CMS-0057-F API deadline 2027: payer FHIR build plan for 1 January

Summary. The date has not moved. Under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), Medicare Advantage organisations and state Medicaid and CHIP fee-for-service programmes must run four HL7 FHIR R4 APIs from 1 January 2027, 61 days after this check: an enhanced Patient Access API, a Provider Access API, a Payer-to-Payer API and a Prior Authorization API. Medicaid and CHIP managed care follow the rating period beginning on or after that date, and exchange issuers the plan year. Decision clocks (72 hours and 7 days, exchange issuers excluded), denial reasons and public metrics have applied since 2026. Two recent changes reshape the build. ONC replaced the older Da Vinci guides with CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1 from 1 October 2026, and on 28 December 2026 it removes US Core 3.1.1 and SMART 1.0.0 from its standards list. The payer half of CMS-0062-P, which would require those guides and add drugs from 1 October 2027, is still only proposed. Build to version 2.2, US Core 6.1.0 and SMART 2.0.0. X12 278 alone cannot satisfy the rule, but plans cannot force partners off it.

About this article. For CTOs and vendors building payer or EHR interfaces for US health plans. On 1 November 2026 we checked dates, versions and clocks against the CFR (eCFR text via Cornell LII, with 45 CFR 170.215 as amended on 4 August 2026), Federal Register texts of 8 February 2024 and 14 April, 4 August and 28 October 2026, and CMS, ONC and OIRA pages. This is general information, not legal or regulatory advice; confirm with your compliance team. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.

What is due on 1 January 2027, and for whom

CMS released CMS-0057-F on 17 January 2024; the Federal Register published it on 8 February 2024. Operational changes started in 2026, and the API build moved to 2027 after commenters objected to the 2026 date first proposed. CMS's rule page, last modified 8 October 2026, still gives primarily 1 January 2027, and we found no delay covering the API dates.

Employer plans and off-exchange commercial products are not impacted payers, although CMS has published a statement of support from self-funded employers. Exchange plans count only on the federally facilitated exchanges, and the policies do not pertain to Original Medicare fee-for-service.

Dates and flexibility differ by payer type. A state's extension must be approved before the date, now 61 days away.

This table lists each API's data and clocks, the versions named in the 2024 rule and the implementation guides (IGs) it strongly encourages.

The named versions have expired. CMS's standards page marks US Core 3.1.1, SMART App Launch 1.0.0 and USCDI v1 as expired on 1 January 2026 and lists US Core 6.1.0, SMART 2.0.0 and USCDI v3 as updated versions. Payers may use an update if ONC has approved it, no other law bars it, and end users keep access. From 28 December 2026 an ONC rule published on 28 October removes the two paragraphs of 45 CFR 170.215 holding the old versions, which the CMS API sections still cite. CMS-0062-P would repoint those references, but it is not final. We found no CMS statement on this gap. Our reading: target 6.1.0 and 2.0.0, and have compliance record why.

X12 278 alone does not comply. HHS said on 28 February 2024 it will not enforce the X12 278 standard against covered entities using a FHIR-based Prior Authorization API. CMS's FAQ adds that a 278-only offer cannot meet the rule, because the 278 cannot carry the covered-services list or documentation requirements. Equally, a plan may not require another covered entity to give up the 278, and the discretion has no set end date. So plan on FHIR plus an X12 route, or FHIR-only with partners who agree.

Testing is a duty, certification is not. CMS does not require payers to certify APIs but does require routine testing and monitoring, including privacy and security checks, and each CMS programme enforces under its own authority.

What changed in 2025 and 2026

The deadline did not move, but the standards and incentives around it did.

CMS-0062-P floated keeping the older guides until 1 January 2028. ONC instead replaced them on 1 October 2026, citing compatibility issues between 2.0.1 and 2.2, known defects in 2.0.1 and the need for one baseline by 2028, and noted that no Health IT Modules had been certified to the earlier versions. A payer shipping only 2.0.1 on 1 January 2027 may comply on paper, because the guides are only recommended, but will have built to versions HHS has dropped.

CMS-0062-P: what would change if it is finalised

ONC's standards adoption from this proposal is final. The payer requirements are not: a CMS page updated in October 2026 still calls them proposed, and OIRA's 1 November 2026 review list has no entry for this rule. If finalised as written, the rule would:

• From 1 October 2027, add drugs covered under a medical benefit to Prior Authorization APIs, put drug prior authorisation data into the other three APIs, and set some drug decision clocks as short as 24 hours.

• From the same date, require Medicaid, CHIP and exchange payers to support NCPDP SCRIPT, Formulary and Benefit, and Real-Time Prescription Benefit for pharmacy-benefit drugs.

• Make the recommended IGs mandatory from 1 October 2027. The April fact sheet offered older or newer versions, such as PAS 2.0.1 or 2.2.1; after ONC's replacement, CMS's September snapshot describes the CRD, DTR and PAS requirement as version 2.2.

• Require unexpired versions of the base standards from the final rule's effective date, leaving US Core 6.1.0 and SMART 2.0.0 for now.

• Require payers to report API endpoints, capability statements and developer documentation to CMS within 60 days of that date, update them within a week of any change and verify them yearly.

• Add annual usage metrics for the three newer APIs, starting in 2028 with 2027 data.

• Add small-group QHP issuers on FF-SHOP exchanges, and set exchange decision clocks of 72 hours and 7 days from 1 October 2027.

• Have HHS adopt FHIR as the HIPAA standard for prior authorisation transactions, with Da Vinci CDex for attachments, due 24 months after the final rule takes effect (36 for small plans).

Treat 1 October 2027 as a planning assumption: CMS-0057-F's API dates moved a year between proposal and final rule.

The build plan: November 2026 to October 2027

For most payers the 1 January date is about proving a working, documented, secured API, not volume. CMS does not require real-time decisions, and ONC expects EHR developers to deploy certified modules by the 2028 reporting periods, so traffic should lag.

Before 1 January 2027

1. Freeze scope against the rule text. Map each requirement to its CFR paragraph per product line. Products often share a platform but not a date.

1. Set the version baseline. FHIR R4.0.1, US Core 6.1.0, SMART 2.0.0, USCDI v3 and Bulk Data 1.0.0, with OpenID Connect Core for Patient Access and CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1 for prior authorisation.

1. Publish the rules catalogue. The API must carry your list of services needing prior authorisation and the documentation each requires. You posted that list with your March 2026 metrics; turn it into CRD responses and DTR questionnaires.

1. Close identity gaps. Patient Access needs SMART App Launch and OpenID Connect. Provider Access needs provider authentication plus attribution, for which CMS prescribes no method. Payer-to-Payer needs payer authentication and an attestation of enrolment and opt-in.

1. Wire prior authorisation data into three APIs. Status, dates, items approved, denial reason and related structured documents must reach Patient Access within 1 business day; Provider Access serves the same data. Payer-to-Payer drops denied requests and adds unstructured documents.

1. Stand up consent flows. Provider Access is opt-out, across all providers unless you offer finer controls. Payer-to-Payer is opt-in, and the offer must reach existing members by the compliance date, not only new joiners. Publish plain-language material before the first data leaves.

1. Test, and know the tools' limits. Inferno kits cover CRD, DTR and PAS at 2.0.1 and 2.2, but all three are labelled draft and low maturity, and the public host is for demonstration only, with no PHI. Keep reports as evidence of testing, not proof of compliance, and add partner testing.

1. Check the platform. Microsoft's date for Azure API for FHIR was 30 September 2026; our Azure FHIR migration plan covers the move.

January to June 2027

Pilot with two or three EHRs, ideally certified to (g)(31) through (g)(33), but do not wait for them. Measure end-to-end turnaround. CMS counts the decision clock in calendar time from receipt of the request: a CRD check does not start it and asking for more documents does not stop it, though programme-specific extensions of up to 14 days exist. Instrument all the APIs now: if CMS-0062-P is finalised, 2027 is the first reporting year.

By October 2027

Prepare for medical-benefit drugs, NCPDP standards if you run Medicaid, CHIP or exchange products, and the IG mandate. Keep the API layer version-aware for future guides, but serve PAS 2.0.1 only for a named partner that depends on it, with an end date.

EHR vendors should certify to (g)(31), (g)(32) and (g)(33) on the 2.2 guides, the only versions available for those criteria since 1 October 2026. Payer platform vendors should prioritise multi-tenant attribution, bulk export performance and audit trails.

Worked example: the compliance clocks for one member

Take a member who moves from an exchange QHP to an MA plan with coverage starting Friday 1 January 2027. The member opts in and names the previous payer on Tuesday 12 January.

A previous payer outside the rule, such as an employer plan, need not respond, but your plan must still ask.

Storage design matters: Provider Access reaches back to 1 January 2016, about 11 years of history by 2027, against 5 for Payer-to-Payer. So do holidays. Monday 18 January 2027 is a federal holiday, and we found no definition of business day in the sections we read, so set one in policy and contracts. If holidays do not count, a request received on Friday 15 January is due on Tuesday 19 January, while a 1-week clock keeps running. Automate both.

India angle: Indian health IT vendors serving US payers

Teams that built FHIR R4 integrations for India's Ayushman Bharat Digital Mission, described in our ABDM HIP integration guide, bring useful skills, but US Core, CARIN and Da Vinci profiles differ, so budget for profile-specific validation. Contracts will shape the delivery model more than code:

• Business associate agreements. Expect a BAA and HIPAA Security Rule controls on every system touching PHI. HHS says HIPAA does not itself bar offshore storage under a BAA but warns that location can raise risk.

• Offshore attestations. One current form, from California Wellcare (December 2025), repeats CMS's definition of offshore, which names India. It asks what PHI is involved, why, and which alternatives were rejected, requires an annual audit with results available to the plan or CMS, and says that plan bars moving or storing data outside the United States. Ask before you price an offshore model.

• Delivery. Build and test with synthetic members, keep production PHI in a US-hosted, BAA-covered tenancy, log any permitted offshore access, and staff US-hours on-call cover.

• India's own law. Section 17(1)(d) of the DPDP Act exempts much of the Act where an India-based party processes data of people outside India under contract with a party outside India, though section 8(1) and the security duty in 8(5) still apply. Have counsel confirm; our DPDP engineering playbook covers the domestic side.

Implementation checklist

• Compliance date confirmed per product line (calendar date, rating period or plan year)

• State extension approved, or exemption requested, before the date, if needed

• All four APIs plus the existing Provider Directory API on FHIR R4.0.1, with public documentation and no login

• US Core 6.1.0, SMART 2.0.0, USCDI v3 and Da Vinci 2.2 adopted, with the reasoning recorded

• Non-drug prior authorisation data flowing into three APIs, with denied requests filtered from Payer-to-Payer

• X12 278 decision documented

• Attribution, opt-out and opt-in live for existing and new members, with plain-language materials

• Bulk Data export load-tested against 2016-onward history; test reports saved

• Usage metrics instrumented for all four APIs

• BAA, offshore attestation and audit evidence filed for every vendor

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. For CMS-0057-F work, we run gap assessments against the rule text and build CRD, DTR and PAS services and data pipelines through our application development services. Talk to us at /contact-us/.

Last updated: 1 November 2026.

References

1. CMS Interoperability and Prior Authorization Final Rule CMS-0057-F fact sheet, 17 January 2024 — CMS

1. Advancing Interoperability and Improving Prior Authorization Processes, 89 FR 8758, 8 February 2024 — Federal Register via govinfo

1. FY 2027 IPPS final rule with adoption of updated health IT standards (CMS-1849-F and CMS-0062-F), 91 FR 49570, 4 August 2026 — Federal Register via govinfo

1. Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity, 91 FR 67916, 28 October 2026 — Federal Register via govinfo

1. 2026 CMS Interoperability Standards and Prior Authorization for Drugs proposed rule fact sheet, 10 April 2026 — CMS

1. HIPAA Transaction Enforcement Discretion FAQs, last modified 21 September 2026 — CMS

1. HIPAA Administrative Simplification FAQs on the enforcement discretion, 13 June 2024 — CMS

1. 2024 CMS Interoperability and Prior Authorization final rule page, last modified 8 October 2026 — CMS

1. Employer Statement of Support for electronic prior authorization — CMS

1. 45 CFR 156.223, prior authorization requirements for QHP issuers — Cornell LII (eCFR)

1. 42 CFR 422.122, MA prior authorization requirements — Cornell LII (eCFR)

1. 42 CFR 431.80, Medicaid prior authorization requirements, extensions and exemptions — Cornell LII (eCFR)

1. 42 CFR 438.242, Medicaid managed care health information systems — Cornell LII (eCFR)

1. 42 CFR 457.732, CHIP prior authorization requirements — Cornell LII (eCFR)

1. 42 CFR 457.1233, CHIP managed care structure and operation standards — Cornell LII (eCFR)

1. Same final rule, PDF with Table H3 at 89 FR 8945 — Federal Register via govinfo

1. 42 CFR 422.119, Patient Access API for MA organisations — Cornell LII (eCFR)

1. 42 CFR 422.121, Provider Access and Payer-to-Payer APIs — Cornell LII (eCFR)

1. APIs and relevant standards and implementation guides, last modified 31 August 2026 — CMS

1. Interoperability Standards and Prior Authorization for Drugs proposed rule (CMS-0062-P), 91 FR 19890, 14 April 2026 — Federal Register via govinfo

1. Statement of Enforcement Discretion, GL-2024-02, 28 February 2024 — CMS National Standards Group

1. Compliance and Enforcement FAQs, last modified 1 September 2026 — CMS

1. Electronic Prior Authorization: industry commitments and finalized and proposed rulemaking, updated September 2026 — CMS

1. Executive Order submissions under review, list dated 1 November 2026 — OIRA, reginfo.gov

1. ONC finalizes the adoption of certain health IT standards in the FY2027 CMS IPPS final rule, updated 4 August 2026 — ONC

1. Improving Prior Authorization Processes FAQs, last modified 14 October 2026 — CMS

1. 45 CFR 170.215, API standards, as amended to 4 August 2026 — Cornell LII (eCFR)

1. Provider Access API FAQs, last modified 10 September 2026 — CMS

1. Da Vinci CRD Test Kit, updated 8 September 2026 — Inferno on HealthIT.gov

1. Da Vinci DTR Test Kit, updated 8 September 2026 — Inferno on HealthIT.gov

1. Da Vinci PAS Test Kit, updated 8 September 2026 — Inferno on HealthIT.gov

1. What is Azure API for FHIR? — Microsoft Learn

1. 42 CFR 422.568, standard timeframes for organization determinations — Cornell LII (eCFR)

1. Payer-to-Payer API FAQs, last modified 30 September 2026 — CMS

1. Federal holidays, 2027 schedule — US Office of Personnel Management

1. Guidance on HIPAA and cloud computing, question 9 — US Department of Health and Human Services

1. Offshore Subcontracting Attestation for Participating Provider, form 25-1301 (12/25) — California Wellcare

1. Digital Personal Data Protection Act, 2023, sections 8 and 17 — MeitY, Government of India