New CMS Prior Authorization Rule: What Changed September 2026

Edward Marx breaks down the CMS prior authorization rule effective September 2026: insurers now have 3 days for urgent decisions and 7 days for others, must give specific reasons for denials, and face up to $250,000 penalties for violations. Starting January 2027, insurers must publicly report denial and appeal-overturn rates.
Chapters
A continuation on our theme, talking with CROs and CFOs, but also even if you're in tech or whatever part of operations, this all matters. And the new CMS rule I want to talk about that payers are already trying to dodge. It's kind of funny. I mean, it's only been out like a month now. So there's a new federal rule that started this month that changes how insurance companies have to handle prior auth, right? Faster decisions, real reasons for denials. Public reporting is going to start in January. So that's going to be a game changer, I think. And insurers already try to figure out how to comply on paper without actually changing anything real. So here's what we all should be watching. So this new federal rule started September 1st, so just a couple weeks ago. Insurance companies now have to make prior authorization decisions faster— 3 days for urgent, 7 days for everything else, down from 14. So that means cutting it in half. And when they deny something, they have to give a specific reason. And then beginning on January 1st, 2027, insurers have to publicly report their denial rates, like I said. And their appeal over Taran rates. I think people are going to look at that. I think plan operators definitely got to look at that. Humana rolled out the new PA portal prior to the portal in August. Cigna and UnitedHealthcare are restructuring their AI decision engines. Interesting. But the American Hospital Association is already saying insurers are still writing boilerplate denial reasons that don't actually explain anything, which was the whole point of the rule. Who gets hurt in the end, right? So non-compliance penalties will go up to $250,000 per violation. For repeated issues. So a little bit more teeth this time. So this is a real workflow change for both sides, right? Both payers and providers. And a public reporting piece starting in January is going to reshape a lot of the payer-provider conversations. So we'll be watching and see how the payers comply. I think it's going to be a big deal.
More from Edward

EdTalks | Episode 184 | What If Being a Misfit Is Your Superpower? | Kevin Johnson









