Prior Authorization Is Becoming a Software Business

Prior authorization has spent years looking like a clinical argument. It is really an information problem with a payment lever attached.

CMS has been pushing that fact into the open this month. On May 13, the agency said 29 provider groups, EHR vendors, networks, and digital health developers had joined its electronic prior authorization acceleration effort. That builds on last year's insurer pledge and on rules already forcing Medicare Advantage, Medicaid, CHIP, and federally facilitated exchange plans to meet decision timelines and move toward API-based workflows.

The easy read is that patients may get faster approvals. The more important read is that prior authorization is slowly ceasing to be a hidden insurance moat and turning into a software standard. Once requests, denial reasons, turnaround times, and documentation requirements move into structured digital pipes, insurers lose some of the advantage that came from owning messy, manual workflow.

That matters because administrative friction has always done quiet financial work. It discouraged marginal claims. It wore down provider offices. It favored large organizations that could afford armies of people to chase forms, faxes, and portal logins. A system like that does not only control utilization. It also decides who can absorb overhead.

CMS is now standardizing the opposite. Providers are being told to test FHIR-based connections with payers and EHR vendors ahead of the January 1, 2027 electronic prior authorization deadline. The agency says prior authorization costs providers $20 to $50 an hour and consumes about 13 hours a week on average, or roughly 700 hours a year for each provider. CMS also says the broader policy shift could save about $15 billion over 10 years.

The pledge architecture matters too. Participating plans have committed not only to standardized APIs, but also to reducing the volume of services subject to prior authorization, honoring existing approvals during insurance transitions, and expanding real-time decisions by 2027. That makes this reform operational, not cosmetic.

If those numbers are even directionally right, the biggest winners may not be the people most often named in political fights over prior auth. The clearest beneficiaries could be the companies that sit in workflow: EHR vendors, network connectors, revenue-cycle tools, and health plans that can plug into those systems without turning every approval into a scavenger hunt. In other words, some value may migrate away from denial management and toward clean integration.

That does not mean insurers lose. In fact, the stronger carriers may like this transition. Standardization can lower their own administrative costs, reduce public heat around opaque denials, and make it easier to scale across Medicare Advantage, Medicaid managed care, and exchange products with one operating model. But it does mean the edge shifts. Winning by making the process hard becomes less durable. Winning by being fast, predictable, and digitally legible becomes more valuable.

That is why investors should pay attention to the details CMS is adding around metrics and reporting. Once prior authorization data is published more consistently, this stops being a vague complaint category and starts becoming an operating benchmark. Plans that look efficient will have evidence. Plans that are slow or unusually denial-heavy will become easier to spot. Software vendors that help shorten cycle times will have a cleaner sales pitch than "we reduce burden."

The casual read on prior authorization reform is consumer-friendly bureaucracy cleanup. The deeper read is that Washington is helping convert one of healthcare's oldest friction businesses into a standards business. That is a subtle but meaningful shift in where profits, bargaining power, and product differentiation can live.

Healthcare investors have spent years debating medical loss ratios, rate notices, and utilization trend. They should keep doing that. But the next important margin story may be more boring and more powerful: who adapts fastest when prior authorization stops being paperwork and starts behaving like infrastructure.