Prior Authorization in the Age of the Algorithm: Reform, Resistance, and the Risk Nobody Is Talking About

CMS is finally forcing prior authorization into the modern era. Payers are automating compliance. And buried in that automation is a contradiction that could make everything worse.

Prior authorization has long been the bureaucratic scar tissue of American healthcare — the administrative layer that sits between a physician’s clinical judgment and a patient receiving care. A doctor orders an MRI. A fax goes out. Someone at an insurance company reviews it, or doesn’t, or routes it to a queue, or loses it. Days pass. The patient waits. The physician’s staff calls again.

For decades, this system operated essentially unchanged. Then, in the span of eighteen months, the political environment shifted dramatically. CMS published a landmark final rule. HHS Secretary Robert Kennedy Jr. and CMS Administrator Dr. Mehmet Oz convened a public pledge with major insurers. Congress stirred. UnitedHealthcare announced reductions to its prior authorization requirements. The fax machine, it seemed, had finally run out of political cover.

But the story beneath the headlines is more complicated — and more consequential for providers, health IT teams, and anyone who thinks carefully about what “reform” actually means when the industry doing the reforming is deploying AI at scale to manage its costs.

The Regulatory Architecture: What Actually Changed

The foundation of the current reform effort is the 2024 CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), which took effect April 8, 2024, with key provisions phased in through 2026 and beyond.

The rule’s most immediate operational requirement: as of January 1, 2026, impacted payers across Medicare Advantage, Medicaid and CHIP, and Marketplace plans are required to send prior authorization decisions for medical items and services within 72 hours for expedited (urgent) requests and 7 calendar days for standard requests.

These are not aspirational guidelines. They are enforceable deadlines. For the first time, “we’ll get back to you” is no longer a legally acceptable answer.

The 2024 rule also required these payers to implement a suite of FHIR-based interoperability APIs: Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization interfaces. Electronic prior authorization interfaces from these payers are required to go live on January 1, 2027, and their use will eventually be incorporated into the Medicare Promoting Interoperability Program for hospitals and MIPS for clinicians. CMS estimates this transformation will save approximately $15 billion over ten years — though that figure encompasses administrative savings across the entire healthcare ecosystem, not just physicians.

The April 2026 proposed rule (CMS-0062-P) extends the logic further. While the 2024 final rule focused on non-drug items and services, the 2026 proposed rule extends prior authorization requirements to drugs, mandating that affected payers support digital prior authorization for pharmaceutical coverage requests, with specific shorter turnaround times and new transparency requirements for denials and appeals outcomes. For drug prior authorizations, the proposed deadlines are 24 hours for urgent requests and 72 hours for standard requests.

The comment period closes June 15, 2026. Most changes, if finalized, would take effect October 1, 2027.

The Political Signal: Oz, Kennedy, and the Pledge

What makes the current reform push unusual is not just its regulatory ambition but its political temperature. Dr. Mehmet Oz, the CMS Administrator, has been unusually direct in his public framing.

In his May 2026 CMS blog post, Oz wrote that completing prior authorizations costs healthcare providers $20–50 per hour and an average of 13 hours per week — roughly $34,000 and 700 hours per year per provider that “could otherwise be spent caring for patients.” His call to action: “axe the fax, kill the clipboard, and put patients over paperwork.”

This is not the language of regulatory compliance. It is the language of a political campaign. And it has had measurable industry effects.

HHS Secretary Kennedy and CMS Administrator Oz secured a public industry pledge from major insurers to fix the prior authorization system. In April 2026, leading health plans announced they had collectively eliminated 11% of prior authorizations across a range of medical services, representing 6.5 million fewer authorizations. One large national plan committed to eliminating authorization requirements for 30% of healthcare services, with a further 30% reduction of remaining requirements targeted by end of 2026.

CMS has also convened working groups — including health systems, hospitals, physician practices, EHR vendors, and payers — to align on implementation deadlines and address workflow gaps and technical handoffs “that no single sector can fix alone.”

The scale of coordination is unprecedented. The question is whether coordination on modernization addresses the deeper structural problem — or simply upgrades the infrastructure through which that problem operates.

The Contradiction at the Center

Here is the tension that does not appear in press releases: the same payers who are pledging to reduce prior authorization are deploying AI systems to automate the prior authorization decisions that remain. And those AI systems have a documented record of producing erroneous denials at scale.

According to a Senate Permanent Subcommittee on Investigations report, UnitedHealthcare’s denial rate for post-hospital care more than doubled between 2020 and 2022 after it implemented algorithms to automate its review process.

A federal class action lawsuit filed in 2023 against UnitedHealthcare Group alleges a 90% error rate in the AI program used for prior authorizations, while noting that only 0.2% of affected policyholders were likely to appeal the denials, because many considered it a hassle and a fruitless effort.

A research paper published in NPJ Digital Medicine noted that UnitedHealthcare’s MA denial rates were reportedly 10 times higher than those of other insurers, prompting Minnesota healthcare organization HealthPartners to announce it would no longer accept UnitedHealthcare’s Medicare Advantage plans starting in 2025 — though the parties ultimately negotiated a resolution.

Surveyed physicians reported that AI-driven denials led to poor clinical outcomes (94%), delayed care (93%), and increased administrative burden — the precise problems prior authorization reform is supposed to solve.

This is the underlying paradox: electronic prior authorization speeds the process, but it also enables automation at a scale that was previously impossible. A human reviewer who processes 50 prior auth requests per day has a natural throughput limit. An algorithm has none. It can deny 50,000 claims per hour, generating appeal volumes that no physician office can absorb.

The reform debate has focused almost entirely on speed and format — getting responses in 72 hours instead of two weeks, replacing fax with FHIR. What it has not adequately addressed is the quality and explainability of the decisions made through these automated systems.

What Providers Actually Face in 2026

For a physician practice or health system, the operational reality of prior authorization reform in 2026 looks like this:

The deadlines are real, but enforcement is untested. The January 1, 2026 response-time requirements exist on paper. Whether payers will consistently meet them — and whether CMS will audit and penalize non-compliance — remains to be seen. The prior authorization space has a long history of regulations that were technically in force but operationally ignored.

EHR workflows are being rebuilt. CMS is actively collaborating with EHR vendors to embed electronic prior authorization tools natively into their platforms, so providers do not need to leave their EHR to submit requests — making the process faster and less error-prone. Epic, Oracle Health, and other major vendors are in various stages of implementing FHIR-based PA APIs. The implementation quality varies considerably, and smaller practices running legacy systems may find themselves at a structural disadvantage.

AI-driven approvals are replacing human review — with mixed results. UnitedHealthcare has publicly stated it is using AI to help reduce prior authorization requirements. UnitedHealth Group’s Optum Real system, tested at Allina Health in Minneapolis, reportedly reduced denials meaningfully by flagging claims that needed more documentation before submission — speeding prior authorization requests and reducing paperwork. This is the optimistic scenario: AI as a pre-submission assistant that helps providers get it right the first time. But the same technology that reduces denials preventively can also generate them systematically when configured to optimize for cost containment rather than care access.

Drug PA reform is still prospective. The April 2026 proposed rule on drug prior authorizations is just that — proposed. With a comment period running through June 2026 and a projected effective date of October 2027, the pharmacy channel will remain largely unreformed for another 18 months at minimum.

The Algorithmic Approval Problem

There is a dynamic in the current reform push that deserves more direct scrutiny: the assumption that automating prior authorization approvals is inherently better than the status quo.

When a human reviewer approves a prior auth request, that approval reflects some degree of clinical interpretation. It can be wrong, and often is, but it is in principle a judgment. When an algorithm approves a request, it is pattern-matching against training data and optimization criteria set by whoever built and configured the model. Those criteria are not publicly disclosed. The logic is proprietary.

During the 2025 legislative session, four states passed bills to prohibit payers from using AI to deny medical necessity or prior authorization determinations, reflecting growing legislative concern that algorithmic systems are replacing human clinical judgment in coverage decisions. KLRD

This state-level pushback points to a gap in the federal reform framework. CMS has mandated electronic prior authorization and faster turnaround. It has not mandated explainability, algorithmic audit rights, or clinical validity testing for the AI systems making the underlying determinations. A payer can meet the 72-hour deadline through an algorithm that denies at rates 16 times higher than traditional human review — and be technically compliant with the new rules.

The interoperability layer that CMS is building is the plumbing. What flows through that plumbing is still governed by payer discretion.

The WISeR Model: CMS’s Own AI Experiment

CMS is not simply criticizing payer use of AI in prior authorization. It is also deploying AI in prior authorization itself.

The WISeR (Wasteful and Inappropriate Service Reduction) Model uses AI and machine learning, combined with clinician review, to ensure select items and services furnished under Original Medicare align with coverage criteria — incorporating electronic prior authorization as a component.

This is a meaningful distinction from pure payer-side automation: WISeR couples algorithmic flagging with human clinical review. The model is explicit that AI alone does not make coverage decisions. Whether this architecture becomes the standard for responsible AI use in prior authorization — rather than the exception — will define much of the next decade of revenue cycle politics.

What Still Needs to Happen

The current reform push is the most serious federal effort in prior authorization in decades. It is also incomplete in ways that matter practically.

Interoperability standards are necessary but not sufficient. FHIR APIs and faster response times address the administrative friction in the prior authorization process. They do not address the criteria by which authorization decisions are made. A denial that arrives in 72 hours via a digital interface instead of in two weeks via fax is still a denial. The format has changed; the economics have not.

Transparency requirements need teeth. The 2026 proposed rule requires payers to publicly post prior authorization metrics for drugs. This is a start. But metrics on approval and denial rates are only useful if they can be interrogated. Payers should be required to disclose the clinical logic underlying algorithmic denials — not just the outcome.

The physician gold card concept needs federal standardization. Several states have enacted laws exempting high-performing physicians from routine prior authorization requirements for certain services. UnitedHealthcare’s Gold Card Program reduces administrative burdens for high-performing providers, streamlining the authorization process. Federal codification of this approach — applied consistently across payers — would meaningfully reduce the burden on the most clinically trustworthy providers.

Enforcement architecture must exist. The single most important question about the new response-time mandates is: what happens when payers miss them? CMS has not yet demonstrated a robust enforcement mechanism. Without one, the deadlines are aspirational rather than operational.

The Larger Stakes

Prior authorization reform is not primarily a technology problem. It is a power-distribution problem. The prior authorization system exists, at its core, because payers discovered that the friction of administrative review reduces utilization — and reduced utilization reduces costs. Whether that friction is generated by a slow fax machine or a fast algorithm is operationally different but functionally similar.

The current reform coalition — CMS, Kennedy, Oz, EHR vendors, health systems, physician groups — is united around the proposition that the friction is too high and the process too antiquated. That coalition is correct. But the coalition includes the payers whose financial interests the friction serves. The pledge signed by major insurers is real, and the 6.5 million eliminated prior authorizations represent genuine relief. The question is what replaces them — and whether the AI systems now being deployed to automate prior authorization decisions are accountable to patients and providers in any meaningful way, or whether they are simply a more efficient version of the same incentive structure.

Dr. Oz framed the vision this way: “When data flows seamlessly — between a provider’s EHR, the payer’s electronic prior authorization interfaces, and a patient’s health record — the entire system becomes more responsive, more accountable, and more focused on what matters most.”

Seamless data flow is a necessary condition for a better system. It is not a sufficient one. Accountability requires not just speed and interoperability, but transparency, explainability, and a clear answer to the question that providers are asking every day: who is responsible when the algorithm gets it wrong?

Sources