ONC and CMS Open Voluntary FHIR Prior Authorization Testing Sprints: What EHR Teams Should Do Before November 20

Prior authorization is one of the places where clinical systems teams feel the gap between what interoperability standards promise and what actually moves between an EHR and a payer. On November 12, 2026, ONC and CMS announced a voluntary industry testing initiative meant to find that gap before 2027 federal requirements arrive. The program runs end-to-end electronic prior authorization (ePA) workflows through 10- to 12-week testing sprints in a production-like environment, built on the HL7 FHIR Da Vinci implementation guides for Coverage Requirements Discovery (CRD), Documentation Templates and Rules (DTR), and Prior Authorization Support (PAS).

The window to raise your hand for the first round is short. Interest registration through Drummond Group is due November 20, 2026. Most health care organizations will not register, and that is fine. The work coming out of these sprints will still shape what your EHR vendor ships and what your payers expect, so it is worth understanding now.

At a glance

What: Voluntary 10- to 12-week sprints testing end-to-end ePA with Da Vinci CRD, DTR, and PAS in Drummond Group's FHIRplace environment.
Who can join: Payers, providers, EHR developers, hospitals, intermediaries, and other partners, including smaller and rural organizations.
Deadline: Register interest for the first round through Drummond by November 20, 2026.
What it is not: Participation is not ONC certification and not a CMS compliance determination.
What to do, in order: Read the announcement, ask your EHR vendor which Da Vinci guide versions it supports and whether it is participating, decide whether to join or monitor, and inventory your highest-volume prior authorization services.

What ONC and CMS actually announced

The initiative invites organizations on every side of the prior authorization transaction to test real workflows together rather than in isolation. According to the ONC announcement, the MITRE-led Health FFRDC and Drummond Group will handle recruitment, participant matching, and coordination. Testing focuses on high-volume and high-priority clinical services, and it is open to organizations of all sizes.

The testing happens in Drummond's FHIRplace environment. This is not FHIRplace's first outing. Drummond has reported that earlier FHIRplace testing in support of MITRE's nationwide payer API testing during the second and third quarters of 2026 surfaced hundreds of interoperability issues across thousands of test executions. That is the practical case for this program: problems that look minor on a conformance checklist become very visible when a real EHR, a real intermediary, and a real payer try to complete a transaction.

One point in the announcement deserves emphasis for anyone who has to explain this to leadership. Participation is voluntary, and it does not constitute ONC certification or a CMS compliance determination. A vendor saying it took part in a FHIRplace sprint is useful information, but it is not a compliance credential.

The three Da Vinci guides at the center of testing

Together, the three guides cover the prior authorization transaction from the moment of ordering to the payer's decision: discovering whether a service has coverage requirements, gathering the documentation the payer's rules call for, and submitting the authorization request and receiving the response. ONC's 2026 Standards Version Advancement Process (SVAP) update lists the following versions and ties them to Health IT Certification Program criteria.

Da Vinci guide	Version (2026 SVAP)	Related certification criterion
Coverage Requirements Discovery (CRD)	2.2.1	45 CFR 170.315(g)(31)
Documentation Templates and Rules (DTR)	2.2.0	45 CFR 170.315(g)(32)
Prior Authorization Support (PAS)	2.2.1	45 CFR 170.315(g)(33)

Version numbers matter more than they look. When two systems claim support for the same guide but implement different versions, the transaction can fail in ways that are hard to troubleshoot from the provider side. Knowing which versions your EHR and your intermediaries support is the single most useful fact you can collect this month.

Why this matters to clinical systems teams

CMS payer interoperability and prior authorization requirements take effect in 2027 for applicable plans, including Medicare Advantage and Medicaid managed care, as Healthcare Dive reported. As payers build their FHIR-based prior authorization APIs, the pressure shifts to the provider side: your EHR or connected systems need to exchange coverage discovery, documentation rules, and authorization requests and responses reliably. HIT Consultant also covered the initiative in the context of the 2027 requirements.

For most hospitals and clinics, the FHIR endpoints will not be something your team builds. They will arrive through your EHR vendor, a revenue cycle platform, or a clearinghouse-style intermediary. That changes your job from development to vendor management, testing, and workflow readiness. It also means the quality of your ePA experience will depend heavily on whether your vendor found its bugs in a sprint like this or found them in your production environment.

One honest caveat: the sources reviewed for this article do not settle the exact split of 2027 obligations between payers and EHR developers, or the enforcement timelines for each. Do not assume your EHR will be ready on the same date your payers go live. Ask, and get the answer in writing.

What practitioners are saying so far

Reaction has been thin, which is not surprising one day after the announcement. ONC's post on X drew minimal engagement. Among the responses on X (here and here), one health IT consultant dismissed the effort as another certification exercise unlikely to fix real problems, another commenter argued that test cases should include edge scenarios such as incomplete documentation and urgent requests with measured decision times, and a digital consultancy pointed to the potential for reduced administrative burden.

In our view, the edge-case point is the one to carry into your vendor conversations. Clean, complete requests for routine services are the easy part. The cases that consume staff time are the pended request, the missing attachment, and the urgent order that cannot wait for a callback. If your vendor's testing only covers the happy path, you will find the rest yourself.

What to do now, whether or not you register

Read the source material. Start with the ONC announcement and Drummond's FHIRplace details. If your organization has any interest in the first round, the November 20 deadline leaves about a week to make a decision.

Ask your EHR vendor specific questions. A short email now can save months of guessing later:

Which versions of CRD, DTR, and PAS does your current release support, and which versions are on the roadmap?
Is the company participating in the FHIRplace sprints, and can customers join or observe test scenarios?
Which payers and intermediaries have you completed end-to-end testing with?
What upgrade will we need to support ePA, and when should we plan for it?
How will denials, pended requests, and errors show up for clinical and revenue cycle staff?

Inventory your prior authorization workload. Pull several months of prior authorization activity from your practice management or revenue cycle system. Rank services by volume, note which payers require authorization most often, and record how each request is submitted today (portal, fax, phone). The initiative is focused on high-volume and high-priority services, and your list will tell you which results to watch most closely.

Name an owner. ePA crosses clinical, revenue cycle, and IT lines, which is exactly how it ends up owned by nobody. At a small organization this may be one person wearing three hats. That is fine, as long as someone is tracking vendor answers, payer go-live notices, and testing results.

Decide: participate or monitor. Smaller and rural organizations are explicitly encouraged to join, and real-world input from under-resourced sites is exactly what these programs need. But a 10- to 12-week sprint takes staff time. If you cannot spare it, plan to monitor published results and follow your vendor's participation instead.

A note on test data and HIPAA

The testing announcement does not create new HIPAA obligations, but any exchange of real patient data still falls under existing rules. Wherever possible, use synthetic test patients. If real electronic protected health information (ePHI) does flow to a vendor, intermediary, or testing partner acting on your behalf, the Security Rule requires satisfactory assurances from the business associate, documented in a written contract or other arrangement, under 45 CFR 164.308(b)(1) and (b)(3) (Required). The transmission security standard at 45 CFR 164.312(e)(1) also applies, with encryption at 164.312(e)(2)(ii) designated Addressable. Addressable does not mean optional: under 45 CFR 164.306(d)(3), you must implement the specification if it is reasonable and appropriate, or document why it is not and implement an equivalent alternative measure if reasonable and appropriate.

This article is for informational purposes only and does not constitute legal or compliance advice. Covered entities and business associates should consult qualified legal counsel or compliance professionals before making decisions pertaining to HIPAA or IT infrastructure.