Prior-Auth Routing Under CMS-0057-F: Where an AI Agent Helps a Payor Meet the Clock

Key takeaways

• Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), Medicare Advantage, Medicaid and CHIP payers must decide expedited requests within 72 hours and standard requests within seven calendar days, beginning in 2026. Every denial needs a specific reason.
• The same rule makes payers post prior-authorization metrics every year, including average and median decision times. Those numbers are public, so missed clocks show up outside the building.
• Much of the time on a request goes to work before any clinician reads it: checking it is complete, finding the right reviewer type and chasing documents. That is where a routing agent can help.
• The agent prepares and routes. Clinicians decide medical necessity. Approve and deny are actions the agent cannot take.
• Measure your own baseline before you change anything: time to a complete request, time in queue by reviewer type, the share of pends for missing information and timeframe misses.

If you run utilization management at a health plan, 2026 changed the arithmetic of a prior-authorization request. The CMS Interoperability and Prior Authorization Final Rule, published on February 8, 2024 as CMS-0057-F, put most of its operational provisions into effect from January 1, 2026. Two of them land directly on your intake and review queues: a decision clock and a specific reason on every denial.

Much of that clock is spent before a clinician opens the file, so routing is the lever. An agent that checks completeness and gets each request to the right reviewer can give your clinicians more of the window, without touching the decision.

What CMS-0057-F asks of payors

The rule applies to what CMS calls impacted payers: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and qualified health plan (QHP) issuers on the federally facilitated exchanges. Not every provision applies to every one of them, so read the CMS fact sheet against your own plan types.

The parts that matter for routing:

• Decision timeframes. Beginning in 2026, decisions are due within 72 hours for expedited requests and seven calendar days for standard requests. For Medicare Advantage the seven-day standard applies from January 1, 2026, replacing 14 days for items and services subject to prior authorization. Medicaid managed care plans move to seven days for rating periods starting on or after that date. QHP issuers on the federal exchanges are excluded from the timeframe requirement. Some programs allow limited extensions of up to 14 days. In Medicare Advantage the grounds are narrow: the enrollee asks, the plan needs evidence from a non-contract provider that could change a denial, or circumstances are exceptional.
• A specific denial reason. From 2026, a denial sent to the provider must include a specific reason, however it is communicated: portal, fax, email, mail or phone.
• Public metrics. Each year, by March 31, payers post the previous year’s data on their website. The first report was due March 31, 2026. In the Medicare Advantage text the list is: the items and services that need prior authorization; the percentage of standard requests approved, denied and approved after appeal; the percentage of requests approved after the review timeframe was extended; the percentage of expedited requests approved and denied; and the average and median time from submission to decision for standard and for expedited requests.
• The Prior Authorization API. From January 1, 2027, payers must run an API that lists covered items and services needing prior authorization, identifies the documentation required, supports the request and response, and returns approve, deny or request-more-information, with a specific reason for any denial.
• What it leaves out. CMS states that none of these policies apply to prior authorization for drugs.

The final rule in the Federal Register carries the regulatory text, and it is worth reading the sections for your own programs rather than relying on a summary, this one included.

Who decides, and what the rules already say about it

Prior-authorization decisions on medical necessity belong to clinicians. For Medicare Advantage, 42 CFR 422.566(d) says that if the plan expects to issue a partly or fully adverse medical-necessity decision, a physician or other appropriate health care professional with relevant expertise must review it first. Many states also require that adverse medical-necessity determinations be made or reviewed by a licensed clinician, and some have legislated on algorithms in utilization review. The details differ by state and line of business, so your compliance team should map the ones that apply to each plan.

That sets the boundary for an agent. It can take a lot of the work that precedes a decision. It should not deny a request, and in the design we describe below it has no way to.

Why routing is the lever

Look at where the hours go on a standard request in your own queues. In most utilization management teams, a share of the elapsed time passes before a reviewer reads the clinical notes:

• The request arrives incomplete, and someone has to notice, ask for the missing documents and wait.
• It lands in a general queue and waits for an intake coordinator to work out which reviewer type it needs.
• It reaches a reviewer who is the wrong fit for the service and gets passed on.
• The expedited flag is missed or applied inconsistently, so an urgent request sits in a standard queue.

Each of these spends the clock without moving the decision. On a 72-hour expedited request, a day lost at intake is a third of the window. The same output also feeds the denial reason: if the agent records which criteria it checked and which documents were present, the reviewer starts from a structured list.

One request, worked through

The request below is illustrative. It is invented, it contains no patient data, and the timings and criteria are examples only. You can see a related case step by step in the prior-auth routing walkthrough.

Intake. On a Monday morning a Medicare Advantage plan receives a standard prior-authorization request for an outpatient lumbar spine MRI. It has a diagnosis code, a procedure code, a referral note and a two-page clinical summary. The receipt time is logged and the seven-day clock starts.

Completeness check. The agent reads the procedure code, the diagnosis code, the plan and the urgency flag, and compares the submitted documents with the documentation list your plan publishes for this service. (From 2027 that list also sits behind the Prior Authorization API.) Suppose your criteria for this imaging ask for a record of conservative therapy and its duration. The clinical summary mentions physical therapy but gives no dates. The agent flags that one gap with the criterion it relates to, and drafts a request to the provider for the therapy notes. An intake coordinator reviews and sends it. The agent does not decide that the request is incomplete on medical grounds. It reports what is missing against a published list.

A pend for missing documents does not stop the clock in itself, and it does not fall within the Medicare Advantage extension grounds above, so this step matters most when it happens in the first hour rather than on day four. Confirm with your compliance team how your programs treat pends.

Routing. When the therapy notes arrive on Tuesday, the agent runs the check again, finds the documentation complete and applies your routing rules. This procedure under this plan goes to the musculoskeletal imaging queue, first to a nurse reviewer. The agent records the version of the rule set it used, the rule that matched, the fields it read and the time the request entered the queue. If no rule had matched, it would have sent the request to a manual-review queue with the reason named, instead of guessing.

Decision. A nurse reviewer opens it on Wednesday. The notes show three weeks of physical therapy, and in this example your criteria require six. The nurse cannot approve under the criteria, so the case goes to a physician reviewer, as 422.566(d) requires before an adverse medical-necessity decision. The physician reads the full record and denies. The agent has no part in that decision and cannot take it.

Denial reason and record. The agent’s earlier output gives the physician a structured summary: the criterion, what the documents showed, and where in the documents it was found. The physician writes the specific reason in their own words: the request does not meet the plan’s criterion of six weeks of documented conservative therapy before advanced imaging, and the notes show three. The notice goes to the provider on Wednesday afternoon, inside the window.

What stays on the record for this request:

• receipt time, urgency and the clock at each step
• the fields the agent read, the agent’s identity and the rule-set version
• the completeness gap, the drafted document request and who sent it
• the queue, the time in queue and the named nurse and physician reviewers who worked it
• the decision, the reason as the physician wrote it, and the time the notice went out

That record serves your appeals team, your internal audit and the annual metrics. Our post on what to retain when an AI agent supports a decision goes through these elements in more detail.

Reviewer queues and named reviewers

The agent routes to a queue for a reviewer type, such as a nurse queue for a service line or a physician queue for a specialty. Your workload tools assign work within the queue. The record then shows the named person who picked up the request and the named person who decided it. For how to record the roles around each agent run, see who is accountable when an AI agent makes a bad decision.

What HIPAA does and does not require here

Two HIPAA points come up in every review of this workflow, and one of them is often overstated.

Minimum necessary applies. The minimum necessary standard supports giving the agent only the fields your routing and completeness rules use. In the example, that is the codes, the plan, the urgency flag and the list of documents received. If a rule needs a field from the clinical notes, grant that field explicitly and log the access.

The right of access is narrower than it is sometimes described. Members have a right of access to the protected health information in the designated record set, which for a health plan includes enrollment, payment, claims adjudication and case or medical management record systems. That is a right to their information. It does not oblige a payor to explain which agent routed a request. Keep the routing record for your own appeals, audits and regulator questions, as a governance choice rather than a HIPAA duty.

The controls around the agent

Your clinical, compliance and security teams should agree these answers before the agent goes live:

• Owner. One accountable owner for the agent and its rules, usually the VP of Utilization Management or the head of clinical operations. That person can pause it.
• What it reads. The fields the rules need, granted explicitly, with any wider access approved and logged.
• What it cannot do. Approve, deny, change the routing rules or send anything to a provider without a person releasing it.
• When rules do not match. A manual-review queue with the reason stated, never a best guess.
• Rule changes. A versioned rule set with a named clinical owner, so every past routing decision traces to the rules in force that day.
• Stopping it. A way to stop the agent at once, with who stopped it, when and why on record.

This is where Moring fits. Moring is an AI governance platform that runs in your own cloud account or on-premises. Before an agent reaches production, a person approves each gate, and only named production approvers can promote it. The agent gets its own identity. Its tool calls go through a gateway where each tool server carries its own guardrails, such as PII redaction, blocked patterns and human approval, so an action like sending a provider request can wait for a coordinator. Approve and deny are simply not tools the agent is granted. Every model call is recorded with the user, model, cost, latency and guardrail verdict, and a stop control blocks the agent’s key so every further call is refused, with the reason on record. Your utilization management rules, criteria and clinical decisions stay yours.

What to baseline before you start

None of the numbers below are results. They are what to measure in your own operation, for a few weeks, before an agent touches a request. Without them you cannot say whether anything improved.

• Time to a complete request. From receipt to the point the request has everything the criteria need.
• Time in queue by reviewer type. Nurse and physician queues separately, standard and expedited separately.
• Pends for missing information. The share of requests pended for documents, and which documents.
• Misroutes. How often a request is passed from one queue to another before a decision.
• Timeframe misses. Requests decided after 72 hours or seven days, and which step consumed the time.

Several feed the metrics you publish each March.

Where to start

Pick one high-volume service line with clear criteria, such as advanced imaging, baseline it, then run the agent on that line alone with a coordinator confirming every route at first.

If it would help to look at one of your prior-authorization workflows against the CMS clock, start with the prior-auth routing walkthrough and then ask us for a review of one workflow. We will map where the time goes today and which steps an agent could prepare, with your clinicians keeping every decision. For the wider view across claims, servicing and utilization management, see governed AI agents in insurance.

Frequently asked questions

Sources

About the author

Arya SharanProduct Marketing & GTM, Moring AIChennai

Owns product marketing and go-to-market at Moring AI across positioning, demand and enablement. Works with regulated buyers on how governed AI agents are scoped, evaluated and bought. Writes about the operating questions that decide whether an agent reaches production.

LinkedIn profile →