Three federal changes reached outpatient psychiatry in 2026: faster prior authorization decisions from government-program payers, a shifting mental health parity picture, and the compliance deadline for the updated substance use disorder privacy rule. Each one changes a workflow your front desk or biller runs every week.
1. Prior authorization: 72 hours and 7 days
Under the CMS Interoperability and Prior Authorization final rule (CMS-0057-F), as of January 1, 2026, Medicare Advantage plans, Medicaid and CHIP programs and their managed care plans must:
- Decide expedited prior authorization requests within 72 hours.
- Decide standard requests within 7 calendar days.
- Give a specific reason for every denial, however the request was submitted.
- Publish prior authorization metrics each year, starting March 31, 2026.
Electronic prior authorization APIs follow on January 1, 2027.
The important limit for psychiatry: the rule covers items and services, and it excludes drugs. Medication prior authorizations, the ones psychiatry practices handle most, still run on each plan's pharmacy benefit timelines and state law. The rule helps with services like TMS, esketamine administration, psychological testing, and intensive outpatient referrals.
Separately, in June 2025 dozens of commercial and government-program insurers pledged through AHIP and the Blue Cross Blue Shield Association to shrink the number of services needing prior authorization, honor existing authorizations for a period when patients switch plans, and move most electronic approvals to real time by 2027. These are voluntary commitments. Track how each payer in your mix is following through.
What to do: log the submission date and time for every service authorization, flag any government-program request past 72 hours or 7 days, and use the specific denial reason to correct and resubmit the same day.
2. Mental health parity: the 2024 rule is paused
The Mental Health Parity and Addiction Equity Act requires health plans to cover mental health and substance use care on terms no more restrictive than medical care. A 2024 final rule added stricter tests for nonquantitative treatment limits, including network adequacy and prior authorization.
- May 2025: the Departments of Labor, HHS, and Treasury announced they would not enforce the new 2024 requirements while litigation is pending, plus 18 months after.
- March 2026: the Departments told the court they intend to issue a new proposed rule revising the challenged provisions, with a target of no later than December 31, 2026.
- Still enforceable: the statute itself, the 2013 final rule, and the Consolidated Appropriations Act, 2021 requirement that plans perform and produce comparative analyses of their nonquantitative treatment limits.
What to do: when a commercial plan applies a limit to psychiatric care that it would not apply to a comparable medical service, such as a stricter prior authorization, a visit cap, or a lower out-of-network rate, ask for the plan's comparative analysis. Plans have to be able to produce it, and the request alone often resolves the issue. State parity laws may be stricter; your state insurance department is the place to complain.
3. 42 CFR Part 2: compliance required since February 16, 2026
Part 2 protects records from federally assisted substance use disorder treatment programs. The 2024 final rule, with a compliance date of February 16, 2026, aligns it much more closely with HIPAA:
- A single patient consent can now cover all future uses and disclosures for treatment, payment, and health care operations.
- HIPAA entities that receive records under that consent may redisclose them as HIPAA allows.
- Breach notification follows the HIPAA Breach Notification Rule.
- Patient notices must be updated, and HIPAA entities that maintain Part 2 records must update their Notice of Privacy Practices.
- The HHS Office for Civil Rights began accepting complaints and enforcing Part 2 on February 16, 2026, with penalties aligned to HIPAA.
Does Part 2 apply to your practice? It depends on whether the practice, or a unit inside it, holds itself out as providing substance use disorder diagnosis, treatment, or referral, and receives federal assistance, which includes Medicare enrollment and DEA registration. A general psychiatry practice that treats co-occurring SUD as part of broader care is often outside Part 2, but practices with a dedicated addiction program often fall inside it. This is a question for counsel.
What to do: if Part 2 applies, update your consent form to the single-consent model, update your Notice of Privacy Practices, and add Part 2 records to your breach response plan.