Guide · Published Sep 6, 2026 · Updated Sep 2026
The 2027 to 2028 Regulatory Calendar for Practice Operations
The regulatory landscape for 2027 and 2028 has a few dated changes worth planning for now, a couple of pending items to watch, and a set of recurring deadlines that never change. Here is the operational calendar, with what is confirmed, what is still proposed, and what each means for your practice.
The 2027 to 2028 regulatory calendar for practices has three layers: confirmed dated changes, chiefly CMS-0057-F prior auth and interoperability requirements for affected payers by January 1, 2027, plus a related MIPS measure from the 2027 performance year; pending items to watch, notably the CY2027 Medicare fee schedule expected to finalize in late 2026; and recurring compliance and credentialing cadences that continue every year. Put all three on one tracked calendar with owners, and confirm status as rules finalize.
Key takeaways
- CMS-0057-F requires affected payers to implement prior auth and interoperability APIs by January 1, 2027.
- A related MIPS electronic prior authorization measure begins with the 2027 performance year.
- The CY2027 Medicare fee schedule is pending as of writing, expected to finalize around late 2026.
- Recurring cadences, OSHA, HIPAA, CLIA, revalidation, continue every year regardless of new rules.
- Track confirmed and proposed items separately on one calendar, and verify status as rules evolve.
Regulatory calendars are easy to get wrong in two opposite ways: treating every rumored change as urgent, or ignoring the landscape until a deadline surprises you. The useful version separates what is actually confirmed and dated from what is still proposed, and puts both alongside the recurring deadlines that never change. Here is that calendar for 2027 and 2028, built to plan from, with honest labels on what is settled and what is not.
Three layers of the calendar
A practice's regulatory calendar has three distinct layers, and keeping them separate is what makes it useful rather than alarming. The first layer is confirmed dated changes: new rules with firm effective dates you can plan around now. The second is pending items: proposed or expected changes that are not yet final, which you watch and prepare for but do not treat as settled, because proposed rules can shift before they land. The third is recurring cadences: the compliance and credentialing deadlines that come around every year or on fixed cycles regardless of any new rule, which form the stable backbone of the calendar. Most practices blur these together, which produces either false urgency about proposed changes or missed recurring deadlines lost among the noise, so the discipline is to label each item by layer: confirmed, pending, or recurring. Doing that turns a shifting, anxiety-inducing landscape into a manageable list where you know exactly what is certain, what to watch, and what simply repeats. The sections below walk each layer for 2027 and 2028, and one honest caveat applies throughout: regulations evolve, so confirm the current status of any item directly before acting, since a calendar is a starting map, not a substitute for the source.
Confirmed dated changes
The anchor confirmed change for this window is CMS-0057-F, the federal interoperability and prior authorization rule, whose major requirements land on January 1, 2027. By that date, affected payers, Medicare Advantage organizations, state Medicaid and CHIP programs, and qualified health plans on the federally-facilitated exchanges, must implement the rule's prior authorization and interoperability APIs, including a Prior Authorization API for medical items and services, and begin posting prior authorization metrics publicly, the full detail in the CMS-0057-F guide. Two things to be clear about: the rule's operational provisions, faster decision timeframes of 72 hours expedited and 7 days standard, and required specific denial reasons, have already been in effect since January 1, 2026, and the rule places its obligations on payers, not directly on providers. The provider-facing piece is a related MIPS electronic prior authorization measure that begins with the 2027 performance year for participating clinicians, an attestation tied to submitting prior authorizations electronically through a payer's API. For most independent practices, the practical meaning of CMS-0057-F is not a compliance burden but a gradual improvement in electronic prior authorization for affected payers, which is a workflow opportunity to prepare for, not a deadline to fear. It does not cover traditional Medicare or most commercial plans, so it changes part of the landscape, not all of it.
Pending: watch these
The main pending item for this window is the CY2027 Medicare Physician Fee Schedule. As of this writing, the CY2027 fee schedule is still in the rulemaking process and not yet finalized, with the final rule expected around late 2026 and provisions taking effect January 1, 2027, the background in the fee schedule guide. Because it is not final, treat its specifics as pending: watch for the final rule, and confirm the details once CMS releases them rather than planning around proposed figures that may change. The fee schedule matters to every practice because it sets Medicare payment, so it is worth tracking closely as it finalizes, but it belongs firmly in the pending layer until the final rule is out. More broadly, the prior authorization reform landscape continues to evolve, including the voluntary industry commitments some insurers have made, which are worth watching but are not binding regulatory deadlines, the context in the insurer pledge guide and the reform guide. The discipline for the whole pending layer is the same: prepare and watch, but do not treat proposed or voluntary items as settled obligations, and re-confirm as they finalize. Keeping pending items visibly separate from confirmed ones prevents both the false urgency of acting on a proposal that changes and the surprise of missing one that finalizes.
The free Rescue Kit and compliance tools help you track regulatory changes and recurring deadlines with owners, so nothing lapses.
Get the free Rescue KitThe recurring cadences
Underneath the changing rules sits the stable backbone: the compliance and credentialing deadlines that recur every year or on fixed cycles, regardless of what is new. These do not make headlines, but missing one can stop billing or trigger a penalty, so they belong on the calendar permanently.
| Obligation | Typical cadence |
|---|---|
| OSHA bloodborne pathogens training | Annually, plus annual Exposure Control Plan review |
| HIPAA training | At hire and periodically thereafter (no fixed federal interval) |
| CLIA certificate renewal | Every two years |
| Medicare revalidation | On its multi-year cycle per provider |
| Payer recredentialing | Commonly every two to three years per provider and payer |
These cadences are covered in depth in the compliance calendar guide and the revalidation calendar, with credentialing timelines in the timelines guide. The point for this regulatory calendar is that the recurring layer is where most practices actually get hurt, not from a dramatic new rule, but from a routine annual training or a revalidation deadline that quietly lapsed, so the recurring cadences deserve at least as much calendar discipline as the headline changes. Put them on a standing calendar with owners, and they stop being a source of preventable failures.
Turning it into a plan
A calendar is only useful if it becomes a plan, so the final step is translating all three layers into tracked, owned action. Put every item, confirmed changes, pending items to watch, and recurring cadences, on one tracked calendar, labeled by layer so you know what is certain and what to watch, and assign each an owner accountable for acting on it, the ownership discipline that runs through all of operations. For each relevant item, translate the rule into the operational step it actually requires: for CMS-0057-F, prepare to take advantage of improved electronic prior auth and, if you participate in MIPS, plan for the 2027 measure; for the pending fee schedule, watch for the final rule and update once it lands; for the recurring cadences, schedule each with lead time and an owner so none lapses. Then revisit the calendar regularly, as pending items finalize and new proposals appear, so it stays current rather than becoming a stale snapshot, folding it into your annual planning per the annual planning guide. Done this way, the regulatory landscape stops being a source of anxiety and surprises and becomes what it should be: a managed list of known items, each with a date, a status, and an owner. And the honest reminder holds throughout, confirm the current status of any item directly before acting, because rules change and this calendar is a map to verify against the source, not a replacement for it. To pressure-test whether your practice is actually tracking these deadlines with owners, the free Leak Audit checks exactly that kind of exposure.
Find your leak before you fix it
Two ways to start, both free. Take the tracker and denial log and run it yourself, or get a 20-minute Leak Audit where we put a real number on what your operations are costing, using your own practice.
Frequently asked questions
What are the major healthcare regulatory changes for 2027 and 2028?
The confirmed anchor is CMS-0057-F, which requires affected payers to implement prior authorization and interoperability APIs and post prior auth metrics by January 1, 2027, with a related MIPS electronic prior authorization measure starting the 2027 performance year. The CY2027 Medicare Physician Fee Schedule is expected to finalize in late 2026 and take effect January 1, 2027. Recurring compliance and credentialing cadences continue throughout.
What is confirmed versus proposed for 2027 to 2028?
Confirmed: CMS-0057-F API and metrics requirements for affected payers by January 1, 2027, and the related MIPS measure beginning the 2027 performance year. Pending as of writing: the CY2027 Medicare Physician Fee Schedule, expected to finalize around late 2026. Recurring obligations like OSHA, HIPAA training, CLIA renewal, and Medicare revalidation continue on their existing cycles. Always confirm current status, as rules evolve.
Does CMS-0057-F create obligations for my practice?
Not directly. CMS-0057-F places its requirements on payers, Medicare Advantage, Medicaid and CHIP, and federally-facilitated-exchange qualified health plans, not on providers. The provider-facing piece is the MIPS electronic prior authorization measure starting the 2027 performance year for participating clinicians. Practically, the rule should improve electronic prior auth over time for affected payers, which is a workflow opportunity, not a compliance burden, for your practice.
What recurring compliance deadlines should be on my calendar every year?
The recurring cadences that do not change year to year: OSHA bloodborne pathogens training annually and an annual Exposure Control Plan review, HIPAA training at hire and periodically, CLIA certificate renewal every two years, and Medicare revalidation on its multi-year cycle, plus payer recredentialing cycles. These belong on a standing compliance calendar with owners, separate from one-time regulatory changes.
How should a practice prepare for upcoming regulatory changes?
Put both the dated regulatory changes and the recurring compliance cadences on one tracked calendar with owners, distinguish confirmed items from proposed ones, and revisit it as rules finalize, since proposed rules can change. Then translate each relevant item into the operational step it requires. A tracked calendar turns a shifting regulatory landscape into a manageable list rather than a source of surprises.
Where can I confirm the current status of these rules?
Primary sources: CMS for the fee schedule, CMS-0057-F, and Medicare programs, and the relevant federal and state agencies for other requirements. Because regulations evolve and proposed rules finalize on their own timelines, always confirm the current status of any item directly rather than relying on a calendar snapshot, and treat this guide as a starting map to verify, not a substitute for the source.