CMS Prior Authorization Transparency Is Live. Here's How Specialty Clinics Should Use the New Data
As of March 31, 2026, the first annual public prior authorization reports required by CMS were due. The new data does not give specialty clinics a clean league table of "good payers" and "bad payers." It is not specialty-specific. It is not centralized. And it does not cover every kind of authorization friction a clinic feels every day.
What it does give you is the first standardized public signal about how covered payers handle prior authorization at scale: how often requests are approved or denied, how often approvals happen only after appeal, and how long decisions take. Used carefully, that is enough to improve staffing, submission workflows, and payer-specific escalation.
If you run a specialty clinic, the right question is not "Which payer has the worst number?" The right question is: What does this new public data tell us about where our own workflow is underperforming, where a payer is structurally harder to deal with, and where we need tighter follow-through after denial?
What CMS actually changed
Under CMS-0057-F, Medicare Advantage organizations, state Medicaid and CHIP programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges must publicly post annual prior authorization metrics from the previous calendar year.
Those reports include aggregated metrics such as:
approval and denial rates for standard prior authorization requests
approval and denial rates for expedited requests
approvals after appeal
approvals after an extension of the review period
average and median time to decision
The first public reports, covering calendar year 2025, were due March 31, 2026. Two caveats matter immediately.
First, the reports are not centralized. CMS provides a template and guidance, but providers still have to find the reports on payer websites.
Second, the reporting level varies by program. Some reports are published at the Medicare Advantage contract level, some at the plan or state level, and some at the issuer level. That means these numbers are useful as payer signals, but not as perfect apples-to-apples benchmarks across every market.
What early public reporting already shows
Even with those limitations, the first wave of public reports already shows meaningful spread. Kaiser Permanente Northern California reported 2025 standard prior authorization denial rates of 10.53% and 11.33% across two Medicare Advantage contracts. Aetna Better Health of Michigan reported a 22.13% denial rate for standard prior authorization requests in its 2025 Medicaid managed care report. UnitedHealthcare of Mississippi reported a 3.69% denial rate for standard prior authorization requests in its 2025 public prior authorization summary.
That does not mean a specialty clinic should expect the same denial rate across TMS, infusion, DME, or any other specific service category. These are aggregate reports, and they are not all the same line of business. But they do prove the core point: public reporting is already surfacing real plan-level variation.
That variation is enough to change how an operations team should prioritize its work.
One important limitation: this is mainly a medical-benefit benchmark
CMS's public reporting rule requires payers to report metrics for medical items and services, excluding drugs.
That makes the new data more directly useful for clinics whose authorization work is concentrated in medical-benefit services: TMS, interventional psychiatry workflows, infusions, procedures, imaging, DME, and buy-and-bill therapies.
For clinics whose biggest friction is pharmacy-benefit prior authorization, the public reports are still useful as a directional payer signal. But they are not a clean benchmark for retail pharmacy GLP-1 authorization performance, PBM edits, or formulary step-therapy denials.
That distinction matters. A specialty clinic can make a bad decision if it treats these public numbers as a full picture of every authorization workflow it runs.
Why this matters more for specialty clinics
A generalist primary care group can absorb some payer variation because prior authorization risk is spread across a broader service mix. Specialty clinics usually cannot.
At a TMS clinic, a small set of recurring services drives a large share of authorized revenue. At an interventional psychiatry clinic, a handful of payer policies can determine whether the schedule runs cleanly or gets buried in peer-to-peer follow-up. At a multi-state specialty telehealth operation, the same payer name can behave differently across products and markets.
That concentration changes the economics of prior authorization operations. A payer with a materially higher denial rate or slower turnaround time may not just create more work. It may justify a different submission checklist, a different staffing model, and a different follow-up cadence.
Public reporting will not tell you how a payer handles your exact CPT code. But it can tell you where to look first.
Four things to do now
1. Benchmark your top payers against the public data
Pull your highest-volume payers and compare your own first-pass outcomes against what those payers published. Do this carefully. Compare the public report to the matching line of business whenever possible, and treat the public figure as a directional benchmark, not a perfect specialty-specific target.
If your internal denial rate is far worse than the payer's published aggregate, that often points to one of three issues:
your submission package is incomplete for that payer
requests are being routed through the wrong workflow or benefit path
denials are being counted internally in a way that masks avoidable front-end defects
If your internal rate is close to the public aggregate, the payer may simply be structurally harder than others and deserve a different operating playbook.
2. Separate payer difficulty from submission quality
The biggest value of the new reports is diagnostic.
Without an external benchmark, every denial problem looks like a team problem. With public metrics, you can start separating:
payers that are difficult for everyone
payers where your clinic is underperforming its benchmark
payers where your clinic is doing fine and should avoid over-engineering the workflow
That distinction matters for specialty clinics because the fix is different in each case. A hard payer may require better expectations, tighter escalation, and more disciplined follow-up. A workflow problem usually requires better intake, stronger documentation, or cleaner routing before submission.
3. Use turnaround data to set operational SLAs
The reports also give you a baseline for decision timing.
Starting January 1, 2026, CMS requires impacted payers other than QHP issuers on the FFEs to send prior authorization decisions within 72 hours for urgent requests and 7 calendar days for standard requests.
Operationally, this means a specialty clinic should stop treating every pending authorization the same. A payer with consistently short average decision times can support a lighter-touch follow-up cadence. A payer with slower or more variable timing may need earlier status checks, earlier patient communication, and more disciplined escalation.
The point is not to admire the metric. It is to use the metric to drive a workflow.
4. Build payer tiers into your prior authorization process
Most clinics already know informally which payers are easier and which are harder. The new public reports give you a reason to formalize that knowledge.
Create simple payer tiers for your highest-volume plans.
Tier 1: cleaner approvals, predictable timing. Standard submission package. Normal follow-up.
Tier 2: higher friction or slower timing. Stronger documentation at first submission. Earlier status follow-up. Clear owner for unresolved cases.
Tier 3: meaningfully high denial rates, poor timing, or repeated need for appeal. More complete first-pass package, earlier escalation, and a tighter denial-to-appeal workflow.
For specialty clinics, that kind of tiering is often more useful than chasing a perfect benchmark number. It gives the team a repeatable way to turn public data into operational decisions.
What the public data does not tell you
The reports are aggregated. They do not tell you:
denial rates for a specific CPT code
denial rates for a specific diagnosis mix
pharmacy-benefit prior authorization performance
whether a payer is harder for your specialty than for the average provider
That is why the public report is only the outer layer of analysis.
The real operating view still comes from your own data: payer plus product plus service category plus outcome. Public reporting gives you context. Your own workflow data gives you the answer.
The strongest analysis is the combination of both.
What changes next: January 1, 2027
The next major milestone in CMS-0057-F is January 1, 2027, when covered payers are required to implement the rule's API requirements, including FHIR-based prior authorization capabilities.
For providers, that is the more structural shift. Public reporting creates transparency. API adoption changes the workflow itself.
Specialty clinics that depend heavily on prior authorization should be asking their platform vendors now what their roadmap looks like for payer API connectivity, status retrieval, and denial reason handling. The organizations that prepare early will have a better shot at turning prior authorization from a manual chase into a more instrumented operational system.
FAQ
Which payers have to post public prior authorization metrics?
Medicare Advantage organizations, state Medicaid and CHIP programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the Federally Facilitated Exchanges.
Does this public data include drugs?
No. CMS requires these public metrics for medical items and services that are subject to prior authorization, excluding drugs. That makes the reports less direct as a benchmark for pharmacy-benefit prior authorizations.
Where do I find the reports?
On payer public websites. CMS provides a template, but there is no single CMS-hosted public database. In practice, providers still have to search payer sites and provider resources.
Can I compare my clinic directly to a payer's public denial rate?
Yes, but only carefully. Match the line of business when you can, and treat the public number as a directional benchmark rather than a specialty-specific target.
What changes in 2027?
Covered payers must implement the rule's API requirements, including FHIR-based prior authorization capabilities, by January 1, 2027.
