Federal regulators fined 14 Medicare insurers a combined $1.54 million and described a pattern of system failures that left patients without medications they were entitled to receive, in an audit report released this week.
The Contract Year 2025 Part C and Part D Program Audit and Enforcement Report from the Centers for Medicare and Medicaid Services covers 18 violations across Medicare Advantage and Part D plans. In 89 percent of those violations, enrollees experienced financial harm of more than $100.
The report comes five months before the deadline meant to fix part of the underlying problem. Starting January 1, 2027, Medicare Advantage, Medicaid, CHIP and marketplace plans must operate electronic systems that let doctors submit prior authorization requests and receive answers digitally rather than through fax queues and phone trees.
For patients, the connection between the two is direct. A prior authorization sitting in a fax machine is a prescription not filled and a procedure not scheduled.
What the Audit Found
The named penalties are public. CVS Health Corporation received the largest at $753,805, followed by Centene Corporation at $380,785, Group 1001 at $84,190, USAble Mutual Insurance Company at $57,757, Health Care Service Corporation at $50,437, and UnitedHealth Group at $48,869. Nine smaller penalties ranged from about $10,000 to $43,000 and included Highmark Health, EmblemHealth, Devoted Health and Memorial Hermann Health Plan.
Most violations involved beneficiary cost sharing and provider payments. Six concerned maximum out-of-pocket protections, where enrollees kept paying cost sharing after they had already hit their annual limit. Two involved low-income subsidy processing. One involved Part D medications rejected because of eligibility errors.
The audit findings are more revealing than the penalty totals. CMS described duplicate logic in a prior authorization system that failed after a software update, causing appeals to process incorrectly. It found system edits that made approved coverage requests unavailable for the rest of the plan year. It found patients eligible for transition fills denied medications because systems checked prior enrollment dates instead of current ones.
CMS also found appeals submitted by a different prescriber processed as brand new coverage requests rather than as appeals, which restarts a clock that should have been running. And it found coverage decisions made without reviewers having all the relevant clinical information in front of them.
The agency's own summary is blunt about the consequence. When data is wrong or systems misfire, the report says, "beneficiaries may experience claim rejections, delayed access to medications or services."
One violation carried two aggravating factors at once because enrollees were denied access to drugs used to treat acute conditions requiring immediate treatment.
What Changed This Year and What Changes Next January
Two separate sets of requirements are often confused, and the distinction matters for anyone waiting on an answer right now.
The first set took effect January 1, 2026, and is already law. Under the CMS Interoperability and Prior Authorization final rule, affected payers must issue expedited prior authorization decisions within 72 hours and standard decisions within seven calendar days. That standard timeline is half of what it previously was. Payers must also give a specific reason for every denial, regardless of how the request arrived, which is what makes a fast appeal possible.
The second set arrives January 1, 2027, and is the technology piece. Affected payers must run application programming interfaces built on a common health data standard, including one that lets a provider see what requires prior authorization, submit the request, track it, and receive the decision without leaving the electronic health record. Payers must also expand patient-facing access so enrollees can see their own prior authorization information, and share data with in-network providers and with other plans when a patient switches coverage.
CMS is also requiring payers to publish annual prior authorization metrics on their websites, including the share of requests approved, denied, and approved on appeal, plus the average time from submission to decision.
The rule applies to Medicare Advantage organizations, state Medicaid and CHIP programs and their managed care plans, and qualified health plan issuers on the federally facilitated marketplaces. Marketplace issuers are excluded from the decision-timeframe requirement.
In its report, CMS signaled that compliance with the new timeframes is now an audit target, telling plans to be ready to show they can identify delayed cases before they exceed the limits.
Faster Decisions Are Not the Same as More Approvals
This is the part that gets lost in the coverage of prior authorization reform, and it is the part patients should hold onto.
Nothing in the rule changes what a plan is allowed to deny. It does not narrow the list of services requiring authorization, alter medical necessity criteria, or create a right to a treatment a plan has decided not to cover. It changes how quickly an answer arrives, how clearly a denial is explained, and how visible the process is.
That is not nothing. A denial delivered in seven days with a specific reason attached can be appealed while a condition is still treatable. A denial that takes three weeks and says only that criteria were not met costs a patient a month.
But a household expecting approval rates to jump next January will be disappointed. The published metrics will make approval and denial rates visible for the first time in a comparable way, which may itself create pressure. That is a slower mechanism than a rule change.
CMS Administrator Dr. Mehmet Oz acknowledged the limits in announcing an industry readiness initiative in May, saying prior authorization "won't be fixed by technology alone." That effort has enlisted 29 health systems, electronic health record vendors and networks, including Cleveland Clinic, Providence, Ochsner Health, Epic, Oracle and athenahealth, alongside major insurers that pledged cooperation last year.
Who Feels This Most
The burden is concentrated among people whose care depends on repeated authorizations. That includes patients on specialty drugs for cancer, autoimmune disease and multiple sclerosis, people needing post-hospital skilled nursing or rehabilitation placement, and patients whose medications require renewed approval each plan year.
Roughly 35 million Americans are enrolled in Medicare Advantage plans, and enrollment is projected to keep climbing. Traditional Medicare uses prior authorization far less, which is why the experience of two people on Medicare can differ so sharply.
Patients are not powerless in the meantime. Anyone who receives a denial should request the specific reason in writing, because plans are now required to provide it. Ask the prescribing office whether an expedited request is appropriate, since urgent requests carry the 72-hour clock. Track the submission date, because the deadline runs from when the plan received the request, not from when you learned about it. And appeal, since a meaningful share of denials are overturned when challenged.
State Health Insurance Assistance Programs offer free counseling on Medicare appeals, and 1-800-MEDICARE can direct beneficiaries to local help. Nobody should stop or delay a prescribed treatment because of a coverage dispute without first talking to the prescribing clinician.
What Happens Next
CMS has said it is updating audit protocols to draw more on data it already holds, and that compliance officers should expect prior authorization timeliness to feature in upcoming audits. The agency continues quarterly compliance calls with plans.
The next visible milestone for patients is the public metrics reporting, which will show plan-by-plan approval and denial rates. The larger one is January 1, 2027.
The confirmed facts are that CMS penalized 14 Medicare sponsors $1.54 million for 18 violations, that most involved cost sharing and payment failures, and that electronic prior authorization becomes mandatory next January. The people most affected are Medicare Advantage enrollees on specialty drugs or awaiting post-hospital placement. The most reasonable action is to demand the written denial reason and appeal it. The central uncertainty is whether faster, more transparent decisions eventually change how often plans say no.
Frequently Asked Questions
What did CMS announce? An audit and enforcement report covering 2025, with 14 civil money penalties totaling $1.54 million across 18 violations by Medicare Advantage and Part D sponsors.
Which plans were penalized? CVS Health received the largest penalty at $753,805, followed by Centene at $380,785. UnitedHealth Group, Health Care Service Corporation, Highmark Health, EmblemHealth and others received smaller amounts.
When do the new prior authorization rules take effect? Decision timeframes of 72 hours for urgent and seven calendar days for standard requests began January 1, 2026. The electronic exchange requirements begin January 1, 2027.
Will my treatment be approved more often after January 2027? Not necessarily. The rule governs speed, transparency, and data exchange. It does not change what plans are permitted to deny.
What should I do if I get a denial? Request the specific reason in writing, which plans must now provide, and file an appeal. Ask your prescriber whether an expedited request applies.
Does this apply to traditional Medicare? The rule covers Medicare Advantage, Medicaid, CHIP and marketplace plans. Traditional Medicare uses prior authorization far less often.
Where can I get free help appealing? Your State Health Insurance Assistance Program offers free Medicare counseling, and 1-800-MEDICARE can point you to local resources.
