Epic Reports 9B Records Exchanged as CMS Prior Auth Deadline Forces Payer API Spend

Epic's Prior Auth API Tests Budget Allocation for Health Systems

Epic Systems reported that its customers have exchanged 9 billion health records and connected 60,000 organizations through TEFCA-aligned arrangements. The company also launched a prior authorization API now being piloted by Ochsner Health, Froedtert ThedaCare Health, Denver Health, and Summit Health for real-time prior auth at the point of scheduling.

For Epic customers, this changes the capital allocation decision around prior auth automation. Health systems that budgeted for standalone prior auth platforms from vendors like Availity, Cohere Health, or Edifecs now face a choice: pay Epic for integrated prior auth capabilities or maintain separate vendor relationships for workflow coverage Epic may not yet match. The pilot phase means buyers should demand throughput metrics and payer coverage data before canceling existing contracts. Four health systems testing an API does not equal production readiness across all payer relationships.

The 9 billion record exchange figure also exposes operational risk. Epic customers are materially dependent on TEFCA and QHIN infrastructure. Any national network outage or policy change in TEFCA governance will directly impact Epic workflows. For buyers not on Epic, this data point provides leverage in EHR renewal negotiations—demand transparent exchange-volume metrics and TEFCA participation evidence from Oracle Health, MEDITECH, or Allscripts before signing multi-year agreements.

CMS Deadline Creates New Compliance Budget Line for Payers

1upHealth announced 1up Gateway, a product designed to help health plans meet the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) with a January 1, 2027 compliance deadline. The rule applies to Medicare Advantage, Medicaid managed care plans, and Qualified Health Plan issuers on federally facilitated exchanges.

1upHealth is positioning Gateway for payers that already have some FHIR infrastructure but lack CMS-0057-specific capabilities—prior auth API endpoints, patient access APIs, and provider access APIs. This is a gap-filler play, not a full platform replacement, which puts it in direct competition with Change Healthcare/Optum, InterSystems, Redox, and cloud-native FHIR services from Google and Microsoft.

For payers and third-party administrators, CMS-0057-F is a hard regulatory deadline with significant operational risk if missed. Budget-wise, this creates a new compliance-driven spend line item between now and 2027. Even without published pricing, buyers should expect platform subscription costs (likely per-member-per-month or tiered by data volume) plus integration and professional services to bridge existing claims, utilization management, and EMR data into FHIR.

Provider organizations should prepare for payers to accelerate FHIR-based prior auth connections. This affects provider IT workloads: configuring EHR integrations to payer APIs, testing end-to-end workflows, and training staff on new prior auth flows. Enterprises that already invested in FHIR infrastructure can use the 1up Gateway announcement as leverage to push their own vendors—EHRs, integration engines, cloud platforms—for CMS-0057-aligned roadmaps and timelines that match or beat 1upHealth's.

What This Means for Enterprise Buyers

The convergence of Epic's bundling strategy and the CMS regulatory deadline creates two distinct budget pressures. Epic customers face a vendor consolidation decision that may reduce prior auth vendor spend but increases dependence on a single EHR platform. Non-Epic health systems should use Epic's exchange volume data to demand comparable transparency and TEFCA participation proof from their EHR vendors.

Payers face a compliance clock ticking toward January 2027. Products like 1up Gateway offer a faster path to CMS-0057-F compliance than replatforming, but buyers should evaluate whether gap-filler products create long-term integration debt or vendor sprawl. The question is whether compliance-driven spending on FHIR APIs now positions the organization for broader interoperability gains or simply checks a regulatory box.

For both health systems and payers, the 9 billion records Epic reported exchanging and the 60,000 organizations on TEFCA suggest that national health data exchange is no longer experimental. It is production infrastructure. Any vendor—EHR, HIE, or FHIR platform—that cannot provide transparent exchange volume metrics, uptime data, and TEFCA participation proof should be viewed as a compliance and operational risk in contract negotiations.