In recently submitted public comments, HIMSS supported the Centers for Medicare and Medicaid Services’ (CMS) goals for advancing electronic prior authorization (ePA) and interoperability while urging the agency to ensure the healthcare community is realistically prepared to meet new requirements.

In response to the CMS Interoperability Standards and Prior Authorization for Drugs proposed rule (CMS-0062-P), HIMSS stated broad support for the rule's goals while raising concerns about implementation readiness and standards alignment. The proposal’s objective is to create a more transparent, expedited and reliable patient and provider experience and to better ensure patients receive the right care at the right time. In 2022, CMS proposed a similar rule to advance Interoperability and ePrior Authorization for medical items and services. This new proposal builds upon that with applications for ePrior Authorization for prescription drugs.

Advancing ePrior Authorization with Realistic Timelines

HIMSS supports the proposed use of FHIR ® standards for electronic prior authorization (ePA), except for retail pharmacy transactions. However, the proposed October 1, 2027 compliance date is premature given critical unresolved barriers:

• Testing at Scale: ePA FHIR® APIs have not yet been successfully tested at scale. HIMSS recommends requiring such testing, drawing on lessons learned from the January 2027 implementation of existing API infrastructure.
• Payer Directory: A CMS Payer Directory, which is essential for payer lookup in the ePA process, does not yet exist. HIMSS urges CMS to prioritize its development to enable feasibility testing and compliance.
• Implementation Guide Alignment: Payers are using different versions of API implementation guides (IG) due to the absence of a required standard in the ONC Health IT Certification Program. HIMSS recommends CMS designate a single IG version to establish a baseline for industry alignment.

Rather than the October 1, 2027 deadline, HIMSS and its members, including payers and EHR developers, recommended a glidepath of implementation milestones, beginning 18 months after the final rule's effective date, or upon completion of the prerequisites above.

NCPDP vs. FHIR ® Standards for Drug Prior Authorization

HIMSS acknowledges the debate on whether CMS should continue using NCPDP standards or advance to FHIR ® for prescription drug ePA. NCPDP advocates note the standard has been effective and that FHIR is premature given that medical ePA is still undergoing testing; FHIR advocates argue that aligning on a single standard for both medical and drug ePA would be the least burdensome long-term path. HIMSS views NCPDP standards as effective, while remaining open to future FHIR® testing for standards alignment.

ONC Standards Expiration: Extend the Compliance Date

HIMSS members, including EHR and other certified health IT developers, raised concerns that requiring an upgrade to newer IG versions by January 1, 2028, is not reasonable given current implementation workloads. Therefore, HIMSS recommends a voluntary shift beginning January 2028 and a mandatory compliance date of January 1, 2029 for implementing new standards and IGs.

Cybersecurity Resiliency

In addition, HIMSS responded to CMS’ Request for Information on Strengthening Healthcare Cybersecurity Resiliency, included in this proposed rule. HIMSS highlighted the need for leveraging proactive security frameworks and global standards, supporting small and rural healthcare organizations, and highlighting artificial intelligence as a growing cybersecurity threat.

Read HIMSS's full public comment letter on CMS-0062-P.