CMS-0062-P Explained: The Proposed October 2027 Da Vinci IG Mandate

Reviewed September 2026. Every status, date and page citation below was checked against the Federal Register text of the proposed rule, the OIRA list of rules under review and the HL7 package registry on 25 September 2026.

In brief: CMS-0062-P is a proposed CMS rule, published on 14 April 2026 at 91 FR 19890, that would build on CMS-0057-F. As drafted, it would make the HL7 Da Vinci implementation guides required from 1 October 2027, bring drugs into electronic prior authorization on two rails (the FHIR Prior Authorization API for medical-benefit drugs and NCPDP SCRIPT for pharmacy-benefit drugs), and have HHS replace the X12 278 with FHIR as the HIPAA standard for prior authorization 24 months after a final rule takes effect. It is not final. Comments closed on 15 June 2026, and on 25 September 2026 the rule was not under OMB review.

The practical reading: CMS-0057-F deadlines are fixed and arrive first, on 1 January 2027. CMS-0062-P is the direction of travel for the year after. This guide sets out exactly what the proposal says, with page citations, what is already final elsewhere, and what payers, PBMs and EHR vendors can sensibly do before the final rule appears.

CMS-0062-P status as of 25 September 2026

CMS-0062-P is still a proposed rule. It has not been finalized, it was not on OIRA's list of rules under review on 25 September 2026, and no final rule or delay notice has appeared in the Federal Register. Every date in the proposal is therefore a proposed date, not a deadline.

What would trigger finalization. The sequence to watch is: the final rule appears on OIRA's list of rules under review under RIN 0938-AV44; OIRA concludes review; the rule is placed on public inspection and published in the Federal Register with an effective date. Only then are the dates fixed, and the final rule can change them. Some commentators have projected a final rule around the end of 2026. That is a projection, not a CMS commitment, and nothing in the public record confirms it as of this review.

What CMS-0062-P proposes

CMS-0062-P proposes seven changes for Medicare Advantage organizations, Medicaid and CHIP (fee-for-service and managed care) and QHP issuers on the federally facilitated exchanges, and it would add small-group QHP issuers on the FF-SHOPs as impacted payers. The table lists each change with its proposed date and the Federal Register page where it appears.

1. The Da Vinci guides would move from recommended to required

Under CMS-0057-F the Da Vinci guides are recommended, and a payer can meet the API requirements another way. CMS-0062-P would require payers to "implement and maintain API technology conformant with an unexpired version" of the guides for each API "beginning on October 1, 2027" (91 FR 19908). CMS says it chose October rather than January because some payers "may have opted not to use the currently recommended IGs" and need time to rework.

For a payer already building to CRD, DTR and PAS, this changes little. For a payer that read "recommended" as permission to design its own prior authorization API, it turns that design into rework with a date on it.

2. Which versions: in practice, the 2.2 guides

The proposal does not hard-code a version in the payer rule. It points payers at "an unexpired version" adopted in 45 CFR 170.215, so the version follows ONC's list. Since 1 October 2026, that list holds CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1: the FY 2027 IPPS/LTCH final rule (FR doc 2026-15833, 91 FR 50315 to 50316) replaced the 2.0.1 versions with no transition period. The same rule adopted CARIN Blue Button 2.2.0, US Drug Formulary 2.1.0, Plan-Net 1.2.0 and CDex 2.1.0, and left PDex at 2.1.0. If CMS-0062-P is finalized as drafted, the 2.2 guides are what payers would be measured against.

The HL7 specifications themselves: CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1, all published 27 March 2026.

3. Drugs would enter electronic prior authorization

CMS-0057-F excluded drugs. CMS-0062-P would bring them in on two rails, chosen by benefit: drugs covered under the medical benefit through the FHIR Prior Authorization API, and drugs covered under the pharmacy benefit through NCPDP SCRIPT (91 FR 19892). The section on drug prior authorization below covers what that means for PBMs.

4. FHIR would become the HIPAA standard for prior authorization

HHS proposes "to replace the present X12N 278 transaction standard with the FHIR standard" for prior authorization transactions (91 FR 19989). This part reaches every HIPAA covered entity, including providers, clearinghouses and commercial plans, not only the payers CMS-0057-F regulates. The compliance date would be 24 months after the final rule's effective date, or 36 months for small health plans (91 FR 19896).

5. Endpoints, metrics and FF-SHOP plans

Payers would report their Patient Access, Provider Directory, Provider Access, Payer-to-Payer and Prior Authorization API endpoints to CMS "no later than 60 days after the effective date of a final rule", report changes within one week and re-verify every 12 months (91 FR 19958). Drug prior authorization metrics would be posted publicly from 2028 with 2027 data, excluding covered Part D drugs for MA-PD plans (91 FR 19942), and API usage metrics would extend beyond Patient Access (91 FR 19972). Small-group QHP issuers on the FF-SHOPs would join as impacted payers, mostly from plan years on or after 1 January 2028 (91 FR 19895).

How CMS-0062-P relates to CMS-0057-F, HTI-4 and the IPPS version update

CMS-0062-P is the third layer of a stack. CMS-0057-F sets the payer obligations and the 2027 API deadline. HTI-4 and the FY 2027 IPPS rule set what certified EHRs must support. CMS-0062-P would tighten the payer side to match and add drugs. Only the first two layers are final.

Two consequences follow. First, the provider side is ahead of the payer side on versions: from 1 October 2026 certified EHRs speak the 2.2 guides, while CMS-0057-F still only recommends the guides to payers. Epic has already put CRD into production with UnitedHealthcare, Network Health and Aetna ahead of the 2027 date. Second, the claims attachments rule and CMS-0062-P fit together: HHS kept prior authorization out of the March 2026 attachments rule, citing misalignment with the 278 and CMS-0057-F, and CMS-0062-P proposes CDex 2.1.0 as the attachments standard for prior authorization instead (91 FR 19998).

Drug prior authorization: NCPDP SCRIPT ePA vs FHIR

CMS-0062-P would not use one standard for all drugs. A drug covered under the payer's medical benefit would go through the same FHIR Prior Authorization API (CRD, DTR and PAS) built for items and services. A drug covered under the pharmacy benefit would go through NCPDP SCRIPT electronic prior authorization, the standard Part D already uses (91 FR 19892).

Some points hold on both rails. Every drug denial would need a specific reason "regardless of the method used" (91 FR 19934). Drug prior authorization status, dates, the drugs and dosage approved, and any denial reason would appear in the Patient Access, Provider Access and Payer-to-Payer APIs (91 FR 19896). CMS is not proposing to require providers to use electronic prior authorization; payers would have to make it available (91 FR 19925). Retail pharmacy HIPAA transactions stay on NCPDP; the FHIR HIPAA proposal covers dental, professional and institutional transactions only (91 FR 19896).

What changes for PBMs

For most plans the pharmacy data lives at the pharmacy benefit manager. CMS-0062-P would make the plan answerable for that data in three places: the NCPDP ePA channel itself, the drug prior authorization data in the three access APIs, and the public drug metrics. That is a contract question before it is an engineering one. In a Da Vinci roundtable in May 2026, the speaker summarising community comments said payers are "working with their third-party partners and their PBMs now to figure out how to get that data" (spoken remark, auto-captioned, HL7 Da Vinci roundtable video).

A panelist on a STAR drug prior authorization panel put the operational risk plainly: "electronic submission does not automatically mean electronic decision-making" (spoken remark, auto-captioned, STAR panel video). A 24-hour Medicaid clock applies to the decision, not to receipt, so the PBM's review queue, not the transaction format, sets the pace. The same pattern shows up for delegated entities under CMS-0057-F: the plan's API answers for vendors it does not run.

Does the X12 278 go away?

Not yet, and not for everything. Today the X12N 278 is the HIPAA standard for prior authorization, and HHS has used enforcement discretion since February 2024 to let covered entities use an all-FHIR prior authorization API instead. CMS's own FAQ says the 278 alone cannot meet the CMS-0057-F API requirements.

If CMS-0062-P is finalized as drafted, X12 278 would stop being the HIPAA standard for prior authorization 24 months after the effective date (36 months for small health plans), replaced by FHIR R4, US Core 6.1.0, SMART App Launch 2.0.0, CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1 (91 FR 20061). CRD would replace the 270/271 only when an eligibility check is used to determine whether prior authorization is required; ordinary eligibility stays on the 270/271. HHS also asked whether to keep the 278 for other referral certification uses (91 FR 19998), so its future for non-prior-authorization referrals is an open question.

The practical answer for the next two years is hybrid. Clearinghouses and payers will run the 278 and FHIR side by side, and the PAS guide's mapping to the 278 is what connects the two. Our Da Vinci PAS and the X12 278 guide shows how a PAS server carries that bridge.

What payers should do now, and what can wait

Payers should act now on anything that is cheap if CMS-0062-P changes and expensive if it does not, and wait on scope decisions that depend on the final text. The CMS-0057-F 1 January 2027 deadline comes first either way.

On timing, a panelist on the STAR drug prior authorization panel called CMS-0062-P work "a 12 to 18 months project end to end" even for organisations that have finished CMS-0057-F (spoken remark, auto-captioned, STAR panel video). If the proposed 1 October 2027 date holds, that range means the planning window is already open.

What EHR vendors and provider groups should do

EHR vendors certifying to 170.315(g)(31) to (g)(33) are already on the 2.2 guides from 1 October 2026, whatever happens to CMS-0062-P. The open items for them are the drug path and the HIPAA change: medical-benefit drug orders would flow through CRD, DTR and PAS to payers, and pharmacy-benefit prescriptions through NCPDP SCRIPT ePA, which ONC already requires certified e-prescribing modules to support on version 2023011 from 1 January 2028 (91 FR 19903). Vendors that serve practices using a clearinghouse for the 278 should plan a FHIR route for the day the HIPAA standard changes.

Provider groups do not have to adopt electronic prior authorization under CMS-0062-P, but hospital Promoting Interoperability already has an electronic prior authorization measure that is optional in 2027 and required from 2028. Provider organizations planning EHR integration work for 2027 should check that their payer connections include the Da Vinci workflow, not only portal logins.

Proof: open-source Da Vinci servers tested with Inferno

Nirmitee has published open-source Da Vinci CRD, DTR and PAS servers, each serving the 2.2 and 2.0.1 versions side by side, and ran them against ONC's Inferno test kits on the public Inferno service. Inferno results are conformance evidence; CMS runs no certification program for payers or vendors.

The servers pass every test in the Inferno CRD and PAS server suites, and pass the DTR payer server suites apart from two Inferno test-kit issues (one open, one fixed upstream and awaiting deployment). Each README links the public Inferno sessions. For how each guide works, see our explainers on Da Vinci CRD (Coverage Requirements Discovery) and Da Vinci DTR, and our CMS-0057-F testing guide for building an evidence pack, since there is no CMS certification program to lean on.

What this means for a roadmap

CMS-0062-P turns CMS-0057-F from a project that ends on 1 January 2027 into the first phase of a multi-year programme. A payer that builds a conformant Prior Authorization API on the 2.2 guides and keeps testing would meet a finalized 1 October 2027 date as a checkpoint, with drugs and the PBM connection as the new work. A payer that builds something bespoke to the letter of the current rule would meet it as a second project. The dates can still move; the direction, toward named guides, drugs in scope and FHIR as the prior authorization standard, is set out in the proposal itself.

Sources

• CMS-0062-P proposed rule, 91 FR 19890, 14 April 2026: federalregister.gov/d/2026-07205
• CMS-0057-F final rule, 89 FR 8758, 8 February 2024: federalregister.gov/d/2024-00895
• FY 2026 IPPS/LTCH final rule including HTI-4: federalregister.gov/d/2025-14681
• FY 2027 IPPS/LTCH final rule (170.215 version update): federalregister.gov/d/2026-15833
• HIPAA claims attachments final rule, March 2026: federalregister.gov/d/2026-05676
• OIRA rules under review (checked 25 September 2026): reginfo.gov
• Spoken remarks are quoted from auto-captioned recordings and linked to the video; the rule text remains the primary citation.

If you are scoping the Prior Authorization API, the drug rails or the 278 bridge, our CMS-0057-F implementation services start with a fixed-scope readiness assessment. Our healthcare interoperability team builds and tests Da Vinci APIs for payers and health-tech platforms. Talk to our team.