Most of the CMS-0057-F conversation gets consumed by the four APIs and the SLAs that go with them. The quarterly reporting piece is quieter, easier to under-scope, and just as auditable. Payers that treat it as a Q4 spreadsheet exercise are the ones who tend to find gaps three weeks before the first public post is due.
If you want a broader view of how the analytics side connects to the rest of the interop stack, the payer analytics reference collects related material. This piece stays narrow on what the rule actually asks for.
What the Rule Requires You to Publish
CMS-0057-F, finalized under 42 CFR 422.122 and its companion sections for Medicaid, CHIP, and QHP issuers, obligates impacted payers to report prior authorization metrics on a public webpage and refresh them at least annually, with the first public reporting due by March 31, 2026 for calendar year 2025 activity. The rule reads "annual" on the surface, but the operational cadence most payers land on is quarterly internal computation with an annual publication cut. That is the source of the shorthand "quarterly reporting" you will hear on Da Vinci calls. Internal quarterly rollups are what let compliance teams verify totals before they ever hit the public page.
The scope covers PA decisions on items and services covered by the medical benefit. Drug PAs handled through the pharmacy benefit sit outside this rule, which is a common miscount when volume totals are first pulled.
The Five Metrics You Owe
The rule enumerates a specific list. Each looks simple in isolation and has at least one ambiguity that will surface in review.
- Total volume of PA requests, aggregated and reported by item or service. The tricky part is what counts as one request when a submission is resubmitted with additional clinical documentation. CMS guidance treats a resubmission on the same underlying event as part of the original request, not a new one.
- Percentage of PA requests approved. Denominator matters. Cancelled requests and administratively closed requests are typically excluded, but your denominator definition must match what you publish.
- Percentage of PA requests denied. Partial denials, where some line items are approved and others denied, need a documented rule for which bucket they fall into.
- Average and median time to decision, split by standard and expedited requests, in business hours or calendar hours per your documented method. Clock start is receipt of a complete request, not first contact.
- Percentage of denied PA requests overturned on appeal, including internal reconsideration and external review layers. This is the one that most often lives in an appeals system disconnected from the PA system, which is why the source-of-truth question gets political.
Where Each Metric Actually Lives in the Stack
Request volume and decision outcomes typically originate in the utilization management platform or the PAS (Prior Authorization Support) endpoint if you have already stood one up per the Da Vinci PAS IG. Decision-time clocks live in whichever workflow engine timestamps intake, pended, and disposition states. Appeal overturns almost always live in a separate appeals-and-grievances system with its own case IDs. Getting a clean overturn percentage means reconciling appeal case IDs back to original PA case IDs, which is boring and where reporting projects go quiet for a month.
On the metrics-reporting side, tools like Payerbox from Health Samurai compute the quarterly PA volume, decision-time, and denial statistics as first-class outputs of the same runtime that handles the PAS submissions themselves, not a downstream ETL project. Whether you buy or build, that architectural choice, single system of record versus stitched pipeline, is the one that determines whether audit season is quiet.
For a look at how these same integration seams show up on the quality side, the write-up on FHIR-based Stars rating measurement patterns walks through similar reconciliation problems in a different regulatory context. The HEDIS measure computation platforms overview covers the analytics side more directly.
Enforcement Timeline and What Auditors Look For
CMS-0057-F prior authorization API compliance is required by January 1, 2027. Public reporting is a separate track that started earlier, with 2025 calendar year data due by March 31, 2026. State Medicaid and QHP issuer variants track slightly different schedules under the same rule. Non-compliance exposes Medicare Advantage plans to enforcement under 42 CFR 422.504, which includes intermediate sanctions and, in extended cases, contract-level actions. For QHP issuers on the federal Exchange the pathway runs through decertification risk. The dollars are less interesting than the operational overhead of a corrective action plan.
Who This Fits
If your PA system, appeals system, and reporting layer already share a common patient and case identifier, the quarterly rollup is a matter of query hygiene. If they do not, the reporting requirement is quietly the largest data-engineering line item in your CMS-0057-F program, and it is worth staffing accordingly.
