Editorial Note on Part 422
Editorial Note: Nomenclature changes to part 422 appear at 70 FR 4741, Jan. 28, 2005.

§ 422.122 Prior authorization requirements. ( a ) *Communicating a reason for denial.* Beginning January 1, 2026, if the MA organization denies a prior authorization request (excluding request for coverage of drugs as defined in § 422.119(b)(1)(v)), in accordance with the timeframes established in §§ 422.568(b)(1) and 422.572(a)(1), the response to the provider must include a specific reason for the denial, regardless of the method used to communicate that information.
( b ) *Prior Authorization Application Programming Interface (API).* Beginning January 1, 2027, an MA organization must implement and maintain an API conformant with § 422.119(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that— ( 1 ) Is populated with the MA organization's list of covered items and services (excluding drugs, as defined in § 422.119(b)(1)(v)) that require prior authorization;
( 2 ) Can identify all documentation required by the MA organization for approval of any items or services that require prior authorization;
( 3 ) Supports a Health Insurance Portability and Accountability Act (HIPAA)-compliant prior authorization request and response, as described in 45 CFR part 162; and
( 4 ) Communicates the following information about prior authorization requests: ( i ) Whether the MA organization— ( A ) Approves the prior authorization request (and the date or circumstance under which the authorization ends);
( B ) Denies the prior authorization request; or
( C ) Requests more information.
( ii ) If the MA organization denies the prior authorization request, it must include a specific reason for the denial.
( 5 ) In addition to the requirements of this section, an MA organization using prior authorization polices or making prior authorization decisions must meet all other applicable requirements under this part, including § 422.138 and the requirements in subpart M of this part.
( c ) *Publicly reporting prior authorization metrics.* Beginning in 2026, following each calendar year that it offers an MA plan, an MA organization must report prior authorization data, excluding data on drugs as defined in § 422.119(b)(1)(v), at the MA contract level by March 31. The MA organization must make the following data from the previous calendar year publicly accessible by posting them on its website: ( 1 ) A list of all items and services that require prior authorization.
( 2 ) The percentage of standard prior authorization requests that were approved, aggregated for all items and services.
( 3 ) The percentage of standard prior authorization requests that were denied, aggregated for all items and services.
( 4 ) The percentage of standard prior authorization requests that were approved after appeal, aggregated for all items and services.
( 5 ) The percentage of prior authorization requests for which the timeframe for review was extended, and the request was approved, aggregated for all items and services.
( 6 ) The percentage of expedited prior authorization requests that were approved, aggregated for all items and services.
( 7 ) The percentage of expedited prior authorization requests that were denied, aggregated for all items and services.
( 8 ) The average and median time that elapsed between the submission of a request and a determination by the MA plan, for standard prior authorizations, aggregated for all items and services.
( 9 ) The average and median time that elapsed between the submission of a request and a decision by the MA plan for expedited prior authorizations, aggregated for all items and services.
[89 FR 8976, Feb. 8, 2024]