API
(b) Prior Authorization Application Programming Interface (API). Unless granted an extension or exemption under paragraph (c) of this section, beginning January 1, 2027, a State must implement and maintain an API conformant with 431.60(c)(2) through (4), (d), and (e), and the standards in 45 CFR 170.215(a)(1), (b)(1)(i), and (c)(1) that (1) Is populated with the State's list of covered items and services (excluding drugs, as defined in 431.60(b)(6)) that require prior authorization; (2) Can identify all documentation required by the State for approval of any items or services that require prior authorization; (3) Supports a HIPAA-compliant prior authorization request and response, as described in 45 CFR part 162; and (4) Communicates the following information about prior authorization requests: (i) Whether the State (A) Approves the prior authorization request (and the date or circumstance under which the authorization ends); (B) Denies the prior authorization request; or (C) Requests more information. (ii) If the State denies the prior authorization request, it must include a specific reason for the denial.