Rules-to-workflow crosswalk

The authority records

CMS-0057-F

United States; specified Medicare Advantage, Medicaid, CHIP, and Federally-facilitated Exchange payer programs · Final and effective. The rule requires impacted payers to improve prior authorization decision timeframes and denial reasons, publish aggregated prior authorization metrics, and implement FHIR-based Prior Authorization and other interoperability APIs. The prior authorization API provisions addressed by the final rule exclude drugs.

CMS-0062-P

United States; proposals affect specified CMS-regulated payers and certain HIPAA covered entities · Proposed; public comment closed June 15, 2026. The proposal would extend many electronic prior authorization, decision-time, transparency, API, and reporting policies to drugs and would adopt or update FHIR-based standards and implementation specifications for prior authorization transactions. The proposals are not final policy.

HL7 Da Vinci PAS v2.2.1

United States realm · Standard for Trial Use, active current published version. PAS defines a FHIR R4 mechanism for submitting prior authorization requests, responses, status, updates, and supporting context in a way designed to map to applicable X12 transactions. It is one part of the Da Vinci burden-reduction workflow.

HL7 Da Vinci CRD v2.2.1

United States realm · Standard for Trial Use, active current published version. CRD enables a provider workflow to query a payer for patient- and service-relevant coverage expectations such as whether prior authorization is required, documentation expectations, first-line treatments, or related instructions. It does not itself submit the authorization request.

HL7 Da Vinci DTR v2.2.0

United States realm · Standard for Trial Use, active current published version. DTR lets payers express documentation requirements computably and allows provider systems or SMART applications to retrieve existing clinical data, prompt for missing information, and create structured responses for downstream authorization or claims workflows.

X12 278 Version 5010

United States HIPAA covered-entity transactions · Adopted transaction baseline; newer X12 versions exist but require separate adoption. The 278 implementation guide defines request and response transactions for admission certification, referrals, service certification, extensions, appeals, reservations, and cancellations between providers, utilization-management organizations, and intermediaries.

NCPDP SCRIPT v2023011

United States prescription and pharmacy transactions · Final and federally adopted for future required use. SCRIPT is the core U.S. e-prescribing standard and includes transactions for electronic prior authorization and medication history. Version 2023011 adds required ePA transactions and other prescribing enhancements.

NCQA UM Accreditation

United States healthcare organizations performing utilization management · Current accreditation program; detailed standards are licensed. NCQA UM Accreditation evaluates organizations that make utilization decisions against a framework for objective, evidence-based, fair, and timely operations. Detailed standards cover clinical information, review processes, timeliness, appeals, and related controls.

URAC Health UM Accreditation

United States healthcare organizations performing utilization management · Current accreditation program; detailed standards require program materials. URAC accredits health utilization-management organizations against standards intended to support effective, transparent, and efficient UM functions, including organizational accountability and consumer protections.

CMS Part C UM Annual Data Submission

United States Medicare Advantage organizations · Finalized; submissions begin in 2026. The collection requires Medicare Advantage organizations to submit information about internal coverage criteria used by the organization or delegated entities to process Part C prior authorizations, increasing oversight of policy and delegation practices.

The operating-domain lens

Timeliness and access to care

Risk that authorization requirements, incomplete requests, review queues, handoffs, or unclear decisions delay or prevent clinically appropriate care beyond required or operationally acceptable timeframes. The crosswalk links 7 capabilities and 4 authority records.

Clinical appropriateness and decision integrity

Risk that clinical criteria, benefit rules, extracted evidence, reviewer qualifications, automation, or escalation logic produce inconsistent, unsupported, biased, or clinically inappropriate authorization recommendations or determinations. The crosswalk links 6 capabilities and 4 authority records.

Documentation completeness and burden

Risk that payer requirements are unclear or unavailable, relevant clinical evidence is missing or duplicated, and clinicians or staff must re-enter information across incompatible forms, portals, calls, or transactions. The crosswalk links 7 capabilities and 4 authority records.

Interoperability and transaction reliability

Risk that FHIR, X12, NCPDP, portal, fax, voice, identity, attachment, or legacy-system handoffs fail, lose meaning, duplicate work, or leave no reliable status and audit record. The crosswalk links 7 capabilities and 6 authority records.

Delegation, governance, and accountability

Risk that a health plan cannot demonstrate who owns policy, clinical review, decision authority, notices, appeals, metrics, accreditation, and oversight when work crosses internal teams and delegated organizations. The crosswalk links 7 capabilities and 4 authority records.

Denials, appeals, and member rights

Risk that adverse determinations lack specific, understandable reasons; appeal rights and peer review are hard to access; deadlines are missed; or later reversals cannot be analyzed without compromising member protections. The crosswalk links 6 capabilities and 4 authority records.

Transparency, metrics, and comparability

Risk that authorization counts, approval rates, denial rates, appeal outcomes, response times, and automation claims use incompatible populations, definitions, periods, or denominators and therefore mislead buyers or the public. The crosswalk links 3 capabilities and 3 authority records.

Policy, benefit, and change management

Risk that authorization lists, benefit rules, medical policies, clinical criteria, coding, service-line scope, or delegated arrangements change without accurate versioning, implementation, provider notice, and downstream testing. The crosswalk links 6 capabilities and 5 authority records.

How to use the crosswalk

Determine applicability with qualified owners, identify affected records and workflows, map each expectation to an accountable decision and retained evidence, then use capability and organization pages to frame a technology evaluation. A mapping is editorial navigation—not a conformity or legal conclusion.

Methodology

1. Define the market boundary, exclusions, operating models, and capability taxonomy before classifying organizations.
2. Require an approved official source for organization inclusion and each documented capability.
3. Keep authority sources, provider claims, independent observations, editorial synthesis, and unknowns in separate evidence states.
4. Use one primary operating model per organization while retaining adjacent scope in the narrative record.
5. Preserve source URLs, review dates, material changes, limitations, and correction history.

Limitations

• The maintained population is substantial but not claimed to be a complete global market.
• Official public documentation may omit available capabilities or lag product and service changes.
• Documented positioning does not measure product depth, configured availability, independent performance, implementation effort, customer outcome, or commercial terms.
• Authority mappings are editorial research aids and do not establish buyer-specific applicability or product conformity.
• No organization may purchase inclusion, classification, finding, or correction outcome.

Reproducibility and updates

The report is reproduced from the provider registry, normalized facts and evidence, authority and domain records, and the publication taxonomy. A material change requires a dated source and editorial explanation. Historical values remain available through the change ledger rather than disappearing when the current record changes.