Vendors Are Selling Prior Auth Readiness the Rulebook Hasn't Finished Writing

The deadline is fixed, the rule behind it is not

CMS-0057-F phases in a standardized API for exchanging prior authorization decisions, with earlier provisions already in effect during 2026 and the core determination exchange requirement landing on January 1, 2027 botminds.ai. HHS finalized the companion HTI-5 rule on October 28, 2026, projecting $1.5 billion in compliance cost savings through streamlined ONC certification fiercehealthcare.com. But HTI-5 explicitly does not finalize proposed changes to information blocking regulations, and those comments remain under consideration fiercehealthcare.com. The companion deregulatory docket in the Federal Register confirms ONC pulled back its broader EHR deregulation proposal rather than finalize it wholesale federalregister.gov, leaving AI agents and information blocking as the unresolved pair most relevant to automated prior authorization x.com. That is the new fact on the table. A rule everyone assumed would land in late October landed, and still left the two questions that matter most to automated adjudication open.

The vendor market did not wait

That vacuum is not sitting empty. Vendors are already marketing into it. One contact center readiness campaign built around CMS-0057-F puts it plainly: a patient calls to refill a prescription, the data is available, the AI understands facebook.com. Evidently has extended its patient-understanding layer into both the EHR and the AI tools health systems already run, positioning itself squarely inside that same determination pipeline rutlandherald.com. These are credible products solving a real operational problem. The issue is not capability. It is that no buyer can yet verify a vendor’s information blocking posture or AI agent accountability against a federal standard, because HTI-5 named those questions and then deferred them. A vendor’s internal confidence that its system is compliant is not evidence a compliance officer can rely on in an audit of a rule that is itself still half-written.

What the frameworks ask for that the rule hasn’t answered

This is where governance vocabulary matters more than governance paperwork. NIST AI RMF’s core functions, govern, map, measure, manage, and ISO 42001’s management system structure both assume an organization can document what an AI system does, who is accountable for its outputs, and how those outputs are monitored over time. Neither was drafted with a federally mandated adjudication API in mind, and neither can substitute for the information blocking clarity HTI-5 deferred. Most health systems already have the governance committee structure to ask these questions. Eighty-four percent report a dedicated AI governance committee beckershospitalreview.com, and the oversight and validation discipline those committees are supposed to run is well established in principle enacton.com. What is not established is a vendor diligence checklist that maps a product’s prior authorization claims to those frameworks when the underlying federal rule is still unsettled.

The decision in front of procurement, not just compliance

The practical move is not another round of internal touchpoint mapping. It is subjecting every vendor pitch that claims CMS-0057-F readiness to the same rigor the governance committee already applies to clinical AI, documentation of training data provenance, audit logging, override mechanisms, and explicit acknowledgment of what the vendor cannot yet certify because HHS has not certified it either. A vendor confident enough to market readiness should be confident enough to put that gap in writing. Organizations that make vendors answer for the parts of the rule that do not yet exist will not be negotiating that answer during an investigation later.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that vendors are marketing compliance readiness against a rule whose key provisions (AI agent accountability, information blocking) remain explicitly unfinalized—is coherent and well
Source & Claim Verification	glm-5.3-flash-fp4 · local	cleared. The core regulatory narrative checks out against opened sources (botminds confirms CMS-0057-F’s 2026 operational wave and Jan 1, 2027 API deadline; Mandel’s post and the Federal Register document corr
Regulatory & Framework Fidelity	Mistral · fallback (mistral-medium-3.1)	cleared. The briefing accurately identifies unresolved gaps in CMS-0057-F and HTI-5 but lacks explicit mapping of vendor claims to NIST AI RMF, ISO 42001, and information blocking frameworks.
Technical Accuracy	Llama	cleared. The article accurately describes the CMS-0057-F rule and its implications for prior authorization, and correctly identifies the outstanding issues related to information blocking and AI agent accounta
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and scrutinizes vendor claims against the backdrop of incomplete federal regulations, highlighting the critical gap for buyers.
Novelty & Non-Duplication	Grok	cleared. HTI-5’s Oct 28 finalization deferring information blocking and AI agents is a genuine new fact that updates the prior-auth story, but the vendor-readiness/governance-gap framing and procurement decisi
Validation	DeepSeek	cleared. The central claim that vendors are selling prior authorization readiness against rules that are unsettled is validated by authoritative sources showing the final HTI-5 rule explicitly deferred key iss

Sources cited: 33. Validation challenges: 0. Learn how these briefings are written and verified.