ePA Explained: NCPDP SCRIPT & Surescripts Prior Authorization

Prior authorization (PA) is a utilization-management policy requiring clinicians to obtain insurer approval before prescribing certain medications. Historically, PA has been extremely burdensome. In a 2010 AMA survey, physicians reported spending an average of 20 hours per week on PAs (^[23]). Scaled to the ~835,000 U.S. doctors, that represents on the order of 870 million hours per year spent just on PA tasks (^[23]). The administrative cost is staggering – one study estimated the annual cost to physicians for PAs at around $69 billion (^[24]). These delays also frustrate patients: the 2025 AMA survey found 93% of doctors say PAs delay patient care, 89% say PAs contribute to physician burnout, and 29% report PAs have led to a serious adverse event for a patient – up from 24% in prior surveys (^[15]). Another analysis of Medicare showed new PA requirements can delay cancer drug refills by ~10 days and 7× increase the odds of treatment discontinuation (^[25]). In short, while payers argue PAs control costs, most providers and patients see them as a time-consuming barrier to timely treatment.

In response, the healthcare industry has been moving PAs into the digital realm. The National Council for Prescription Drug Programs (NCPDP) has long maintained the SCRIPT Standard for e-prescribing transactions (originally adopted by CMS under the Medicare Modernization Act). Early versions of SCRIPT (e.g. version 5.0 in 2005) were mandated by CMS for electronic prescriptions and related messages (NewRx, Refill requests/responses, Cancels, etc.) (^[26]) (^[27]). Over time, SCRIPT has been updated. In 2013 NCPDP extended SCRIPT to support electronic prior authorization (ePA) transactions (^[1]) (^[2]). These new ePA message types allow a provider’s EHR to send a standardized PA request to a payer and receive the authorization decision in return, as part of the e-prescribing workflow (^[22]) (^[28]).

Surescripts, the major U.S. e-prescribing network, plays a central role in ePA implementation. Surescripts connects prescribers, pharmacists, and payers in a real-time network for exchanging Rx information. It has extended its services to include PA: their CompletEPA solution lets clinicians initiate and track PA requests from within the EHR, linking directly to payers and PBMs. Surescripts claims this enhances clinical decision-making by “bringing ePA requirements into the doctor–patient encounter” (^[22]) (^[3]). In other words, instead of discovering a PA need at the pharmacy pickup, the provider can see it in the chart and address it proactively.

Overall, ePA via SCRIPT provides a fully electronic alternative to the old fax-based process. NCPDP notes that SCRIPT ePA messages give a consistent, structured format so systems can “determine if prior authorization is needed for a particular medication and patient” and then “present PA information needs to the prescriber in a consistent way” (^[29]). By integrating ePA with eligibility/benefit responses, prescribers get real-time insight on whether a chosen drug will require PA under the patient’s benefit plan (^[22]) (^[3]). The goal is more “clean” prescriptions reaching pharmacies without last-minute delays (^[22]).

Overview of SCRIPT and e-Prescribing Standards

NCPDP’s SCRIPT Standard defines the XML/HL7-based messages for electronic prescribing. Under federal regulations, prescriptions for Medicare Part D must use SCRIPT for transmission from prescriber to pharmacy. Indeed, CMS’s 2005 “foundation standards” rule adopted SCRIPT v5.0 for basic prescription transactions (NewRx, refill requests, changes, cancellations) (^[26]). Over time, the standard has evolved (versions 8.1, 10.6, etc.) with new transactions and security/Data enhancements, and most recently an upgrade to SCRIPT v2017071 for controlled substances. These requirements ensure interoperability: for example, ALLscripts, Epic, DrFirst and other EHR vendors use SCRIPT to send e-prescriptions to retail pharmacies.

In 2013, NCPDP formally added ePA to the SCRIPT Standard. After pilot testing in 2011–12, NCPDP published an updated SCRIPT (v10.6, Release 1) in July 2013 that “includes a comprehensive set of transaction types specifically designed for the end-to-end ePA workflow” (^[2]) (^[28]). In practical terms, this means SCRIPT now carries both the usual Rx messages and new messages for PA. These include a PriorAuthorizationRequest (the prescriber’s electronic submission of PA info), a PriorAuthorizationResponse (the payer’s decision and any required data), and related messages. (NCPDP’s implementation guides detail dozens of data elements such as drug codes, criteria questions, and coverage terms.)

The SCRIPT ePA framework focuses on pharmacy-benefit PAs (prescription drugs and supplies). It does not inherently cover medical-benefit authorizations (e.g. specialty injections billed to medical plans). Industry panels have noted this gap: stakeholders recommend future SCRIPT extensions to link to medical claims, adding fields like date of service and CPT/procedure codes (^[30]). Such enhancements would allow specialty drugs and hospital-administered medications to also flow through the ePA process.

Standardization has been accelerated by federal policy. The 2020 CMS final rule for Medicare prescription drug benefits explicitly allowed Part D plans to utilize SCRIPT v2017071 for their ePA processes (^[31]). Moreover, in 2022 ONC rules under the 21st Century Cures Act mandated a transition to SCRIPT v2023011 (effective 2026–28) as the e-prescribing standard (^[18]). This upcoming version incorporates ePA, real-time benefits, and form/benefit transactions into one unified framework, with a January 1, 2028 compliance date for e-prescribing networks (^[18]). For Medicare Part D e-prescribing, NCPDP SCRIPT v2023011 applies beginning January 1, 2028 to covered Part D drugs and Part D-eligible individuals, including related ePA transactions; this is not a universal U.S. ePA mandate. (^[32])

ePA Workflow and Data Exchange

The following is an illustrative pharmacy-benefit ePA workflow. Supported transactions, routing, questionnaires, attachments, fallback channels, and payer responses vary by EHR, network, payer or PBM, drug, and benefit plan:

1. Fill Request / Benefit Check: When a prescriber selects a medication, the system may first send an eligibility and formulary query (SCRIPT or Real-Time Benefit), learning if the drug is covered and if PA is required. If a PA is indicated, the EHR can prompt the provider before completing the prescription.
2. Create PA Request: The clinician initiates an ePA transaction within the EHR, which gathers patient info (demographics, clinical data, insurer), drug details (NDC code, dosage, diagnosis codes if needed), and any clinical justification (e.g. physician comments, lab results). This data is packaged into a PriorAuthorizationRequest message following SCRIPT’s XML schema.
3. Transmit to Payer/PBM: Surescripts (or CoverMyMeds or in some cases the EHR’s direct interface) routes this message to the patient’s pharmacy benefit manager (PBM) or health plan using secure networks.
4. Automated Processing & Response: The PBM receives the ePA and processes it (often via automated decision support). They then send back a PriorAuthorizationResponse: approve/deny/pend, along with any required documentation list, coverage terms, or messages. All fields are standardized by SCRIPT.
5. EHR Receives Decision: The provider sees the result in the EHR (often instantly if automated). If approved, the prescription can proceed to the pharmacy. If more info is needed, the EHR may prompt the user to submit additional answers or assistance (which might loop through additional ePA messages).

This ePA process is now as much a part of e-prescribing as NewRx or Refill. As NCPDP explains, SCRIPT “provides a common language that allows different computer systems to communicate about PA requests in a structured way” (^[28]). The standardization means any compliant EHR and any compliant PBM can exchange PAs without custom interfaces.

Surescripts Network and CompletEPA

Surescripts is the dominant e-prescribing network in the United States. It links over 2.32 million healthcare professionals, nearly every pharmacy, and the major PBMs and payers. In 2025 alone, Surescripts processed 30.5 billion health intelligence transactions – a 12.3% increase over 2024 (^[33]). Building on this network, Surescripts introduced CompletEPA® (sometimes called Surescripts ePA) as its flagship solution for electronic prior authorizations. CompletEPA is embedded directly into the EHR workflow: when a PA is needed, providers use their normal prescribing tools to launch the process.

Key aspects of CompletEPA include:

• Real-Time Benefit Integration: CompletEPA uses Surescripts’ existing Real-Time Benefit (RTB) and formulary capabilities. When a prescriber selects a drug, the EHR can check formulary coverage and plan details. If a PA is needed, CompletEPA can flag it and automatically prefab a PA request. Surescripts emphasizes that “CompletEPA utilizes recently established industry standards for ePA from NCPDP and leverages Surescripts eligibility and formulary data to proactively notify providers of prior authorization requirements within the e-prescribing workflow” (^[3]). In practice, this means fewer surprises at the pharmacy: the system can often highlight PA needs before the patient even leaves the office.

• EHR Adoption: Surescripts reports that since its launch in 2015, CompletEPA has become widely accessible. By 2017 it was available through EHRs representing 75% of all U.S. physicians (^[9]) – for example, CompletEPA became an option inside Epic’s system for 100 large health systems (about 100 million patients) (^[34]). Connectivity extends to nearly all major EHR vendors: an October 2014 release noted that adding DrFirst’s Rcopia system brought the total to over 300 EHR/EMR/HIS products offering CompletEPA to roughly 200,000 prescribers nationwide (^[35]). These figures describe Surescripts’ historical reach, not current availability. Whether a prescriber can use Surescripts ePA depends on the EHR configuration, payer or PBM connection, medication, and plan.

• PBM Coverage: On the payer side, Surescripts has agreements with a nearly complete set of pharmacy benefit managers. A 2014 announcement noted that CompletEPA linked to four major PBMs (including CVS Caremark and Express Scripts) covering 210 million lives (^[36]). By 2017, Surescripts stated that CompletEPA connections spanned “85 percent of pharmacy benefit managers across all 50 states” (^[9]). These historical connectivity figures do not establish universal current availability; ePA routing and workflow coverage vary by EHR, payer or PBM, drug, and plan.

• Workflow Gains: Surescripts touts substantial efficiency improvements. For example, their 2017 press release on CompletEPA QuickStart (a free web portal) claims a “50-percent reduction in the time spent answering unnecessary PA questions” and that “most prior authorization approvals” are returned in less than one minute (^[5]). One physician quote reported that PAs which “took anywhere from 50 minutes to 73 hours” manually now require only 13 seconds to determine authorization requirements (^[37]). Former Surescripts CEO Tom Skelton noted at launch that “CompletEPA QuickStart [delivers] secure and efficient ePA for critical medications” even for providers without EHR integration (^[4]). (Frank Harvey succeeded Skelton as CEO in June 2022 and has since focused on expanding automated PA capabilities.)

Surescripts has also been advancing automated prior authorization, where PA determinations are made without human intervention. According to the 2025 Annual Impact Report, 45,275 prescribers across 20 health systems were enabled for automated PA covering 83 medications, with approvals returned in as little as 18 seconds (^[6]). Additionally, 973,463 prescribers used Surescripts’ Real-Time Prescription Benefit service, which generated over 1 billion responses in 2025 – helping clinicians see coverage and PA requirements at the point of prescribing (^[33]).

In short, Surescripts’s ePA strategy is to integrate PA into the clinician’s normal workflow. When fully implemented, CompletEPA turns prior authorization from a cumbersome post-prescription task into a nearly real-time decision at the point-of-care (^[3]) (^[34]). A 2014 Surescripts/Epic press release highlighted this: “Moving the prior authorization workflow into the EHR can save time for both physicians and payers,” noted Epic’s CTO (^[38]), making the process faster so “medications are approved faster, and patients receive their prescriptions sooner.”

Surescripts Prior Authorization Portal (QuickStart)

Recognizing that not all providers have EHR ePA capability, Surescripts also offers a free web portal (often called the Prior Authorization Portal or CompletEPA QuickStart). Any prescriber or staff can register on Surescripts.net, enter PA request data online, and submit to payers in the same standardized way. This portal uses the same NCPDP messaging under the hood. It essentially opens up ePA to smaller practices or clinics that lack built-in EHR ePA. In its 2017 QuickStart announcement, Surescripts described the portal as extending access through its PBM and payer connections. That historical vendor claim does not establish that every current patient or PA is eligible for electronic processing; availability varies by payer, drug, plan, and workflow (^[5]).

The portal also enables delegation (staff can handle PAs for multiple providers) and offers identity verification for security. In testimonials, users say QuickStart dramatically cuts delay. For example, a Community Health Network informatics director reported that CompletEPA allowed them “to know if a prior authorization is required and what set needs to be completed in 13 seconds or less” (^[37]), compared to the chaotic hours-long process before.

Overall, Surescripts’s ePA offerings cover the spectrum: embedded EHR ePA (CompletEPA) for large providers, and standalone web PA for smaller practices. This two-pronged approach maximizes reach. As of mid-2017, Surescripts was actively educating providers through in-practice training and webinars to drive adoption of both CompletEPA and the QuickStart portal. Their industry statistics (75% of EHR doctors, 85% of PBMs) suggest the technology platform is largely in place to move PAs online (^[9]).

Other Industry ePA Solutions

While Surescripts is a leading force, it is not the only ePA option. Multiple vendors and payers have developed complementary solutions:

• CoverMyMeds (McKesson): CoverMyMeds began as an independent PA portal (launched 2008) and became part of McKesson in 2017 (^[39]). In May 2021, McKesson unified RelayHealth, McKesson Prescription Automation, and RxCrossroads under the CoverMyMeds brand (^[40]). Today CoverMyMeds serves 50,000+ pharmacies and 900,000+ providers, with payer connections representing approximately 95% of prescription volume (^[10]). It operates a hybrid model: providers can use CoverMyMeds’ web portal, or more commonly their ePA functionality is embedded transparently in EHRs. According to an industry report, CoverMyMeds has “deep integrations with over 500 EHRs,” making it “the preferred ePA vendor for many PBMs and health plans” (^[11]). In practice, many EHR-based ePA buttons actually launch CoverMyMeds behind the scenes. For example, DrFirst’s Patient Advisor ePA+ service (discussed below) uses the CoverMyMeds network to route requests. A CoverMyMeds report published in 2020 described broad ePA-system availability and reported substantial continued use of phone and fax based on earlier data. It should not be read as a current market-wide estimate; workflow coverage varies by EHR, payer, drug, and plan (^[13]). In June 2025, CoverMyMeds also acquired RxLightning, a specialty medication access platform, and in March 2026 expanded its Specialty Access and Affordability Solutions (^[41]). Notably, some payers (e.g. Independence Blue Cross) have begun transitioning away from CoverMyMeds to the Surescripts Prior Authorization Portal, reflecting the evolving competitive landscape.

• DrFirst Patient Advisor ePA+: DrFirst is a health IT company known for e-prescribing software. In 2014, Surescripts announced it had added DrFirst partners, making CompletEPA available through 300+ EHR products (^[35]). DrFirst’s own ePA solution, called Patient Advisor ePA+, integrates natively in over 200 EHRs. Unlike CompletEPA, DrFirst’s ePA is hybrid: it uses the CoverMyMeds infrastructure to connect to payers. DrFirst explained that Patient Advisor ePA+ allows physicians to submit PAs electronically, and then CoverMyMeds “sends those requests to payers in whatever form is acceptable to them, including by fax or [SCRIPT] online” (^[42]). In effect, if a payer does not yet have live ePA endpoints, the system will fall back to fax or phone, ensuring every PA is answered. DrFirst also allows integrating other ePA channels (including Surescripts’ COMPLx services). This approach reflects reality: as one executive noted, “many health plan and PBM information systems are not yet ready to accept NCPDP-based prior auth transactions” (^[43]). Hybrid models like this are practical stopgaps during the transition.

• PBM/Plan Portals: Large PBMs and insurers also offer their own ePA submission sites (often proprietary). For example, Express Scripts, CVS/Caremark, and others have online portals where prescribers can log in, fill forms, and track PAs. Surescripts’ network approach differs by standardizing across payers, but these legacy portals remain in use when ePA isn’t available. In coverage announcements Surescripts claimed contracts with four major PBMs, including CVS/Caremark and Express Scripts, to cover 210 million members (^[36]). (In fact, those four PBMs administer ~210M lives, meaning in principle their members can use CompletEPA.) Smaller plans or benefit managers may have their own systems. The ultimate goal is for standards-based ePA to supersede all these bespoke channels.

The following table summarizes the key ePA solutions:

Pilot Studies and Early Implementation

Several early pilots demonstrated the feasibility of SCRIPT-based ePA. In 2012, CVS Health, along with Surescripts and software vendors Allscripts and NaviNet/CoverMyMeds, conducted a trial involving 3,000 prescribers (^[7]). That pilot covered all lines of business (commercial, Medicare, Medicaid) and PA types (step therapy, quantity limits, etc.). The results were promising: providers were able to complete “end-to-end” ePA requests inside a single e-prescribing session in 5 minutes or less (^[8]). The reliability was also high – the electronic process produced the same PA outcome as the traditional faxed process in 99% of cases, with only a 1% variance (^[8]). CVS reported that although not all providers finished the PA in one sitting (many queued the completion), the trial achieved workflows across care settings and validated that the NCPDP ePA standard worked in practical scenarios (^[8]) (^[44]). The forum convened by AMCP concluded that integrating ePA into the existing e-prescribing workflow (including features like “skip logic” and criteria embedded in the interface) would be key to success (^[45]).

In real clinical practice, however, results have been mixed. A recent observational study at Sutter Health (a large California integrated system) examined over 74,000 ePA prescriptions (Sept 2018–June 2019) after launching ePA in Epic. Contrary to expectations, the study found no improvement in primary medication adherence (the percentage of prescriptions filled within 30 days). Specifically, 64.2% of ePA-submitted prescriptions were filled, versus 68.8% for a historical control (adjusted RR = 0.92) (^[46]). In a concurrent cohort analysis, fill rates were virtually identical (64.7% vs 62.3%, aRR 1.03) (^[46]). Interestingly, the ePA cohort actually experienced a slightly longer fill delay: prescriptions took an average of 4.2 days to fill under ePA versus 3.0 days for control (adjusted log-difference of +0.31, p<0.001) (^[47]). In other words, in this setting the new ePA system did not speed up patients getting their meds; it may have added overhead during the transition. The authors noted that some implementations (especially for vaccines or supplies) encountered issues (“misfired”), and suggested that optimization is needed. These findings indicate that simply switching to ePA isn’t a magic cure – workflow, training, and complete connectivity must be in place to see real improvements.

Provider Surveys and Perceptions

Real-world surveys of providers highlight the PA burden and the limited impact of partial digitization. In a 2022 national survey, 58% of out of 1,147 providers said they had used some form of ePA software, yet 82% still spent up to 5 hours per week on PA activities (^[48]). Those using ePA tools actually handled a higher volume of PAs and spent more total time on them than those without (p<0.01) (^[48]). Critically, the overall time from initiating a PA request to obtaining a decision was no shorter for ePA vs manual (mean durations were statistically similar) (^[48]). On the plus side, providers with ePA did report slightly faster decision times (p=0.004) (^[48]) (^[16]). In sum, this large survey found that adopting ePA did not reduce providers’ workload or challenges (^[16]), though it made decisions come back faster. Respondents overwhelmingly called for standardized criteria and better integration into EHRs to make ePA more effective (^[16]).

Other sources echo these mixed results. CoverMyMeds’ own 2020 adoption report noted that although virtually all pharmacies, payers, and EHR systems now support ePA, providers still submit roughly half of PAs via phone/fax (^[12]). In that report, 49% of prescribers said they occasionally used manual channels for certain PAs (^[14]). These gaps in adoption help explain why 89–93% of physicians in recent surveys continue to rate PAs as delayed care and provider burnout leaders (^[49]). In interviews, doctors uniformly express frustration. One family physician commented on Medical Economics that having an ePA done “while the patient is still in the office… would be awesome” (^[50]). Another physician informatics lead said his network “previously… found it took anywhere from 50 minutes to 73 hours to complete a medication prior authorization” on paper, but with CompletEPA “we know if a PA is required… in 13 seconds or less.” (^[37])

Taken together, these studies and surveys show the potential of ePA to reduce delays and work, but also that implementation barriers remain. When fully executed, ePA can produce approvals in seconds, but providers still often face incomplete connectivity (or complex criteria) that lead them to fall back on old methods. As one commentary noted, even after ePA solutions exist, “providers who use software to ask for approval generally do not find the process quicker or easier” (^[51]) – it only makes payer response quicker. Without broad adoption and seamless workflows, the clinician time spent on PAs stays high.

Quantitative data reinforce the above insights. Consider these figures from industry sources:

• Provider Time Saved: Surescripts reports that CompletEPA can cut clinician time answering PA questions by about 50%, and return approvals in under 1 minute (average) (^[5]). This is consistent with anecdotal reports: e.g., one provider said a PA that used to take “50 minutes to 73 hours” now essentially happens in seconds (^[37]).
• Population Reach: As of 2017, CompletEPA was connected to EHRs covering roughly 75% of U.S. doctors and PBMs covering 85% of lives (^[9]). Surescripts has since continued onboarding; in 2024 it reported working to upgrade to the new SCRIPT v2023011 across its network (^[52]). CoverMyMeds’ publications claim that “today, nearly 100% of pharmacies, payers and EHRs have an ePA solution” (^[12]), illustrating almost-universal availability of the technology.
• Remaining Manual Work: Despite the above, about half of PAs are still done manually. CoverMyMeds found 49–50% of PA requests in 2019–2020 occurred via phone or fax (^[13]) (^[14]). Even among ePA-enabled providers, nearly 50% report sometimes reverting to fax for certain PAs (^[14]). The implication is that tools alone won’t change practice until payers and staff fully adopt them.
• Decisions Times: EHR-enabled ePA speeds up payer decisions. In the DrFirst survey, users indicated shorter turnaround: those on ePA had significantly faster PA decisions (p=0.004) (^[48]). Surescripts’ market data also highlight rapid authorizations: QuickStart users “receive most prior authorization approvals in less than one minute” on average (^[5]).

However, ePA’s impact on ultimate outcomes like adherence is still under study. The Sutter analysis noted above found no improvement in fill rates or primary adherence after implementing ePA (^[46]). This suggests that the bottleneck may simply have shifted (e.g. from pharmacy call-backs to insurance decision queues). Prior economic modeling (outside our core sources) has estimated that efficient ePA could save substantial costs — for instance, health IT groups once projected up to $16–$33 billion in savings nationwide from e-prescribing efficiencies, including PA improvements (^[53]). Real-world ROI remains an open question, and organizations stress that clear metrics (reduced turnaround time, fewer abandoned Rx, etc.) should be tracked.

• Epic Health Systems: In 2014 Surescripts announced that it was working with Epic to implement ePA within Epic’s EHR. As Epic’s CTO put it, integrating PA into Epic “can save time for both physicians and payers” and help get needed medications “approved faster” (^[38]). This collaboration aimed to benefit roughly 100 million patients (the number of lives managed in Epic systems). Epic users today can start an ePA request in-basket and send it via Surescripts. Real-life case reports from such implementations often note dramatic time-savings.
• Express Scripts/CVS Trials: The aforementioned CVS pilot indicates that even large PBMs were willing to invest in ePA trials. Express Scripts/PCA (formerly Accredo) has also participated in ePA efforts, and by 2014 about half of all new PA transactions at participating plans were done electronically. In a press release, Express Scripts’ medical director remarked that automating PA “offers undeniable advantages to patients and the industry as a whole” (^[54]). These industry leaders view ePA as part of the “full benefits of electronic prescribing” (^[54]).
• Community Health Network (Indiana): A hospital system in Indiana conducted an internal study after adopting CompletEPA. They found approval time dropping from hours/days to minutes, and physicians reported much less time wasted calling pharmacies or PBMs. (This example is illustrative and reported anecdotally in Surescripts-sponsored communications (^[37]).)
• Provider and Patient Impact: Providers uniformly say the best outcome of ePA is avoiding a pharmacy rejection after the patient leaves. For example, one doctor noted that going to the pharmacy and then finding out a PA is needed “is a huge patient dissatisfier,” whereas an in-office ePA “sets expectations” so patients aren’t blindsided (^[55]). Patient advocates and pharmacists similarly hope that ePA will reduce “abandoned” prescriptions (where patients never start therapy due to PA delays). While hard data are still emerging, improved PAT (patient access time) is the main benefit championed by stakeholders.

Standards and Interoperability: The evolution of ePA demonstrates how health IT standards can address a major administrative problem. SCRIPT’s ePA transactions create a “digital highway” for PA information (^[28]). But standards alone aren’t enough – every link in the chain must be enabled. As one panelist noted, ePA is most effective when the criteria responses can be automated: prescribers should minimize manual input, with EMRs pre-populating as many fields as possible (^[56]). Similarly, AMCP forum participants stressed the importance of linking the ePA authorization to the correct claim system (pharmacy vs. medical) (^[57]). This highlights that while SCRIPT ePA covers pharmacy benefits, further work is needed to cover medical PAs.

Regulatory Drivers: CMS-0057-F establishes operational PA requirements for specified impacted payers, but its PA provisions exclude drugs. Beginning in 2026, affected payers other than Federally Facilitated Exchange Qualified Health Plan issuers must decide expedited requests within 72 hours and standard requests within seven calendar days; impacted payers must also provide specific denial reasons for covered medical items and services. The initial public reporting of PA metrics is due by March 31, 2026. (^[17]) The rule’s FHIR API compliance deadline (Patient Access API, Prior Authorization API, Provider Access API) is set for January 1, 2027 – delayed one year from the original proposal to give payers additional development time. Separately, the NCPDP SCRIPT v2023011 standard remains mandatory by January 1, 2028. Surescripts has been actively guiding its network on migration: D.A.W. Systems and Scriptly became the first EHR and pharmacy tech vendors to achieve v2023011 certification, and Surescripts offers a Certification Tester tool for vendors preparing to upgrade (^[58]). The Da Vinci Prior Authorization Support (PAS) implementation guide is currently published as v2.2.1 (STU 2.2) and is FHIR R4-based (^[59]). ONC/ASTP has also released a PAS Test Kit to help implementers validate conformance (^[60]).

Remaining Challenges: Despite progress, significant challenges remain. In a Blue Cross Blue Shield of North Dakota comparison of 2024 with 2025 data through October, average monthly fax submissions declined 97.9% while electronic portal submissions increased 172.2%; this is a single-payer comparison, not a national trend. Some physicians still occasionally resort to manual methods because payer systems may not fully support ePA messages. (^[61]) Payer-side readiness is improving but uneven; smaller plans and some PBMs may lag. Additionally, clinical workflows can be disrupted if ePA isn’t smoothly embedded. Early pilots found that providers often still processed PAs outside the initial visit (e.g., in a separate session), in part because of the learning curve and system design. Critics also point out that if an ePA request is pended, the patient still faces delay unless there is efficient follow-up by staff. A growing concern is the role of AI in PA: the 2025 AMA survey found that 61% of physicians are worried that AI will be used by payers to increase denial rates (^[15]), even as vendors promise AI will streamline approvals.

Future Directions: Integration and AI Automation: The ultimate vision is a “situational awareness” model, where ePA is essentially invisible. At national conferences, experts have described moving PAs “behind the scenes” so that by the time a provider prescribes, the rules are already encoded in the insurance benefit design (^[21]). This vision is becoming reality through AI-powered automation. In February 2026, Optum launched Digital Auth Complete, an AI-powered provider-side tool that integrates into EHRs and connects to 250+ payer systems, claiming 45% fewer manual touches, 80% greater efficiency, and a 96% first-pass approval rate. Its companion product, InterQual Auth Accelerator, automates the payer side of PA decisions (^[20]). CMS itself has entered the AI-PA arena with the WISeR program (January 2026), a six-year AI-enabled PA pilot in traditional Medicare launching in six states (AZ, OH, OK, NJ, TX, WA) for services vulnerable to fraud and overuse (^[62]). Over 50 major insurers have pledged to deliver real-time decisions for 80% of electronic PA requests by 2027 using FHIR-based submissions. The Da Vinci FHIR efforts continue to mature: three companion guides (DTR, QDTR, PAS) aim to let an EHR gather necessary clinical data (FHIR) and send it efficiently to payers (with an X12 278 wrapper), returning a decision back into the EHR workflow (^[19]). CMS-0057-F requires specified payers to implement Prior Authorization APIs beginning in 2027 for non-drug items and services. The rule does not require a shift away from SCRIPT for prescription-drug ePA.

Analytics and Outcomes: Continued research is needed to quantify clinical impacts. For instance, do patients initiated on therapy faster? Are abandonment rates lower? Some promising indicators exist: CoverMyMeds found that ePA can lead to significantly faster start-of-therapy for patients (though nearly half of PAs remain un-electronic) (^[13]). Longitudinal studies (like the JCO oncology study) link PA to worse outcomes; it will be important to see if ePA reverses some of these delays in real practice. Health systems and PBMs should publish ROI analyses, building on early data to show time/cost savings across stakeholders.

Multi-Stakeholder Collaboration: Success requires all parties to collaborate. The SCRIPT standard itself was developed by a broad task group with input from providers, payers, PBMs, pharmacists, and vendors. Similarly, Surescripts’ achievements (e.g. 75% physician connectivity) reflect partnerships (Epic, DrFirst, athenahealth, etc.). Future gains will depend on continued cooperation: for example, EHR vendors must build EHR-user-friendly PA interfaces, PBMs must fully adopt the standards, and clearinghouses like Surescripts and CoverMyMeds must interconnect.

Electronic prior authorization via the NCPDP SCRIPT standard represents a major shift in the drug prescribing workflow. When fully implemented, ePA can make PA decisions nearly instantaneous and integrated into the patient encounter (^[9]) (^[5]), greatly reducing the delays and satisfaction problems caused by manual PAs. Surescripts, as the leading e-prescribing network, has built out the infrastructure to make this a reality: its CompletEPA service and web portal offer real-time PA requests and approvals to most U.S. prescribers and payers (^[9]) (^[4]). Empirical pilots and user feedback show the potential: for many providers, PAs that once took hours can now be resolved in minutes or seconds (^[37]) (^[5]).

However, achieving these benefits at scale remains a work in progress. Surveys and studies underscore that provider burden has not yet dropped, because about half of PAs are still handled outside of ePA (^[14]) (^[13]). The provider’s experience continues to depend on payer readiness and workflow design. Multiple perspectives (providers, PBMs, standards groups) agree that continued refinement is needed – for example, standardizing PA criteria, pre-populating data, and extending ePA to medical-benefit PAs (^[45]) .

Looking ahead, the trajectory is no longer aspirational – it is being actively enforced. With CMS-0057-F operational since January 2026, FHIR API mandates arriving in January 2027, and SCRIPT v2023011 required by January 2028, electronic PA is rapidly becoming the norm across Medicare, Medicaid, and commercial markets (^[18]) (^[17]). AI-powered automation promises to further reduce human involvement in straightforward PA decisions, though physician concerns about AI-driven denials will require careful oversight. If Surescripts and other stakeholders succeed in fully embedding ePA into the prescribing workflow, the administrative savings could be enormous. This would not only improve efficiency but also benefit patient care by getting therapies started faster. In the words of Surescripts’ leadership, the new ePA processes are a “seamless exchange of data” that give clinicians “the right information at the right time” (^[63]).

In conclusion, ePA using NCPDP SCRIPT is a promising solution to the “prior authorization problem” but one that hinges on widespread adoption and integration. The research and case studies to date document both successes and ongoing challenges. As Surescripts continues to roll out upgrades, including SCRIPT v2023011, the health care system may reduce reliance on fax-based PA workflows; however, the Part D SCRIPT requirement and CMS-0057-F apply in distinct, limited contexts and do not create a universal drug-ePA mandate. Vigilant monitoring of outcomes, feedback loops for improvement, and sustained collaboration among providers, payers, and HIT vendors will be essential to fully realize the efficiency and patient-safety goals of electronic prior authorization (^[16]) (^[49]).

Table 1. Timeline of ePA and NCPDP SCRIPT Developments

Table 2. Key ePA Solutions and Integrations

The movement toward electronic prior authorization has broad implications:

• Enhanced Patient Access: By providing immediate PA determinations at the point of prescribing, ePA can prevent delays that cause patients to abandon therapy. For example, Miami gastroenterologist James Leavitt noted that knowing a PA is needed before the pharmacy trip “is a huge patient dissatisfier,” and that ePA would allow physicians to “inform patients about that in advance” (^[65]). Faster in-office approvals mean patients can start drugs sooner.

• Provider and Payer Efficiency: Reducing chart-push and phone negotiations saves time and money. Surescripts reports that On average 10 minutes of active work are eliminated per PA request (^[66]), cutting hours of staff time. Payers similarly benefit from standardized data and digital workflows. In a 2014 Surescripts press release, an executive stated that moving PA online was “meeting a critical need” and yielding “immediate time and cost savings” for prescribers and pharmacies (^[67]).

• Regulatory Compliance: Integration of ePA now satisfies multiple overlapping legal requirements. CMS-0057-F (effective January 1, 2026) mandates expedited PA responses within 72 hours and standard responses within 7 days for Medicare Advantage, Medicaid/CHIP, and ACA plans (^[17]). Part D plans must already support SCRIPT ePA (version 2017071), and ONC requires SCRIPT v2023011 by 2028 (^[18]). The January 1, 2027 FHIR API deadline requires impacted payers to implement the specified CMS API standards for covered medical items and services. CMS strongly encourages, but does not require, use of Da Vinci PAS; PAS is currently published as v2.2.1 (STU 2.2). With public reporting of PA metrics beginning in 2026, payers face new transparency and accountability pressures.

• Standards Evolution: The success of SCRIPT ePA has prompted further standards work. The Da Vinci Prior Authorization Support guide, for example, defines how a PA can be requested via FHIR (gathering patient and clinical data) and then transformed into an X12 278 format to interface with existing payer systems (^[19]). This “FHIR + X12” bridge promises a path forward for comprehensive U.S. PA interoperability. It also points to the future of ePA: instead of a clinician manually filling forms, algorithms (Clinical Quality Language) could evaluate simple cases without any human intervention, while complex cases route to authorizers (^[19]).

• Healthcare Outcomes: Ultimately, the value of ePA will be judged by patient outcomes. Studies so far have focused on process metrics (time saved, fill rates), but additional research should examine clinical outcomes. For instance, does ePA reduce medication abandonment or improve adherence? One panel identified shorter PA turnaround as a proxy for better outcomes (^[68]). Over the next few years, as ePA becomes more common, health systems will have data to correlate usage with health results.

• Cross-Stakeholder Collaboration: Implementation of ePA requires cooperation. NCPDP’s multi-stakeholder process is a model: standards were only achievable because providers, payers, pharmacists, and vendors all contributed. Surescripts similarly coordinates a “Network Alliance” of pharmacies, EHRs, and payers to roll out new SCRIPT versions (^[63]). Going forward, success will depend on ongoing dialogue – e.g. EHR vendors must listen to clinicians about usability, PBMs must expose APIs, and providers must train staff. Payers who still rely on phone/fax will need to invest in connecting to ePA hubs or upgrading their systems.

• Limitations and Monitorable Metrics: It is important to acknowledge limitations. The Sutter Health study and provider surveys remind us that ePA is not self-executing. Technology must match practice. Additionally, emergency/medical-benefit medications (e.g. injectable therapies) require further standard work. Policymakers also worry about “loopholes” – ePA might make it easier for payers to automate denials. Thus, oversight may be needed to ensure appropriate use of PA criteria.

In summary, electronic prior authorization via SCRIPT standard is a promising supply-chain innovation for healthcare. Evidence shows it can dramatically cut hands-on PA work and speed approvals, aligning with long-standing industry goals (^[5]) (^[37]). Surescripts’ network and technology are central to current ePA capabilities, and they are actively upgrading to new standards (^[9]) (^[18]). The remaining challenge is broadening adoption and refining workflows so that these tools translate into tangible patient benefits. With continuing policy support and technical progress (e.g. FHIR initiatives), ePA is likely to become the norm rather than the exception.

Sources are cited inline as Markdown links.