Three Federal Clocks, Fifty State Rules: The Prior Authorization Paradox Health Plans Cannot Ignore
CMS has built a federal automation mandate, launched an AI pilot in traditional Medicare, and lost a legislative battle to preempt the state laws that directly contradict both.
The prior authorization system has never been especially coherent. But it has reached a new level of structural contradiction. Health plans now face three distinct federal signals about PA — all pointing toward automation and AI — while 18 states and counting have passed or proposed laws restricting exactly that.
The attempt to resolve this contradiction through a federal preemption play failed, spectacularly, in a Senate vote of 99 to 1. Plans are left to operate in both realities simultaneously.
This is not a compliance calendar problem. It is a governance architecture problem. And the plans that treat it as the former will spend significant money solving the wrong thing.
The architecture question is concrete: in every automated PA workflow the plan or its delegates operate, who owns the adverse decision, what standard governs it, and how does that accountability vary by state and line of business? If the plan cannot answer that question cleanly, the FHIR API is an infrastructure investment without a governance foundation underneath it.
Three federal clocks are already running. Most plans have mapped only one.
The three mandates are not coordinated by design. CMS-0057-F is a final rule with operational requirements already in effect. CMS-0062-P is a proposed rule in active comment period. WISeR is a CMMI demonstration with its own governance structure and performance-based vendor incentives.
Plans that have scoped only the CMS-0057-F FHIR API have addressed one-third of the federal PA obligation. The drug PA extension in CMS-0062-P adds pharmacy-benefit workflows many plans have not yet begun to scope. WISeR adds a third layer: AI decision governance in traditional Medicare in the exact states where state-level clinical review requirements also apply.
The comment period for CMS-0062-P closes June 15, 2026. Plans operating in the six WISeR states — Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington — are simultaneously subject to the CMMI pilot requirements and state laws governing AI adverse decisions. The compliance intersection is active, not theoretical.
Medicare Advantage insurers alone made nearly 53 million prior authorization determinations in 2024. At that volume, even a small calibration difference between automated and clinical-review approval rates generates material appeals exposure.
Eighteen states have answered the federal automation signal with their own requirement: a human must verify the decision.
At the same time that CMS has built its federal automation stack, the states have been moving in a different direction. Since January 2025, at least 18 states have taken legislative action on prior authorization. Arizona now requires a human to verify claims denials and rejected PA requests. Maryland established oversight requirements for AI used in claims management. Arizona and Indiana have set PA turnaround requirements that, if missed by the insurer, result in automatic approval.
None of this is necessarily inconsistent with the federal goal of faster PA decisions. But it is directly inconsistent with the idea that AI-driven adverse decisions can stand without human clinical accountability. Plans operating in states with these requirements cannot satisfy them purely by meeting the FHIR API mandates in CMS-0057-F. The API gets the request there faster. The state law determines who — or what — can say no.
The Trump administration understood the tension and attempted to resolve it legislatively. A provision in the House reconciliation bill would have banned enforcement of state AI laws for 10 years. It was removed from the final package by a Senate vote of 99 to 1. The administration has since pursued an executive order directing the establishment of an AI Litigation Task Force and threatening to withhold discretionary federal funding from states with “onerous” AI regulations — but this remains an unsettled legal front, not a resolved one.
Plans cannot wait for that litigation to conclude. State laws are active today. The governance question must be answered in the current regulatory environment — not the one the Trump administration hoped to create.
The reconciliation bill’s proposed 10-year moratorium on state AI law enforcement was not a minor procedural casualty. It was the administration’s primary legislative strategy for resolving the federal-state AI tension at scale. The 99-1 Senate vote signals broad, bipartisan resistance to preempting state authority over AI governance in healthcare — a signal that the legal landscape will remain fragmented for years.
The executive order creating an AI Litigation Task Force represents a secondary approach: use enforcement pressure and potential federal funding leverage to discourage states from maintaining restrictive AI laws. Whether this succeeds is uncertain and contested. What is certain is that no final legal clarity exists today, and plans that defer governance architecture decisions while waiting for it will face a compressing compliance window.
Plans in WISeR states should note that the pilot’s AI decision framework and the state clinical review requirements are simultaneously active. CMS has not reconciled these two obligations at the plan level. That reconciliation falls to the plan.
What plans are underestimating
The governance gap is not in the FHIR implementation. It is in the decision accountability structure that must govern what the FHIR system does.
Plans have largely parsed this as a dual compliance problem: build the FHIR APIs for CMS, track the state laws separately for legal. That framing will prove insufficient.
The real problem is decision logic governance. When PA workflows are automated and the system generates a denial recommendation, the legal accountability question is who owned that decision and what standard did they apply. In states with human verification requirements, an AI-generated denial without meaningful clinical review is a compliance failure — regardless of how sophisticated the FHIR implementation is.
There is also a financial variable embedded in the 22-point WISeR approval gap. A PA workflow calibrated for automation rather than clinical accuracy will systematically generate more denials than human review would sustain. That pattern creates appeals volume, regulatory scrutiny, and potential member harm — all of which carry financial and reputational costs that a compliance API project cannot absorb.
Plans cannot wait for federal preemption to clarify the landscape. The reconciliation attempt failed. The executive order is an enforcement threat, not a legal ruling. State laws are active today. The question every plan leadership team should now be asking is not “are we compliant with CMS-0057-F?” but rather “in every state and line of business where we automate a PA decision, who is accountable for that decision, and what standard governs it?”