CMS Implementation Guides
Patient Access API
The Patient Access API must be queried in the context of an individual patient. The patient, through standard OAuth
2.0 mechanisms, must explicitly inform the Health Plan's systems that the third-party app is authorized to access
data on their behalf.
C4BB. The Patient Access API is required conform to the HL7 Consumer Directed Payer Data Exchange (CARIN IG for Blue Button, v STU 1.0.0) to facilitate the exchange of claims and encounter data. Consumer-directed exchange occurs when a consumer or an authorized caregiver invokes their HIPAA Individual Right of Access (45 CFR 164.524) and requests their digital health information from a HIPAA covered entity (CE) via an application or other third-party data steward (third-party application).
USCDI. The Patient Access API is required to adhere to either of the following IG's to facilitate the exchange of clinical information as defined in the United States Core Data for Interoperability (USCDI):
- HL7 FHIR US Core IG, v STU 3.1.0
- HL7 FHIR Da Vinci Payer Data Exchange (PDex) IG, v STU1.0.0
The USCDI is a standardized set of health data classes and constituent data elements designed for interoperable health information exchange.
US Drug Formulary. The Patient Access API is required to conform to the HL7 FHIR Da Vinci Payer Data Exchange (PDex) US Drug Formulary IG, v STU 1.0.1, to facilitate the exchange of current formulary information.
Payer-to-Payer Data Exchange
CMS-regulated payers are required to exchange certain clinical data in electronic form at the patient's request. This enables the patient to take their information with them as they move from payer to payer over time, and helps create a more consistent patient record.
Payer-to-Payer Data Exchange must take place via a FHIR-based API (P2P API) by January 1, 2023.
Impacted payers are required to exchange, at a minimum, the data classes and elements included in the content standard adopted at 45 CFR 170.213 (the U.S. Core Data for Interoperability (USCDI) version 1 data set). The data exchanged must have a date of service on or after January 1, 2016 and must be maintained by the payer.
At a minimum, payers must make the following patient data (maintained by the payer) available via the Payer-to-Payer (P2P) API:
- Clinical Data per USCDI v1
- Claims and Encounters (excluding cost information)
- Information about pending and active Prior Authorization (PA) decisions
Payers who receive data are required to incorporate that data as part of the payer's records for the member; this is part of the data maintained by the receiving payer. Impacted payers are not required to exchange the following data:
- Cost / cost-sharing information
- Provider remittances
The P2P API must adhere to the HL7 FHIR Da Vinci Payer Coverage Decision Exchange (PCDE) IG, V STU 1.0.0 for PA information since it addresses sharing between payers more specifically than does the HL7 FHIR Da Vinci Payer Data Exchange (PDex) IG followed by the Patient Access and Provider Access APIs.
Provider Directory
As part of the Interoperability and Patient Access Final Rule, CMS requires health plans (payers) to implement a Provider Directory API using FHIR-based APIs. The resulting Provider Directory is a public-facing digital endpoint accessible through the payers' website that provides data on in-network providers.
The Provider Directory API enables a member to use a third-party application to access information about providers and provider organizations in their network. The Provider Directory API is publicly accessible and does not require any authorization to access the data.
FHIR Standards
| Standards |
Patient Access API |
Provider Access API |
Provider Directory API |
Payer-to-Payer API |
PARDD API |
| USCDI, at 45 CFR 170.213 (currently V1) |
 |
|
|
|
|
| FHIR Release 4.0.1 |
|
|
|
|
|
| HL7 FHIR U.S. Core IG STU 3.1.1 |
|
|
|
|
|
| HL7 SMART App Launch Framework IV 1.0.0 |
|
|
|
|
|
| HL7 FHIR Bulk Access (Flat FHIR) IG v 1.0.0 STU 1 |
 |
|
|
|
|
| OpenID Connect Core 1.0 |
|
|
|
|
|
Recommended IGs by API
CMS recommends but does not require using the following Implementation Guides.
| Implementation Guide |
Patient Access API |
Provider Access API |
Provider Directory API |
Payer-to-Payer API |
PARDD API |
| CARIN for Blue Button IG Version STU 1.1.0 |
|
|
|
|
|
| Da Vinci PDex IG Version STU 1.0.0 |
|
|
|
|
|
| Da Vinci PDex U.S. Drug Formulary IG Version STU 1.1.0 |
|
|
|
|
|
| Da Vinci PDex Plan Net IG Version STU 1.1.0 |
|
|
|
|
|
| Da Vinci Payer Coverage Decision Exchange (PCDE) IG Version STU 1.0.0 |
|
|
|
|
|
| Da Vinci Prior Authorization Support (PAS) IG Version STU 1.1.0 |
|
|
|
|
|
| Da Vinci Coverage Requirements Discovery (CRD) IG Version STU 1.0.0 |
|
|
|
|
|
| Da Vinci Documentation Templates/Rules (DTR) IG Version STU 1.0.0 |
|
|
|
|
|
