On January 1, 2026, a federal rule called CMS-0057-F started requiring certain insurers to decide an urgent prior authorization within 72 hours and a standard one within 7 calendar days (Forvis Mazars, April 2026). That is a real change, and a good one. But before you rebuild your intake around it, three things the headlines skip: the rule does not touch commercial or employer (ERISA) plans, it excludes prescription drugs, and the part that would actually cut your paperwork — submitting a prior auth straight from your records instead of a fax — doesn't arrive until 2027.
So here is the honest version for a behavioral-health clinician: what changed this year, what didn't, and what to do about the gap.
What the 72-hour rule actually says
Two numbers. For plans in scope, an expedited (urgent) prior authorization decision is now due in 72 hours, and a standard decision in 7 calendar days, effective January 1, 2026 (EHR Source, February 2026). Before this, urgent behavioral-health decisions routinely ran 5 to 14 days and standard ones stretched to 14 to 30. Cutting that clock is worth having.
There's a quieter win in the same rule that matters more than the timeline: payers now have to give a specific reason for a denial, no matter how you submitted the request. A real reason, not "does not meet criteria." That is the difference between guessing at an appeal and writing one.
And starting March 31, 2026, in-scope payers have to publicly report their prior-auth numbers — approval and denial rates, appeal outcomes, average decision times. Sunlight on the denial machine. Slow, but sunlight.
Who it actually covers (the carve-out nobody mentions)
Here's where the headline gets smaller. The rule binds Medicare Advantage, Medicaid (fee-for-service and managed care), CHIP, and Qualified Health Plans sold on the federal exchange (CMS fact sheet).
It does not bind commercial or employer-sponsored (ERISA) plans. If a client carries insurance through a private employer — a large share of the working clients in a New York, New Jersey, or Connecticut private practice — the 72-hour clock does not apply to them at all. Their prior auth runs on the same timeline it always did. (This is the same carve-out that keeps insurance reimbursement structurally low, which is its own conversation — see Cash-Pay vs Insurance: The Real Income Ceiling.)
And drugs are excluded. Prescription medication prior authorizations — including psychotropics — sit under a different set of standards and are not covered by this rule's timelines. CMS has proposed folding drugs in later under a separate rule, but that hasn't happened. So if you coordinate med PAs with a prescriber, nothing about that got faster this year.
What it does NOT change for behavioral health
This is the part the payer-facing explainers leave out, because they aren't written for the person on the receiving end of the form.
2026 is phase one. The piece of CMS-0057-F that would genuinely save you time — an electronic prior auth you submit from your own system instead of a portal or fax — runs on a FHIR API requirement that doesn't take effect until January 1, 2027. Through all of 2026, you're still in the portal. Still on hold. Still keeping the parallel paper trail that quietly eats your week (more on that structural drain in Therapist Documentation Burnout).
A faster deadline is not an automatic yes. Missing the 72-hour clock does not auto-approve the authorization. The payer is late, not beaten. You still have to chase it.
And the blind spot is documented. In May 2025, the GAO reported that CMS had not specifically examined behavioral health in its oversight of Medicare Advantage prior authorization — even though 8 of 9 MA organizations it reviewed require prior auth for behavioral health, and most used their own internal criteria, not Medicare's, to decide inpatient behavioral-health stays. Behavioral health wasn't the priority. It was the part nobody was watching.
Meanwhile, the system is getting fined — slowly
There is a parallel story worth knowing, because it's the same system being held to account from a different direction, and it tells you how fast "accountability" actually moves.
In May 2026, Connecticut fined all five of its major insurers — Aetna, Anthem, Cigna, ConnectiCare, and UnitedHealthcare — for mental-health parity violations (CT Mirror, May 2026). The numbers underneath are the tell: regulators found Anthem reimbursing master's-level behavioral-health clinicians at roughly 75% of the Medicare rate, while paying medical/surgical providers about 115%. Same plan, different math, depending on whether the provider treats a body or a mind. For the tri-state clinicians this is written for, that's not abstract — that's your rate.
It's a pattern, not an outlier. Pennsylvania fined Aetna $550,000 in March 2026 over parity violations tied to autism therapy and stricter review of opioid-use-disorder treatment (PA Insurance Department). Georgia issued roughly $25 million in parity fines against 11 insurers in January 2026 — and as of this spring had collected $0, with the insurers appealing (11Alive Investigates).
That's the honest shape of it. The fines are real. The collection lags. Enforcement exists, and it's slow enough that you can't run your practice on the assumption it will arrive in time to help this quarter.
What a private-practice therapist should actually do now
You don't get to wait for the system. So, practically:
- Track the clock on in-scope plans. For Medicare Advantage, Medicaid, CHIP, and exchange QHPs, the 72-hour and 7-day deadlines are now yours to hold them to. Calendar the deadline when you submit. A late decision is leverage.
- Make them name the reason. The specific-denial-reason requirement is the most useful thing in this rule. When a denial comes back vague, push for the concrete reason — it's required now — and build the appeal from it.
- Document for the appeal from day one, not after the denial. The 79% of clinicians who report patients abandoning treatment during prior-auth delays (AMA, 2025 survey) aren't losing on the merits. They're losing on the wait.
- For commercial, ERISA, and drug PAs: nothing changed. Keep your existing defensive process. Don't assume the new timelines cover a client they don't.
- Get ready for 2027 now. The electronic prior auth is coming. When it lands, the practices that already keep clean, structured, exportable records will switch on; the ones still living in a Word doc and a fax cover sheet will be retrofitting under a deadline. That readiness is roughly the whole point of what therapists actually want in an EMR.
FAQ
Does CMS-0057-F apply to commercial insurance?
Mostly no. It binds Medicare Advantage, Medicaid, CHIP, and Qualified Health Plans on the federal exchange. Commercial and employer-sponsored (ERISA) plans are not covered — the only commercial plans in scope are exchange QHPs.
Does the 72-hour rule cover mental health?
For services under in-scope plans, yes — the decision timelines apply to behavioral-health prior authorizations the same as other care. But prescription drugs are excluded, commercial and ERISA plans are out, and the electronic submission that actually reduces clinician paperwork does not take effect until 2027.
When does electronic prior authorization start?
The FHIR-based prior authorization API requirement takes effect January 1, 2027. The 2026 changes are decision timelines and denial-reason transparency, not electronic submission.
Does missing the 72-hour deadline auto-approve my authorization?
No. A missed deadline means the payer is out of compliance, but it does not automatically approve the request. You still have to pursue it.