Do the New CMS Rules on Prior Authorization Go Far Enough?

The new CMS regulations on prior authorization have been heralded as a big step forward in reducing administrative burdens on physicians, but some people think it doesn’t go far enough.

The CMS regulations, which were issued last January, require federally regulated health plans to “improve the electronic exchange of health information and prior authorization processes for medical items and services,” according to a CMS press release. For example, starting next year, affected plans must send prior authorization decisions within 72 hours for urgent requests and 7 calendar days for non-urgent requests. The rule also requires all impacted payers to include a specific reason for denying a prior authorization request, and payers must publicly report prior authorization metrics.

But Alex Shteynshlyuger, MD, a New York City urologist, noted in a phone interview that the regulation is limited to Medicare Advantage (MA) plans, Medicaid HMOs, and some plans on the Affordable Care Act’s insurance exchanges, though it also includes plans in the Children’s Health Insurance Program. In addition, the prior authorization requirements only apply to requests from physicians who are in the MA plan’s network, he said.

That excludes providers like him, who aren’t in an MA plan but do accept traditional Medicare and also provide care to MA enrollees who have out-of-network benefits. “They are receiving claims from me; they’re receiving medical records from me. I’ve already been verified by Medicare, right?” said Shteynshlyuger, who brought up some of his concerns at the interim meeting of the American Medical Association (AMA) last November. “[But] CMS comes in and says, ‘These providers are not vetted enough,’ even though we are sending claims to [Medicare] for the same patients and receiving payments from them … This is irrational logic by CMS to try to create impediments for physicians who do not want to sign unfair contracts from insurance companies.”

Shteynshlyuger also is unhappy that CMS is instituting “enforcement discretion” — meaning that the agency generally won’t be enforcing the rule — for a provision of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), known as X12, that requires health plans to implement electronic transactions for prior authorization. “The enforcement discretion as issued is overly broad, lacks any rational basis, and lacks reasonable justification,” he wrote in a December 29 letter to the agency. “The decision to issue a broad discretion is arbitrary and capricious. CMS lacks legal authority to issue such regulatory guidance and lacks authority to suspend enforcement without going through the [Administrative Procedures Act] required notice and comment period.” Shteynshlyuger said he has not yet heard back from CMS about his letter.

Asked about some of Shteynshlyuger’s concerns, a CMS spokesperson said in an email that it is not enforcing the HIPAA rule as long as the affected plans instead use a standard programming interface that allows for electronic prior authorizations. “Covered entities may separately continue to make an X12 prior authorization process available to providers,” the spokesperson said, adding that “HHS will continue to evaluate the HIPAA prior authorization transaction standards for future rulemaking.”

In addition, the spokesperson said, “To encourage providers to adopt electronic prior authorization processes, this final rule also adds a new measure for Merit-based Incentive Payment System (MIPS)-eligible clinicians,” as well as hospitals, related to using electronic prior authorizations.

The AMA agrees that prior authorization is still a big problem, AMA President Bruce Scott, MD, said in a phone interview that was conducted with a press person present. “I think there’s a growing awareness across health systems that [prior authorization] is overused, unjustified, and needs to be right-sized,” he said. “Patients are becoming increasingly aware of this overused blunt cost-control process by insurance companies. As a result, there is anger that’s building and frustration among physicians that has grown as well.”

The “partial fix” that CMS issued last January “didn’t go far enough,” Scott said. And he is concerned that even the CMS regulations will have limited effectiveness because of the Supreme Court’s Chevron decision, issued last July, which overturned a 1984 ruling saying that whenever a dispute emerges over regulating an ambiguous law, judges should defer to the interpretation of federal agencies, assuming those interpretations are reasonable.

In the wake of the Chevron ruling, the AMA is anxious to see the prior authorization regulations be codified by Congress so they aren’t in danger of being challenged. The association therefore is supporting the Improving Seniors’ Timely Access to Care Act, which would cement the CMS regulations into law. That bill, which had bipartisan support in the House and Senate, appeared to be on the brink of passage, but was ultimately left out of the budget deal that Congress passed at the end of last year.

“The frustration was that this was a bipartisan, bicameral bill that was in the [budget deal] that would have fixed [prior authorization] in many ways, and instead, it gets cut,” Scott said. “We’re not pushing for something radical here. We’re saying we need to right-size this. We’re pushing for transparency, we’re pushing for efficiency and for communications that are electronically linked so we don’t have to use fax machines.”

Shteynshlyuger, who is an AMA member, said he is not a fan of the bill because it lacks an enforcement mechanism. “The original bill had enforcement requirements,” but those were removed in order to bring the cost of the bill down and thus increase its chances of passage, he said. “Unfortunately, organized medicine has been either misled as to what the bill says, or is complicit. I requested that the AMA withdraw their support for this bill in Congress.”

Instead, the House and Senate “should issue comprehensive rules or prior authorizations that apply to every health plan,” including employer-sponsored plans, he said. “We cannot live another day under the disastrous systems we have today.” Currently, the Labor Department is looking at whether to regulate prior authorization in employer-sponsored health insurance plans; the AMA testified about the issue at a September 2024 meeting of the department’s Employee Retirement Income Security Act Advisory Council.

Another complaint about the CMS rules is that they don’t apply to pharmacy services, or to prior authorization for drugs administered inside physician offices. CMS said it is developing a proposed rule to streamline prior authorization for drugs covered under federally regulated plans, and that it plans to issue the proposed rule in March.

Please enable JavaScript to view the comments powered by Disqus.