Hospital to SNF transfer app in 2026: approved days, beds, HIPAA
TL;DR
A hospital to SNF transfer app in 2026 is one shared case per patient: the referral, facility answers, the payer's approved days, same-day beds, the patient's choice and a chat, with an admin page deciding who sees what. The screens are easy. HIPAA design and Apple distribution set the schedule.
- In June 2024, 19 Medicare Advantage plans denied 12% of SNF admission requests and overturned 95% of appealed denials (HHS OIG).
- Since January 1, 2026, impacted payers must decide standard prior authorization requests within seven calendar days, expedited ones within 72 hours.
- Keep approved days and the next review date on the case.
- Ship iOS as a custom app through Apple Business or as an unlisted app; both pass App Review.
Why hospital-to-SNF transfers stall
MedPAC's March 2026 report counts 14,518 skilled nursing facilities in 2025 and about 1.5 million fee-for-service Medicare-covered SNF stays in 2024, and notes hospital reports of SNF transfer delays.
Insurance adds days. Per a JAMA Internal Medicine study, Medicare Advantage patients discharged to a SNF in 2023 were 3.1 percentage points more likely than Traditional Medicare patients to stay in the hospital 14 days or longer. HHS OIG found that in June 2024, 19 Medicare Advantage organizations denied 12% of SNF admission requests. Only 18% of those denials were appealed, and 95% of the appeals were overturned.
In one transfer project we scoped, the buyer named the gap: the hospital case manager seldom knows how many days the plan approved. The facility side needed admins to post same-day male and female bed counts. The app puts both numbers on one screen.
Prior authorization got a deadline on January 1, 2026
Under CMS-0057-F, Medicare Advantage plans and Medicaid and CHIP programs, managed care included, must answer expedited prior authorization requests within 72 hours and standard ones within seven calendar days from January 1, 2026. A denial must carry a specific reason. The first public metrics show Medicare Advantage insurers denied 12% of standard requests on average in 2025, with a median response of about a day, per KFF. A Prior Authorization API follows on January 1, 2027.
With answers due in days, the bottleneck moves to the hospital. Model the authorization as data now (status, approved days, next review date, denial reason) so the API fills the same fields later.
How we built this guide
Regulatory facts come from rule text and federal agencies, coverage numbers from federal reports and KFF, distribution rules from Apple and Google. Examples come from our case studies or anonymized pipeline records; any group with fewer than three data points is not published.
Disclosure: Mercury Development builds custom healthcare software and profits when transfer apps get built. Not legal advice.
The transfer case at a glance
| Case element | Holds | Updated by | Source of truth |
|---|---|---|---|
| Referral packet | Clinical summary, needs, insurance | Hospital case manager | Hospital EHR |
| Facility responses | Sent, viewed, accepted or declined | Facility admissions | The app |
| Authorization | Payer, status, approved days, next review | Case manager, later payer API | Payer |
| Beds | Open beds by sex, last update time | Facility admin | The app |
| Patient choice | Facilities offered, preference | Case manager with patient | Hospital record |
| Case chat | One thread per facility | Hospital team and that facility | The app |
| Discharge | Date, transport, handoff | Case manager | Hospital EHR |
Approved days belong on the case
Approved days mean two things.
In Medicare Advantage they come from the plan: an approval for admission, then reviews of the stay. CMS told plans in a February 2024 FAQ that a predicted length of stay alone cannot be used as the basis to terminate post-acute care services. Store approved days, last covered day and next review date, and show days remaining on the case.
Original Medicare approves nothing, but the benefit has edges. Per Medicare.gov, Part A covers SNF care after an inpatient stay of at least 3 days in a row, observation time excluded, for up to 100 days per benefit period, at $217 a day for days 21-100 in 2026. Medicare Advantage plans may waive the 3-day stay, so record which rule applies. Days used earlier in the benefit period are gone: per CMS's HETS companion guide, an eligibility request with service type code AG returns SNF spell data with remaining days and copayment amounts.
Bed availability needs an owner and a timestamp
Federal data won't tell you who has a bed today. CMS's Provider Information dataset lists active nursing homes with certified beds and Five-Star Rating inputs: a sound base for facility profiles. Certified beds are capacity, not vacancy.
Vacancy comes from the facility. In the transfer project we scoped, each facility admin was to post open male and female beds daily. Treat each count as a claim with an author and a time, grayed out once older than the shift. Let case managers ask in chat first.
Approvals follow patient choice
The hospital side has a legal order. Under 42 CFR 482.43, the hospital gives the patient a list of Medicare-participating SNFs in the area they request, tells them they are free to choose and must not specify or otherwise limit qualified providers. Managed care patients also get any network data it holds. It must identify any referred SNF in which it has a disclosable financial interest and document that the list was presented.
So facilities can promote themselves in profiles, but the patient sees every qualifying SNF in the requested area, marked in network, out of network or unknown, with CMS ratings. Then approvals stack in order: patient choice, facility acceptance, payer authorization, discharge. Each step gets an owner and a timestamp, and a case moves only to a named step.
Live chat and the admin page decide who reads a case
HIPAA does not block the referral. 45 CFR 164.501 counts the referral of a patient from one provider to another as treatment, and under 164.502(b) the minimum necessary standard does not apply to disclosures to a provider for treatment.
Permission to refer is not permission to browse. Give each facility its own thread with the hospital team, so competing SNFs never see each other's replies or status. A facility that declines loses access; the audit log keeps what it saw.
The admin web page is where access ends. Each hospital and facility gets an administrator who creates and deactivates users, effective on the next request. Our Precision Practice Management system lets managers limit rejection codes by user class, and its specification keeps confidential patient information off the user side.
When the chat itself has to become part of the record, see when HIPAA compliant chat for clinicians is worth building custom.
HIPAA technical implementation starts with a risk analysis
The ambiguity buyers feel is written into the rule. 45 CFR 164.306 lets you use any security measures that reasonably and appropriately implement the standards, weighing your size and costs against the risks. Encryption is addressable under 164.312. An accurate and thorough risk analysis is required under 164.308, and it turns "HIPAA compliant" into decisions: where case data lives, who reads which case, what gets logged.
OCR announced the 14th enforcement action of its Risk Analysis Initiative in June 2026. A stricter Security Rule proposed in January 2025, with mandatory encryption and multi-factor authentication, is still pending; final action is projected for July 2027, per Davis Wright Tremaine. We build to the proposal now: both controls cost less in sprint one than as a retrofit.
A cloud host is a business associate even when it stores only encrypted ePHI, per HHS guidance, so sign the BAA and keep PHI in HIPAA-eligible AWS services. Amazon SNS mobile push and SMS are outside that eligibility, and Apple's Human Interface Guidelines warn against confidential information in notifications. Send "New message on a case", never a patient's name.
The full sequence after the risk analysis is in our guide to HIPAA compliant app development.
Apple B2B distribution: pick the channel before the build
Apple is the second gate, and its choice sticks: once an app is approved, its distribution method can't be changed, and switching between private and public takes a new app record.
- Public App Store. Risky for a network tool: a developer posted a guideline 3.2 rejection saying the App Store is intended for apps with a public audience (Apple Developer Forums).
- Custom apps, which buyers still call the Apple B2B program. Each organization you name receives the app in Apple Business, which replaced Apple Business Manager on April 14, 2026, and deploys it by device management or redemption codes. Every version passes app review, typically in 1-2 days.
- Unlisted. Link-only and suited to partners; anyone with the link can install, so access control lives in your login.
- Enterprise. Internal apps for an organization's own employees, 100 or more; a network of separate organizations does not fit.
Custom apps carry an onboarding cost: each facility needs an Apple Business account, and verification can take up to five business days. Guideline 2.1 requires a demo account for login apps; load it with sample data, and submit from the client's own developer account: guideline 5.1.1(ix) expects healthcare apps from the legal entity that provides the service. On Android, managed Google Play publishes a private app to up to 1,000 organizations.
Each route and who should submit the app are covered in our guide to App Store approval for healthcare apps.
Build, buy or connect: which path fits
Referral networks exist. WellSky says CarePort's network includes more than 2,000 hospitals and 130,000 post-acute and community providers. LeanTaaS acquired Aidin, which serves 200+ hospitals, in September 2026. PointClickCare says it is the system of record in approximately 80% of U.S. skilled nursing facilities.
- One hospital that needs reach: buy, and spend on integration.
- A SNF group or regional network whose edge is its placement workflow: build.
- A care management company or plan working across others' systems: build the case layer, connect the rest.
- A startup selling the network itself: build, and settle distribution and BAAs first.
What our own pipeline records show
We reviewed by hand our pipeline records for staff-facing care coordination and administration software, compiled in September 2026, leaving out records without buyer-stated requirements. Counts stay unpublished under our client agreements; shares are rounded to five points.
- Around 85% paired the frontline app with a staff-side control layer: an admin web page, a dashboard, role management or an administrator portal.
- Around half hit a gate outside the code: contract review by legal, client IT holding hosting and environment access, or App Store review.
Those gates run on other people's calendars, so we track them separately.
Why we settle HIPAA and distribution in week one
Our opinion: settle two decisions before the first screen. The risk analysis decides where case data lives and who reads it. The distribution route decides the app record, the developer account and whether every facility needs Apple Business. Both are cheap in week one and costly after approval.
The limit: a single hospital buying reach needs neither. Buy the network.
Written by Rob Devereaux, Chief Operating Officer at Mercury Development. Rob has run the firm's operations from Hudson, Ohio since 2019 and has over 20 years of operational and financial experience. The pipeline records behind this article's requirement counts sit in the operations he oversees.
Send us your transfer workflow and we will map the first release
Tell us who sends referrals, who accepts them, which payers your patients use and how partners install apps today. We will map the case, mark the week-one HIPAA and distribution decisions, and show what the first release needs.