CMS-0057-F Provider Access API

The Provider Access API is new in CMS-0057-F: an impacted payer must let in-network providers retrieve a patient's claims, encounter, clinical, and prior authorization data over FHIR R4, for patients attributed to that provider, by January 1, 2027. Patients get an opt-out. The required content baseline is FHIR R4.0.1 with US Core 3.1.1 (45 CFR 170.215 as adopted); US Core 6.1 (USCDI v3) is the ecosystem target most implementations build to, not a requirement.

Example

Readiness checklist
 1. Build the provider attribution process: which patients each in-network
    provider may query, and how the roster is maintained.
 2. Implement the patient opt-out and the plain-language education materials
    the rule requires.
 3. Reuse the Patient Access data pipeline: the payload classes are the same
    USCDI set, minus remittances and cost-sharing.
 4. Publish a CapabilityStatement at /metadata for the provider-facing
    endpoint.
 5. Gate every release in CI:

pidgeon data install fhir-us-core-6.0   # package id says 6.0; installs US Core STU 6.1
pidgeon conform \
  --endpoint https://provider-fhir.example.com \
  --ig http://hl7.org/fhir/us/core/ \
  --walk --ci

The walk validates one sampled instance per declared (resource, profile) pair and exits non-zero on any error or must-support finding, so the gate fails before an auditor or a provider integration does. Structural conformance evidence only; it does not judge data completeness for any specific patient.

Validation context

Strict and compatibility validation notes land here with the phase-1 data export.