Electronic prior authorization was finalized in the HTI-4 Final Rule with three defined certification criteria and fixed timelines. Unlike criteria still under development, ePA’s requirements and deadlines are certain. ONC testing is expected to open in November 2026. The implementation timeline includes bonus measure status on January 1, 2027, and required measure status on January 1, 2028.
What You Need to Certify
Three new certification criteria under 45 CFR 170.315(g)(31), (32), and (33) define requirements for electronic prior authorization. These criteria reference FHIR implementation specifications developed by the HL7 Da Vinci project:
- Coverage Requirements Discovery (g)(31). Enables a provider to request information from payers about coverage requirements and needed documentation for a specific patient and condition.
- Documentation Templates and Rules (g)(32). Provides a mechanism for providers and clinicians to access and assemble documentation requirements specified by payers.
- Prior Authorization Support (g)(33). Enables submission of prior authorization requests from health IT systems and allows checking the status of previously submitted requests.
Health IT modules must also comply with API Condition and Maintenance of Certification requirements, including authenticity verification, registration requirements, and published technical documentation.
Implementation Timeline and Testing
Testing opens November 2026. Just two months later, the bonus measure period begins January 1, 2027. From that point, 12 months remain before required measure status takes effect. Certification testing typically takes 4 to 6 months. As a result, the margin for design, development, and remediation is quite narrow.
Developers who certify during the bonus period can get findings and feedback while runway remains. They can plan remediation and payer integration before the required measure deadline on January 1, 2028. Early submission means sequencing work strategically instead of scrambling at the end.
Achieving certification requires two things: API infrastructure capable of supporting the measure, and compliance with evolving FHIR standards. Beyond that, certified modules must maintain published technical documentation and complete authenticity verification with participating payers. These requirements persist as long as the module remains certified.
Developers planning to certify ePA should begin reviewing the HL7 FHIR Da Vinci implementation guides now. Register for ePA testing with Drummond to begin the certification process.