Prior authorization
Prior authorization for drugs: the timeframes that apply when CMS-0057-F does not
Prior authorization for drugs runs on different clocks from the CMS-0057-F rule, which does not apply to drug decisions. A Medicare Part D plan must decide a coverage determination within 72 hours, or 24 hours when expedited, of receiving the request. A Medicaid program that requires prior approval of an outpatient drug must respond within 24 hours and allow at least a 72-hour emergency supply. Where requests are sent electronically, NCPDP standards apply. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
Published by OffshoreMeds. Facts last checked October 10, 2026. How we check our numbers.
Medicare Part D
Coverage determinations: 72 hours, or 24 when expedited
| Step | Timeframe | Source |
|---|---|---|
| Step: Standard coverage determination | Timeframe: Notice to the enrollee and prescriber within 72 hours of receiving the request. | Source: 42 CFR 423.568 |
| Step: Expedited coverage determination | Timeframe: Within 24 hours of receiving the request, when the prescriber indicates the standard time could seriously jeopardize the enrollee's life, health or ability to regain maximum function. | Source: 42 CFR 423.570 and 423.572 |
| Step: Exception requests | Timeframe: The clock runs from receipt of the prescriber's supporting statement. If none arrives within 14 calendar days of the request, it runs from the end of that period. | Source: 42 CFR 423.568(b) |
| Step: A missed deadline | Timeframe: It counts as an adverse coverage determination, and the plan must forward the request to the independent review entity within 24 hours. | Source: 42 CFR 423.568(h) |
| Step: Redetermination (first appeal) | Timeframe: File within 60 calendar days of receiving the written decision. The plan decides within 7 calendar days, or 72 hours when expedited. A prescriber may file for the enrollee. | Source: 42 CFR 423.582 and 423.590 |
A denial notice must state the specific reasons for the denial. A prior authorization for a Part D drug is a coverage determination, which CMS said when it adopted the electronic prior authorization standard in 2020. For a drug on the medical benefit under Medicare Advantage, the standard decision time is also 72 hours and the expedited time 24 hours, and neither can be extended (42 CFR 422.568).
Medicaid
Outpatient drugs: a response within 24 hours and an emergency supply
A State Medicaid plan may require prior approval of a covered outpatient drug only if the system responds by telephone or other telecommunication device within 24 hours of a request, and provides at least a 72-hour supply in an emergency (Social Security Act section 1927(d)(5)). The statute says “response,” and CMS’s own summaries call it a response or a decision. Medicaid managed care plans that cover outpatient drugs must run a program that meets the same requirements, and the 7-day and 72-hour service clocks in the managed care rules are not the drug rule (42 CFR 438.3(s)(6)).
CMS-0057-F excludes drugs from its timeframes, and CMS said so directly in the preamble, noting that where a State requires prior authorization of covered outpatient drugs a response must be provided within 24 hours (89 FR 8758). State programs can be stricter, and State timeframes were not surveyed here. The rule for other services is on the prior authorization timeframes page.
Electronic requests
NCPDP standards for electronic prior authorization of drugs
- When Part D plans, prescribers and dispensers send prior authorization transactions electronically for covered Part D drugs, they must use the adopted NCPDP SCRIPT standard (42 CFR 423.160). Fax and phone requests are still allowed, so the standard binds only when the request is sent electronically.
- Either SCRIPT version 2017071 or 2023011 may be used until December 31, 2027, and 2023011 only from January 1, 2028. The formulary and benefit standard version 60 and the real-time benefit tool standard version 13 apply from January 1, 2027.
- In April 2026 CMS proposed to extend drug electronic prior authorization and denial-reason rules to Medicaid, CHIP and exchange plans from October 1, 2027 (CMS-0062-P). It is a proposal; only the technology standards part had been finalized as of October 10, 2026.
In practice
What staff track for each drug request
- The date, hour and method of the request, and the fax confirmation where one was used.
- Whether it was sent as standard or expedited, and whether it is an exception request.
- The date the prescriber’s supporting statement went in, and the end of the 14-day period.
- The plan’s response deadline, the written notice, and the 60-day appeal date.
- The approval duration, so a refill or a new prescription does not need a second request.
CMS guidance says a prescriber’s office staff may submit a coverage determination request on the prescriber’s behalf. That is guidance, not a regulation. The work of preparing, submitting and tracking requests is described on the prior authorization staff page.
Portals
Payer and vendor portals have their own terms
Electronic prior authorization platforms set their own rules for who may use an account and from where. The Terms of Service of one widely used platform, CoverMyMeds, last modified July 1, 2023 and read from an archived copy dated November 11, 2024, limit use to licensed health care providers who prescribe or dispense and their employees, bar using or allowing anyone else to use an account, and say use is intended for United States residents on a computer in the United States, with use by non-US residents or on a computer outside the United States described as prohibited (CoverMyMeds Terms of Service). The live site showed a United States-only notice to a visitor outside the United States, so the current text could not be read, and the archived text does not say how it applies to a contractor’s staff. Read the current terms of any portal before staff outside the United States are given access; the credential standards that apply to each person are on the HIPAA training and access rules page. This is general information, not legal advice. Review your payer contracts and the rules where you practice with your compliance advisor.
The terms behind each seat
One flat monthly fee per seat, never a percentage of collections. A Business Associate Agreement is signed before anyone touches protected health information. Clinical decisions stay with your US-licensed providers. See all OffshoreMeds services.
Related guides
- Prior authorization timeframes (CMS rule)
Which payers the CMS rule covers, the 72-hour and 7-day timeframes, what it excludes and the dates that matter.
- Prior authorization staff
Staff who prepare, submit and track prior authorizations, with the clinical line kept where it belongs.
- HIPAA training and access rules
The access and training standards that attach to each person, which parts are required, and what the 2025 proposal would add.
- Medicare appeal levels and deadlines
The five appeal levels for original Medicare claims, the deadline and decision-maker at each, and the 2026 and 2027 dollar thresholds.
Get Started
Book a free 30-minute call.
Pick a time below. Have these ready: the roles you need, your specialty and your EHR. We’ll come back with a fixed seat quote, candidate profiles to interview and a go-live plan.
Calendar not showing? Open the booking page in a new tab.
Please keep patient information out of the booking notes. A Business Associate Agreement is signed before anyone touches protected health information. See how this site handles your details in the privacy policy.