CMS-0057-F speeds up and standardizes prior authorization for medical services but excludes drugs, a core part of cancer treatment. CMS-0062-P, proposed in April 2026, would bring medical-benefit drugs into the electronic API from October 1, 2027. AI can prepare documentation today, while a qualified person makes the decision.
Most recent federal rules aim to make prior authorization faster and more electronic, and for oncology teams the gap in those rules is easy to see drugs sit at the center of cancer treatment, and the finalized rules stop short of them. That gap shapes what EHR, practice management and prior authorization vendors need to build next. This post gives a dated timeline of what applies now and what is only proposed a view of where AI fits in the Da Vinci flow, the guardrails forming around it, and a build checklist.
Why oncology prior authorization works differently
Oncology requests describe a regimen delivered in cycles instead of a single order. Staging, biomarkers, and line of therapy decide what a payer needs to see, and a change in regimen can restart the request, so one patient can generate several requests over a course of care.
The mix of services involved is broad. A JAMA Network Open survey of 178 patients with cancer asked which services required prior authorization.
| Service | Patients reporting prior authorization |
| Imaging | 71% |
| IV chemotherapy | 49% |
| Surgery | 47% |
| Radiotherapy | 34% |
Respondents could report more than one service, and the group was a convenience sample recruited through social media and advocacy organizations, so the figures are not nationally representative. They still show that one patient often touches several authorization pathways, which means a tool built around a single order type will miss part of the workload.
Staff time points in the same direction. In an ASCO survey of 300 members, reported by OncLive, 56% said a standard request typically takes an hour or less, and 63% said an escalated request typically takes three hours or less. Those are the ceilings respondents reported, not averages, but they show how much staff effort each request needs, and the clinical documentation a payer asks for is the part software can prepare. Start by mapping where each documentation element lives in your product today, from staging and biomarkers to prior therapies and supporting notes, because that map shows what a questionnaire could fill automatically and what still needs a person.
Where CMS-0057-F stops, and CMS-0062-P picks up
CMS-0057-F covers prior authorization for medical items and services and excludes drugs. CMS-0062-P would extend the same approach to drugs, but it is a proposal that CMS published in the Federal Register on April 14, 2026. Its comment period closed on June 15, 2026, and CMS still lists it as proposed. So far, only the standards versions have been finalized.
| Date | What happens | Status |
| January 1, 2026 | Most impacted payers must decide urgent requests within 72 hours and standard requests within 7 days, and must give a specific reason for each denial | In force |
| March 31, 2026 | Payers post their first public prior authorization metrics | In force |
| October 1, 2026 | Updated Da Vinci guides take effect: CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1 | In force |
| January 1, 2027 | Payer Prior Authorization API required | Finalized |
| October 1, 2027 | Medical-benefit drugs would join the Prior Authorization API | Proposed |
| 2028 | Payers would report drug metrics on 2027 data, and the MIPS electronic prior authorization measure, optional in 2027, would become required | Proposed |
The FY2027 IPPS final rule, published on August 4, 2026, finalized the updated guides, and ONC confirms that they replace the previously adopted versions on October 1, 2026. CMS-0062-P would also retire some older versions by January 1, 2028. The same three guides carry drugs under CMS-0062-P, so building to CRD, DTR, and PAS now avoids a second build in 2027. The MIPS measure comes from the CY 2027 physician fee schedule proposed rule, whose comment period closed on September 14, 2026, and Medical Economics reports that practices of 15 or fewer clinicians are excused from that category by default and can still opt in. Plan around the measure only after CMS finalizes it.
For a product team, the table reads as three work streams: the standards work that is already final, the drug work that CMS-0062-P would add in 2027 on those same guides, and the reporting that follows in 2028. Sequencing the build in that order keeps the proposed items from blocking the final ones.
This post stays on the provider and vendor side. For the payer half, see our posts on what breaks in real prior authorization API implementations and the full payer obligations under the final rule.
Where AI helps on the provider side today
Prior authorization in the Da Vinci flow moves through three guides, from the order to the decision.
- CRD (Coverage Requirements Discovery). CRD runs while the clinician places the order and finds out whether the payer requires authorization and what it requires. The answer reaches the clinician while the regimen is still being built.
- DTR (Documentation Templates and Rules). DTR launches the payer’s questionnaire and collects the documentation the payer asked for. Staging, biomarkers, and line of therapy land here, and staff otherwise look them up one by one.
- PAS (Prior Authorization Support). PAS assembles the request as a FHIR bundle, submits it, and tracks the response through to a decision, including any specific denial reason.
Nalashaa sees AI fitting in three places across these steps, and this is our view and not part of any standard. Each one follows a point where staff currently spend time assembling or sorting information.
- Chart-to-questionnaire extraction (DTR). A model reads the notes and proposes answers to the questionnaire, such as stage, line of therapy, and biomarkers, with a pointer to the passage each answer came from. Documentation captured upstream, for example by an ambient scribe, feeds this step, and our post on ambient AI scribes in US clinics covers that side.
- Letter and appeal drafting (PAS). Kate Baker, MD, MMHC, medical director of value-based care at Tennessee Oncology, describes submitting letters for the same medicine across many patients as a repetitive process, which makes it a natural fit for drafting from a template that the tool fills with each patient’s details. She also names the limit: “We’re still in a stage where a human would need to double-check the work being done by AI.”
- Status and denial triage (PAS). Because payers must now give a specific reason for each denial, software can sort those reasons as they arrive and route each one to the right queue, such as resubmission or appeal, with the status written back to the chart. A specific reason is easier to classify, so this placement gains value as the 2026 requirements reach more payers.
In all three places, AI drafts and the clinician confirms. Build the confirm step into the screen, not around it: show the source passage beside each AI-filled answer, let the clinician edit it, and record who approved it.
The guardrails forming around AI on both sides
Physicians and lawmakers are both setting expectations for AI in prior authorization. An AMA survey of 1,000 physicians, released in May 2026, found that six in ten are concerned AI may increase denial rates, and that 24% say reviews of medical necessity denials are consistently done by appropriately qualified clinicians. Those figures show how much physicians value visible, qualified review, and design can meet that expectation: when every AI-assisted request shows who reviewed it and what changed, practices and payers can both point to the review.
States have started to write the expectation into law. Rise Health counts seven states that passed AI health insurance laws in 2026, and five of them show the pattern.
| State | Takes effect | What it requires |
| Washington | June 11, 2026 | Only a licensed physician or health professional may deny on medical necessity, and AI cannot be the sole means to deny, delay, or modify care |
| Iowa | July 1, 2026 | AI cannot be the sole basis to deny, delay, or downgrade a request, and for requests from January 1, 2027 a qualified reviewer or clinical peer signs the denial |
| Alabama | October 1, 2026 | A medical necessity denial is always made by a licensed physician or other qualified health care professional |
| Colorado | January 1, 2027 | A licensed clinician reviews any denial, and AI output alone cannot issue one |
| Utah | January 1, 2027 | Reviewers apply independent medical judgment, and insurers disclose their use of AI |
Georgia (January 1, 2027) and Illinois (2028, on downcoding) complete the seven. The common thread is that AI can inform a decision, but a qualified person makes it. Because the dates differ by state, a vendor serving practices in several states can build one review-and-sign pattern that meets the strictest version instead of a separate flow for each law.
Payers are adapting to the same moving rules. AHIP and the Blue Cross Blue Shield Association report 11% fewer prior authorizations since their June 2025 commitments, 15% fewer in Medicare Advantage, and a goal to address 80% of electronic requests in real time in 2027. Plans are modernizing their own workflows as well, as our post on prior authorization automation for health plans describes.
For builders, these threads lead to one design requirement: log what the AI suggested, what the clinician changed, and what was submitted, with timestamps and user IDs. That record helps providers support a submission, payers review it, and auditors examine both.
What to build now: a checklist for oncology EHR and prior authorization tools
The checklist below turns the sections above into build items for oncology EHR, practice management, and prior authorization products. The first four items prepare a product for the payer APIs due on January 1, 2027 and for the drug expansion CMS has proposed for 2027, and the last three cover status, review, and payer readiness.
- Regimen-level requests. Track re-authorization for each cycle or regimen change, so a change in therapy opens a new request without re-keying the case.
- Structured clinical fields. Capture staging, biomarkers, and line of therapy as fields that DTR questionnaires can read, in addition to free-text notes.
- Benefit routing. Route each drug by benefit, medical or pharmacy, because CMS-0062-P would bring only medical-benefit drugs into the Prior Authorization API.
- CDex attachments. Send documentation packets through CDex so supporting records travel with the request.
- Status and denial reasons. Return both to the chart with timestamps, so staff see each decision where they already work and can triage the denial reason.
- Review and sign. Add a review-and-sign step with an audit trail for any AI-prepared content, covering the suggestion, the clinician’s edits, and the version that was submitted.
- Payer readiness list. Keep a named list of which payers are live, by date. Practices will ask a version of the question Hoyt Gong poses in his Medical Economics commentary: “Which of your payers will be live in your EHR on Jan. 1?”
How Nalashaa helps
Nalashaa builds the pieces this post describes inside specialty EHR, practice management and prior authorization products: CRD, DTR, and PAS integration, regimen-level request handling, and AI-assisted drafting with a review-and-sign audit trail. Our team works with healthcare IT vendors on interoperability and automation, so the payer-side rules and the clinical workflow get built together. See our healthcare automation services, or email us at info@nalashaa.com
FAQ
Does chemotherapy require prior authorization?
Often, depending on the plan, the regimen, and whether it is covered under the medical or pharmacy benefit. Payers publish oncology requirements, and the request usually needs staging, diagnosis, and regimen details. Check the payer’s current policy for each drug.
Do the CMS prior authorization rules cover oncology drugs?
CMS-0057-F excludes drug prior authorizations. CMS-0062-P proposes adding medical-benefit drugs to the electronic API from October 1, 2027, but it is a proposal and could change. Pharmacy-benefit drugs follow a separate path, so check the rule’s status before planning around it.
Where can AI be used in prior authorization?
Providers use it to pull facts from notes, draft letters and appeals, and triage status and denials. Payers also use it, and several states now require a qualified person to make the final decision.
Latest posts by Priti Prabha (see all)
- AI in Oncology Medical Billing: Fixing Claims That Stall - October 16, 2026