One voluntary pledge, five tech companies, no deadline, and a law written in 1974 that explains why Washington cannot simply fix this.
Prior authorization has generated more federal activity in 2026 than almost any other healthcare topic. A final rule. A proposed rule for drugs. A voluntary pledge from insurers covering 257 million Americans. A formal statement from five major employers. And yet, by the federal government's own math, the largest block of commercially insured people in the country remains outside every mandatory requirement.
On October 21, 2026, CMS and the Department of Labor announced that five employers have signed a statement backing electronic prior authorization for self-funded health plans. The five signatories are Amazon, Axon Enterprise, Google, Meta, and Oracle. The statement notes that more than 53 percent of Americans, more than 180 million people, receive their coverage through employer-sponsored self-funded plans. According to CMS, other employers can sign on through a CMS email address.
The question worth asking is why the CMS announcement was an employer statement and not a rule. To answer that, you have to go back to 1974.
1. The Law That Made Self-Funded Plans Federal Territory
In 1974, Congress passed ERISA, the Employee Retirement Income Security Act. ERISA created a federal framework for employer-sponsored retirement and health plans. The law's preemption clause is the detail that matters most for prior authorization. States cannot directly regulate self-funded employer plans. That blocks state insurance commissioners from setting benefit requirements, imposing coverage mandates, or, critically, extending electronic prior authorization rules to employers that self-insure.
The numbers are large. KFF's 2025 Employer Health Benefits Survey finds that 67 percent of covered workers in the United States are in self-funded plans. In firms with 200 or more workers, the share rises to 80 percent. A 2021 Health Policy Nerd analysis puts roughly 65 percent of the 155 million Americans with employer-sponsored health insurance in ERISA-governed self-funded plans. These are not small employers running niche arrangements. They are the default for anyone who works for a mid-to-large company.
When a self-funded employer pays claims, it is not buying a group insurance policy from a carrier. It is using its own reserves to cover employee health costs. Most employers hire a third-party administrator, often a subsidiary of a large insurer or a pharmacy benefit manager, to process claims, run utilization management, and provide network access. The employer takes the financial risk. The TPA runs the workflow. State insurance regulators have almost no jurisdiction.
That architecture is why CMS cannot simply issue a rule and reach 180 million people. The agency can write rules for Medicare Advantage organizations, state Medicaid programs, and plans sold on the ACA exchanges. It can encourage. It can convene. It cannot directly mandate that a TPA change its electronic prior authorization setup for a self-funded employer plan unless Congress hands it the authority to do so.
The employer statement of October 21 is the voluntary answer to that structural limit.
2. What the Statement Actually Says and Does Not Say
The employer statement makes four asks. It calls on third-party administrators to meet the voluntary insurer pledge from June 2025. It urges HHS, CMS, and pledge participants to make new electronic prior authorization platforms available to self-insured ERISA plans immediately. It wants carriers and administrators to offer reforms, such as changes to which services require prior authorization, on a plan-by-plan basis. And it frames each employer's adoption as an ERISA fiduciary decision, acknowledging that every plan sponsor must weigh the choice independently.
Read that carefully. The statement asks TPAs to do something. It does not require them to do it. The CMS press release quotes HHS Secretary Robert F. Kennedy, Jr.: "Prior authorization should help patients get the right care, not trap doctors and families in administrative delays." That is a statement of purpose. No enforcement follows.
The statement does not set a deadline for TPA compliance. It does not say what happens if an administrator declines. It does not create a contractual obligation. It does not change a single coverage rule.
What it does is give employers a shared language and a public pressure point. Five large employers, with combined market influence that TPA contracts reflect, have named a direction. More can sign. The CMS page lists an email address for exactly that. A TPA serving ten large self-funded employers faces a different conversation when several of them reference this statement at renewal than when none of them do.
That is the real mechanism: not a mandate but a coordination signal that shifts the default in contract negotiations.
3. The Rule That Left Self-Funded Plans Out
The Interoperability and Prior Authorization Final Rule, CMS-0057-F, is the statutory backbone of what the voluntary pledge is trying to extend. It is also the document that draws the line most clearly around self-funded plans.
CMS-0057-F applies to five categories of payers: Medicare Advantage organizations, state Medicaid and CHIP fee-for-service programs, Medicaid managed care plans, CHIP managed care entities, and Qualified Health Plan issuers on the federally facilitated exchanges. Self-funded employer plans are not on the list.
The rule has two main sets of dates. In January 2026, payers covered by the rule had to begin giving specific reasons for denied prior authorization decisions and meet decision timeframes of 72 hours for urgent requests and seven calendar days for standard ones. QHP issuers on the federal exchanges were excluded from the timeframe requirement. The full suite of API requirements arrives January 1, 2027, now 67 days away from today's date of October 26, 2026, by our arithmetic.
The API requirements are substantive. Covered payers must publish their list of covered items and services. They must identify documentation requirements for prior authorization. They must accept requests and return responses electronically. They must communicate an approval, a denial with a specific reason, or a request for more information, in computable form. HHS also announced enforcement discretion on the HIPAA X12 278 standard, so a FHIR-based API or a hybrid FHIR and X12 278 approach can satisfy the rule.
CMS estimates that about 365 parent organizations are subject to CMS-0057-F. That is not a small group, and the rule will produce real change for the markets it covers. CMS projects it will save $15 billion over ten years. The CAQH Index data supports that direction: a manual prior authorization transaction costs an average of $10.97; a fully electronic one costs $5.79, a 47 percent reduction per request.
Then put that rule next to the employer market. If 67 percent of covered workers are in self-funded plans, a rule that covers Medicare Advantage, Medicaid, and the exchanges still leaves the majority of commercially covered people outside its direct reach. A physician practice running prior authorizations for both a Medicare Advantage patient and a patient in a large tech company's self-funded plan will face two different workflows on the same day, possibly from the same TPA, after January 1, 2027.
A second proposed rule, CMS-0062-P, published April 10, 2026, would extend electronic prior authorization to prescription drugs. Its proposed compliance date is October 1, 2027. It would also add small group QHP issuers on the FF-SHOP. The proposal does not name self-funded plans either.
4. The Pledge Record, One Year In
The employer statement asks administrators to meet the June 2025 insurer pledge. It is fair to look at how that pledge is doing before measuring what extension to it is worth.
The June 23, 2025 voluntary pledge, announced by major insurers covering 257 million Americans according to AHIP as reported by HFMA, had six components. Insurers committed to standardized electronic prior authorization targeted for January 1, 2027. They promised to narrow the scope of services requiring authorization. They committed to a 90-day continuity-of-care period after a patient changes plans. They said plain-language determinations would accompany approvals and denials. They targeted 80 percent of electronic prior authorization requests delivered in real time, with an approval or denial, by 2027. And they said non-approved requests would go to medical review by a qualified clinician.
The April 2026 progress report tells a mixed story. AHIP and the Blue Cross Blue Shield Association reported that participating plans eliminated 6.5 million prior authorizations, an 11 percent reduction. AHIP specified that the figure covers medical services and not prescription drugs. The coalition did not name which services were removed or how the cuts varied by insurer.
KFF Health News reported on July 17, 2026 that eight insurers that signed the original pledge did not sign the April 2026 update on standardizing electronic prior authorization. The eight are Alignment Health Plan, EmblemHealth, HealthFirst, Independent Health, Medica, MVP Health Care, Point32Health, and SummaCare. EmblemHealth subsequently said it would sign. Medica described the technology update as a "significant technical and operational hurdle" it cannot commit to now.
The same reporting noted that CMS Administrator Mehmet Oz had promised public dashboards to track progress and that none have appeared. Representative Greg Murphy, a North Carolina Republican and a physician, called the pledge "no teeth." AHIP spokesperson Chris Bond said "there is still significant work ahead."
On the ground level, the burden data moved in the wrong direction. MGMA's September 2026 poll found that 44 percent of medical group leaders said prior authorization turnaround times became slower in 2026 compared with 2025, even with the first-phase CMS-0057-F requirements in effect. MGMA's 2026 Regulatory Burden Report found that 90 percent of practices said prior authorization burden increased over the prior 12 months.
That is the baseline an employer is working with when it decides whether to ask its TPA to meet the pledge.
5. The Physician Survey and the Denial Math
The AMA published the results of its 2025 Prior Authorization Physician Survey on May 13, 2026. The survey covered 1,000 practicing physicians. The topline results describe a system that is technically improving while administratively worsening.
Ninety-five percent of physicians said prior authorization delays access to necessary care. Seventy-nine percent said patients abandon treatment because of authorization challenges. Twenty-six percent reported a serious adverse event tied to prior authorization delays, including hospitalization, permanent impairment, or death. Seventy-four percent said denials increased over the past five years.
On the administrative side: physicians and their staff spend an average of 13 hours per week on prior authorizations. Physicians complete an average of 40 prior authorizations per week. Ninety-four percent say the process contributes to burnout. Colin Banas, MD, chief medical officer at DrFirst, told Physicians Practice that prior authorization friction has overtaken EHR friction as the leading administrative irritant for physicians. He also noted that without payers operational on the receiving end, new APIs risk falling back to phone calls and faxes, and that enforcement could lag as it did in the early years of the information blocking rule.
Only 33 percent of physicians said they believe the insurer pledge will make a meaningful difference. AMA President Bobby Mukkamala, M.D., said that "Physician trust in voluntary insurer pledges is deeply eroded after years of unfulfilled promises."
The denial math offers a different window. Medicare Advantage, the one payer market with public data at scale, generated about 52.8 million prior authorization determinations in 2024, according to a KFF analysis published January 28, 2026. About 7.7 percent were denied, fully or partially, which is roughly 4.1 million requests. Only 11.5 percent of those denials were appealed. Of the appeals, 80.7 percent were overturned.
Read that sequence again. Most requests are approved. Most denials are never appealed. When a denial is appealed, it almost never holds. One reasonable interpretation: the authorization process is not primarily sorting clinically necessary care from unnecessary care. It is creating friction that most patients and practices do not overcome, and the clinical necessity determination largely disappears on appeal. The administrative burden, not the coverage decision, may be the operative variable.
No equivalent public data set exists for self-funded commercial plans. If you administer a self-funded plan today, you may not be able to answer basic questions: what is your plan's denial rate, what share of denials are appealed, and what share of those are overturned. CMS-0057-F begins to require prior authorization metrics reporting for impacted payers. Self-funded plans have no such obligation. That is a gap the employer statement, even if fully adopted, does not fill.
6. What the 67-Day Clock Means for Providers
January 1, 2027 is now 67 days away, by our arithmetic from October 26, 2026. For providers, the deadline is not a single obligation but a cluster of them, and only some require action on the provider side.
The Prior Authorization API is a payer-side obligation. Payers covered by CMS-0057-F must publish their list of covered services, accept electronic prior authorization requests in FHIR format, and return decisions electronically. The provider's EHR vendor, clearinghouse, or e-prescribing platform connects to those APIs. For providers, the immediate task is not building API infrastructure but confirming that your vendors are ready to connect to the payers' APIs on day one. MGMA and physician practice groups have recommended requesting that confirmation in writing.
The Promoting Interoperability measure linked to electronic prior authorization requests begins with the 2027 MIPS performance period. That is a practice-level reporting requirement, not a deadline on January 1, but the systems and workflows that feed it should be in place before claims start accumulating in 2027.
The baseline problem is that most practices have no current performance data to compare against. Banas advised practices to track approval rates, denial rates, appeal rates, overturn rates, and turnaround times by payer now, before the APIs go live. Without a pre-API baseline, you cannot tell whether digitization reduced your administrative burden or just moved it to a different format.
For health system leaders, the practical framing is payer-by-payer. CMS-0057-F covers your Medicare Advantage and Medicaid managed care payer relationships. It does not cover your large self-funded employer contracts. Those contracts are where the employer statement becomes relevant, and where a conversation with your TPA contacts now, before the five tech company announcement fades from the news cycle, may produce something useful: a timeline, a readiness confirmation, or at minimum a documented request you can reference later.
For FQHCs, the exposure runs in two directions. Medicaid managed care plans are impacted payers under the rule, and that is a large share of most health centers' patient population. The API requirements on that side arrive January 1, 2027 and are not voluntary. On the commercial side, health center patients who are employed by small and mid-size companies may sit in fully insured plans also covered by the rule, or in small self-funded plans where the employer statement has no reach. Tracking prior authorization friction by payer type will help you see where the burden concentrates and how it shifts after January 1.
For radiology and AI diagnostics, the lesson is about workflow positioning, not technology specifications. An AI tool that identifies an abnormal finding accelerates the first step in a clinical pathway. Prior authorization often controls the second step: follow-up imaging, biopsy referral, specialist consult. If the authorization for that second step sits in a manual fax queue at a self-funded plan TPA that has not met the pledge, the time-to-treatment does not improve in proportion to how quickly the AI found the finding.
The implication: when evaluating AI tools for diagnostic workflows, ask the downstream question explicitly. After the AI flags an abnormality, what payers cover this patient population? Are those payers in scope for CMS-0057-F, or self-funded? What is the current authorization turnaround time for the downstream service? Does your contract with the TPA include a turnaround service level? These questions place the tool in its actual operating environment rather than the idealized one.
What This Means for Lung Cancer Detection
This is the lane Oatmeal Health works in. We build AI lung cancer diagnostics designed to catch cancers earlier in underserved communities, including Federally Qualified Health Centers that serve patients with elevated lung cancer risk and limited access to specialists.
The prior authorization landscape intersects with lung cancer screening in a specific way. The U.S. Preventive Services Task Force issued an A recommendation for annual low-dose CT lung cancer screening in adults aged 50 to 80 with a 20 pack-year smoking history. Most preventive services with A or B USPSTF recommendations are covered without cost-sharing under the ACA, including by self-funded ERISA plans that comply with the ACA. But the pathway from a positive screening result to a follow-up scan, biopsy, or pulmonary medicine referral requires prior authorization in many plans. That is where the friction concentrates.
An AI model that identifies an actionable lung nodule on a chest CT delivers the most value when the next step is clear and fast. When the patient's coverage is a self-funded plan with a TPA that has not adopted the pledge and still runs manual fax-based authorizations, the value of the early detection erodes in the delay. We have seen authorization turnaround times for diagnostic imaging range from same-day to three weeks depending on the payer. Three weeks in a suspected lung cancer pathway changes outcomes.
The employer statement is a signal that large employers understand this problem. If more employers sign on, if TPAs see the administrative cost of not modernizing as greater than the cost of modernizing, and if CMS eventually moves enforcement from discretion to rule, the pathway from detection to diagnosis gets shorter for more patients. That is the outcome worth watching, not the press conference.
For now, the statement is useful as a negotiating reference and early as a structural fix. Providers working in self-funded plan patient populations should use it as a prompt to check their own contracts, identify their TPA contacts, and put a request in writing before January 1.
**Jonathan Govette** is Co-Founder and CEO of Oatmeal Health, an AI lung cancer diagnostics company focused on catching cancers earlier in underserved communities. He writes The Oatmeal Bite for health system leaders, FQHCs, radiologists, and benefits leaders.
Key References
CMS, press release, "Leading Employers Back Expansion of Electronic Prior Authorization to Self-Funded Health Plans," October 21, 2026. cms.gov. Source for five signatories, 180 million figure, Census statistic, and Kennedy quote.
CMS, "Employer Statement of Support Encouraging Third-Party Administrators to Expand the Prior Authorization Pledge to the Self-Funded Market," cms.gov. Source for four asks, lack of deadline, ERISA fiduciary language, and sign-on email address.
CMS, fact sheet, Interoperability and Prior Authorization Final Rule (CMS-0057-F), cms.gov. Source for impacted payers, decision timeframes, API requirements, January 2026 and January 2027 effective dates, 365 parent organizations, and $15 billion 10-year savings estimate.
CMS, fact sheet, CMS-0062-P, April 10, 2026. cms.gov. Source for proposed drug prior authorization rule, October 1, 2027 proposed compliance date, and FF-SHOP addition.
KFF, 2025 Employer Health Benefits Survey. kff.org. Source for 67 percent and 80 percent self-funded shares.
KFF, "Medicare Advantage Insurers Made Nearly 53 Million Prior Authorization Determinations in 2024," January 28, 2026. kff.org. Source for 52.8 million determinations, 7.7 percent denial rate, 11.5 percent appeal rate, and 80.7 percent overturn rate.
American Medical Association, press release, 2025 AMA Prior Authorization Physician Survey, May 13, 2026. ama-assn.org. Source for 95 percent, 79 percent, 26 percent, 74 percent, 13 hours per week, 33 percent, 24 percent figures, and Mukkamala quote.
Physicians Practice, "Prior Authorization a Year After the Insurer Pledge," Keith A. Reynolds. physicianspractice.com. Source for 40 prior authorizations per week, 94 percent burnout, Banas quotes, four API types, and MIPS 2027 measure.
KFF Health News, "Insurers Hedge on Trump-Backed Pledge To Improve Denials Process," Lauren Sausser and Renuka Rayasam, July 17, 2026. kffhealthnews.org. Source for eight non-signing insurers, Medica quote, no public dashboards, Murphy "no teeth" quote, and Bond quote.
HFMA, coverage of June 2025 insurer pledge. hfma.org. Source for 257 million covered, six pledge components, and voluntary structure.
Becker's Payer Issues, "Insurers' Prior Authorization Commitments, 1 Year In," Elizabeth Casolo, July 20, 2026. beckerspayer.com. Source for AHIP/BCBSA April 2026 6.5 million PA eliminations (secondhand).
Insurance Business Magazine, "Health Plans Have 10 Weeks to Meet the Prior Auth API Deadline, and the Burden Has Not Eased Yet," October 2026. insurancebusinessmag.com. Source for MGMA September 2026 poll (44 percent slower), MGMA 2026 Regulatory Burden Report (90 percent increased burden), MCG Health and Itiliti Health partnership, and CAQH Index transaction cost comparison ($10.97 manual, $5.79 electronic).
Health Policy Nerd Substack, "ERISA, Third Party Administrators, and Self-Funded Plans: America's Primary Insurance Scheme." healthpolicynerd.substack.com. Source for ERISA preemption structure and TPA operating model.