Understand the CMS Interoperability and Patient Access final rule API requirements for payers

Verified steps

1. Review the CMS Interoperability and Patient Access Final Rule (CMS-9115-F) published on cms.gov to identify the four mandatory FHIR API types: Patient Access API, Provider Access API, Payer-to-Payer Data Exchange API, and the Prior Authorization API (added by CMS-0057-F).
2. Understand the Patient Access API requirements: payers must expose a FHIR R4 endpoint providing claims, clinical (US Core profiles), formulary (PDex Formulary IG), and provider directory (Plan-Net IG) data to members via SMART on FHIR.
3. Review the compliance date timeline: the Patient Access API was required by July 1, 2021 for most impacted payers; the Provider Access API and Payer-to-Payer API have later effective dates tied to subsequent rulemaking.
4. Identify the impacted payer types: Medicare Advantage organizations, Medicaid FFS programs, CHIP FFS programs, Medicaid managed care plans, CHIP managed care entities, and QHP issuers on the federally facilitated exchanges.
5. Review documentation and attribution requirements: payers must document their FHIR API endpoints in a machine-readable format and provide member-facing documentation on how to access the API.
6. Review the penalties and enforcement framework: CMS enforces compliance through the annual plan performance review and can impose compliance actions on non-conformant plans.