Patient Access API
The Patient Access API is a CMS-mandated FHIR-based API that allows health plan members to access their own health data — including claims, clinical information, and prior authorization decisions — through third-party applications of their choice.
Regulatory Background
- CMS-9115-F (2020) — First required payers to implement a Patient Access API using FHIR R4, effective July 1, 2021
- CMS-0057-F (2024) — Expanded data requirements and added prior auth decision access, effective January 1, 2027
Required Data
Payers must make the following data available through the API:
| Data Category | FHIR Resources | Source |
|---|---|---|
| Claims & EOB | ExplanationOfBenefit (CARIN BB profiles) | Adjudicated claims |
| Coverage | Coverage | Member enrollment |
| Clinical data | Conditions, Medications, Allergies, Labs, etc. (US Core) | Claims-derived or received clinical data |
| Prior auth decisions | Claim (preauthorization use), ClaimResponse | PA system |
| Provider directory | Practitioner, PractitionerRole, Organization, Location | Provider network |
Technical Requirements
Standards
- FHIR R4 — Base standard
- CARIN Blue Button IG — Profile for EOB/claims data
- US Core IG — Profile for clinical data
- SMART on FHIR — App launch and authorization framework
Authentication & Authorization
- OAuth 2.0 with PKCE — Secure app authorization
- OpenID Connect — Member identity verification
- Member must explicitly consent to data sharing with third-party apps
- Payer must maintain a developer portal for app registration
App Directory
Payers should provide:
- Documentation of available FHIR endpoints
- Sandbox environment for testing
- App registration and onboarding process
- Production access path
Member Experience
- Member opens a third-party health app (e.g., Apple Health, personal health record app)
- App redirects to the payer's login page
- Member authenticates with their payer credentials
- Member authorizes the app to access their data
- App receives an OAuth access token
- App queries the payer's FHIR API for claims, coverage, and clinical data
- Data is displayed in the app for the member to view, manage, and share
Privacy & Security
- Payers must implement HIPAA-compliant security measures
- Third-party apps are not covered entities under HIPAA — the FTC regulates them under the Health Breach Notification Rule
- Payers must provide members with clear information about the risks of sharing data with third-party apps
- Members can revoke app access at any time
