Prior Authorization for Behavioral Health: What Changed on January 1, 2026 (CMS-0057-F)

What CMS-0057-F changed — and what it didn't

CMS published the Interoperability and Prior Authorization Final Rule (CMS-0057-F) on January 17, 2024, at 89 FR 8758. Phase 1 of the rule took effect January 1, 2026 and added three concrete requirements for covered plans.

Timeline floors. Standard (non-urgent) PA decisions must be issued within seven calendar days of receiving a complete request. Urgent decisions must come within 72 hours. If a plan determines a submission is incomplete, it must notify the provider within 24 hours of receipt and specify what is missing. Prior to this rule, there were no uniform federal timeline requirements for commercial MA or Medicaid managed care plans, and standard decisions routinely stretched two weeks or longer.

Specific written denial reasons. When a plan denies a PA request, the denial must identify the exact basis — not just invoke “medical necessity.” Under CMS guidance, a specific reason may reference the plan provision or coverage policy the request failed to satisfy, cite the specific clinical criterion used, or explain why the submitted documentation did not support the plan of care. Vague denial letters from covered plans no longer comply.

Public performance reporting. Starting with 2026 data, covered payers must post prior authorization performance metrics annually: approval and denial rates broken down by service category, and average decision times for both urgent and standard requests. The first public reporting cycle covers 2026 activity and is due by March 31, 2027. When that data is published, a plan's behavioral health PA denial rate becomes directly comparable to its medical/surgical denial rate — the exact comparative baseline an MHPAEA parity argument needs.

What didn't change. Phase 2 of CMS-0057-F — the FHIR-based Prior Authorization API requirement using the HL7 Da Vinci PAS implementation guide — does not take effect until January 1, 2027. For now, PA submissions can still be made by phone, fax, or web portal. The new Phase 1 requirements govern the plan's response, not the submission method.

Which plans are covered — and which aren't

The scope of CMS-0057-F is the most important fact to nail down before citing it in an appeal.

The most common plan type for working-age adults employed by large companies is a self-funded ERISA plan — and those plans are exempt from CMS-0057-F. If your patient's employer plan is self-funded, the specific-denial-reason requirement does not apply under this rule. What does apply is MHPAEA and the CAA 2021 § 203 comparative analysis duty, both of which cover self-funded ERISA plans. See the MHPAEA parity appeals guide for those arguments.

For fully-insured commercial plans regulated by state insurance departments, coverage depends on whether the state has enacted a parallel PA reform law. As of early 2026, 18 or more states had taken legislative action on prior authorization reform, some of which extended timeline and denial-reason requirements to commercial fully-insured plans. Check the per-state appeals guides for your state's specific rules.

The specific denial reason is your new MHPAEA hook

Before January 2026, a typical prior authorization denial for a behavioral health service on a covered plan might read: “Your request for CPT 90834 (psychotherapy, 45 minutes) has been denied. The service does not meet our criteria for medical necessity. You have the right to appeal within 60 days.”

That language gave a therapist no comparative target. You knew the plan denied; you didn't know which criterion they applied. Running a parity argument — showing that the same criterion is applied more restrictively to behavioral health than to comparable medical/surgical care — requires knowing what that criterion actually is.

Under CMS-0057-F, the same denial on a covered plan must now read something like: “Your request for CPT 90834 has been denied. The submitted documentation did not meet criterion 4.C.1 of our Outpatient Behavioral Health Medical Necessity Policy (version 2025-Q4): the documented functional impairment score did not meet the threshold required for ongoing weekly treatment.”

Now you have a target. Criterion 4.C.1 of their behavioral health medical policy is a non-quantitative treatment limitation (NQTL) — a restriction on the scope or duration of care that isn't expressed as a simple number. Under the MHPAEA framework, the plan is required to apply that criterion no more restrictively to mental health than it applies comparable criteria to analogous outpatient medical/surgical benefits.

The appropriate combined response is a demand letter that does two things at once: (1) it identifies the specific criterion cited in the denial as an NQTL, and (2) it invokes the CAA 2021 § 203 statutory duty to produce the written comparative analysis for that criterion.

Sample combined demand language

Insert this paragraph into the appeal letter, adjusted to the specific denial:

Pursuant to CMS-0057-F (89 FR 8758), effective January 1, 2026, this plan's denial of the above prior authorization request is required to identify the specific criterion that failed. The denial cites [criterion name and policy version from the denial letter]. That criterion is a non-quantitative treatment limitation within the meaning of 29 CFR § 2590.712 and MHPAEA. Under § 203 of the Consolidated Appropriations Act of 2021 (codified at 29 U.S.C. § 1185a(a)(8)), I request the written NQTL comparative analysis showing how [cited criterion] is applied equivalently to comparable outpatient medical/surgical services. Please provide the analysis within 30 days. Failure to produce a defensible comparative analysis is itself evidence of a parity violation and will be escalated to the relevant state and federal regulators.

Send by certified mail or via the plan's appeal portal with a tracking number. If the denial is for a CO-197 (authorization absent or exceeded) code, lead with the NQTL argument: prior authorization itself is a non-quantitative treatment limitation, and the comparative question is whether the plan requires it for analogous outpatient medical visits.

What to do when a covered plan misses the deadline

A missed timeline under CMS-0057-F is a compliance violation, not an automatic approval. But a documented miss gives you two immediate tools.

Document it precisely. Note the exact date and method of your PA submission, the applicable deadline (7 days for standard requests, 72 hours for urgent), and the date the response arrived — or didn't. If the submission was electronic or via a portal, download the confirmation receipt.

Write to the plan. A short letter noting the specific deadline under 89 FR 8758 and the date the window elapsed without a response has two effects: it creates a paper record, and it often prompts the plan to resolve the PA request quickly to avoid a formal complaint.

File a CMS complaint if the plan doesn't respond. For Medicare Advantage plans, complaints go through the plan's own grievance process first, then to CMS's Parts C and D Beneficiary Ombudsman (1-800-MEDICARE). For Medicaid managed care, the state Medicaid agency has oversight authority. For ACA marketplace plans, file with CMS or the state-based exchange depending on your state's exchange type. CMS publishes annual performance data on MA plans, so a complaint creates a record in that system.

When your patient's plan isn't covered: state-level protections

If your patients are mostly on commercial employer plans, CMS-0057-F won't reach them directly. Several states have enacted prior authorization reform laws that extend timeline and denial-reason requirements to fully-insured commercial plans. Two states with particularly strong behavioral-health-specific rules:

Illinois (see the Illinois appeals guide) prohibits prior authorization and concurrent review for the first 72 hours of hospital inpatient behavioral health treatment under 215 ILCS 5/370c.1. Additional protections apply to partial hospitalization and intensive outpatient services. Illinois fully-insured plans cannot require PA before care begins in those settings.

California (see the California appeals guide) passed multiple prior authorization and mental health parity reform laws in 2024–2025. For fully-insured commercial plans regulated by the California Department of Insurance or the Department of Managed Health Care, urgent PA determinations must be issued within 72 hours and standard determinations within five business days. California's SB 855 (Chapter 151, Statutes of 2020) also requires coverage for all medically necessary mental health and SUD treatment at all levels of care — which limits the grounds on which a plan can deny even if it gets the PA decision timing right.

For all other states, the National Conference of State Legislatures tracks PA reform legislation updated through 2025. If your state isn't among those listed above, MHPAEA and CAA 2021 § 203 are your primary tools regardless of plan type.

Step-by-step checklist for prior authorization appeals in 2026

Use this for any prior authorization denial on a plan covered by CMS-0057-F.

Before the denial arrives

1. Confirm the patient's plan type: MA, Medicaid MCO, CHIP, or ACA marketplace QHP means CMS-0057-F applies. Self-funded employer plan means it doesn't.
2. Log the exact date and method of every PA submission. For phone submissions, note the representative's name and reference number.
3. Mark the timeline: T+7 days for standard, T+72 hours for urgent. If no response by that date, begin the escalation sequence.

When the denial arrives

1. Read the denial for a specific criterion. If the letter only says “not medically necessary” without citing a criterion, write back noting the CMS-0057-F specificity requirement and request the basis in writing.
2. Map the cited criterion to the NQTL framework. Any criterion that restricts the scope, duration, or continuation of care without being a simple dollar cap or visit limit is an NQTL under 29 CFR § 2590.712.
3. Send the combined demand letter above — citing CMS-0057-F for the specificity requirement and CAA 2021 § 203 for the comparative analysis demand. Send via certified mail or portal with tracking.
4. If the plan fails to produce the comparative analysis within 30 days, escalate to the relevant regulator (CMS for MA, state Medicaid agency for MCO, state DOI for commercial) and to external review.

FAQ