Thoughts on Healthcare Markets & Technology

Part I: Sometimes Interoperability Is Just a Modifier: CMS’s CY 2027 Imaging Site-Neutral Cut, the Hospital Machine-Readable File, 835 Allowed-Amount Percentiles, and the Contract-Semantics Price

CMS proposed a $260M imaging cut for CY 2027. It only works because two characters on a claim line, modifier PO, reliably identify the target setting. That is interoperability doing real work…

Listen now

3 hours ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Part II: Sometimes Interoperability Is Just a Modifier: CMS’s CY 2027 Imaging Site-Neutral Cut, the Hospital Machine-Readable File, 835 Allowed-Amount Percentiles, and the Contract-Semantics Price

CMS proposed a $260M imaging cut for CY 2027. It only works because two characters on a claim line, modifier PO, reliably identify the target setting. That is interoperability doing real work…

Listen now

3 hours ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

• CMS calls interoperability a “necessary foundation,” but the July package builds no single omnibus interop rule. It builds narrower pieces: standardized claims and status data, ACO rosters and digital measures, FHIR exchange, a targeted imaging site-neutral cut that runs on modifiers and codes, and a versioned hospital price file it is trying to make both valid and comparable.

• Two OPPS components, two different legal statuses. The noncontrast-imaging payment change is a CY 2027 proposal, and CMS says it would apply beginning January 1, 2027 if finalized. The hospital price-transparency section is an RFI sitting on top of already-live machine-readable-file rules and finalized CY 2026 schema changes.

• Site neutrality, precisely: pay the physician-office-equivalent rate (a 40 percent relativity adjuster) for imaging-without-contrast in APCs 5521 through 5524 and certain composite APCs, but only at grandfathered off-campus departments billing modifier PO. Rural sole-community-hospital departments and on-campus departments are exempt. This is the third narrow service-family step, not universal parity.

• CMS’s case, in numbers: 70 codes carry more than 95 percent of the off-campus volume, excepted-department rates run about 2.5 times office rates, and CMS pegs CY 2027 savings at 260 million dollars and roughly 8.5 billion over 2027 through 2036.

• Why it’s an interop story: the cut can only exist because the claim identifies the service, the APC family, the setting, and the PO or PN modifier. Payment reform rides on transaction semantics.

• Transparency has moved from a posting chore to a governed public dataset: schema, validator, NPIs, 835-derived percentiles, an attestation, and now a monthly enforcement file. The next frontier is contract meaning, not file shape.

  Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of Contents

1. Interoperability is not one API, sometimes it is a modifier

2. The site-neutral proposal, precisely bounded

3. CMS’s utilization case, with the numbers

4. Why a payment cut belongs in an interoperability story

5. Price transparency graduates from a posting chore to a public dataset

6. The CY 2026 quality layer that is already live

7. The 2027 RFI goes after contract meaning, not file shape

8. The consumer layer is still a mess

9. Enforcement becomes data too

10. Computable is not comparable

Interoperability is not one API, sometimes it is a modifier

CMS keeps calling interoperability a necessary foundation, and the phrase does a lot of quiet work, because it sets up an expectation the July package never fulfills. Nobody shipped an omnibus interoperability rule. What actually exists is a scatter of narrower mechanisms that each depend on shared, stable data: standardized claims and status transactions, ACO assignment rosters and digital measures, FHIR-enabled exchange, a targeted imaging payment cut that runs entirely on service and location identifiers, and a hospital price file CMS is trying to make both machine-valid and actually comparable across hospitals. Interoperability here is not a product. It is a precondition that shows up in different costumes.

The most useful reframing of this installment is that interoperability is sometimes not an API at all. Sometimes it is the humble billing modifier that lets a payment rule exist in the first place. The two big pieces here, an imaging site-neutral proposal and a hospital price-transparency RFI, look unrelated, one about paying less for CT scans and one about parsing contract terms out of a JSON file. What ties them together is that both are entirely dependent on identifiers meaning the same thing everywhere, and both are attempts to turn messy real-world variation into something a computer can act on. They just serve different users and sit at different points on the road from “the file parses” to “the numbers are comparable.”

The site-neutral proposal, precisely bounded

The imaging proposal has to be stated with its boundaries intact, because the fastest way to be wrong about it is to call it site neutrality without the qualifiers. CMS proposes to pay the physician-fee-schedule-equivalent rate, implemented as a relativity adjuster equal to 40 percent of the OPPS amount, for imaging-without-contrast services assigned to APCs 5521 through 5524 and certain specified multiple-imaging composite APCs, but only when those services are furnished in an excepted off-campus provider-based department billing modifier PO. Nonexcepted off-campus departments, the ones billing modifier PN, already get the office-equivalent rate, so this proposal is about closing the gap for the grandfathered, excepted departments that had been protected. And rural sole-community-hospital departments would be exempt from the change entirely.

The legal scaffolding matters because it is what makes a non-budget-neutral, service-specific cut defensible. CMS invokes the statutory authority to adopt a method for controlling unnecessary growth in the volume of covered outpatient services, and it points to the D.C. Circuit’s decision in American Hospital Association v. Azar, which upheld exactly this kind of service-specific, non-budget-neutral payment reduction. That citation is not decoration. It is CMS signaling that it has been to court on this theory before and won, which is why it feels comfortable targeting a single service family rather than adjusting rates across the board.

The boundaries, stated plainly, are the whole point. This is not universal OPPS-to-office parity. It applies to a defined imaging family, only at grandfathered off-campus hospital departments, with a rural carve-out, and it does not touch on-campus departments or the broad run of outpatient services. Anyone who describes this as CMS adopting general site neutrality, or who forgets the rural exemption, or who sweeps on-campus departments into it, has overstated a deliberately narrow policy into something it is not. Precision on scope is the difference between describing the proposal and misrepresenting it.

CMS’s utilization case, with the numbers

CMS builds its argument on a concentration story, and the numbers are worth carrying because they are what a comment letter will either accept or attack. CMS says roughly 70 HCPCS codes account for more than 95 percent of imaging-without-contrast volume in off-campus departments, even though the relevant APCs contain 337 codes in total, and the same proposal covers APCs 5521 through 5524 plus imaging composite APCs 8004, 8005, and 8007. That concentration matters, because it means a narrowly targeted policy hitting a short list of codes captures almost all the volume. CMS adds that more than 90 percent of those top 70 codes overlap between excepted and nonexcepted departments, which is the empirical backbone of the “same service, different rate” claim: the departments are doing substantially the same imaging, just under different payment treatment.

The growth figures are the motive. From 2016 through 2025, CMS says volume for the top codes in excepted departments rose more than 38 percent and spending rose 33 percent, with the increment amounting to about 126 million dollars in 2025 alone, and CMS estimates the proposal would reduce Medicare spending by about $260 million in the first year. More striking, utilization per fee-for-service beneficiary climbed more than 67 percent over a period when fee-for-service enrollment actually fell by roughly 17 percent. Volume up sharply while the covered population shrank is exactly the pattern the “control unnecessary growth” authority was written for, and CMS is clearly building that record on purpose.

Then the payment gap, which is what makes it worth doing. CMS calculates that excepted-department OPPS rates average about 2.5 times the office rate for this family, and that beneficiary cost sharing runs more than twice the office amount, because a beneficiary generally pays 20 percent of the higher rate. So the patient is penalized for where the scan happens, not for anything clinical. CMS estimates CY 2027 savings of 260 million dollars, split as about 190 million to Medicare and about 70 million to beneficiaries, and projects 8.5 billion in lower net Part B spending across 2027 through 2036. To its credit, CMS says it considered the obvious confounders, coding changes, guideline shifts, case mix, and pandemic rebound, and it leans on MedPAC’s finding of substantial severity overlap and no statistically significant cost effect for aligned low-complexity services, while noting that genuinely needed extra observation, medication, or diagnostic services remain separately billable. The honest editorial formulation is that CMS is testing whether comparable service identity plus observed setting patterns justify a narrower rate. It is not claiming every patient or every facility is identical, and it would be a straw man to say it is.

Why a payment cut belongs in an interoperability story

At first glance an imaging payment cut has nothing to do with interoperability, and that reaction is exactly why it belongs here. The cut can only operate because the claim carries a specific stack of identifiers that all have to be present and correct: the HCPCS code for the service, the APC family it maps to, the provider setting, the off-campus status, and the PO or PN modifier that says which kind of department billed it. Strip out any one of those and the policy cannot find its target. The rate reduction is not applied by a human reading a chart. It is applied by logic keying off standardized data fields.

This is what data-defined payment looks like in practice. A modifier, two characters on a claim line, is what lets CMS carve one site-and-service combination out of the vast undifferentiated stream of outpatient claims and pay it differently. That is interoperability in the least glamorous, most operational sense: not an app, not a FHIR endpoint, but the boring agreement that PO means one thing and PN means another, consistently, across every hospital in the country. It does not create clinical-data interoperability, and nobody should claim it does. What it demonstrates is the dependency running underneath the entire series, which is that payment reform is impossible without consistent transaction semantics. You cannot pay differently for a thing you cannot reliably identify, and identification is a data problem before it is a payment problem.

Price transparency graduates from a posting chore to a public dataset

The second half of this installment is where interoperability climbs one rung, from claims identity to price-data identity, and the hospital price-transparency regime is the case study. The obligation itself is old news by now. Since January 1, 2021, hospitals have had to publish a comprehensive machine-readable file plus consumer-friendly shoppable-service information. The machine-readable file has to cover gross charges, discounted cash prices, payer-specific negotiated charges, and de-identified minimum and maximum negotiated charges across hospital items and services. And since July 1, 2024, hospitals have been required to produce that file in one of CMS’s standardized layouts, the wide CSV, the tall CSV, or JSON, following an official data dictionary, with the standardized schema and validator formally taking effect January 1, 2025. That standardization is the moment the file stopped being a free-form disclosure and became a schema-governed artifact.

The reason this matters more than a compliance checkbox is who CMS expects to use the file. CMS explicitly envisions employers, researchers, innovators, price-tool developers, EHR vendors, consumer apps, and aggregators all reusing the machine-readable file. That intended-audience list reframes the whole exercise. The file is not a static page a shopper glances at once. It is a piece of public data infrastructure, meant to be ingested, joined, and built on by third parties at scale. Once you accept that framing, everything CMS does next, the schema tightening, the validator, the identifiers, follows logically, because infrastructure has to be consistent in ways a one-off disclosure never did.

The CY 2026 quality layer that is already live

The part people miss is that the transparency regime already got materially stricter this year, and this piece is live rather than proposed. Beginning January 1, 2026, with enforcement starting April 1, hospitals that report percentage-based or algorithm-based rates, rather than a clean dollar figure, must derive and encode statistics from their remittance data: the 10th percentile, the median, and the 90th percentile of allowed amounts, plus the count of underlying allowed amounts, computed from 835 remittance advice or equivalent data over a 12- to 15-month lookback, and CMS’s final schema implements those fields in version 3.0. In the same move, CMS removed the old “estimated allowed amount” concept. So a hospital can no longer wave its hands with an estimate when the negotiated charge is a formula; it has to go into its actual remittance history and compute a distribution.

The accountability wrapper tightened too. Hospitals must identify the relevant active Type 2 NPIs, the organizational provider identifiers, and include an attestation from a CEO, president, or responsible senior official swearing the file is true, accurate, complete, and contains all the information needed to derive a dollar amount when the negotiated charge is not directly knowable. That is a named executive putting their signature on the data, which changes the compliance calculus considerably.

CMS’s official data dictionary version 3.0 is where the regulation literally becomes machine validation, and the specifics show how tightly the screws turned. The schema replaced the prior affirmation object with an exact attestation, added an attester name field and a list-valued Type 2 NPI field, removed the estimated-amount field, and added median amount, 10th percentile, 90th percentile, and count fields. For a percentage or algorithm charge, the remittance count is now required, not optional. And in a nice privacy touch, counts from one through ten are reported as the literal category “1 through 10” rather than the exact small number, to reduce the risk of reidentifying a specific contract from a thin cell. That last detail is the tell that CMS is thinking about this file as a real dataset with real reidentification risk, not as a compliance formality.

The 2027 RFI goes after contract meaning, not file shape

Having largely won the battle to make the file parse, CMS is now opening the harder war, which is making the contents mean the same thing across hospitals, and that is what the 2027 RFI is about. CMS says its compliance reviews keep finding that important contract context shows up inconsistently and that free text is a nightmare to parse. So it asks whether things like outlier payments, stop-loss clauses, rate tiers, carve-outs, and other adjustments should get their own dedicated structured fields, and if so, whether those fields belong at the item-or-service level, the service-category level, or the contract level. Those are not trivial questions; they are the difference between a price file you can actually compare and one that is technically valid and practically useless.

CMS also goes after the identifier problem directly, and the example it gives is the perfect illustration of why semantic interoperability is hard. It asks about standardizing payer, plan, product, network, and employer identifiers, because the same insurer shows up in the wild as “Blue Cross,” “BlueCross,” “BC,” and “BCBS,” and those variants make cross-hospital matching a mess. If you cannot reliably tell that two hospitals are describing the same payer, you cannot compare what that payer pays them, and the whole point of the dataset evaporates.

This is the clean conceptual line worth drawing for a technical audience: the shift from syntactic interoperability, meaning can the file pass the schema, to semantic interoperability, meaning does the same field mean the same thing across hospitals and contracts. CMS has mostly solved the first and is now attacking the second. The crucial status caveat is that the RFI is a set of questions, and CMS explicitly anticipates future guidance and notice-and-comment rulemaking before any of it becomes required. The RFI does not amend the underlying transparency regulation. So these proposed structured fields are things CMS is thinking about, not fields hospitals must populate in 2027, and presenting them as finalized requirements would be a status error.

The consumer layer is still a mess

Underneath the machine-readable-file story sits the consumer-facing layer, and CMS more or less admits it is still a mess. The current rules require hospitals to post 300 shoppable services, including 70 that CMS specifies, or every shoppable service if the hospital offers fewer than 300. Hospitals can satisfy this with a standardized file or by qualifying through an internet price-estimator tool. In practice, CMS reports inconsistent formats, confusion about whether prices include facility charges, professional charges, or both, ambiguity around ancillary and bundled services, and cases where a cash price appears in an estimator but not in the machine-readable file, which means the two artifacts contradict each other.

So the 2027 RFI asks a batch of consumer-layer questions too: whether to update the list of 70 specified services, whether to require a common shoppable-service file format, whether to end the deemed-compliance shortcut for estimator tools, whether to require the estimator’s underlying data as a separate file, whether to standardize consumer-facing fields, and whether to make ancillary services, implants, and bundles explicit rather than buried. Every one of those is a real usability problem for anyone trying to actually shop for care. And every one of them is, again, a question rather than a 2027 requirement. The consumer layer is being actively rethought, but it has not been resolved, and the honest read is that the shopper experience remains the weakest, least standardized part of the whole regime.

Enforcement becomes data too

The final move completes the pattern that runs through the entire oversight rail: enforcement itself becomes a dataset. In July 2026, CMS launched a monthly public-use dataset of enforcement activities and outcomes, carrying the hospital and location, address, the CMS-assigned transparency identifier, the action or outcome, and the date. Since 2024, CMS has had authority to disclose compliance assessments and actions well beyond the formal civil monetary penalties it used to be limited to publicizing. So the government is now publishing, on a recurring cadence, a structured record of who complied, who did not, and what happened.

Line that up with everything else in this installment and you get a recurring architecture that is worth naming explicitly, because it recurs across CMS’s whole approach: a schema, a validator that checks against it, organizational identifiers that make entities matchable, an executive attestation that puts accountability on the data, and an enforcement record that turns the whole thing into oversight. That is the same skeleton, dressed for price transparency, that shows up in nursing-home surveys and drug-price reconciliation. CMS builds the format, checks conformance, identifies the actors, extracts a sworn statement, and publishes the consequences.

One caution CMS itself issues is worth honoring: a closed enforcement case does not establish present compliance. A hospital that resolved an old case is not thereby certified as compliant today, and reading the enforcement dataset as a clean bill of health would misuse it. And the deeper caveat, the one that should temper any excitement about price transparency as a shopping tool, is that even at its best the machine-readable file describes contracted or historical allowed amounts, not a guaranteed individualized out-of-pocket quote for a specific patient. The 2027 RFI is trying to make those historical amounts comparable across hospitals without pretending they are personalized price quotes, and that distinction has to survive intact. Computable is not the same as comparable, and comparable is not the same as an actual quote. CMS has largely standardized the file’s shape. Standardizing what the numbers mean, and being honest about what they can and cannot promise a patient, is the work that remains

.

The cut applies only to noncontrast imaging in APCs 5521-5524 at grandfathered off-campus departments billing PO. Rural sole-community hospitals are exempt. On-cam…

Read more

The cut applies only to noncontrast imaging in APCs 5521-5524 at grandfathered off-campus departments billing PO. Rural sole-community hospitals are exempt. On-campus departments are not touched. Scope matters.

The utilization case: volume up 38% and utilization per FFS beneficiary up 67% from 2016-2025, while FFS enrollment fell 17%. CMS pegs 2027 savings at $260M and $8.5B over a decade.

The price transparency side of the package is on the same logic. CMS solved file parsing. The 2027 RFI goes after contract meaning: stop-loss clauses, rate tiers, payer identifiers that actually match across hospitals.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

Thoughts on Healthcare Markets & Technology

Why the CY 2027 PFS Rule Gives Shared Savings ACOs Several Digital On-Ramps Instead of One ePA Mandate: APP Plus, Medicare eCQMs, the 95/75 Gates, Three CEHRT Paths, and the FHIR dQM Roadmap

The most expensive misread of the CY 2027 PFS rule: people see ‘ePA’ near ‘ACO’ and think CMS just mandated electronic prior auth for Shared Savings orgs. It did not. Here is what actually happened…

Listen now

a day ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

• The CY 2027 PFS proposed rule, CMS-1848-P (RIN 0938-AV82), does not mandate electronic prior auth for Shared Savings ACOs in 2027. It proposes real quality and health-IT changes, and separately asks about future ePA and a future FHIR digital-measure transition. Several on-ramps, not one gate.

• First survival skill: sort the pile. There are actual Shared Savings proposals, Shared Savings RFIs, look-alike proposals in other programs (MIPS, the Ambulatory Specialty Model), and one already-final payer rule (CMS-0057-F). They are not the same thing and carry different force.

• The quality set: an eight-measure APP Plus (five ACO-reported clinical measures, two admin-claims measures, CAHPS), dropping two prior measures.

• Legacy MIPS CQM reporting survives on purpose. Only 140 of 472 reconciled ACOs reported a MIPS CQM in preliminary PY 2025, up from 33 of 453 in PY 2023. Forcing a cutover now would strand investment.

• Medicare eCQMs are a scoped bridge: full electronic logic, but the population is limited to assigned Medicare beneficiaries, so multi-TIN ACOs don’t have to aggregate all-payer data they can’t reliably dedupe.

• Two separate gates people constantly merge: a 95 percent TIN-coverage test and a 75 percent measure-completeness test.

• CEHRT proof collapses from “report every PI measure” into one of three paths. ePA is an RFI for CY 2028, not a rule. And the ASM category-zeroing consequence is not Shared Savings policy.

  Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of Contents

1. CMS built several doors into digital ACOs, not one switch

2. Sort the pile first: four different legal buckets

3. The eight-measure APP Plus set

4. Why legacy MIPS CQM reporting survives on purpose

5. Medicare eCQMs, a scoped bridge with a matching problem

6. The 95 and the 75, two gates people keep merging

7. Three CEHRT evidence paths replace one PI score

8. ePA for ACOs is only a question, and ASM is a different animal

9. The payer API rail already moving, and the FHIR dQM roadmap

10. Where the burden actually goes

CMS built several doors into digital ACOs, not one switch

The most common way to misread the CY 2027 Physician Fee Schedule rule is to see the letters “ePA” near the letters “ACO” and conclude that CMS just told Shared Savings organizations to start doing electronic prior auth. It did not. What CMS actually did is more interesting and much easier to get wrong: it built several separate on-ramps into a digital operating model, some of them concrete proposals for 2027, some of them questions about 2028 and beyond, and it laid them out in a document large enough that the proposals and the musings are easy to blur together.

The right mental model is a set of doors, not a switch. There is a door for quality reporting that quietly shifts toward electronic measures without forcing anyone through it yet. There is a door for satisfying the certified-EHR requirement that used to be one heavy obligation and is now a choose-one-of-three affair. And there is a door labeled prior auth that is, for Shared Savings, still just a question CMS is asking, not a threshold anyone has to clear. Whether those doors eventually converge into a single mandatory path is a real possibility CMS is clearly steering toward, but steering toward something and requiring it are different verbs, and the whole art of reading this rule is keeping them straight.

Read more

CMS built several on-ramps toward a digital ACO model, not one switch. Some are firm 2027 proposals. Some are RFIs about 2028. Some live in MIPS or the Ambul…

Read more

Thoughts on Healthcare Markets & Technology

Medicare Gives Clinical AI a Billing Identity Before It Has a Price Theory: The CY 2027 OPPS SaMS Proposal, the New O1 Status Indicator, the New Technology Bridge, and the Lab-Analysis

Medicare just gave clinical AI a billing identity. It has not given it a price theory. That gap is the whole story in the 2027 OPPS proposed rule…

Listen now

2 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

• The CY 2027 OPPS proposed rule, CMS-1850-P, does not create a universal payment category for clinical AI and does not price algorithmic value from first principles. Comments are due August 31, 2026.

• What it does: proposes an outpatient taxonomy for certain algorithmic clinical services, a new status indicator (O1) that makes many of them separately payable, and a temporary New Technology APC band to hold rates roughly steady while CMS keeps arguing with itself about cost, evidence, packaging, and overuse.

• The vocabulary tell: CMS renames Software as a Service (a cloud business model) to Software as a Medical Service, or SaMS. Cute, and telling.

• Not all of it gets paid separately. Across source-defined groups totaling 36 HCPCS codes designated as SaMS in Table 61, a subset would carry O1 while others retain their existing status indicators (such as Q1, E1, N, or M) and packaging rules. Do not read this as “all the AI codes now get paid.”

• The rates are stability, not valuation. AI-QCT stays at 950.50 dollars even though a handful of early claims implied placement in the lowest New Technology APC payment band. Optellum keeps its assignment even though claims implied a ~90 percent cut. This is legibility, not a value model.

• The sleeper is the lab move: CMS proposes to treat repeated algorithmic analysis of stored test data as an “other diagnostic test,” pulling it off the Clinical Laboratory Fee Schedule.

• This did not start in 2026. HeartFlow got separate OPPS payment back in 2018. MedPAC has been warning about bundle erosion and overuse the whole time.

Table of Contents

1. CMS gives clinical AI a billing identity before it has a price theory

2. What SaMS actually is, and the quiet burial of SaaS

3. Why OPPS was never built to pay for software

4. Three cohorts, not one category, and O1 is a flag not a seal

5. The New Technology bridge, or rate stability wearing a pricing costume

6. The claims-data paradox: AI-QCT and Optellum

7. The lab migration is the real structural move

8. This started in 2018: HeartFlow and the lineage nobody remembers

9. MedPAC’s counterweight and the value question CMS ducked

10. What O1 does not certify

CMS gives clinical AI a billing identity before it has a price theory

The temptation with this proposal is to write the headline “Medicare starts paying for AI,” collect the clicks, and move on. Resist it, because it is wrong in both directions at once. Medicare has paid for algorithmic clinical software since 2018, so this is not a debut. And the CY 2027 OPPS rule does not actually price the value of AI, so this is not a valuation either. What it is, and this is the useful framing, is CMS handing a set of algorithmic clinical services a billing identity before it has figured out what any of them are worth. Legibility first, valuation later, maybe never.

That gap between “we can now see it in the claims” and “we know what to pay for it” is the entire story, and it is a genuinely hard problem rather than bureaucratic dithering. The stuff CMS is trying to pay for does not behave like the stuff OPPS was built to pay for. There is no gurney, no vial, no observable material resource to cost out. There is a subscription, a per-click license, and a proprietary model whose actual cost the vendor has every incentive not to disclose. So CMS is doing the only thing it can do at this stage, which is create a place to put these services on a claim, flag some of them as separately payable, and buy itself time with a temporary rate band while it keeps asking the questions it has been asking, unresolved, for years. Everything below is a variation on that theme.

Read more

CMS is retiring Software as a Service and replacing it with Software as a Medical Service (SaMS). Not cosmetic. It’s CMS trying to reframe these as clinical services, not subscriptions. Matters a lot once you …

Read more

Thoughts on Healthcare Markets & Technology

Part I: Medicare Wants a Three-Second Claim But Still Owes a Fourteen-Day Wallet: Inside the ClaimsCore Re-Platforming Draft, the MAP Bridge, and Why Sub-Second Adjudication Cannot Pay Providers

CMS wants sub-second Medicare claims adjudication. The statutory payment floor is still 13 days. Those two facts don’t cancel each other. They coexist, and that’s the whole story…

Listen now

3 days ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Part II: Medicare Wants a Three-Second Claim But Still Owes a Fourteen-Day Wallet: Inside the ClaimsCore Re-Platforming Draft, the MAP Bridge, and Why Sub-Second Adjudication Cannot Pay Providers

CMS wants sub-second Medicare claims adjudication. The statutory payment floor is still 13 days. Those two facts don’t cancel each other. They coexist, and that’s the whole story…

Listen now

3 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

• The July 2026 Original Medicare blog says CMS wants to modernize claims processing toward real-time claims. That is a direction, not a build. Treat it as intent.

• The concrete target lives in an earlier, less-hyped document: the ClaimsCore Request for Information and draft Statement of Objectives, with responses due January 8, 2026. It contemplates replacing FISS, MCS, the DME system, and the Common Working File with a commercial cloud platform. It is not an award, but it has since been followed by a competitive multi‑phase RFP with an initial schedule.

• The estate CMS wants out of: roughly 1.2 billion claims a year, more than 460 billion dollars, about 33.6 million Original Medicare beneficiaries, COBOL and Assembler on mainframes, nightly batch, VSAM and flat-file history, and policy changes that can take 7 to 12 months to code.

• There is already a live bridge, MAP, running in limited parallel with legacy processing, and even that small step needed continuity with CWF, IDR, NCH, CCW, and existing status transactions. Migration, not adjudication, is the actual hard part.

• The punchline for anyone with working capital at stake: even a three-second yes hits a 13-day statutory payment floor and a 30-day clean-claim ceiling. Congress owns the floor, not CMS. Fast decision, same wallet.

• Faster also means riskier. A machine-speed system magnifies the blast radius of stolen credentials and bad routing. The February 2024 Change Healthcare attack, which federal analyses and subsequent OCR reporting describe as affecting tens of thousands of providers and exposing data on approximately 192.7 million individuals across payers and providers, is the standing warning.

Table of Contents

1. The headline everyone gets wrong

2. What CMS actually said in July, and how to label it

3. The prehistory nobody reads: a 2025 listening session and a quiet bridge

4. The legacy estate: 1.2 billion claims and a lot of COBOL

5. What the ClaimsCore draft actually asks for

6. Migration is the whole ballgame

7. Five flavors of real time and one EDI state machine

8. The fourteen-day floor Congress still owns

9. Who eats the risk: clearinghouses and the Change Healthcare shadow

10. Speed is not modernization without parity

    Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

The headline everyone gets wrong

The easy version of this story is “CMS wants faster claims,” and that version is both true and useless. Everybody wants faster claims. The interesting version, the one that actually matters if you run a clearinghouse, a MAC, a revenue-cycle shop, or a fund with exposure to any of the above, is a three-part setup that pulls in different directions at once. CMS has a real, operating modernization bridge that handles a thin slice of volume today. It has a much bigger draft concept to rip out and replace the shared systems entirely. And it has a decades-old statutory payment clock that quietly guarantees sub-second adjudication cannot turn into sub-second cash without an act of Congress. Hold those three things in your head at the same time and the whole subject stops being a slogan and starts being an engineering and finance problem.

The reason people botch it is that the flashiest word, real-time, gets used to mean five or six different things that are not the same thing, and the difference between “the system decided instantly” and “the money moved instantly” is roughly the entire point. So this piece spends most of its time separating decision from cash, target from status, and ambition from the pile of legacy plumbing that ambition has to survive.

What CMS actually said in July, and how to label it

The July 2026 Original Medicare blog is the strategy layer, and it is careful. It says CMS intends to modernize claims processing to support real-time claims, new payment structures, and program integrity. That sentence is a compass heading. It is not a rule, a contract, a funded program, or a date. Nothing in it commits CMS to anything a provider or vendor can plan a budget around. The correct verb is “intends,” and the correct posture is to read it as the mission statement it is.

The blog matters mostly because it gives you permission to go read the actual target document, which is not from July at all and did not get a press release with balloons. That document is the ClaimsCore Sources Sought and RFI, with an attached draft Statement of Objectives, posted to the federal contracting system on January 8, 2026. This is where the concrete ambition lives. And the single most important label to slap on it is this: it is a draft acquisition artifact, a request for industry input, not an award, not a signed requirement, not a national timeline. Everything in it is a target CMS is floating, which is a very different animal from a commitment CMS has made. Say “contemplates” and “proposes,” never “will,” and never “has.”

The prehistory nobody reads: a 2025 listening session and a quiet bridge

Before ClaimsCore, there was a listening session, finalized July 30, 2025, on real-time claims processing and on ways to shore up Medicare’s EDI cybersecurity. That session set the table. It floated the early pilot concept, raised the premise of exchanging clinical data alongside claims, named the intermediary groups who would be affected, and gave CMS’s own account of the Change Healthcare disruption. If you want to understand why real-time and cybersecurity keep showing up in the same breath, this is the origin: the pilot idea and the breach post-mortem were literally in the same room.

Then there is the part almost nobody outside the plumbing knows about, which is that a bridge already exists and is running right now. Call it MAP, the newer processing platform that CMS has been standing up in limited parallel with the legacy professional‑claims and, by 2026, additional claim families as rollout expands. This is not a concept. It is live, at low volume, and the transmittals that operationalized it are worth knowing by name because they carry the actual lesson. One transmittal issued September 5, 2025 consolidated claim history between the legacy Multi-Carrier System and MAP so that status inquiries, the 276 and 277 exchange, would return consistent answers across both worlds for the first professional-claim slice. Another, issued December 31, 2025 with an implementation date of March 31, 2026, set up a daily snapshot file into the Integrated Data Repository and established limited parallel processing with downstream continuity.

Here is the tell buried in those two dry transmittals. Even a small, careful step onto the new platform required CMS to keep feeding legacy-format snapshots downstream and to preserve continuity with the Common Working File, the Integrated Data Repository, the National Claims History, the Chronic Conditions Warehouse, and the existing status transactions. The bridge could not just be a new front door. It had to keep every old room reachable. That is the first and loudest warning against anyone who describes a new adjudication engine as a clean swap. There are no clean swaps here. There is only migration with the lights kept on.

The legacy estate: 1.2 billion claims and a lot of COBOL

To understand why CMS is even entertaining a rip-and-replace, you have to look at the size and age of what it is replacing, and the ClaimsCore draft is refreshingly blunt about both. It sizes the current estate at roughly 1.2 billion claims a year and more than 460 billion dollars flowing through, using about 33.6 million Original Medicare beneficiaries as the sizing assumption. That is the volume a replacement has to eat without dropping a bite.

The technology underneath is exactly what you would fear and exactly what makes this hard. The draft describes COBOL and Assembler running on mainframes, nightly batch exchanges rather than continuous processing, and claim history sitting in VSAM and flat files, which are storage formats that predate most of the people who will be asked to migrate them. And it names the operational cost of all that age in the most concrete way possible: a policy change can take 7 to 12 months, or longer, to code and deploy. Sit with that number. When Medicare payment policy shifts, the system that pays the claims can need most of a year to catch up. That lag is not a bug someone forgot to fix. It is the accumulated weight of shared systems that have been patched, extended, and interwoven for decades, where touching one rule risks a dozen downstream behaviors nobody fully maps anymore.

So the case for re-platforming is not “new is shinier.” The case is that a nine-to-twelve-month change cycle on a 460-billion-dollar payment engine is a genuine liability, for agility, for program integrity, and for the ability to implement the very payment ideas the rest of this series is about. The AI-software payment taxonomy, the drug-price refunds, the ACO reporting, all of it eventually has to be executed by something, and that something currently speaks Assembler and runs overnight.

What the ClaimsCore draft actually asks for

The RFP target state reads like a modern platform wish list, and it is worth being precise about what is on it, because precision is what keeps you from overclaiming. ClaimsCore contemplates replacing FISS, the institutional Part A system, MCS, the professional Part B system, the DME claims system, and the Common Working File itself, folding them into a commercial cloud platform configured for Medicare and already expected to operate with more than two million active users and over 100,000 claims per day. On top of that, the draft seeks instant or sub-second adjudication, real-time status, configuration-driven policy so a rule change is a setting rather than a code release, prepayment program-integrity controls, open APIs, and interoperability across X12, REST and FHIR, and plain flat files for the systems that still need them.

The RFP also lays out proof‑of‑concept expectations, framed as challenges a vendor would have to meet, with measurable targets for things like sub‑second adjudication, fraud detection, and accuracy. And this is exactly where discipline earns its keep. Those metrics are comparative objectives in the competitive RFP and associated acquisition documents. They are not CMS performance results, they are not contractual service levels anyone has signed, and they are not a promised schedule. The three-second figure that people will inevitably quote is a target in a request for industry feedback, not a requirement CMS has adopted. Describe the proof of concept as proposed and challenge-based, never as awarded or achieved, and do not let a crisp number in a draft masquerade as a fact about a running system. Nobody has replaced Medicare’s shared systems. CMS has asked the market whether, and how, it might.

Migration is the whole ballgame

The adjudication speed is the part that makes headlines. The migration is the part that makes or breaks the project, and the draft, to its credit, basically admits this. A successful system, it says, would have to preserve hundreds of interfaces, migrate decades of claim history, extract legacy business rules into portable formats, explain the differences between old and new behavior, support parallel runs so the new engine can be checked against the old one, and avoid vendor lock-in so CMS is not trading one trap for another.

Read that list as a threat model rather than a feature list and it gets more honest. Hundreds of interfaces means hundreds of downstream systems, contractors, and data consumers who each assume the current formats and timing, and any one of them can break in a way that looks like a payment error. Decades of history means the new platform has to answer questions about claims adjudicated under rules that no longer exist, which is not a data-copy problem, it is a semantics problem. Extracting legacy rules into portable formats means somebody has to figure out what the COBOL actually does, including the parts that are load-bearing by accident, which is a genre of archaeology that has sunk many modernization efforts. Parallel runs mean you operate two systems at once for a while, which is more work and more cost, not less, during the transition. And the realistic rollout is family-by-family, MAC-by-MAC, slice-by-slice, exactly the way the MAP bridge started, precisely because a big-bang cutover on a 460-billion-dollar engine is how you end up on the front page.

The lesson the MAP transmittals already taught applies at full scale here. The hard part is not teaching a cloud platform to say yes or no quickly. The hard part is making sure that fast yes means the same thing everywhere it lands, in the status inquiry, in the remittance, in the data repository, in the accounting ledger, and in the historical record, for every claim type, under every rule vintage, without stranding a single downstream consumer. Speed is a demo. Semantic parity is the product.

Five flavors of real time and one EDI state machine

A lot of the confusion about real-time Medicare claims comes from the fact that current Medicare EDI already produces near-immediate responses, and people mistake those fast acknowledgments for fast payment. They are not the same, and the difference is a small state machine worth walking through, because it is the difference between “the system got my file” and “the money is in the account.”

When a claim goes in, the first thing back can be a TA1, which addresses interchange acceptance, basically whether the envelope was readable. Then a 999 addresses syntax and implementation, whether the claim was well-formed. Then a 277CA handles claim-level front-end acceptance and assigns a control number, which is the first point where the claim is a real, tracked thing in the system. Later, a 276 inquiry and its 277 response return claim status, telling you where the claim sits in processing. And finally an 835 carries the remittance and the adjustment detail, the document that explains what was paid and why. Several of those messages can come back fast, even today. Not one of them, on its own, proves that money has settled in a bank. A 277CA is not a payment. A 277 status of “processed” is not cash in hand. The 835 is the closest thing to the truth, and even it describes a payment rather than being the payment.

So when a document or a vendor says real-time, the useful reflex is to ask which of these it means. Real-time interchange acceptance, real-time syntax validation, real-time front-end acceptance, real-time status, real-time remittance, and real-time funds movement are six different claims, and only the last one touches your working capital. The ClaimsCore draft is mostly talking about the decision, the adjudication, being fast. That is genuinely valuable, because faster decisions mean faster certainty, faster explanations, faster exception handling, and fewer claims stuck in limbo. It is just not the same as faster money, and conflating the two is the single most common error in this whole subject.

The fourteen-day floor Congress still owns

Now the paradox that makes this installment fun, or infuriating, depending on your role. For clean electronic claims, the Medicare Claims Processing Manual and the Social Security Act impose a payment floor of 13 days, which makes the 14th day the earliest a routine electronic claim is ordinarily paid. Clean claims also face a payment ceiling of 30 days, after which interest starts accruing. Those clocks live in statute, in the parallel Part A and Part B provisions, which means they apply to institutional and professional claims alike and, crucially, they are not CMS’s to move by regulation.

Put the two facts side by side and the tension is almost comedic. CMS can, in principle, build a system that adjudicates a clean claim in under a second. It cannot, without Congress changing the underlying law, pay that clean claim any sooner than day 14 as a routine matter. The decision engine and the disbursement clock are governed by different masters. So sub-second adjudication delivers a real and worthwhile set of benefits, faster certainty about whether you will be paid, faster and clearer explanations when you will not, real-time status, and quicker handling of the weird edge cases, but it does not and cannot, by itself, produce immediate ordinary payment. A three-second claim still meets a fourteen-day wallet.

This is why the language matters so much and why sloppy phrasing here is genuinely misleading. The defensible terms are real-time adjudication and real-time payment determination. The term to avoid, unless a source specifically establishes that funds are moving instantly, is real-time payment, because it tells providers and investors something about cash that the underlying facts do not support. The most important sentence CMS could modernize is arguably not in any rule it controls. It is a payment floor written into the statute, and until that changes, the working-capital math for provider finance stays roughly where it has always been.

Who eats the risk: clearinghouses and the Change Healthcare shadow

There is a comforting intuition that a faster, more automated system means less operational risk for the intermediaries in the middle. The opposite is true, and it is not close. Machine-speed decisions magnify the consequences of everything that can go wrong upstream: stolen credentials, misrouted responses, replayed transactions, and compromised submitter authority all get worse when the system acts on them instantly and at scale. Speed is a force multiplier, and it multiplies the bad along with the good.

Which is why the existing EDI rulebook already leans hard on the intermediaries, and why it will lean harder as speed increases. The Medicare EDI requirements make clearinghouses hold their own credentials, act only for providers and transactions they are actually authorized to handle, keep that submitter authority transaction-specific rather than blanket, preserve minimum-necessary access to data, and route each response only back to the provider who initiated it. Every one of those controls is really an answer to a specific way the plumbing can be abused, and every one of them gets more load-bearing when the plumbing runs at machine speed.

The February 2024 Change Healthcare attack is the concrete reason none of this is abstract. CMS and other federal analyses now frame that event as affecting a very large share of U.S. providers, with data exposure estimates approaching 193 million individuals across providers, payers, and pharmacies, and it is the case study that put EDI cybersecurity in the same sentence as real-time claims in the first place. A single compromised node in a highly connected, fast-moving claims network is not a local outage. It is a systemic event. So the honest read for anyone in the intermediary business is that modernization raises the stakes on identity, authorization, availability, and reconciliation rather than lowering them. The faster the yes, the more it matters that the yes was asked by the right party, about the right claim, and delivered to the right place.

Speed is not modernization without parity

Strip away the slogan and the subject resolves into a fairly clear-eyed set of statements. CMS wants faster claims processing and has said so at the strategy level. The concrete target for that ambition is a draft acquisition concept, ClaimsCore, that contemplates replacing the shared systems with a cloud platform, and it is a target, not a done deal or a schedule. There is already a live, low-volume bridge, MAP, whose main lesson is that even a tiny step onto new rails required keeping every legacy connection intact. The estate being modernized is enormous and ancient, and the case for change is real, driven as much by a nine-to-twelve-month policy-change cycle as by raw speed. Migration, not adjudication, is the part that will actually determine success or failure. And the money, thanks to a statutory floor that CMS does not control, does not get faster just because the decision does.

The test to apply to every future claim about this, from CMS, from a vendor, or from a breathless analyst, is whether a fast decision stays explainable, authorized, reconcilable, and correctly posted everywhere downstream. A system that decides in three seconds but cannot answer a status inquiry consistently, or cannot reconcile against the ledger, or strands a downstream data consumer, has not modernized anything. It has just gotten quicker at creating problems. Speed without semantic parity is a demo, not a payment system, and the difference is exactly the thing worth watching as this moves from a January RFI toward whatever it eventually becomes

.

The ClaimsCore RFI contemplates replacing FISS, MCS, the DME system, and the Common Working File with a commercial cloud platform. That’s a draft acquisition concept, not an aw…

Read more

The ClaimsCore RFI contemplates replacing FISS, MCS, the DME system, and the Common Working File with a commercial cloud platform. That’s a draft acquisition concept, not an award. Nobody has replaced Medicare’s shared systems.

A live bridge, MAP, already runs in limited parallel with the legacy system. Standing it up required preserving continuity with 5 downstream repositories. Even a thin slice of new volume needed every old room to stay reachable.

Real-time adjudication and real-time payment are six different claims depending on which transaction type you mean. Only one of them touches your working capital. The 14-day floor is in statute. Congress owns it, not CMS.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

Thoughts on Healthcare Markets & Technology

CMS Re-Plumbed Medicare in One July 2026 Week: The Payment, Data, and Oversight Rails Buried in Five Separate Rules, Guidances, and Memos on Doctor Pay, Claims, AI, Drug Prices, and Nursing

CMS shipped 5 documents in 2 weeks last July. Different offices, different legal weight, zero shared cover page. Nobody noticed because it was not packaged as a plan. But read together, something big is visible…

Listen now

4 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

• Between July 2 and July 16, 2026, CMS pushed out a strategy blog, two big proposed rules (CY 2027 PFS and CY 2027 OPPS/ASC), a 102-page draft drug-price effectuation guidance, and a 13-page operative nursing-home survey memo. Different offices, different legal weight, no shared cover page.

• Read together, they rhyme. The pattern: CMS is changing what Medicare pays for and how, spelling out the data plumbing needed to run those payments, then turning that same data back into qualification, monitoring, reconciliation, and public shaming.

• Call it the payment-data-oversight spine. Payment shows up in AI-software reimbursement, site-of-service cuts, ACO incentives, and negotiated-drug refunds. Data shows up in real-time claims ambitions, FHIR quality reporting, ePA, machine-readable prices, NDC-level drug ID, and the Medicare Transaction Facilitator. Oversight shows up when that data decides a refund deadline, an ACO’s reporting status, a nursing home’s survey scope, or an icon on Care Compare.

• Big caveat: this is an editorial read, not a CMS program. CMS did not “launch three rails.” Four of the five documents are proposals or drafts. Only the nursing-home memo is live.

• Why it matters for operators: the leverage is moving out of rates and into identity, routing, reconciliation, and audit. Whoever owns the handoff owns the risk.

  Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of Contents

1. One week, five documents, zero shared cover page

2. What CMS actually said, and what it carefully didn’t

3. The three rails, minus the marketing

4. The five-step move CMS keeps running

5. Why legal status beats page count every time

6. Who inherits the plumbing

7. The five questions to ask every future CMS release

One week, five documents, zero shared cover page

Here is the thing worth staring at. In roughly two weeks in July 2026, CMS shipped a pile of material that looks, at a glance, like a coordinated modernization push. It was not packaged that way. The OPPS fact sheet landed July 2 and the proposed rule followed July 7. The Physician Fee Schedule newsroom stuff dropped July 14 and the actual proposed rule hit the Federal Register July 16. And then July 16 got busy: the Original Medicare strategy blog, the drug-price effectuation fact sheet plus its draft guidance, and the nursing-home press release plus the survey memo all came out the same day. Anybody scanning headlines that week would be forgiven for thinking a single grand plan had been announced.

No such plan was announced. What actually shipped was a proposed rule here, an RFI there, a chunk of draft guidance, one live survey memorandum, and a strategy blog that reads more like a mission statement than a mandate. The instinct to bundle them is right. The instinct to call the bundle a program is where people are going to get themselves in trouble, in analyst notes and in board decks, over the next few months.

So the honest framing is not that CMS unveiled a unified system. It is that five vehicles with wildly different legal weight all converge on the same administrative model, more or less by accident of timing and, probably, by shared institutional habit. The agency is doing the same thing in five places at once, and once you see the shape, you cannot unsee it.

Read more

The Outpatient rule proposed reimbursement for AI clinical software doing doctor-adjacent work. Not a device. Not a service exactly. A new billa…

Read more

Thoughts on Healthcare Markets & Technology

Part I: The Jan 2027 Prior Authorization Reckoning: FHIR API Mandates, the Two Year MIPS Attestation Ramp, ONC Certification Gates & Why the Real Money Sits Between the Payer Endpoint and the Order

CMS prior auth FHIR APIs are not a proposed rule. They are a January 1, 2027 hard deadline for MA plans, Medicaid managed care, CHIP, and federally facilitated exchange issuers…

Listen now

4 days ago · Thoughts on Healthcare

🎧 Part II Podcast episode for paid subscribers only. Also available on Spotify.

Thoughts on Healthcare Markets & Technology

Part II: The Jan 2027 Prior Authorization Reckoning: FHIR API Mandates, the Two Year MIPS Attestation Ramp, ONC Certification Gates & Why the Real Money Sits Between the Payer Endpoint and the Order

CMS prior auth FHIR APIs are not a proposed rule. They are a January 1, 2027 hard deadline for MA plans, Medicaid managed care, CHIP, and federally facilitated exchange issuers…

Listen now

4 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

Part 4 covers the interoperability half of the story: the 2024 CMS Interoperability and Prior Authorization final rule hitting its January 1, 2027 API compliance date, and the 2027 proposed rule’s rework of the clinician side attestations. Key mechanics:

1. Impacted payers, meaning MA organizations, state Medicaid and CHIP fee for service programs, Medicaid and CHIP managed care entities, and QHP issuers on the federally facilitated exchanges, must implement enhanced FHIR APIs by January 1, 2027: Patient Access, Provider Access, Payer to Payer, and Prior Authorization

2. The Prior Authorization API must publish covered items and services, surface documentation requirements, accept requests, and return approvals with expiration terms, denials with specific reasons, or requests for more information

3. Decision clocks of 72 hours expedited and 7 calendar days standard, plus specific denial reasons and public PA metrics, already operational since the beginning of 2026

4. The MIPS Electronic Prior Authorization measure flips from required in 2027 to optional and bonus eligible in 2027, then mandatory in 2028 with CEHRT modules certified to all three ONC electronic prior authorization criteria

5. A new Electronic Prior Authorization for Prescription Drugs measure required starting 2028, aligned with the CMS 0062 P drug prior auth proposed rule

6. CMS seeking comment on extending ePA measures to Shared Savings Program ACOs in future years

7. The build list: requirement discovery and documentation assembly middleware, payer rules and outcomes graphs built from structured denials, appeal automation with human control, drug ePA as a parallel transaction stack, and payer side implementation tooling

Table of Contents

Why prior auth got a federal plumbing mandate

What the 2024 final rule actually requires by January 2027

The four APIs, briefly and honestly

The attestation ramp: rehearsal in 2027, mandate in 2028

Certification is the distribution gate

The workflow gap is where the product value lives

Denial reasons as training data

Drug prior auth is a neighboring country with its own customs

The payer side is also a market

What this means for ACOs and the Part 1 data layer

The build list and the series thesis

Why prior auth got a federal plumbing mandate

Prior authorization is the one healthcare administrative process that unites physicians, patients, hospitals, and late night comedians in shared contempt. The current state involves phone trees, proprietary portals, faxes that refuse to die, and the genuinely absurd preliminary ritual of contacting a payer to ask whether a service requires permission before beginning the process of asking for permission. The costs are measured in staff hours, abandoned care, and delayed treatment, and everyone has known this for twenty years. What changed is that CMS decided the fix was infrastructure rather than exhortation. The 2024 Interoperability and Prior Authorization final rule, CMS 0057 F, mandated standardized FHIR interfaces and, in the same rulemaking, set prior authorization decision timelines that take effect beginning January 1, 2026, across most federally regulated coverage, and the operational deadlines are no longer abstract. The timeline and transparency requirements went live at the start of 2026. The API requirements land January 1, 2027, which at this point is a countdown measured in months, not rulemaking cycles. The 2027 proposed rule then adjusts how clinicians get scored for actually using the new plumbing, and the adjustment is more interesting than it looks.

What the 2024 final rule actually requires by January 2027

The rule applies to what CMS calls impacted payers: Medicare Advantage organizations, state Medicaid and CHIP fee for service programs, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federally facilitated exchanges. Notably absent are employer sponsored commercial plans and traditional Medicare itself, so the mandate covers a large share of covered lives while leaving the commercial book to follow voluntarily or not at all, which matters for anyone modeling market coverage of a product built on these rails.

Two requirement families are already in force. Since the start of 2026, impacted payers must issue prior authorization decisions within 72 hours for expedited requests and 7 calendar days for standard requests and must provide specific reasons when denying; however, the public reporting of prior authorization metrics including approval, denial, and appeal outcomes applies beginning with the initial reporting due March 31, 2026 for 2025 data, not at the start of 2026 itself. The specific denial reason requirement is quietly the most commercially important sentence in the rule, and the reason gets its own section below. The second family is the January 1, 2027 API compliance date, which requires the payer to stand up and enhance a set of FHIR based interfaces that turn prior authorization and payer data exchange from portal archaeology into machine readable transactions.

The four APIs, briefly and honestly

The Patient Access API, which predates this rule, gets enhanced to include prior authorization information, so a beneficiary’s app can see what has been requested, approved, and denied. The Provider Access API requires payers to share claims, encounter, specified clinical data, and non drug prior authorization information with in network providers who have a treatment relationship with the patient, subject to attribution processes and patient opt out. The Payer to Payer API moves the same data classes between plans when a patient switches coverage, addressing the eternal problem of every new plan pretending the patient’s history began at enrollment. And the Prior Authorization API is the centerpiece: it must let a provider’s system discover whether a given item or service requires prior authorization, identify the documentation requirements, submit the request electronically, and receive a decision that is an approval with its expiration conditions, a denial with specific reasons, or a request for more information. In implementation terms this maps to the FHIR Da Vinci pattern the industry has been piloting for years, coverage requirements discovery, documentation templates and rules, and prior authorization support, and the three ONC electronic prior authorization certification criteria referenced by the 2027 rule align to exactly those functions.

The honest assessment is that the APIs solve transport and discovery, which is real, and solve nothing else. Knowing that a lumbar MRI requires authorization and that the payer wants six weeks of documented conservative therapy does not locate the conservative therapy in the chart, judge whether the physical therapy notes are recent enough, or fix the request when the payer bounces it back. Those are workflow and content problems, and the rule deliberately leaves them to the market.

The attestation ramp: rehearsal in 2027, mandate in 2028

The 2024 rule originally required MIPS clinicians to attest for the 2027 performance period that they used a Prior Authorization API via CEHRT for at least one hospital discharge and medical item or service (excluding drugs). The 2027 proposed rule softens then hardens this. For 2027, the Electronic Prior Authorization measure becomes optional and available for bonus scoring if finalized as proposed. For 2028, it becomes required, and the CEHRT must include health IT modules certified to all three ONC electronic prior authorization criteria. Separately, a brand new measure, Electronic Prior Authorization for Prescription Drugs, arrives as a 2028 requirement, aligned with the CMS 0062 P proposed rule covering drug prior authorization standards.

Read as sequencing rather than retreat, this is smart regulatory design. The payer APIs go live January 2027, and requiring every MIPS clinician to transact against them in the same year the endpoints are being debugged would have produced a mutual failure spiral, with clinicians blaming payer endpoints and payers blaming provider systems while CMS adjudicated the finger pointing. Instead, 2027 becomes a rehearsal year with a carrot: early adopters collect bonus points in a program where the performance threshold sits at 75, vendors get twelve months of production traffic against real payer endpoints before failure carries penalties, and the payers get a year of load below mandate volume. Then 2028 is proposed to arrive with two mandatory measures, medical and drug, and the entire MIPS eligible population would need certified ePA capability at once if the proposal is finalized. For anyone selling into this market, that is the demand curve drawn in advance: a thin early adopter market in 2027 that determines reference customers and integration lessons, followed by a compressed compliance driven buying wave through 2028. The companies that treat 2027 as the product hardening year win the 2028 stampede. The companies that wait for the stampede will be doing implementations at gunpoint.

Certification is the distribution gate

The 2028 requirement that CEHRT include modules certified to all three ONC electronic prior authorization criteria turns certification into the market’s bouncer. A startup with an excellent prior auth workflow has three routes past the rope. It can partner with an incumbent certified EHR vendor and live inside someone else’s roadmap, which is fast to market and slow to everything afterward. It can license or white label a certified module, trading margin for speed. Or it can pursue ONC certification for its own module, which costs real money and quarters of effort but yields control of the integration surface and a moat measured in regulatory friction. Each route reshapes the sales cycle, because the buyer’s question shifts from does this work to does this count, and the answer to does this count is a certificate number, not a demo.

There is also a structural consequence worth naming: the certification requirement quietly favors the large EHR vendors, who will certify their native modules and bundle them at marginal prices, exactly as they did with prior certification waves. The independent vendor’s survivable position is not competing on the certified transaction, which becomes a commodity checkbox, but on everything the checkbox does not do, which is the next section.

The workflow gap is where the product value lives

Picture the transaction from inside the clinic. A clinician orders a procedure. The useful system asks the payer’s coverage requirements discovery endpoint whether authorization is needed and what evidence is required, then goes hunting in the chart: the diagnosis codes, the relevant labs and imaging, the medication history showing the failed conservative therapy, the notes documenting duration and severity. It assembles the documentation package against the payer’s rules, shows the clinician or staff exactly what is present and what is missing before submission, submits through the Prior Authorization API, tracks the transaction state against the 72 hour and 7 day clocks, handles the request for more information loop without anyone opening a separate portal, and writes the final status, including the approval’s expiration conditions, back onto the order where the scheduling team can see it. Then it retains the whole evidentiary trail, because an approval that cannot be reproduced during a payment dispute is a rumor.

Every clause in that paragraph is a place the generic FHIR connector does nothing and the workflow product earns its keep. The chart retrieval problem alone, finding and judging the sufficiency of clinical evidence, is a genuine language model application with actual economic stakes, and it is bounded enough to do responsibly: the model proposes the evidence package, the human approves the submission, and the audit trail records both. Fully autonomous submission is the place to not get cute, both because payers will treat automated volume adversarially and because the liability for a fabricated clinical assertion lands on the practice, not the vendor. The design principle is automation of assembly, human ownership of attestation.

Denial reasons as training data

The requirement that denials carry specific reasons, combined with machine readable transactions and the public reporting of payer level prior authorization metrics, converts an infuriating outcome into a strategic dataset. Every denial now arrives as structured feedback: this payer, this plan, this service, this diagnosis, this site of care, this documentation package, this result. Accumulate that across a customer base and the system stops being a submission pipe and becomes a predictive rules engine. It can warn before submission that the conservative therapy documentation is missing or stale, that this payer routinely bounces this service at this site of care, that the imaging result is older than the plan’s lookback tolerance. It can rank which requests to expedite, draft appeals against the stated denial reason with the responsive evidence attached, and tell a medical group which payers’ real world behavior diverges from their published policies, which is negotiation ammunition at contracting time.

The defensible asset, then, is not the transaction capability everyone will have by 2028. It is a continuously updated policy and outcomes graph, payer by payer, tied to source documents and transaction history. That graph compounds with volume, which means the market has increasing returns to scale and the early network of high volume customers is worth subsidizing. It also, inevitably, invites the arms race question, since payers can watch approval optimizing behavior and adjust. The stable equilibrium is the one where the tool raises first pass approval rates by making submissions genuinely complete and appropriate, which saves the payer review cost too, rather than by gaming criteria, which invites the criteria to mutate. Vendors get to choose which business they are in, and the choice will show up in their renewal rates.

Drug prior auth is a neighboring country with its own customs

The proposed 2028 prescription drug ePA measure, and the CMS-0062-P proposed rule it aligns with, extend the campaign into pharmacy, and anyone planning to copy and paste their medical ePA product into drugs is going to have a bad time. Drug prior authorization runs through pharmacy benefit managers rather than medical plans, speaks NCPDP transaction standards alongside the FHIR world, and lives inside e prescribing flows with their own formulary and benefit files, step therapy protocols, quantity limits, and specialty pharmacy routing. The clinical logic differs too: medical necessity for a procedure is an evidence narrative, while drug authorization is more often a criteria checklist about tried and failed alternatives, diagnosis codes, and lab thresholds, with the specialty drug tier adding hub services, financial assistance, and site of care fights.

The unified product opportunity is real but sits above the transaction layer: shared patient context, shared identity, one work queue for staff who currently juggle both worlds, and combined analytics on time to therapy and abandonment. Underneath, the transaction stacks stay separate, and pretending otherwise is how demos die in implementation. The commercial pitch on the drug side is measurable: prescription abandonment at the pharmacy counter is heavily driven by authorization friction, so the proof points are time to therapy, first fill rates, and staff touches per script, measured across the ugly long tail of plans rather than the one friendly PBM in the pilot. For pharma, faster authorization is faster revenue, which is why hub services and manufacturer funded access programs are an adjacent buyer category for the same infrastructure, with all the usual compliance chaperones that come with manufacturer money.

The payer side is also a market

The conversation defaults to provider side products, but somebody has to build the payer half, and January 2027 is close. Every impacted payer needs the four APIs live, needs its prior authorization criteria translated from PDF medical policies into machine executable requirement rules, needs its utilization management workflow rewired to consume structured submissions and emit structured decisions inside the regulatory clocks, and needs the public reporting pipeline for its PA metrics. The national carriers will build or buy at scale, but the market’s long tail, regional MA plans, Medicaid managed care organizations, and state fee for service programs, mostly cannot build this and will buy it as a service. Medicaid agencies in particular sit under the mandate with procurement cycles that move like continental drift, which paradoxically makes them durable customers once landed. The policy digitization work, converting clinical criteria documents into executable rules with version control and audit trails, is its own product category, and it has a second buyer in the provider side vendors who need the same rules from the other direction. A company that becomes the neutral rules translation layer, selling executable policy to both sides, occupies an enviably annoying to displace position.

What this means for ACOs and the Part 1 data layer

Two threads connect this part back to the beginning of the series. First, the Provider Access API is an underappreciated gift to accountable care. An ACO’s chronic problem is seeing what happens to its beneficiaries inside Medicare Advantage adjacent and cross payer contexts, and a standardized in network provider feed of claims, encounters, and clinical data, however imperfect the attribution mechanics, is a new pipe into the four ledger operating system Part 1 described. The enablement platforms that industrialize Provider Access API ingestion across many payers will have a data advantage that shows up directly in benchmark and utilization modeling. Second, the 2027 rule explicitly seeks comment on applying electronic prior authorization measures to Shared Savings Program ACOs in future years, and the new MSSP CEHRT attestation options already include a FHIR API based quality data pathway. The direction is unsubtle: CMS intends the accountable care population to run on the same standardized rails, and ACOs that build their data infrastructure FHIR native now are pre complying with rules that have not been written yet, which is the cheapest compliance there is.

The build list and the series thesis

Part 4’s products: requirement discovery and documentation assembly middleware sitting between the EHR and the payer endpoint, with human controlled submission and audit grade evidence retention; the payer rules and outcomes graph built from structured denials, sold as pre submission intelligence and appeal automation; a parallel drug ePA stack sharing context but not transactions with the medical side; payer side API implementation and policy digitization for the long tail of plans; and Provider Access API ingestion as a data feed business for the accountable care world.

Across four parts, one thesis kept surfacing. This rule cycle is CMS replacing trust based payment with verification based payment. Benchmarks get guardrails instead of projections, QP status attaches to the entity where the work actually happened, quality reporting demands attestation evidence instead of measure shopping, remote monitoring demands employed humans and initiating visits instead of contractor arbitrage, practice expense moves to auditable cost data instead of 2007 surveys, and prior authorization becomes a structured transaction instead of a fax based hostage negotiation. Every one of those substitutions creates demand for systems that produce, retain, and defend evidence. The last decade of healthcare software sold visibility. The next one sells proof. The comment period closes in September, the final rules land in the fall, and the entrepreneurs who read the preamble instead of the press release are, as usual, going to be the ones who saw it coming

.

The decision clocks already went live in 2026: 72 hours for expedited requests, 7 calendar days for standard. Specific denial reasons required. Public reporting of PA metrics sta…

Read more

The decision clocks already went live in 2026: 72 hours for expedited requests, 7 calendar days for standard. Specific denial reasons required. Public reporting of PA metrics started this year.

Four APIs due January 2027: Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization. The PA API must accept submissions and return structured approvals, denials with reasons, or info requests.

The APIs solve transport. They do not find the clinical evidence in the chart, judge its sufficiency, or fix the request when a payer bounces it. That workflow gap is where the product value actually lives.

Subscribe to www.onhealthcare.tech for free and paid articles, podcasts, and more.

Thoughts on Healthcare Markets & Technology

The 2027 Fee Schedule Money Section: Conversion Factor Cuts, the G2211 Modifier Swap, a 32 Percent ACO Recruiting Tool, the Remote Monitoring Employment Bomb, and Practice Expense Leaving 2007

CMS just published the 2027 fee schedule proposal and buried a 32% E/M payment modifier inside it. Here is what that means for every primary care practice in America…

Listen now

6 days ago · Thoughts on Healthcare

To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).

Abstract

This article covers the payment mechanics of CMS 1848 P, where the dollars actually move. Key proposals:

1. Proposed CY 2027 conversion factors of $33.17 for QPs (down 1.19 percent) and $32.84 for non QPs (down 1.68 percent), driven by expiration of the one year 2.50 percent WFTC bump

2. Same day E/M plus global procedure by the same practice: highest priced service at 100 percent, everything else at 50 percent

3. G2211 replaced by modifiers: MOD1 adds 16 percent to the E/M base code; MOD2 adds 32 percent for MSSP ACO practitioners and LEAD Model participant providers, billable for all beneficiaries served, and flows into assignment, benchmarks, and performance year spend

4. Remote monitoring: RTM limited to established patients, initiating visit required for RPM and RTM, payment only for services performed by employed clinical staff rather than contractors, device inputs revalued downward, and a comment solicitation on collapsing the CPT families into four new G codes

5. Practice expense: phase out of the specialty PE per hour scaling step anchored to 2007 or earlier data, replaced by a stabilizer; SNF Part A stay indirect PE adjustment; comment sought on the facility versus non facility differential for employed physicians

6. Global surgery: MACRA 523 data collection paused, public use file of imputed post op visit RVUs published, revaluation openly teed up

7. New coding for shared medical appointments, clinical staff advance care planning codes, SBIRT and tobacco cessation work RVU catch up, DSMT and MNT as stand alone RHC visits

8. A 340B Part D claims repository requirement starting January 2027 and a duplicate testing interoperability RFI

9. The build list: MOD2 aware revenue and ACO accounting, employed model RPM enablement, PE cost evidence platforms, global period exposure analytics

   Thoughts on Healthcare Markets & Technology is a reader-supported publication. To receive new posts and support my work, consider becoming a free or paid subscriber.

Table of contents

The conversion factor cliff nobody should pretend is a surprise

Same day E/M and the global period squeeze

G2211 dies and becomes two modifiers

MOD2 math and the 32 percent recruiting tool

The remote monitoring employment bomb

The G code bundling threat is the bigger bomb

Practice expense wakes up from 2007

The primary care repricing RFI is the whole ballgame

Odds and ends that are secretly product categories

The build list

The conversion factor cliff nobody should pretend is a surprise

Start with the number every practice CFO flips to first. The proposed CY 2027 conversion factor is $33.17 for qualifying APM participants and $32.84 for everyone else. That looks like a cut because it is one: down $0.40 or 1.19 percent for QPs and down $0.56 or 1.68 percent for non QPs versus 2026. The arithmetic underneath is worth spelling out because it explains the politics of the next six months. The statutory updates are positive, 0.75 percent for QPs and 0.25 percent for non QPs, and there is another positive 0.53 percent adjustment for proposed work RVU changes. The problem is that the Working Families Tax Cut legislation handed the fee schedule a one year 2.50 percent bump for 2026 only, and that bump now walks out the door. Current law simply requires the cliff. Expect the usual year end congressional patch drama, and expect it to matter more this time because the QP versus non QP spread is now permanent and compounding at half a point per year. The two conversion factor structure means every payment discussion in this rule is really two discussions, and every model a practice builds needs a QP toggle.

The strategic takeaway is that CMS has stopped hiding the ball. The base fee schedule is designed to erode in real terms, the QP differential is designed to widen, and the only structurally growing payment concepts in the rule attach to accountable care participation. The fee for service rate is becoming the mattress in a store that makes its money on the delivery fees.

Read more

First: the conversion factor. $33.17 for ACO participants, $32.84 for everyone else. Both are cuts. The 2.5% congressional bonus from 2026 expires. Current law requires the cliff. No surpri…

Read more

Read more

93% of MIPS reporters earned a positive adjustment in 2017-2019. The largest was 1.88%. Everyone passed, nobody got paid, every practice paid real overhead to get there.

The new core measure…

Read more