In our last issue, we covered CMS-0062-P bringing drug PA under the interoperability framework, 50 health plans committing to standardized electronic PA by January 2027, and states continuing to expand AI oversight. The bigger story this month was where the actual competitive differentiation in PA automation is happening. ONC finalized HTI-4. And the industry conversation landed, in a way that felt pretty coordinated, on EHR integration as the thing that actually determines whether automation works in practice.
"We've been building for this environment from the start. The bet was always that PA automation had to live inside the EHR to actually change outcomes. Nice to see the regulation catch up."
— Daniel Friedman, CEO, Ethermed
EHR integration is where differentiation is actually happening
The PA automation industry has spent years solving for speed. Extract data faster. Complete forms faster. Submit requests faster. That work produced real efficiency gains. But it optimized the wrong layer of the problem.
Clinician adoption is what limits most implementations. And adoption comes down to a simple question: is the tool already in the EHR, or does it ask the clinician to step outside it? SMART-on-FHIR apps, bi-directional data exchange, coverage requirements discovery at the point of ordering. When automation lives inside the EHR, it gets used. When it requires a separate login or a separate screen, it mostly doesn't.
That has been true operationally for some time. HTI-4 makes it structural.
HTI-4 final rule: ONC locks ePA into certified health IT
ONC finalized HTI-4, establishing certification criteria that require electronic prior authorization capabilities in certified health IT. The rule builds on FHIR and updated NCPDP SCRIPT standards. Transactions previously optional under ePA frameworks are now required, with a transition to SCRIPT 2023011 by 2028.
Health IT vendors seeking or maintaining ONC certification will need to build ePA workflows natively: certified capabilities within the system, with a regulatory timeline attached. The integration layer has moved from differentiator to baseline.
For health plans, the implication runs in the other direction. As certified EHRs increasingly support ePA natively, the connectivity infrastructure between payers and providers standardizes. Plans with FHIR-based API readiness will meet providers where they already are. Plans still building that infrastructure will face friction on both ends of the transaction.
CMS also published a reference implementation for CMS-0057-F on GitHub this month, a technical blueprint for FHIR-based PA APIs built on CMS-validated patterns. Worth a look if your development team is still working out the architecture.
Massachusetts and Iowa: two more states take effect
Two states moved from legislation to live requirements this month.
Massachusetts' new PA regulations tightened turnaround timelines, mandated clinical rationale for denials, and strengthened provider appeal rights. Generic denial language will not satisfy the documentation standard. Plans need to show the specific clinical basis for adverse determinations.
Iowa enacted reforms requiring faster decisions, limiting retroactive denials, and establishing new penalty exposure for plans that miss response timelines. Network adequacy obligations got tighter as well.
Manatt's tracker sits at more than 240 AI-related health care bills across 43 states in 2026. The White House has proposed federal preemption of state AI laws, but that is unresolved. Until it is, organizations operating across multiple states need jurisdiction-specific compliance logic built into their workflows. A single national ruleset does not hold.
Payers are disclosing PA requirements for 14% of services
A study this month put a number on something providers have been describing for years: major insurers publicly disclose prior authorization requirements for just 14% of services.
Think about what that means operationally. Before a provider submits anything, someone has to determine whether the service requires authorization, which entity within the plan owns the workflow, and where to submit it. For 86% of services, that information is not publicly available. So providers call. Or they guess. And a lot of authorizations go sideways before they ever get submitted.
This is sometimes called the "right door" problem. It is also one of the most underinvested areas in PA automation. Routing intelligence and automated payer-specific determination of where an authorization belongs are basic infrastructure. Without them, everything downstream breaks.
Interoperability updates
WEDI's CMS-0057-F Testing Directory is growing, with health plans, EHR vendors, and clearinghouses listed for coordinated FHIR API testing ahead of January 2027. If your team is working on API readiness and has not looked at testing partnerships through the directory, it is worth checking.
One date worth putting on the calendar: Da Vinci CRD, DTR, and PAS older IG versions expire January 1, 2028. That is a real planning constraint at this point.
Closing Thought
HTI-4 is largely codifying what good PA implementations already look like: ePA embedded in certified health IT, built on FHIR, connected at the point of care. The plans getting ahead of this are not waiting on mandates. They are building the infrastructure now because the operational case is already there.
If any of this is on your team's agenda (HTI-4 timelines, FHIR API readiness, or state compliance logic) we are happy to talk through it.
