(1) Beginning January 1, 2024, the authority shall require each managed care organization to comply with the following standards related to prior authorization for health care services and prescription drugs:

(a) The managed care organization shall meet the following time frames for prior authorization determinations and notifications to a participating provider or facility that submits the prior authorization request through an electronic prior authorization process, as designated by each managed care organization:

(i) For electronic standard prior authorization requests, the managed care organization shall make a decision and notify the provider or facility of the results of the decision within three calendar days, excluding holidays, of submission of an electronic prior authorization request by the provider or facility that contains the necessary information to make a determination. If insufficient information has been provided to the managed care organization to make a decision, the managed care organization shall request any additional information from the provider or facility within one calendar day of submission of the electronic prior authorization request.

(ii) For electronic expedited prior authorization requests, the managed care organization shall make a decision and notify the provider or facility of the results of the decision within one calendar day of submission of an electronic prior authorization request by the provider or facility that contains the necessary information to make a determination. If insufficient information has been provided to the managed care organization to make a decision, the managed care organization shall request any additional information from the provider or facility within one calendar day of submission of the electronic prior authorization request.

(b) The managed care organization shall meet the following time frames for prior authorization determinations and notifications to a participating provider or facility that submits the prior authorization request through a process other than an electronic prior authorization process described in subsection (2) of this section:

(i) For nonelectronic standard prior authorization requests, the managed care organization shall make a decision and notify the provider or facility of the results of the decision within five calendar days of submission of a nonelectronic prior authorization request by the provider or facility that contains the necessary information to make a determination. If insufficient information has been provided to the managed care organization to make a decision, the managed care organization shall request any additional information from the provider or facility within five calendar days of submission of the nonelectronic prior authorization request.

(ii) For nonelectronic expedited prior authorization requests, the managed care organization shall make a decision and notify the provider or facility of the results of the decision within two calendar days of submission of a nonelectronic prior authorization request by the provider or facility that contains the necessary information to make a determination. If insufficient information has been provided to the managed care organization to make a decision, the managed care organization shall request any additional information from the provider or facility within one calendar day of submission of the nonelectronic prior authorization request.

(c) In any instance in which a managed care organization has determined that a provider or facility has not provided sufficient information for making a determination under (a) and (b) of this subsection, a managed care organization may establish a specific reasonable time frame for submission of the additional information. This time frame must be communicated to the provider and enrollee with a managed care organization's request for additional information.

(d) The prior authorization requirements of the managed care organization must be described in detail and written in easily understandable language. The managed care organization shall make its most current prior authorization requirements and restrictions, including the written clinical review criteria, available to providers and facilities in an electronic format upon request. The prior authorization requirements must be based on peer-reviewed clinical review criteria. The clinical review criteria must be evidence-based criteria and must accommodate new and emerging information related to the appropriateness of clinical criteria with respect to black and indigenous people, other people of color, gender, and underserved populations. The clinical review criteria must be evaluated and updated, if necessary, at least annually.

(2)(a) Each managed care organization shall build and maintain a prior authorization application programming interface that automates the process for in-network providers to determine whether a prior authorization is required for health care services, identify prior authorization information and documentation requirements, and facilitate the exchange of prior authorization requests and determinations from its electronic health records or practice management system. The application programming interface must support the exchange of prior authorization requests and determinations for health care services beginning January 1, 2025, and must:

(i) Use health level 7 fast health care interoperability resources in accordance with standards and provisions defined in 45 C.F.R. Sec. 170.215 and 45 C.F.R. Sec. 156.22(3)(b);

(ii) Automate the process to determine whether a prior authorization is required for durable medical equipment or a health care service;

(iii) Allow providers to query the managed care organization's prior authorization documentation requirements;

(iv) Support an automated approach using nonproprietary open workflows to compile and exchange the necessary data elements to populate the prior authorization requirements that are compliant with the federal health insurance portability and accountability act of 1996 or have an exception from the federal centers for medicare and medicaid services; and

(v) Indicate that a prior authorization denial or authorization of a service less intensive than that included in the original request is an adverse benefit determination and is subject to the managed care organization's grievance and appeal process under RCW 48.43.535.

(b) Each managed care organization shall establish and maintain an interoperable electronic process or application programming interface that automates the process for in-network providers to determine whether a prior authorization is required for a covered prescription drug. The application programming interface must support the exchange of prior authorization requests and determinations for prescription drugs, including information on covered alternative prescription drugs, beginning January 1, 2027, and must:

(i) Allow providers to identify prior authorization information and documentation requirements;

(ii) Facilitate the exchange of prior authorization requests and determinations from its electronic health records or practice management system, and may include the necessary data elements to populate the prior authorization requirements that are compliant with the federal health insurance portability and accountability act of 1996 or have an exception from the federal centers for medicare and medicaid services; and

(iii) Indicate that a prior authorization denial or authorization of a drug other than the one included in the original prior authorization request is an adverse benefit determination and is subject to the managed care organization's grievance and appeal process under RCW 48.43.535.

(c) If federal rules related to standards for using an application programming interface to communicate prior authorization status to providers are not finalized by September 13, 2023, the requirements of (a) of this subsection may not be enforced until January 1, 2026.

(d)(i) If a managed care organization determines that it will not be able to satisfy the requirements of (a) of this subsection by January 1, 2025, the managed care organization shall submit a narrative justification to the authority on or before September 1, 2024, describing:

(A) The reasons that the managed care organization cannot reasonably satisfy the requirements;

(B) The impact of noncompliance upon providers and enrollees;

(C) The current or proposed means of providing health information to the providers; and

(D) A timeline and implementation plan to achieve compliance with the requirements.

(ii) The authority may grant a one-year delay in enforcement of the requirements of (a) of this subsection (2) if the authority determines that the managed care organization has made a good faith effort to comply with the requirements.

(iii) This subsection (2)(d) shall not apply if the delay in enforcement in (c) of this subsection takes effect because the federal centers for medicare and medicaid services did not finalize the applicable regulations by September 13, 2023.

(3) Nothing in this section applies to prior authorization determinations made pursuant to RCW 71.24.618 or 74.09.490.

(4) For the purposes of this section:

(a) "Expedited prior authorization request" means a request by a provider or facility for approval of a health care service or prescription drug where:

(i) The passage of time:

(A) Could seriously jeopardize the life or health of the enrollee;

(B) Could seriously jeopardize the enrollee's ability to regain maximum function; or

(C) In the opinion of a provider or facility with knowledge of the enrollee's medical condition, would subject the enrollee to severe pain that cannot be adequately managed without the health care service or prescription drug that is the subject of the request; or

(ii) The enrollee is undergoing a current course of treatment using a nonformulary drug.

(b) "Standard prior authorization request" means a request by a provider or facility for approval of a health care service or prescription drug where the request is made in advance of the enrollee obtaining a health care service or prescription drug that is not required to be expedited.