
Patient Access API : CMS-regulated payers, specifically MA organizations, Medicaid Fee-for-Service (FFS) programs, Medicaid managed care plans, CHIP FFS programs, CHIP managed care entities, and QHP issuers on the FFEs, excluding issuers offering only Stand-alone dental plans (SADPs) and QHP issuers offering coverage in the Federally-facilitated Small Business Health Options Program (FF-SHOP), are required to implement and maintain a secure, standards-based (HL7 FHIR Release 4.0.1) API that allows patients to easily access their claims and encounter information, including cost, as well as a defined sub-set of their clinical information through third-party applications of their choice. This rule finalizes new policies that help liberate health information and move the healthcare system toward greater interoperability. We are working to balance these important issues in a way that empowers patients to be in charge of their healthcare. We believe they also have a right to know their health information is exchanged in a way that ensures their privacy and security. Patients have a right under HIPAA to access their health information. CMS is also working with payers to provide information they can use to educate patients about sharing their health information with third parties, and the role of federal partners like the Office for Civil Rights (OCR) and the Federal Trade Commission (FTC) in protecting their rights.


For instance, as part of this final rule a payer may ask third-party application developers to attest to certain privacy provisions, such as whether their privacy policy specifies secondary data uses, and inform patients about those attestations. These requirements support the privacy and security of patient information.ĬMS is taking additional steps to provide payers and patients opportunities and information to protect patient data and make informed decisions about sharing patient health information with third parties. CMS is adopting the standards for FHIR-based APIs being finalized by HHS in the ONC 21 st Century Cures Act rule at 45 CFR 170.215. CMS, in partnership with the Office of the National Coordinator for Health Information Technology (ONC), has identified Health Level 7® (HL7) Fast Healthcare Interoperability Resources® (FHIR) Release 4.0.1 as the foundational standard to support data exchange via secure application programming interfaces (APIs). Identifying the right standards can help data flow securely and efficiently. In a future where data flows freely and securely between payers, providers, and patients, we can achieve truly coordinated care, improved health outcomes, and reduced costs.Įnsuring the privacy and security of patient information is a top priority for CMS.

Patients and their healthcare providers will have the opportunity to be more informed, which can lead to better care and improved patient outcomes, while at the same time reducing burden. The CMS Interoperability and Patient Access final rule establishes policies that break down barriers in the nation’s health system to enable better patient access to their health information, improve interoperability and unleash innovation, while reducing burden on payers and providers. Lack of seamless data exchange in healthcare has historically detracted from patient care, leading to poor health outcomes, and higher costs. As part of the Trump Administration’s MyHealthEData initiative, this final rule is focused on driving interoperability and patient access to health information by liberating patient data using CMS authority to regulate Medicare Advantage (MA), Medicaid, CHIP, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs). The Interoperability and Patient Access final rule (CMS-9115-F) delivers on the Administration’s promise to put patients first, giving them access to their health information when they need it most and in a way they can best use it.
