Medicare and Cybersecurity Changes to Prepare for in 2027
Practical priorities for providers and health plans
Medicare changes taking effect in 2027 will reach well beyond the billing department. New requirements for electronic prior authorization, changes in health-plan payment calculations, and an expanded group of negotiated prescription drug prices will affect how Arizona’s physicians and health plans deliver care, exchange information, and manage revenue. Selected specialists will also begin a new performance-based payment model.
Centers for Medicare and Medicaid Services (CMS) will retain the historical reward factor for the 2027 Star Ratings instead of implementing the previously planned Health Equity Index reward. Plans and participating practices should align screening processes, follow-up documentation, and incentive contracts with the correct measurement and payment timelines.
The year-end task is to translate and implement changes coming for 2027 into daily workflows, including budgets, contracts, and delivery of care. The following priorities reflect federal guidance available as of October 1, 2026. This is not a comprehensive list.
Prepare for medical prior authorization and Part D drug pricing changes
Electronic prior authorization is an immediate operational priority. Beginning January 1, 2027, Medicare Advantage organizations must standardize electronic interfaces that support prior authorization requests and responses for medical items and services. Related requirements expand exchanges of patient information among plans, providers, and patients. Providers should ask their electronic health record vendors and major Medicare Advantage payers to demonstrate a complete authorization transaction before year-end.
Prescription drug changes will affect both plan administration and patient conversations. Negotiated Medicare prices for 15 additional selected Part D drugs take effect January 1, 2027. The list includes Trelegy Ellipta, Xtandi, and the selected drug grouping that includes Ozempic, Rybelsus, and Wegovy. The expansion should prompt a review of pharmacy-benefit-manager contracts, claims configuration, reimbursement arrangements, and patient cost estimates. The first negotiated prices for selected Part B drugs are scheduled for 2028, so organizations should keep those two implementation calendars separate.
Plan for payment and performance changes
Physician practices should also budget for the expiration of a temporary payment increase. Under current law, the one-year 2.5 percent Physician Fee Schedule conversion-factor increase for 2026 does not continue in 2027. CMS’s July 2026 proposal projects conversion-factor decreases of approximately 1.19 percent for qualifying advanced alternative-payment-model participants and 1.68 percent for other practitioners. These are proposed figures, not final rates, and their effect on a practice will depend on its services and other payment adjustments.
The proposal also contains potentially significant changes to same-day office visits and procedures and to remote monitoring, including proposed limits on contractor-furnished monitoring services. Practices using those arrangements should prepare financial scenarios and review vendor contracts now. Before changing billing instructions or finalizing budgets, confirm what CMS adopts in the final rule and whether Congress changes the payment framework.
Performance in 2027 determines adjustments to covered Medicare Part B professional-service payments in 2029; the initial adjustment range is minus 9 percent to plus 9 percent. Participating practices should build a reporting calendar, establish baseline performance, and review arrangements with primary care partners. Waiting until the payment year would leave the first performance year unaddressed.
Strengthen cybersecurity and verify readiness
Cybersecurity warrants a separate budget discussion. As of October 1, 2026, HHS continues to identify its major HIPAA Security Rule overhaul as a proposal. It would add more prescriptive requirements, including multifactor authentication and encryption with limited exceptions, technology inventories, periodic testing, and greater verification of business-associate safeguards. These proposed measures should not be presented as a finalized 2027 compliance mandate. The existing Security Rule remains in force.
Organizations can nevertheless make useful investments now. Review the security risk analysis, test restoration of critical systems, and confirm that business associate agreements and vendor contracts address incident reporting, cooperation, and access to necessary information. Current HIPAA obligations already extend to covered entities and business associates. Adding new electronic connections for Medicare data exchange should trigger a practical review of access permissions, data flows, and safeguards.
Before year-end, leadership should assign an accountable owner to each applicable change and require evidence of readiness: tested transactions, revised contracts, verified benefit calculations, current privacy notices, and a funded implementation plan. Finance, clinical operations, information technology, and legal teams should work from the same calendar. That preparation gives organizations a better chance of preserving revenue and maintaining patient access when the new year begins.
Lexie Davis is a health care attorney with Fennemore who advises medical practices, health care entities, and health care professionals on health care regulatory compliance, business operations, and agreements. Her practice includes HIPAA compliance, physician employment and shareholder agreements, health care practice formation and structuring, credentialing, and licensing. She can be reached at ldavis@fennemorelaw.com.
Heather Macre is a director with Fennemore where her work focuses in the areas of business litigation, healthcare and bankruptcy. In the healthcare arena, Heather’s business acumen encompasses all aspects of healthcare agreements, such as hospital recruitment agreements, employment agreements and non-compete covenants, and office-sharing agreements. She can be reached at hmacre@fennemorelaw.com.