When Your Contract Is Stricter Than CMS: Measuring Timeliness Against More Than One Clock
October 11, 2026
Key Takeaways
- •Current regulations set the applicable duties, and the published audit protocols describe specific tests. Binding commitments in provider agreements, state contracts and approved Models of Care can be stricter, and they belong in your monitoring alongside both.
- •Using one threshold for cases governed by different standards can miss breaches of a stricter commitment, or label cases late against a standard that does not apply to them.
- •A stricter commitment should be scoped to the population, request type, dates and endpoint its terms actually govern. Contract ID is enough only when it fully identifies that population.
- •Keep enough information to distinguish contractual lateness from failure of the applicable federal deadline.
- •Review your contract scope before you screen rows by an active-contract list. Universe scope follows the engagement letter and the requested period, not today’s list.
If your plan processes expedited organization determinations for items and services, you know the federal standard. Under 42 CFR 422.572(a)(1), for a request accepted for expedited processing, the plan must make its determination and notify the enrollee "as expeditiously as the enrollee's health condition requires," and no later than 72 hours after receiving the request.
Expedited Part B drug requests have a 24-hour maximum under (a)(2) that cannot be extended. For eligible item and service requests, 422.572(b) allows an extension of up to 14 calendar days, but only under the conditions it lists and with written notice to the enrollee. The published ODAG protocol's Standard 1.3 tests extended requests at 17 calendar days from receipt. That is a test of the full allowance: a shorter extension expires sooner, and none of these maximums is permission to wait when the enrollee's condition calls for faster action. Applicable integrated plans follow the integrated determination provisions at 42 CFR 422.629 and 422.631 for non-drug determinations.
Those are not always the only timeframes your plan has committed to. For illustration, a provider agreement may impose a shorter deadline for a defined class of requests. For applicable integrated plans, 422.629(c) permits more protective state timeframes or notice requirements, which must be included in the state Medicaid agency contract. An approved Model of Care may commit to an annual reassessment cycle shorter than the 365 days the SNPCC protocol tests, and implementing the approved Model of Care is itself a federal obligation under 422.101(f). Where a commitment like these is binding, your compliance program should be able to monitor it, without assuming its enforcement mechanism is the same in every case. Each one creates a measurement problem the federal maximums alone do not solve.
Two Possible Errors
The simplest approach is one threshold for everything. Using one threshold for cases governed by different standards creates two possible errors.
| Approach | What goes wrong | Impact |
|---|---|---|
| Measure everything at the federal maximum | A case notified in 60 hours meets the 72-hour maximum but misses a shorter contractual deadline | Some breaches of the stricter commitment go unreported as breaches of that commitment |
| Measure everything at the stricter number | Cases governed only by the federal standard are labeled late against a threshold that does not apply to them | Overstated late counts, if those results are presented as failures of the applicable standard |
An on-time rate cannot tell you, by itself, which clock produced it. A report that omits its thresholds and scope can conceal either error.
The 60-hour example also depends on what it measures. Decision, oral notification, written notification and any required written confirmation are different events. Use the notification endpoint each standard requires, not the determination timestamp or the date a letter was generated, and track required written notice or confirmation separately. Applicable integrated plans have their own written notice requirements for adverse determinations.
Scope Each Commitment to What It Governs
The fix is to scope each stricter commitment to the population, benefit, request type, dates and endpoint its terms actually govern. Contract ID may fully identify that population. An agreement may instead cover only certain services, providers or request categories, in which case contract ID alone would over-apply it. The same setting should drive both the row-level validation and the aggregate timeliness report; separately configured thresholds can drift apart, and a validation result that disagrees with the report is hard to explain.
Read extension terms closely. Confirm the starting event, hours versus calendar days, and whether an extension value means additional time after the initial deadline or total elapsed time from receipt. Configure the extended check separately from the unextended one.
Scope It by Date, Too
Requirements change. Under 42 CFR 422.568(b)(1)(ii), added by the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), standard organization determinations for items and services subject to prior authorization under 422.122 have a seven-calendar-day notification maximum beginning January 1, 2026, subject to medical exigency and permitted extensions. Applicable integrated plans have a parallel provision in 422.631. Other standard pre-service item and service requests keep the 14-calendar-day maximum, and standard Part B drug requests keep their 72-hour maximum, which cannot be extended. The currently published ODAG Standard 1.1 still states the older 14-day and 28-day tests, which is one reason current regulations and published audit tests should not be treated as interchangeable.
Three things follow.
Requests straddle the line
An OD universe pulled in 2026 can contain requests received on both sides of January 1, because inclusion in the OD table is driven by the determination date. Document how your plan treats requests pending across the change, and the authority for that treatment. Do not select a standard from the universe year or the date you run the report.
Not every standard request is a prior authorization request
Identify prior authorization requests from source-system data before applying the shorter standard. The OD record layout has no field that marks a request as prior authorization, so a mixed file cannot be split from the universe alone.
The clock does not always start at the original receipt
For a standard request upgraded to expedited, the OD layout's receipt date and time columns hold the upgrade date and time; keep the original receipt separately if another standard needs it. For a request filed by a purported representative without the required valid documentation, CMS's Parts C and D appeals guidance (section 20.2.1) starts the timeframe when that documentation arrives. That rule does not delay an enrollee-filed request, and it is not a reason to demand fresh documentation that is already valid and on file. Document the trigger that decides which standard applies separately from the event that starts the clock, because they can differ.
Make the Measurement Self-Describing
When a report mixes thresholds, it should say so. A summary row labeled with a single threshold, when some of its cases were measured against another, is a misleading label. Show the thresholds actually applied, and keep the applied threshold on each measured case so anyone reviewing a late case can see which standard it failed. Where both a federal and a contractual standard matter, retain the elapsed time and both limits, so the two assessments can be reconstructed separately. A single configured threshold does not, by itself, produce two independent verdicts.
The same discipline applies over time. Capture and record a configuration version when a validation loads its rules, and do not let a configuration published later change the version an in-progress validation already captured. Otherwise the same report run months apart can disagree, and reconstructing why becomes much harder.
Contract IDs That Are Not on Your List
A related check shows up in the same data: rows carrying a contract ID your organization does not list as active. Some belong out of a measurement, such as a contract outside the scope of the request that came through an extract. Others do not. A contract terminated during or after the requested period can still have cases that belong in a historical universe, because universe scope follows the engagement letter, the requested period and the record layout's inclusion rules, not today's contract list.
So review your scope before you screen rows by an active-contract list, and keep that list matched to the engagement scope and period. If you do screen off-list rows out of timeliness measurement, treat it as a documented screening policy and keep the rows in record totals so nothing silently disappears. A blank or malformed contract ID is a different case: eligibility is unknown, so the row should remain subject to the normal applicable checks, including the contract ID format check itself.
Sevana's CMS Universe Scrubber supports configurable thresholds for selected timeliness checks; depending on the check, a threshold can be scoped by contract or by request date. For supported checks in audit validation, the row-level checks and the Timeliness Report use the configuration recorded with that validation, and each calculated timeliness result keeps the threshold it was measured against. An optional contract-list check, when enabled for an organization, warns on well-formed contract IDs that are not on the list, automatically skips the remaining row checks and timeliness measurement for those rows, and keeps them in uploaded-record totals. Review the list against the intended scope and period before enabling it.
The Honest Summary
Current regulations set the duties, published audit protocols describe specific tests, and binding contractual and Model of Care commitments can hold your plan to more. Monitoring all of them means scoping each standard to the cases it actually governs, measuring at the endpoint and clock start it specifies, documenting how each case was assigned to a standard, and being able to show afterwards which standard each result represents. For more on how the seven-day change interacts with your ODAG universes, see Prior Authorization Metrics and Your ODAG Universes.
Scope note. This post discusses measurement practice. It is not legal advice or a CMS compliance determination, and contractual examples are illustrative. CMS cautions that its audit protocols and record layouts should not be used on their own to interpret policy; see the CMS Program Audits page.
Reviewed against current eCFR text of 42 CFR 422.568, 422.572, 422.629, 422.631 and 422.101(f), CMS-0057-F (89 FR 8758), the CMS-10717 ODAG and SNPCC protocols (OMB 0938-1395, expiring January 31, 2027) and the CMS Parts C and D appeals guidance, October 2026.
Frequently Asked Questions
Are the ODAG audit protocol timeframes the same as the regulatory timeframes?
Not necessarily. Current regulations set the applicable duties, and the published audit protocols describe specific tests. For example, since January 1, 2026, standard organization determinations for items and services subject to prior authorization have a seven-calendar-day notification maximum under 42 CFR 422.568(b)(1)(ii), while the currently published ODAG Standard 1.1 still states 14-day and 28-day tests. Plans must meet current regulations, and CMS may review related requirements beyond the listed tests.
Does the seven-day standard apply to every standard organization determination?
No. The seven-calendar-day maximum in 42 CFR 422.568(b)(1)(ii) applies to standard organization determinations for items and services subject to prior authorization under 422.122, beginning January 1, 2026, subject to medical exigency and permitted extensions. Other standard pre-service item and service requests keep the 14-calendar-day maximum, and standard Part B drug requests keep a 72-hour maximum that cannot be extended. Applicable integrated plans have a parallel provision in 422.631.
How long can an expedited organization determination be extended?
For eligible item and service requests, 42 CFR 422.572(b) allows an extension of up to 14 calendar days, only under the conditions it lists and with written notice to the enrollee. Expedited Part B drug requests have a 24-hour maximum that cannot be extended. The published ODAG protocol tests extended expedited requests at 17 calendar days from receipt, which reflects the full allowance; a shorter extension expires sooner.
When does the timeliness clock start for a request filed by a representative?
When a request is filed by a purported representative without the required valid documentation, CMS's Parts C and D appeals guidance (section 20.2.1) starts the timeframe when that documentation arrives. That does not delay a request filed by the enrollee, and it is not a reason to demand fresh documentation that is already valid and on file.
Should rows with inactive contract IDs be excluded from timeliness measurement?
Not automatically. Universe scope follows the engagement letter, the requested period and the record layout's inclusion rules, so a contract terminated during or after the requested period can still have cases that belong in a historical universe. Review scope before screening rows by an active-contract list, and if you screen them out of timeliness measurement, document the policy and keep the rows in record totals.
Measure Against the Right Clock
See how row-level validation and timeliness reporting handle thresholds that differ from the CMS defaults, with the applied threshold kept on every measured case.