The 2026 Prior Authorization Rule Has a Clock. It Does Not Measure Your Whole Wait.

A federal deadline can be real and your staff can still feel as if prior authorization is taking longer.

Those two things are not contradictory.

In September 2026, MGMA reported that 44% of medical group leaders in its Sept. 1 poll said payer prior authorization turnaround had become slower in 2026 compared with 2025. At the same time, federal requirements that took effect in 2026 set maximum decision timeframes for certain prior authorization requests handled by certain payers.

The management mistake is to treat those two measures as if they describe the same clock.

They do not.

What changed in 2026

Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), impacted payers generally must send prior authorization decisions within 72 hours for expedited requests and seven calendar days for standard requests. The operational requirements began in 2026.

The rule covers Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, and CHIP managed care entities. Qualified Health Plan issuers on the Federally Facilitated Exchanges are impacted by other parts of the rule, but they are excluded from these new 72-hour/seven-day decision-time requirements.

Another important boundary: the 2024 final rule's prior authorization process requirements apply to medical items and services, excluding drugs. CMS issued a separate proposed rule in April 2026 that would extend and align several requirements for drugs beginning in 2027 if finalized. As of September 2026, that remains a proposal, not the current rule.

So a practice should not read “72 hours / seven days” as a universal deadline for every payer, every plan, every request, or every drug authorization.

The federal clock is the middle clock

For practice leadership, it helps to split the prior authorization journey into three operational intervals.

1. Order to submission: the practice queue

The physician orders a service, but the payer cannot decide on a request it has not received.

Time can accumulate before submission while staff verifies benefits, identifies whether authorization is required, gathers documentation, clarifies the requested service, waits for clinical notes to be signed, navigates a portal, or resolves missing information.

That interval belongs to the practice workflow. A federal payer decision deadline does not measure it.

If a practice only tracks the date of the final payer decision, a slow internal queue can be mistaken for a slow payer — or hidden inside an overall average.

2. Submission to payer decision: the payer decision window

This is the interval the 2026 CMS deadlines are designed to constrain for the payer categories and non-drug requests covered by the rule.

CMS says the maximum is 72 hours for expedited requests and seven calendar days for standard requests, subject to the applicable program requirements. Payers must also provide a specific reason when a covered prior authorization request is denied.

This is the segment leadership should compare with the applicable payer and program rules — not the total elapsed time from the physician's order to the patient's scheduled service.

3. Decision to final resolution: the post-decision queue

A payer decision is not always the end of the operational work.

A denial may require review, additional documentation, a peer-to-peer discussion, resubmission, appeal, scheduling changes, or communication back to the ordering team. Even an approval can sit before the next operational step is completed.

That interval is not captured by the payer decision deadline either.

For management purposes, “prior authorization took 11 days” is therefore incomplete. The useful question is: where were those 11 days spent?

Why this distinction matters when the payer asks for more information

CMS's Prior Authorization API guidance says an impacted payer's response can approve, deny with a specific reason, or request more information needed to support the request. That makes documentation readiness operationally important even when the payer is subject to a decision deadline.

The management lesson is not to assume every delay is the payer's fault or the practice's fault. It is to make the delay visible enough to assign ownership correctly.

If requests repeatedly spend two days inside the practice before submission, that calls for a different response than requests that are submitted promptly but sit with a payer. And both are different from requests that receive timely decisions but take days to reach final resolution.

A better prior authorization management view

A useful report for practice leadership does not need to reproduce every task performed by a prior authorization specialist. It should answer a small number of operational questions:

• When was the service ordered?
• When was the prior authorization request actually submitted?
• When did the payer make a decision?
• When was the request finally resolved for the practice?
• Which payer and plan handled it?
• Was it standard or expedited?
• Was the request actually subject to the 2026 CMS decision-time rule?
• Was additional information, peer-to-peer review, resubmission, denial, or appeal involved?

From there, leadership can look at the median time for each interval by payer and plan rather than relying on one blended “prior auth turnaround” number.

CMS itself now requires impacted payers to publicly report prior authorization metrics that include the average and median time from submission to decision for standard and expedited requests. The concept is useful internally too: measure the part of the workflow you are trying to manage.

The question to ask at your next RCM or operations meeting

Ask for this view:

Show me our median order-to-submission time, submission-to-decision time, and decision-to-resolution time by payer and plan — and tell me which requests are actually subject to the 2026 CMS deadlines.

That one request does several things at once.

It separates internal workflow from payer performance. It keeps staff from treating every authorization as if the same federal rules apply. And it makes recurring bottlenecks easier to see without turning practice leadership into prior authorization technicians.

What changes next

The 2024 CMS final rule also requires impacted payers to implement Prior Authorization APIs beginning in 2027. Those APIs are intended to support electronic exchange of coverage requirements, documentation requirements, requests and responses.

That can reduce friction, but it should not be treated as a promise that every authorization becomes instantaneous. CMS expressly notes that some decisions will still require clinical review.

For practices, the practical preparation is straightforward: know where your current delays live before new technology changes the workflow. Otherwise, faster electronic transmission can arrive without giving leadership a clearer view of the underlying process.

The takeaway

The 2026 prior authorization rule created an important decision-time standard for specific payer categories and non-drug medical items and services.

But the federal clock does not measure the whole wait your practice experiences.

If prior authorization still feels slow, do not stop at a single turnaround-time number. Separate the workflow into order to submission, submission to payer decision, and decision to final resolution. Then investigate the interval that is actually creating the delay.

Measure the right clock before you decide what needs fixing.