What Is Interoperability and Why Should Health Plans Care?
Interoperability is the ability of disparate healthcare systems, applications, and stakeholders to securely exchange, interpret, and act on data in real time. For health plans, it’s no longer a technical consideration—it’s a strategic imperative.
Efficient data exchange drives measurable operational improvements: faster prior authorization decisions, reduced administrative burden, stronger provider collaboration, and higher member satisfaction. Health plans that embrace interoperability also gain the data infrastructure needed to support value-based care models, AI-powered analytics, and predictive population health management. Plans that don’t risk falling behind on all three fronts.
What Regulatory Requirements Are Driving Interoperability?
These requirements did not emerge in isolation. The CMS Interoperability and Patient Access Final Rule (CMS-9115-F), published May 1, 2020, laid the regulatory groundwork by requiring Medicare Advantage organizations, Medicaid and CHIP programs, and QHP issuers on the federally facilitated exchanges to implement a Patient Access API, giving enrollees electronic access to their claims, encounter, and clinical data through third-party applications of their choice.
The primary regulatory driver is the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), published January 17, 2024. This rule mandates that Medicare Advantage organizations, Medicaid managed care plans, CHIP programs, and Qualified Health Plan (QHP) issuers implement APIs based on Fast Healthcare Interoperability Resources, developed by Health Level Seven® (HL7®) International and known as HL7 FHIR®, to facilitate real-time health information exchange and streamline prior authorization workflows.
A second rule—the Health Care Claims Attachments Transactions and Electronic Signatures Final Rule (CMS-0053-F)—establishes the first federal standards for electronically transmitting clinical documentation for claims adjudication, with a compliance deadline of May 26, 2028. Together, these mandates represent a coordinated CMS push toward a fully digital, automated healthcare ecosystem.
What Specific API Requirements Apply to Health Plans Under CMS-0057-F?
CMS-0057-F requires health plans to implement new HL7 FHIR-based APIs and expand existing HL7 FHIR APIs by January 1, 2027.
Prior Authorization API — automates electronic prior authorization requests, documentation collection, and decision communication. This API is typically implemented using three chained implementation guides from the HL7® Da Vinci Project, which CMS currently recommends but does not yet mandate:
- HL7 FHIR® Implementation Guide: Da Vinci Coverage Requirements Discovery (CRD), Version 2.2.1: Enables real-time retrieval of payer coverage rules and prior authorization requirements at the point of care.
- HL7 FHIR® Implementation Guide: Da Vinci Documentation Templates and Rules (DTR), Version 2.2.0: Automates the collection of clinical documentation needed to support prior authorization requests.
- HL7 FHIR® Implementation Guide: Da Vinci Prior Authorization Support (PAS), Version 2.2.1: Facilitates electronic submission and response for prior authorization requests in real time.
Provider Access API — a new requirement enabling in-network providers to retrieve their attributed patients’ claims, encounter, and clinical data, along with pending and active prior authorization decisions, to support care coordination.
Payer-to-Payer API — expands the original Medicaid/CHIP-only payer-to-payer exchange requirement to include Medicare Advantage and QHP issuers, enabling patients to bring their historical data with them when they switch plans.
Patient Access API — builds on the original Patient Access API by adding prior authorization information — including status and, for denials, the specific reason — to the data enrollees can retrieve through third-party applications.
Provider Directory API — continues the existing requirement that plans make provider directory information available via HL7 FHIR, helping ensure patients and other systems can access accurate, current network data. CMS-0057-F extends this requirement to state Medicaid and CHIP fee-for-service programs.
Compliance dates for the Patient Access API prior authorization enhancement, Provider Directory API, Provider Access API, and Payer-to-Payer API take effect January 1, 2027.
What Are the Key Compliance Deadlines Health Plans Need to Know?
Health plans should track three critical compliance dates:
- January 1, 2026: Operational and process-related prior authorization requirements under CMS-0057-F took effect. This included new transparency standards and timeframe requirements for prior authorization decisions.
- January 1, 2027: Full HL7 FHIR-based API compliance is required—CRD, DTR, and PAS along with the Patient Access API prior authorization enhancement, Provider Directory API, Provider Access API, and Payer-to-Payer API must be fully implemented and operational across applicable plan types.
- May 26, 2028: CMS-0053-F compliance deadline for electronic claims attachment standards using X12 and HL7® Clinical Document Architecture (HL7 CDA®) — Consolidated CDA (C-CDA) Implementation Guides.
CMS has indicated it will treat the January 2027 API requirement as an active enforcement date, not a soft deadline. Health plans running parallel implementation programs for both rules simultaneously will be best positioned to meet all three dates without resource conflicts.
What Is Payer-to-Payer Data Exchange and When Does It Take Effect?
Payer-to-payer data exchange is the CMS-mandated requirement for health plans to share a member’s clinical and claims history with a new payer when that member transitions between health plans. The goal is to eliminate care gaps caused by missing longitudinal health records and reduce the redundant data collection that members currently face when switching coverage. Member consent is central to this process—health plans may only exchange data with a member’s prior or concurrent payer at the member’s request and with their authorization, giving members control over whether and when their historical information is shared rather than making the exchange automatic.
Under CMS-0057-F, payer-to-payer data exchange requirements are incorporated into the January 1, 2027 compliance phase. Health plans must implement the necessary HL7 FHIR-based APIs, consent management processes, and data governance protocols to ensure compliant, secure transfers of member health information.
What Does the New Prior Authorization Drug Proposed Rule Mean for Health Plans?
CMS-0057-F applies specifically to medical items and services — it does not extend to medical drugs (also known as Part B drugs), pharmacy, or Part D drug authorizations. However, it does mandate that health plans:
- Send prior authorization decisions within 72 hours for urgent requests and seven calendar days for standard requests.
- Provide a specific reason for any denial, enabling faster appeals and reducing provider abrasion.
- Publicly report prior authorization metrics annually to CMS, including approval rates, denial rates, and decision timeframes.
These requirements add significant workflow and reporting obligations that many health plans currently handle through manual processes. Automating these workflows is essential to achieving compliance at scale.
CMS has proposed extending similar prior authorization reforms to the drug benefit space through CMS-0062-P, which would apply to Part B drugs, Part D drugs, and Medicaid/CHIP outpatient drugs. Rather than relying solely on the HL7 FHIR-based Da Vinci APIs used for medical prior authorization, the proposed rule leans on standards already embedded in pharmacy workflows—specifically NCPDP SCRIPT for electronic prior authorization transactions between prescribers, pharmacies, and payers, alongside HL7 FHIR-based APIs where drug benefit data intersects with medical benefit systems. This dual-standard approach reflects the reality that pharmacy claims processing runs on a different technical infrastructure than medical claims, and CMS is proposing to bridge the two rather than force pharmacy transactions entirely into the HL7 FHIR framework used for medical services.
How Does Interoperability Change the Prior Authorization Process?
Interoperability transforms prior authorization from a paper-driven, fax-reliant process into a real-time, point-of-care transaction. Under CMS-0057-F’s HL7 FHIR API mandates, providers can submit prior authorization requests electronically and receive near-instant decisions—directly within their existing EHR workflows.
For health plans, this shift requires building or integrating HL7 FHIR-based PAS, CRD, and DTR capabilities into their core administrative and care management platforms. It also means that coverage rules, documentation requirements, and authorization statuses must be structured, and accessible via API. Plans that automate these workflows reduce administrative spend, improve provider satisfaction, and lower the volume of delayed or denied claims driven by documentation gaps.
What Does CMS-0057-F Mean for Medicare Advantage Plans?
Medicare Advantage (MA) organizations are directly subject to CMS-0057-F and must comply with all prior authorization and interoperability API requirements by January 1, 2027. MA plans that serve high-acuity, dual-eligible, or chronically ill populations face elevated authorization volumes, making HL7 FHIR-based automation especially critical.
Beyond compliance, MA plans that implement real-time prior authorization workflows gain a measurable advantage: faster care delivery, reduced provider friction, and lower administrative overhead—all of which directly affect Star Ratings, which drive MA quality bonuses and benchmark payments.
What Does CMS-0057-F Mean for Medicaid Managed Care Plans?
Medicaid managed care organizations (MCOs) are subject to the same HL7 FHIR API requirements under CMS-0057-F. For Medicaid plans, interoperability is compounded by the complexity of state-specific rules, eligibility variability, and the diverse socioeconomic needs of the Medicaid population.
Real-time data exchange is particularly valuable for Medicaid MCOs navigating care coordination for members with complex social determinants of health (SDOH). Plans that integrate SDOH data, claims history, and authorization workflows through HL7 FHIR-compliant platforms can identify care gaps earlier, reduce avoidable utilization, and improve member retention.
What Does CMS-0057-F Mean for Commercial and QHP Issuers?
Qualified Health Plan (QHP) issuers on the federally facilitated marketplace are included within the scope of CMS-0057-F. These plans must implement the same HL7 FHIR-based prior authorization and interoperability APIs—by January 1, 2027.
For commercial plans, alignment with the CMS-0057-F framework also creates a competitive differentiator. Plans that deliver faster, more transparent prior authorization decisions improve provider network relationships and member experience scores, both of which influence market positioning and renewal rates.
State legislatures are accelerating this dynamic. Since January 1, 2025, some states have enacted their own prior authorization reforms extending CMS-0057-F-style requirements into the fully insured commercial market, which falls outside the federal rule’s direct reach. Colorado’s House Bill 24-1149 took effect January 1, 2026, requiring commercial carriers to comply with federal electronic prior authorization standards and, by 2027, to build APIs that let physicians check requirements and submit requests directly through their EHR systems. Texas, meanwhile, has revised its long-standing “gold card” law, under which HB 3812 shifted the exemption evaluation period from six months to a full year for state-regulated insurers, about a fifth of the state’s market. On top of this state-level activity, major national carriers have voluntarily committed to standardizing electronic prior authorization submissions using HL7 FHIR APIs and honoring existing prior authorizations for 90 days when members change plans mid-treatment, with these commercial-market commitments targeted for 2026. For commercial plans not directly bound by CMS-0057-F, this combination of state mandates and voluntary industry pledges means the operational bar is converging with the federal timeline regardless—making early alignment less a compliance choice than a market necessity.
What Are the Biggest Implementation Challenges Across Plan Types?
The most common implementation challenges health plans face include:
- Legacy system incompatibility: Older core administrative processing systems weren’t built to support HL7 FHIR APIs natively, requiring costly custom integration or full platform replacement.
- Data governance gaps: Inconsistent or siloed data makes it difficult to expose structured, API-ready information across payer, provider, and member touchpoints.
- Resource constraints: Many health plans—particularly smaller organizations—lack the internal IT staff to build and maintain multiple HL7 FHIR API endpoints simultaneously.
- Vendor readiness: Not all third-party vendors have conformance-tested their systems against Da Vinci Implementation Guide specifications, creating downstream compliance risk.
- Parallel program management: Running CMS-0053-F and CMS-0057-F as separate workstreams increases redundancy and blind spots. A unified governance structure is essential.
How Is CMS Enforcing Interoperability Compliance?
CMS holds several enforcement levers for CMS-0057-F, though many remain in their early stages given the rule’s phased 2026–2027 compliance timeline. The agency can conduct plan audits and compliance reviews, and it can pursue enforcement actions and compliance activities through its Office of Burden Reduction and Health Informatics for plans that miss reporting deadlines or fail to meet operational requirements. Perhaps the most significant enforcement mechanism is transparency itself: beginning with CY 2025 data due March 31, 2026, impacted payers must publicly post prior authorization performance metrics—including approval rates, denial rates, and decision timeframes—making outlier performance visible to patients, providers, regulators, and advocacy groups alike. Health plans that fail to meet prior authorization transparency and decision timeframe requirements face this combination of potential penalties, public reporting exposure, and reputational risk, even though CMS enforcement activity to date has been limited relative to the scope of its formal authority.
Separately, the National Standards Group (NSG) has exercised its own enforcement discretion regarding HIPAA’s existing X12 278 transaction standard. Although X12 278 technically remains the HIPAA-adopted standard for prior authorization transactions, NSG announced in February 2024 that it will not pursue HIPAA Administrative Simplification enforcement action against covered entities that implement an all-HL7 FHIR-based Prior Authorization API instead of X12 278. This discretion gives plans committing to an all-HL7 FHIR architecture meaningful flexibility, reducing the overhead of maintaining redundant transaction standards—though it’s worth noting this is a policy position rather than a change to the underlying statute, and NSG has continued soliciting stakeholder input (including a December 2025 listening session) on whether to formally replace X12 278 with HL7 FHIR through future rulemaking.
What Happens If a Health Plan Isn’t Compliant by the 2026 and 2027 Deadlines?
Non-compliance with CMS-0057-F exposes health plans to regulatory penalties, heightened CMS scrutiny, and potential corrective action plans.
Beyond regulatory consequences, health plans that fail to automate prior authorization workflows face mounting administrative costs—the CAQH Index consistently documents hundreds of millions of dollars in annual waste attributable to manual authorization processes. Non-compliance isn’t just a legal risk. It’s a financial and competitive one.
How Does HealthEdge® Help Health Plans Meet Interoperability Requirements?
HealthEdge provides an integrated, end-to-end HL7 FHIR foundation purpose-built to support CMS interoperability compliance — without the rip-and-replace disruption of overhauling your existing systems.
Meeting CMS-0057-F isn’t just about standing up API endpoints. It requires connecting prior authorization workflows, claims, benefits, and clinical data across systems that have historically operated in silos. HealthEdge brings these together in a single, standards-based data pipeline:
- Streamlined prior authorization. HealthEdge supports HL7 FHIR-based prior authorization workflows aligned to the Da Vinci implementation guides CMS points to — Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS) — enabling automated decision-making, real-time provider communication, and built-in business intelligence for utilization management.
- Connected core data. A cloud-based core administrative foundation links claims, benefits, and authorization data across the ecosystem, supporting the real-time, standards-based exchange that the patient-, provider-, and payer-facing API requirements demand.
- Accurate, audit-ready data. Integrated payment integrity and claims editing reduce manual intervention and accelerate adjudication accuracy — ensuring the data flowing through your interoperability APIs is clean and reliable.
With more than 125 pre-built APIs and active participation in the HL7 Da Vinci Project, HealthEdge helps ensure conformance against the exact Implementation Guide specifications CMS requires — turning a January 1, 2027 mandate into a long-term operational advantage.
HL7® and FHIR® are the registered trademarks of Health Level Seven International, and their use does not constitute an endorsement by HL7.