FHIR US Core STU 9 + Da Vinci Prior Authorization APIs (2026 ONC SVAP) mark a turning point in U.S. health IT. For the first time, certified EHRs, payer APIs, and provider workflows can align around a single, automation-ready interoperability stack. ONC published 2026 SVAP standards in August 2026, and the CMS Prior Authorization Rule (CMS-0057-F) effective Jan 1, 2026 is pushing payers toward FHIR APIs. The industry is moving from "FHIR-capable" to “FHIR-operational.”
This guest post explains what changed in 2026 and how the Da Vinci CRD/DTR/PAS v2.2.x suite automates prior authorization end to end. It also shows how providers, payers, and builders can turn these standards into faster approvals, cleaner revenue cycles, and better patient experiences.
2026 Interoperability Stack: What ONC SVAP Actually Approved
The 2026 ONC-approved interoperability standards refresh the baseline for certified health IT. They also open voluntary advancement paths under the Standards Version Advancement Process (SVAP), which lets certified developers adopt newer versions of approved standards without waiting for a full rulemaking cycle. The 2026 approved standards became available for voluntary use on August 29, 2026.
The headline updates:
- HL7 FHIR US Core STU 9.0.0 (June 2026). The national profile set for FHIR R4 resources. It adds new data classes (for example, FamilyMemberHistory) and tightens conformance expectations for USCDI-aligned exchange.
- USCDI v6. Expands the minimum data set for interoperability, which shapes what payers and providers expose through Patient Access and Provider Access APIs.
- C-CDA Release 5.0. Updates the U.S. clinical document templates. It remains CDA R2-based rather than FHIR-native, and it is still relevant for transitions of care and quality reporting.
- Da Vinci CRD/DTR/PAS v2.2.x. Coverage Requirements Discovery (CRD) v2.2.1, Documentation Templates and Rules (DTR) v2.2.0, and Prior Authorization Support (PAS) v2.2.1 form the automation backbone for prior authorization.
Why this matters: developers can now voluntarily certify against these versions. Early adopters get a head start on payer and provider alignment before the 2027 API deadlines arrive. It is also the first time electronic prior authorization guides have entered SVAP, a signal that ONC wants prior auth automation to become a core capability of certified health IT.
How the layers fit together
Adopting these standards in isolation is a common mistake. Think of them as layers:
- Data contract (USCDI v6): which clinical data is in scope.
- Representation (US Core STU 9): the FHIR profiles, search parameters, and must-support elements that carry that data.
- Workflow (Da Vinci CRD/DTR/PAS): the administrative logic on top: is prior auth needed, what documentation is required, how is the request submitted and tracked.
- Document exchange (C-CDA 5.0): transitions of care and summaries that have not moved to FHIR.
Every Da Vinci workflow depends on clean US Core data underneath it. If medication lists or lab results are poorly mapped, DTR cannot pre-fill accurately, and clinicians end up repeating manual work in a new interface.
CMS Prior Authorization Rule (CMS-0057-F): Deadlines That Drive Architecture
The CMS Prior Authorization Rule (CMS-0057-F) effective Jan 1, 2026
runs on two tracks: operational process reforms in 2026 and FHIR API requirements in 2027.
Effective January 1, 2026: process reforms
- 72-hour decisions for expedited (urgent) requests and 7-calendar-day decisions for standard requests, for Medicare Advantage, Medicaid, and CHIP. Many MA plans previously had up to 14 days for standard requests.
- Specific denial reasons on every denial. A vague "does not meet medical necessity" is no longer enough.
- Public reporting of prior authorization metrics.
One caution on scope: qualified health plan (QHP) issuers on the federally facilitated exchanges have carve-outs from some of the prior authorization provisions. Payers should confirm exactly which requirements apply to each line of business before finalizing their roadmaps.
By January 1, 2027: the FHIR APIs
Impacted payers must implement four FHIR APIs:
- Patient Access API: claims, USCDI clinical data, prior authorization information, and cost-sharing for members.
- Provider Access API: in-network providers access claims, USCDI data, and prior auth information for patients they treat.
- Payer-to-Payer API: data follows the patient when they change plans or have multiple payers.
- Prior Authorization API: query requirements, submit requests, check status, and receive decisions through FHIR, with attachments handled through emerging approaches such as Da Vinci CDex.
Operational takeaway: full API compliance is due in 2027, but the 2026 decision clocks already force the issue. Providers and payers that wait to stand up CRD/DTR/PAS workflows will face backlogs, missed deadlines, and avoidable denials.
Da Vinci CRD/DTR/PAS v2.2.x: How Prior Authorization Automation Works
The HL7 Da Vinci Project's implementation guides translate payer policy into executable FHIR flows.
CRD (Coverage Requirements Discovery). At order entry, the EHR queries the payer through CDS Hooks to learn whether the ordered service requires prior authorization and which rules apply. The clinician finds out before the patient leaves the visit, not days later.
DTR (Documentation Templates and Rules). DTR launches structured questionnaires tied to payer rules, often as a SMART on FHIR app, and pre-populates them from the chart: problems, medications, labs, imaging, and notes. Less back-and-forth means fewer "additional information requested" loops.
PAS (Prior Authorization Support). PAS packages the request and supporting evidence, submits it to the payer, tracks its status, and returns the decision (approved, denied with a specific reason, or pended) via FHIR.
The end-to-end flow
- The provider enters an order, and CRD returns "prior auth required" plus the applicable rules.
- The EHR launches the DTR form, which auto-populates from the chart.
- PAS submits the request, and the payer returns a decision within 72 hours (expedited) or 7 days (standard).
- If approved, the service is scheduled. If denied, the system triggers a peer-to-peer or an alternative plan, with the documented reason attached.
This is the practical engine behind the rule's 7-day and 72-hour mandates. It is also why payers are exposing Prior Authorization Decision Support (DTR) APIs to providers in 2026, well ahead of the 2027 deadline.
FHIR US Core STU 9: What's New and Why It Changes Integration Plans
US Core STU 9 (June 2026) tightens alignment with USCDI v6 and adds resources that matter for care coordination and quality. Notable shifts:
- New and updated profiles, such as FamilyMemberHistory, supporting risk stratification and social determinants of health.
- Stronger conformance expectations for USCDI data classes, improving consistency across EHRs and payer APIs.
- Cleaner mappings for quality and prior authorization workflows, reducing the custom mapping debt that accumulates when integrating with Da Vinci guides.
For developers, STU 9 is the target profile set for 2026 to 2027 interoperability, especially when paired with CRD/DTR/PAS. If you are planning Custom EHR, EMR & PHR Software Development or building patient apps, design against STU 9 from the start rather than retrofitting later.
Real-World Patterns: Patient Apps, Payer APIs, and Population Health
The standards are no longer theoretical. Three patterns dominate 2026 deployments.
1. Patient apps pulling real-time lab results via FHIR APIs
Health systems and third-party apps use US Core profiles to surface real-time lab results, medications, and care plans directly in patient-facing apps. Federal survey data indicates that 81% of hospitals enable third-party app access via FHIR, with a somewhat smaller share specifically configured for FHIR APIs. Patients increasingly expect "any-app" access to their data.
The architecture is straightforward. The patient authorizes an app through SMART on FHIR and OAuth 2.0. The EHR exposes US Core Observation resources for labs, and the app renders trends, reference ranges, and reminders. With STU 9's tighter profiles, the same app behaves more consistently across different EHR sources.
2. Payers exposing Prior Authorization Decision Support (DTR) APIs
Payers subject to CMS-0057-F are standing up DTR and related endpoints so providers can submit structured documentation and receive decisions inside the mandated windows. Early integrations report fewer phone calls and faxes, faster scheduling, and clearer denial reasons, all of which support the rule's transparency goals.
3. Population health platforms aggregating data with Bulk FHIR
For risk contracts and quality programs, Bulk FHIR (FHIR Bulk Data Export) enables population-level data pulls across EHRs and payer systems without thousands of individual API calls. It is the backbone for care gap closure, HEDIS and Stars measurement, and value-based analytics at scale. US Core STU 9 conformance makes the aggregated data more consistent and more usable.
The Numbers Providers Care About
- 81% of hospitals allow patient access through third-party apps, and roughly 70% are configured for FHIR APIs (ASTP/ONC survey data).
- 7 days is the standard prior auth decision window, and 72 hours the expedited window, from January 1, 2026.
- January 1, 2027 is the deadline for the four required FHIR APIs.
Implication: if your EHR or patient portal does not support US Core STU 9 and Da Vinci CRD/DTR/PAS, you risk falling behind on both patient experience and revenue cycle performance.
Building for 2026 to 2027: A Reference Architecture
A practical, compliance-aligned stack has four layers:
- Front door. A patient portal or mobile app using SMART on FHIR, US Core STU 9 resources, and asynchronous messaging.
- Clinical workflow. EHR-integrated CRD at order entry, DTR forms pre-populated from the chart, and PAS submission with status tracking.
- Data spine. A FHIR R4 server with US Core profiles, Bulk FHIR for population health, and C-CDA 5.0 for document exchange where it is still required. An integration engine bridges HL7 v2 and C-CDA flows so you avoid a rip-and-replace.
- Security and governance. OAuth 2.0/OIDC, granular scopes, audit logs, and consent management aligned with HIPAA and information blocking rules.
This is where an experienced healthcare software development company can accelerate time to value: integrating payer APIs, normalizing data into US Core profiles, and operationalizing prior auth automation without disrupting clinical workflows.
Design principles that save projects
- Start with data quality, not endpoints. Add US Core STU 9 profile validation to your CI pipeline.
- Design for versioning. SVAP is voluntary, so the industry will run mixed versions for a while. Publish accurate capability statements.
- Treat prior auth as a product. Measure time to submission and first-pass approval, and remove clicks.
- Plan for exceptions. Keep a fallback to portal or manual submission for payers and services that are not yet automated.
Where Custom EHR, EMR & PHR Software Development Fits In
Off-the-shelf EHRs cover baseline FHIR, but many organizations need Custom EHR, EMR & PHR Software Development to:
- Embed CRD/DTR/PAS directly into specialty workflows such as imaging, DME, and behavioral health.
- Expose US Core STU 9 resources consistently across legacy modules and acquired practices.
- Build PHR views that turn raw FHIR resources into patient tasks: medication refills, lab prep, and prior auth status.
The differentiator is not "FHIR support." It is operational FHIR: write access, closed-loop orders, and prior auth automation that actually shortens cycle time.
Hospital Management Software Development Company: Scaling Interoperability Across the Enterprise
Health systems need interoperability beyond the ambulatory EHR. A Hospital Management Software Development Company can extend these capabilities into:
- ED and inpatient consults: trigger CRD for high-cost services and track PAS status in care management dashboards.
- Revenue cycle: automate attachments (CDex), parse denial reasons, and schedule peer-to-peer reviews directly from PAS responses.
- Population health: use Bulk FHIR to combine claims and EHR data for risk adjustment, care gaps, and quality reporting.
The result is fewer fax queues, faster authorizations, and cleaner claims, all of which support the rule's transparency and timeline mandates.
Implementation Playbook: From Voluntary SVAP Adoption to Production Automation
Phase 1 (August to December 2026): Voluntary SVAP adoption
- Adopt US Core STU 9 and Da Vinci CRD/DTR/PAS v2.2.x in non-production environments.
- Map USCDI v6 data classes to your FHIR server and validate conformance with public test suites.
Phase 2 (Q1 to Q2 2027): Payer API integration
- Connect to your top payers' Prior Authorization APIs and pilot CRD at order entry for high-volume services.
- Instrument dashboards for prior auth cycle time, denial reasons, and attachment completeness.
Phase 3 (H2 2027): Scale and optimize
- Expand DTR templates across specialties and enable Bulk FHIR for population health and quality.
- Publish patient-facing prior auth status in portals and apps to reduce call volume.
Common pitfalls
- Treating compliance as one-and-done. Standards keep advancing, so build a repeatable process for tracking versions.
- Ignoring terminology. Maintain mappings to SNOMED CT, LOINC, RxNorm, and ICD-10.
- Underestimating security. Use least-privilege scopes, audit logging, rate limiting, and regular penetration tests.
- Forgetting the end user. A compliant API with a clumsy clinician workflow will not reduce burden.
- Overlooking performance. CRD checks at order entry must return in seconds, so set performance budgets early.
KPIs That Matter for Interoperability Investments
- Prior auth cycle time: median time from submission to decision (target: under 72 hours for urgent, under 7 days for standard).
- First-pass approval rate: percentage of requests approved without extra documentation.
- Electronic submission rate: requests sent via API versus fax or phone.
- Patient app activation: share of patients authorizing third-party apps and viewing lab results or prior auth status.
- Data completeness: percentage of USCDI v6 classes exposed through US Core STU 9, plus Bulk FHIR export success rates.
These metrics tie directly to CMS-0057-F compliance, patient satisfaction, and revenue integrity.
The Bottom Line for 2026 Planning
FHIR US Core STU 9 + Da Vinci Prior Authorization APIs (2026 ONC SVAP) are more than a standards update. They are the operating system for the next era of U.S. healthcare interoperability. The 2026 SVAP standards are available, the CMS decision clocks are live, and with 81% of hospitals enabling third-party app access via FHIR, the ecosystem is ready.
Organizations that pair US Core STU 9 with CRD/DTR/PAS v2.2.x, invest in Bulk FHIR, and harden security and governance will see faster authorizations, lower administrative cost, and higher patient trust. They will also reach the 2027 API deadlines without a last-minute
Sign in to leave a comment.