Federal health IT rules and new state laws are set to bring changes to EHR certification, clinical AI oversight, electronic prescribing, prior authorization and hospital data exchange in 2027.
Among the developments are new payer prior authorization API requirements, changes to Medicare’s Promoting Interoperability Program and new restrictions on AI-assisted clinical decision-making in California.
Here are eight health IT changes hospital and health system leaders should know heading into 2027:
1. Payers must launch electronic prior authorization APIs.
Beginning Jan. 1, 2027, certain payers must implement electronic prior authorization application programming interfaces under the CMS Interoperability and Prior Authorization final rule, which CMS released Jan. 17, 2024.
The APIs must support access to prior authorization requirements and documentation, electronic requests and responses, and information about whether requests are approved, denied or require additional documentation.
The requirements apply to certain Medicare Advantage organizations, state Medicaid and Children’s Health Insurance Program agencies, Medicaid and CHIP managed care plans, and qualified health plan issuers on federally facilitated exchanges. For qualified health plan issuers, the requirements apply to plan years beginning on or after Jan. 1, 2027.
The same rule requires payers to implement a Provider Access API and a Payer-to-Payer API beginning Jan. 1, 2027, and to add prior authorization information to the Patient Access API.
Although the requirements fall on payers, they are intended to make electronic prior authorization more accessible to healthcare providers. Hospital CIOs and revenue cycle leaders may need to evaluate how their EHR systems and other technologies can connect with payer APIs as implementation progresses.
2. Electronic prior authorization becomes an optional hospital reporting measure.
CMS modified the electronic prior authorization measure in the Medicare Promoting Interoperability Program, first established in the 2024 interoperability and prior authorization rule, making it an optional bonus measure for the 2027 EHR reporting period. The change was finalized in the agency’s fiscal year 2027 inpatient payment rule. The measure becomes mandatory beginning with the 2028 EHR reporting period.
The measure is tied to the payer APIs taking effect the same year: It centers on whether hospitals request prior authorization electronically through a payer’s Prior Authorization API using certified EHR technology.
For hospital CIOs, the 2027 reporting period offers a window to test electronic prior authorization connections with payers before the measure becomes mandatory.
3. Hospitals will face a new medical device data exchange measure.
Beginning with the 2027 EHR reporting period, CMS will add a measure involving unique device identifiers for implantable medical devices to the Medicare Promoting Interoperability Program.
The change, finalized in the fiscal year 2027 inpatient payment rule, adds the measure to the program’s Public Health and Clinical Data Exchange objective.
Unique device identifiers are codes assigned to medical devices that can support device tracking, patient safety and information exchange.
Because the Promoting Interoperability Program is tied to Medicare payment, the new measure creates an additional area for hospital EHR and clinical data teams to evaluate as they prepare for the 2027 reporting period.
4. HHS will remove more EHR certification criteria.
Several federal health IT certification criteria will be removed Jan. 1, 2027, under the HTI-5 final rule, issued Oct. 26 by HHS.
The criteria leaving on that date include family health history, patient health information capture, automated numerator recording and automated measure calculation, along with two application programming interface criteria involving patient selection and all-data requests.
Overall, the final rule removes 14 of the certification program’s 60 criteria and revises seven others, far fewer than the 34 removals proposed in December 2025. Timing varies by criterion: 13 changes take effect with the final rule, seven on Jan. 1, 2027, and one on Jan. 1, 2030.
The rule also narrows the decision support interventions criterion to drop AI “model card” requirements, meaning certified health IT developers no longer have to provide source information about the training, performance and validation data behind AI tools. That federal rollback runs counter to California’s new bias law, which requires developers to give deployers documentation about training data and known risks.
The changes reduce federal certification obligations for health IT developers. They do not necessarily require EHR vendors to discontinue existing capabilities used by hospitals.
5. California will require healthcare organizations to monitor AI for potential bias.
Beginning Jan. 1, 2027, California healthcare organizations using certain AI-powered clinical decision support systems will face new requirements to identify and address risks of biased outcomes.
Under Senate Bill 503, developers of these systems and deployers, defined as health facilities, clinics, physician offices and group practices that use them, must make reasonable efforts to identify systems with known or reasonably foreseeable risks of biased impacts, such as diminished access to care, care quality or outcomes based on protected characteristics.
The law also requires developers to make certain information available to healthcare organizations deploying the technology, including documentation about intended uses, performance limitations, training data and known risks. Deployers must regularly monitor covered systems and take reasonable and proportionate steps to mitigate bias risks.
The requirements could affect how California hospitals evaluate, purchase and monitor AI-powered clinical tools.
6. California will strengthen clinician oversight of AI-assisted decisions.
Another California law taking effect Jan. 1, 2027, will establish new requirements intended to preserve clinicians’ professional judgment when AI informs patient care.
Under Assembly Bill 1979, hospitals, clinics, physician offices and group practices must take reasonable steps to ensure licensed healthcare professionals retain the ability to exercise independent professional judgment when care is informed by clinical decision support systems.
The law also prohibits covered organizations from deploying AI to independently perform clinical functions that require professional licensure or to direct unlicensed personnel in performing those functions, subject to specified exceptions.
The legislation additionally extends California’s medical information privacy protections to certain businesses offering healthcare chatbots directly to consumers.
7. EHR developers face a deadline to update electronic prescribing technology.
Health IT developers maintaining certification under the federal electronic prescribing criterion must update affected products to support a newer national prescribing standard by Dec. 31, 2027.
The HTI-4 final rule requires certified electronic prescribing technology to transition to National Council for Prescription Drug Programs SCRIPT Standard Version 2023011.
The changes also include updates to RxNorm and National Drug Code standards and requirements supporting electronic prior authorization transactions.
The transition period allows developers to maintain certification using either the older or newer SCRIPT standard through Dec. 31, 2027. The updated standard becomes the only permitted version for that certification criterion beginning in 2028.
The deadline gives hospital EHR and pharmacy technology teams a timeline to coordinate with vendors on prescribing system updates.
8. New real-time prescription benefit certification requirements approach.
Federal certification changes will also require certain health IT developers to support real-time prescription benefit capabilities by the end of 2027.
Under HTI-4, developers maintaining certification to the electronic prescribing criterion must also certify to the real-time prescription benefit criterion.
The technology is designed to give prescribers access to prescription benefit information, including information that can help patients and clinicians compare drug costs and suitable alternatives.
The certification requirement is based on NCPDP Real-Time Prescription Benefit Standard Version 13.
Beginning Jan. 1, 2028, certified health IT modules subject to the electronic prescribing criterion must also satisfy the real-time prescription benefit certification requirement.
Payers face an earlier, related deadline. Under a separate CMS rule, Medicare Part D sponsors’ real-time benefit tools must comply with the same Version 13 standard by Jan. 1, 2027.
Becker’s 3rd Annual Fall Chief Pharmacy Officer Summit is the top tier event that the people leading the future of pharmacy convene. This 3-day event is built specifically for Chief Pharmacy Officers and senior pharmacy leaders. The sessions examine the workforce, financial and clinical priorities shaping pharmacy today. Becker’s is where candid discussions flourish and new ideas thrive. Becker's 3rd Annual Fall Chief Pharmacy Officer Summit
