

MACPAC (February 2025) flags limited federal oversight of Medicaid PA automation; state oversight varies.

The broader ai agents in healthcare guide covers how to assign work between an agent and its reviewers. If evidence is still missing or unverified, return the draft to the person responsible for completing it before anyone approves submission.

The CMS prior authorization rule (CMS-0057-F): separate 2026 duties from 2027 APIs

The CMS prior authorization rule, CMS-0057-F, is the Interoperability and Prior Authorization Final Rule: process and API duties for impacted payers. Your plan depends on the payer’s program and coverage period, alongside separate provider participation measures.

CMS’s original fact sheet and its process FAQ, updated 14 October 2026, set out these milestones:

• Announcement: CMS announced the final rule on 17 January 2024.
• Operating duties: From 1 January 2026, Medicare Advantage and Medicaid/CHIP fee-for-service must follow the deadlines for 72-hour expedited and 7-day standard decisions (calendar days). Medicaid/CHIP managed-care requirements apply to rating periods beginning on or after that date. Federally facilitated exchange (FFE) QHP issuers are excluded from those timeframes; specific denial reasons apply more broadly, including their plan years beginning on or after that date. Across submission channels, decisions must be faster when the patient’s condition requires, with permitted program extensions retained.
• Public reporting: Impacted payers had to publish public metrics covering calendar-year 2025 by 31 March 2026. That deadline doesn’t establish that every payer complied.
• API compliance: From 1 January 2027, payer duties cover 3 new APIs (Prior Authorization, Provider Access, Payer-to-Payer) and expanded Patient Access; Medicare Advantage and Medicaid/CHIP fee-for-service use that date. Medicaid/CHIP managed care uses the first rating period beginning on or after it; FFE QHPs use plan years beginning on or after it. Applicable exceptions and extensions remain.

Apply each milestone to the payer group and coverage period it actually governs.

CMS’s process FAQ ties the decision clock to payer receipt: undisclosed documentation requirements don’t stop or restart it. CRD discovery starts no clock; permitted extensions remain, and real-time decisions aren’t required.

Your total order-to-decision time also includes evidence collection and routing. Record the order, payer receipt and final decision times. Use the payer clock to assess the applicable decision obligation and the full order-to-decision clock to find delays in evidence collection or routing.

For eligible clinicians, CMS’s finalized 2027 MIPS ePA measure requires a qualifying non-drug API request through certified electronic health record technology (CEHRT), or an exclusion. CMS has proposed making it optional in 2027 and required in 2028; the hospital/CAH changes were finalized separately.

Read CMS QPP’s July 2026 policy comparison alongside the linked CMS overview. Check individual exclusion eligibility before configuring attestation.

When you agree on the provider launch, distinguish the proposed clinician change from the duties already finalized. Your technical team still needs to check evidence access and support for the selected payers.

The finalized rule excludes drugs. Part D uses NCPDP SCRIPT ePA; medical-benefit drug support may be voluntary. CMS’s 10 April 2026 CMS-0062-P proposal would add medical-benefit FHIR and pharmacy-benefit NCPDP duties.

Build your launch scope from a payer-by-request list. For each entry, write down the applicable program period and current submission channel, then assign the provider work needed to prepare the request. Keep the MIPS participation task separate.

Before expanding, operations and engineering need to agree which cases can use today’s route and which depend on a payer connection.

A prior authorization API needs a fallback for each payer

A prior authorization API connects accessible chart evidence to a supported payer route. Decide who will recover the case when that connection fails. For the MIPS electronic prior authorization measure, check the eligible-clinician requirements and current policy above.

Get the evidence into the request

HL7’s Da Vinci prior authorization guides share FHIR R4 (4.0.1). Their complementary jobs can sit in one EHR/app workflow:

ONC’s August 2026 adoption notice identifies CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1, effective 1 October 2026. This adoption doesn’t finalize proposed drug duties or make these versions universal under the payer rule.

HL7’s March 2026 DTR specification makes evidence access a practical test: can your app retrieve the required EHR data and apply the payer’s questionnaire logic? Identify missing or nonstandard fields, then let staff complete them.

Let staff review and edit prepopulated answers, and save their origins and any overrides. DTR answer provenance records where each field answer came from; the AI review screen’s sentence-level chart sources support clinical claims in a draft.

The standard permits review; we require it in our recommended launch workflow.

For broader data access, read fhir is no longer optional. If your evidence sits in Epic, start with how to integrate with epic EHR before promising questionnaire completion. Confirm what staff will still need to enter.

A prepopulated questionnaire can only carry the evidence your connection can retrieve. Test whether that access supplies the answers required for your selected service, then decide which fields staff will complete. Leave the unfinished questionnaire with its case so the person collecting the missing information can pick up where it stopped.

Verify payer coverage and recovery

• Check the payer: HL7’s March 2026 DTR specification calls for checking the patient’s payer against the app’s supported-payer list. Technical compatibility alone doesn’t establish a business arrangement.
• Check the state: HL7’s March 2026 PAS specification separates transport receipt from pend and final authorization; subscribe for pended decisions. Keep inquiries user-initiated and avoid repeated polling. Inspect OperationOutcome for 4xx corrections; 5xx failures may be temporary.

PAS intermediaries convert FHIR requests to X12 278 and responses back when required. CMS’s 28 February 2024 guidance permits qualifying intact FHIR exchange under discretion; other X12 duties remain. Verify each payer’s API, X12, portal or fax route.

A technical failure goes to your integration owner, while clinical or documentation exceptions stay with the case owner. If you change channels during recovery, carry the approved packet version and its follow-up into the new route so neither person has to reconstruct the case.

Keep the case intact when a payer or channel needs a different submission path.

Before submitting, confirm that the selected route works and that someone will handle failures. Payers building servers should use the CMS API implementation resource, updated in August 2026.

Build, buy, or use your EHR’s prior authorization tools

Compare prior authorization software against the payer/service/EHR combinations you actually need. A launch can combine these paths. Start with the work each option covers and the work your staff still has to finish; include your practice management system in that assessment.

The vendor capabilities below were checked on 29 October 2026. Confirm support for your own workflow before choosing a path.

Combine existing capabilities and scope custom work around the gaps that remain.

Put the options beside a case your team actually has to complete. For that payer and service, identify which component retrieves the evidence and where staff approve the packet. Then name the person who finishes a request when it falls outside the supported path.

That last answer determines the remaining work. Check whether configuring an existing tool will cover the gap.

If it won’t, decide whether staff will keep doing that step or whether you need custom support for it. You can deliberately keep a manual step in the pilot once you’ve assigned the work.

For the wider Epic portfolio, use the epic ai guide. Assess oncology and imaging rules separately from fertility or behavioral-health requirements. If you work across EHRs or embed authorization in a practice product, assess the custom connections and workflow that product will need.

The ai specialty practice management software guide covers the broader specialty-platform question. If your product scope reaches beyond authorization into billing, use medical billing software development to define that wider boundary. Name the integrations and uncovered case steps your custom layer will take on.

Is prior auth slowing your schedule? Talk to a Topflight Apps engineer about automating your highest-volume authorizations first.

Implement prior authorization automation in 6 steps, then measure the results

In the AMA’s 2025 survey, released 13 May 2026, respondents self-reported 13 combined physician/staff hours weekly for their patients’ medication and medical-service PA; 95% reported care delays at least sometimes.

CAQH’s 2025 Index (April 2026), using 2024 activity, estimates 15 minutes of medical-provider handling saved per PA exchange via X12 278 versus fax/email/mail, plus a $461 million national medical-PA savings opportunity. These are estimates.

Those figures describe different kinds of work, so your prior auth automation pilot needs its own baseline. Track staff handling separately from the elapsed wait for a payer decision before promising a result.

1. Baseline the work

Record requests/week, staff hours, turnaround time and denial rate by payer before changing the workflow. You’ll need the same measures after launch to compare the pilot with the work it replaced.

2. Select the first payers and services

• Check which payer/service lines account for the highest request volume.
• Keep the actual plan products visible in the pilot scope.

3. Build the scoped rule library

Choose who will keep documentation requirements current for the pilot’s selected payers and services. AAFP/FPM’s November/December 2023 guide recommends payer-specific required information, order-time alerts and prepopulated forms where supported; build the library around your selected services and actual plan products.

4. Connect EHR evidence

Confirm which access paths are available:

• FHIR
• HL7
• Document exports

Identify the fields staff must complete before you promise automated packet completion.

5. Launch with staff approval

Review every outgoing submission and route clinical questions to the clinician. Track what staff change in each draft, then use that record to examine the edits during the pilot.

6. Expand after review

Review the fixed-cohort results and unresolved cases before adding payer/service coverage or available API routes. Let those results determine what you take on next.

Choose case or service-line units, freeze the cohort and clock conventions, and report unresolved cases alongside decided cases. Use these proposed local definitions consistently across periods:

CAQH CORE’s December 2021 pilot defined first-pass approval through staff interaction. Keep your numerator and denominator explicit so that different definitions don’t get mistaken for the same result.

Epic reported 42% less medication PA submission time at Summit Health; Fierce Healthcare repeated it on 10 March 2026. That measures submission; measure payer decision time separately.

Keep the request unit and measurement rules fixed before expanding coverage.

If you’re also changing billing queues, scope that work through medical billing automation and downstream revenue cycle automation. Base the next PA expansion on the pilot’s results, including the cases staff still have to resolve.

HIPAA controls follow every prior authorization packet

Before choosing controls, map where the packet is used and stored, and which organization handles it at each point. That gives you a place to assign the applicable contracting and disclosure duties, alongside access and audit controls.

Map where the packet goes

HHS OCR’s risk-analysis guidance, reviewed 12 August 2026, covers every ePHI location. Apply that inventory to chart retrieval, model processing, draft storage, reviewer access, submission and PHI-bearing logs.

Identify the organization or service handling each copy and transmission, then assign safeguards and contracting decisions to that use. Reassess the associated risks when you add a processing component.

Include drafts and PHI-bearing logs when mapping where the packet is stored and used.

Follow an unapproved draft through that map as carefully as the final packet. For each copy, you should be able to name the organization or service holding it and who can open it, with the controls assigned to that location.

Return to the map when you change the workflow. If a different service starts processing or storing the packet, reassess the risks and contracting decisions for that part of the path.

Limit and record each use

• HHS OCR’s business-associate guidance (checked 29 October 2026) covers applicable business associates and PHI-handling subcontractors, including qualifying model/storage operators. BAAs follow that chain; providers needn’t contract directly with every downstream subcontractor.
• Under HHS’s payment definition, 45 CFR 164.501 (current through 27 October 2026), payer preauthorization is payment activity. Generally apply minimum-necessary limits, send reasonably needed documentation, and review the selected packet before disclosure.

HIPAA’s 45 CFR 164.312 (current through 27 October 2026) requires mechanisms to record and examine ePHI-system activity, with access and integrity safeguards. For this workflow, we also recommend recording the reviewer identity, approved version and approval timestamp.

Save the access record and approval trail with the packet so you can trace who used or approved it. The hipaa compliant ai guide covers the broader architecture once you’ve assigned controls along this path.

Build prior authorization automation around your payers with Topflight Apps

Bring us one of your highest-volume payer/service workflows and the plan products it covers. We’ll work through the chart evidence you can access and the points where a case still needs a person, then agree which handoffs the pilot needs to cover.

Topflight Apps can build payer-rule checks, evidence collection and drafts for staff approval, with EHR/payer connections for submission, status and appeals. We’d scope FHIR submission preparation around your applicable payer transition.

For the agreed pilot scope, our delivery terms are:

• We deploy in your cloud account under the agreed architecture and scope.
• The agreed pilot scope has a fixed price.
• You own custom code under agreed IP and third-party licensing terms.

Want a prior auth plan ready for 2027? Book a call to map your payers and workflows.

You can scope requirement lookup, evidence assembly, drafting and follow-up now, with people approving outgoing work. Start from the cases your staff must complete and decide who takes over when a request needs attention.

Use that workflow to prepare for the payer-API transition that applies to your selected plans. Bring the first payers and services you want to cover to the scoping call, and we’ll work through the connections and review steps the pilot needs.