Drug prior authorization is the gap in the federal rule

Drug prior authorization is the gap in the federal rule. When CMS finalized its interoperability and prior authorization rule in January 2024, it left drugs out of nearly every provision that mattered. The new decision timeframes and the requirement to give a specific reason for each denial apply to medical items and services. So do the public metrics and the Prior Authorization API. Drugs were left to older rules, written separately for each program and each benefit.

The result is a system in which the same drug can face different clocks depending on how it is billed. An infused biologic covered under a Medicare Advantage plan’s medical benefit follows the rules for organization determinations. A self-injected drug for the same patient under Part D follows the rules for coverage determinations. CMS proposed in April 2026 to bring drugs into its framework from October 2027. The proposal keeps the split between medical and pharmacy benefits.

The argument made here is that the clock and the record for a drug should follow the patient, not the benefit that happens to pay for it.

Key takeaways

• The 2024 rule excluded drugs. Its decision clocks and denial reason requirements cover medical items and services only. So do its public metrics and its API.
• Drugs already have clocks, but they differ. Part D coverage decisions are due within 72 hours, or 24 hours when expedited. Medicare Advantage plans follow the same limits for Part B drugs. Medicaid must answer outpatient drug requests within 24 hours.
• The clocks start and end differently. A Part D exceptions request starts its clock when the prescriber’s supporting statement arrives. A missed deadline means something different in each program.
• CMS proposed to close part of the gap. Its April 2026 proposal would bring medical-benefit drugs into electronic prior authorization from October 2027. State programs and exchange plans would also adopt the pharmacy standards Part D already uses.
• States have filled in with step therapy laws. Step therapy reform laws are on the books in 40 states, but they do not reach self-funded employer plans.
• The clock should follow the patient. A drug’s prior authorization should carry the same timeframe and the same record whichever benefit pays for it.

What the 2024 rule left out

According to CMS’s fact sheet on CMS-0057-F, the rule’s prior authorization provisions do not apply to drugs. That leaves drug decisions outside each of the rule’s main levers.

From the CMS fact sheet on CMS-0057-F (January 2024).

The split has practical roots. Drugs already had their own rules in Part D and in Medicaid. Pharmacy transactions also run on their own family of standards from NCPDP, the standards body for pharmacy claims. Folding drugs into a FHIR framework built for medical services would have meant reconciling 2 sets of standards at once. The 2024 rule finished the medical side first, and the April 2026 proposal returns to drugs.

The cost of that sequence falls on the public view of prior authorization. When payers posted their first prior authorization metrics in March 2026, as our review of the first metrics described, the numbers left drugs out. Approval rates and decision times for drugs remain invisible in the only public reporting CMS requires.

How drug prior authorization works today

Each federal program built its own rules for drugs, and those rules have grown apart over time. The differences show up in the length of each clock and in the electronic path a request can take.

Part D

Part D has the most developed rules. A standard coverage determination is due within 72 hours, and an expedited one within 24 hours. Part D also moved to electronic prior authorization early. A final rule published in December 2020 let Part D sponsors use the NCPDP SCRIPT standard for electronic prior authorization from January 2021. The same rule required it from January 2022, according to CMS.

The program has kept moving. Part D plans have had to offer prescribers a real-time benefit tool since 2021, showing coverage and cost at the moment of prescribing. A rule published in June 2024 requires an updated version of the SCRIPT standard from January 2028. It also names a specific standard for prescriber real-time benefit tools from January 2027. HTI-4 brought the same e-prescribing standards into health IT certification, as our review of HTI-4 described.

Drugs under the medical benefit

Drugs given in a clinic or an infusion center are usually covered under the medical benefit, which is Part B in traditional Medicare. Medicare Advantage plans decide requests for these drugs under the rules for organization determinations. A standard decision is due “no later than 72 hours after receipt of the request” under 42 CFR § 422.568. An expedited decision is due within 24 hours. Neither limit can be extended.

What these drugs lack is the electronic plumbing. Under the 2024 rule, they sit outside the Prior Authorization API that payers must run by January 2027. They also sit outside the Part D standard, because Part D covers a different benefit. Requests for these drugs often move through payer portals or by fax.

Medicaid and commercial coverage

Medicaid has the tightest clock. Federal law lets states require prior authorization for covered outpatient drugs only if they answer each request within 24 hours. In an emergency, the state must also allow at least a 72-hour supply of the drug, under section 1927(d)(5) of the Social Security Act.

Commercial plans follow state law, and states have been active. Step therapy reform laws are on the books in 40 states, according to the Alliance for Patient Access. Those laws set rules for when a patient can skip a drug the plan prefers.

Those state laws stop at self-funded employer plans, which ERISA governs. The Safe Step Act, introduced as H.R. 5509 and S. 2903, would create a step therapy exceptions process for employer plans. It would require plans to grant exceptions in defined cases, such as when a patient is already stable on a medication.

Who makes the decision

The 2 benefits are often run by different organizations. A pharmacy benefit manager often processes requests under the pharmacy benefit. The health plan or a vendor working for it usually handles requests under the medical benefit. Each runs its own intake and its own reviewers.

Federal rules hold the plan responsible either way. A Part D sponsor that delegates work to a pharmacy benefit manager keeps “ultimate responsibility” for its contract with CMS, under 42 CFR § 423.505(i). The division of labor between companies is a business arrangement. Responsibility for the decision stays with the plan.

What the April proposal would do

CMS released its proposal, CMS-0062-P, on April 10, 2026. Its drug provisions split the work by benefit. Drugs under a medical benefit would join the electronic prior authorization framework built for medical services. Drugs under a pharmacy benefit would use the NCPDP standards that Part D plans already support.

State programs means Medicaid and CHIP, including their managed care plans. Exchange plans means issuers on the federal exchanges. From the CMS fact sheet on CMS-0062-P (April 2026).

The pharmacy standards are the ones Part D plans already use.

• SCRIPT carries prescriptions and electronic prior authorization transactions.
• Formulary and Benefit tells a prescriber’s system what a plan covers and which restrictions apply.
• Real-Time Prescription Benefit returns a patient’s coverage and cost when a drug is prescribed.

The proposal does not name Medicare Advantage in its drug timeframe and denial reason provisions. Medicare Advantage plans already follow the Part B drug limits in their own regulations.

CMS has also moved on the provider side. Its July 2026 proposal for the physician fee schedule includes a new measure on electronic prior authorization for drugs, for clinicians in the Merit-based Incentive Payment System. The measure would start in 2028, according to CMS’s summary of its electronic prior authorization rulemaking.

The proposal is a real step. It would bring drug decisions into public metrics for the first time and give medical-benefit drugs an electronic path. It would also keep a separate system for each benefit. The 2 systems would use different standards, and in some programs different clocks.

Where the split hurts

The line between medical and pharmacy benefits is an artifact of billing, not of medicine. Many specialty drugs can be covered under either benefit, depending on the site of care and the form of the drug. Cancer treatment often pairs infused drugs under the medical benefit with oral drugs under the pharmacy benefit. Some biologics for inflammatory bowel disease begin with infusions in a clinic and continue as injections at home. The diagnosis and the goal of treatment stay the same while the benefit changes.

Compiled from federal regulations and CMS guidance.

On paper, drugs often move faster than medical services. The problem is less the length of the clock than its fragmentation. A clinician’s office handles each benefit through a different channel. Each channel has its own forms and its own rules for what makes a request complete. An approval under 1 benefit does not carry over when treatment moves to the other.

A drug does not change when the benefit that pays for it does. The prior authorization should not change either.

The split also repeats work. A plan may approve a biologic under the medical benefit and then require a new prior authorization when the patient moves to a self-injected form under the pharmacy benefit. Our piece on approvals that last the course of treatment argued that an approval should match the shape of the care. For drugs, the shape of the care crosses benefit lines often.

When the clock starts

The table compares the length of each clock. The moment a clock starts matters as much. In Medicare Advantage, the clock for a Part B drug starts when the plan receives the request. In Part D, the clock for an exceptions request starts when the plan receives the prescriber’s supporting statement, under 42 CFR § 423.568. If no statement arrives within 14 calendar days, the plan has 72 hours from the end of that period.

An exceptions request asks a Part D plan to cover a drug that is off its formulary or to waive a restriction such as step therapy. The rule makes sense on its own terms, because a plan cannot judge an exception without the prescriber’s reasons. It also means that 2 requests filed on the same day can have deadlines days apart. A clock that starts at different moments cannot be compared across programs, even when the hours match.

What happens when the clock runs out

The programs also differ on what a missed deadline means. In Part D, a plan that misses the deadline must treat the miss as an adverse decision. It must then send the case to the independent review entity within 24 hours, under the same regulation. In Medicare Advantage, a missed deadline is itself an adverse decision that the enrollee may appeal, under the organization determination rules.

Medicaid takes a different approach. Its emergency supply rule protects the patient while a decision is pending, rather than setting a consequence for the plan. Commercial plans follow whatever their state requires. Each approach protects patients in a different way, and none of them applies across every program.

A single clock for a drug

The fix is not to force every drug into a single electronic standard. NCPDP’s pharmacy standards work, and the Da Vinci guides work for medical services. The fix is to make the rules for a drug follow the patient across both.

1. The same clock for the same drug. Every program would decide standard drug requests within 72 hours and expedited ones within 24 hours, whichever benefit pays. Programs with shorter clocks, such as Medicaid, would keep them.
2. A clock that starts the same way. The clock would start when the plan receives a request with the information its published rules require. A plan that needs more would have to ask for it within the same window.
3. Approvals that carry across benefits. When treatment with an approved drug moves from the medical benefit to the pharmacy benefit, the approval travels with it for the rest of the course of treatment.
4. Metrics now, not in 2028. Plans could publish drug prior authorization metrics in the same format as their medical metrics before any requirement takes effect. The data already sits in their systems.
5. Requirements at the moment of prescribing. Real-time benefit tools already show coverage and cost in Part D. Every plan could show the prior authorization requirements for a drug when it is prescribed, under either benefit.
6. Step therapy exceptions with a clock. An exception request is a prior authorization in all but name. It should follow the same timeframe and the same rules for stating reasons.

What the record should carry

An approval can travel only if both sides can read it. That is harder than it sounds, because the same drug carries different codes under each benefit. Pharmacy claims identify a drug by its National Drug Code. Medical claims usually identify it by a HCPCS billing code, which can cover several products. A record that follows the drug needs a small set of facts kept in the same form under both benefits.

• The drug under both codes. The record carries the National Drug Code alongside the billing code, so either benefit can match the approval.
• The clinical facts that met the criteria. These include the diagnosis and the history of treatments already tried.
• The decision and its reasons. A denial names the criteria that were not met and the specialty of the reviewer.
• The scope of the approval. The record states the approved dose range and how long the approval lasts, so a change of benefit does not reset it.

Neither standard needs to change for this. NCPDP’s electronic prior authorization transactions and the Da Vinci guides both return an identifier for each decision. A plan that links those identifiers in its own systems can honor an approval issued under the other benefit. The harder work is organizational, because the 2 benefits are often run by different companies.

A supply while the decision is pending

Federal rules already accept that a patient should not go without a drug while paperwork catches up. Part D plans must ensure access to a temporary supply of drugs within the first 90 days of coverage under a new plan, under 42 CFR § 423.120. The same rule protects current enrollees when a plan changes its formulary. Medicaid’s emergency supply rule does the same work over a shorter period.

The same idea could extend to any patient already stable on a drug whose coverage moves from 1 benefit to the other. A bridge supply while the new prior authorization is pending would keep treatment going. It would also take the urgency out of the request, which gives the reviewer time to read the record.

There are fair objections. Pharmacy and medical benefits are often run by different companies, and sharing approvals across them requires data exchange that does not exist everywhere. Drug pricing and rebates also shape formulary choices in ways that medical policies do not. Those are reasons the change takes work. They are not reasons a patient should start over when the route of a drug changes.

Where Redlake stands

Redlake builds tools that health plans use in utilization review. Our first rule is that a machine can say yes, but only a person can say no. That rule fits drugs as well as services. A request that meets published criteria for a drug can be approved quickly. A denial goes to a clinician with the right expertise, usually a pharmacist or a physician.

Our second rule is that every recommendation shows its reasons. The reasons for a drug decision often involve step therapy and prior treatment history. Those facts should travel with the patient across benefits. Our third rule is that every decision can be reconstructed. A record that follows a drug across benefits is what makes that possible when treatment moves between settings.

We think plans should treat a drug’s prior authorization as a single decision with a single record, even when 2 systems carry it. Plans can start by publishing their drug metrics, and by honoring approvals when a drug moves between benefits. The April proposal is a good start, and plans do not need to wait for it to finish the job.

What to watch in the rest of 2026

• The CMS-0062-P final rule. Watch whether CMS finalizes the drug provisions for October 2027, and whether it aligns timeframes across benefits.
• The physician fee schedule final rule. Watch whether the proposed drug measure for clinicians survives.
• The Safe Step Act. Watch for committee action on step therapy exceptions for employer plans.
• State bills for 2027. Watch for states that apply their prior authorization timeframes to drugs under both benefits.
• Plan announcements. Watch whether plans begin publishing drug prior authorization data before any rule requires it.

About this analysis

Method. The drug provisions of CMS’s 2024 rule and its April 2026 proposal are compared with the rules that already govern drugs in each program, using CMS documents and federal regulations.

Data notes. The count of states with step therapy laws comes from an advocacy organization’s letter to Congress. CMS-0062-P and the drug measure are proposals, and their provisions may change. The comparison tables describe requirements as written, not how plans perform against them. The single-clock proposal is this analysis’s suggestion.

Sources. CMS fact sheet on CMS-0057-F (January 2024). CMS fact sheet on CMS-0062-P (April 2026). CMS guidance on e-prescribing standards. CMS summary of electronic prior authorization rulemaking (2026). Medicare Advantage regulations at 42 CFR § 422.568. Part D regulations at 42 CFR part 423. Social Security Act § 1927(d)(5). Alliance for Patient Access letter to congressional leaders (2026).

Frequently asked questions

Does CMS’s 2024 prior authorization rule apply to drugs?

No. CMS-0057-F excluded drugs from its decision timeframes and its denial reason requirements. Drugs are also outside its public metrics and its Prior Authorization API. They remain under older rules that differ by program and by benefit.

How fast must drug plans in Medicare decide requests?

A Part D plan must decide a standard request within 72 hours and an expedited one within 24 hours. Medicare Advantage plans follow the same limits for Part B drugs. For a Part D exceptions request, the clock starts when the prescriber’s supporting statement arrives.

What did CMS propose for drug prior authorization in 2026?

CMS proposed in April 2026 to bring drugs under a medical benefit into electronic prior authorization from October 2027. State programs and exchange plans would support NCPDP standards for pharmacy-benefit drugs. Payers would also publish drug prior authorization metrics starting in 2028.

What is the difference between the medical and pharmacy benefits?

The medical benefit usually covers drugs given by a clinician, such as infusions in a clinic. The pharmacy benefit covers drugs dispensed by a pharmacy, including many that patients take or inject at home. Many specialty drugs can fall under either one.

Do state step therapy laws apply to employer plans?

They apply to fully insured plans that the state regulates. They do not apply to self-funded employer plans, which ERISA governs. The Safe Step Act would create a federal exceptions process for those plans.