§ 457.732 Prior authorization requirements.

(a) Communicating a reason for denial. Beginning January 1, 2026, if the State denies a prior authorization request (excluding a request for coverage of drugs as defined in § 457.730(b)(6)), in accordance with the timeframes established in § 457.495(d), the response to the provider must include a specific reason for the denial, regardless of the method used to communicate that information.

(b) Prior Authorization Application Programming Interface (API). Unless granted an extension or exemption under paragraph (d) of this section, beginning January 1, 2027, a State must implement and maintain an API conformant with § 457.730(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that—

(1) Is populated with the State's list of covered items and services (excluding drugs as defined in § 457.730(b)(6)) that require prior authorization;

(2) Can identify all documentation required by the State for approval of any items or services that require prior authorization;

(3) Supports a HIPAA-compliant prior authorization request and response, as described in 45 CFR part 162; and

(4) Communicates the following information about prior authorization requests:

(i) Whether the State—

(A) Approves the prior authorization request (and the date or circumstance under which the authorization ends);

(B) Denies the prior authorization request; or