CMS-0057-F is the mandate that turns payer FHIR from "nice directory" into operational APIs. Operational provisions around prior-auth decision timing and denial reasons are already live (since January 2026). The API provisions land January 1, 2027 for Medicare Advantage and Medicaid/CHIP FFS (managed care and QHP variants follow by rating/plan year).

The four surfaces: an upgraded Patient Access API (including prior-auth status), a Provider Access API, a Payer-to-Payer API (member history follows the member), and the Prior Authorization API — the CRD / DTR / PAS workflow that lets a provider discover requirements, gather documentation, and submit without a fax. Public reporting of prior-auth metrics starts in 2027.

What ImOnFHIR does with it: this is the comply-track clock. The lab exercises PAS/DTR-shaped payloads and payer-realistic scenarios so plumbing is proven before that date. We point at CMS.gov and the open Da Vinci IGs; we do not host licensed CPT content used in real prior-auth catalogs.