CMS Rule Requirements Overview
Requirements for CMS Interoperability and Patient Access for Health Plans
This page highlights the requirements for health plans under CMS’s recently announced regulation in the Interoperability and Patient Access final rule (CMS-9115-F). This rule is focused on driving interoperability and patient health data access for health plans including Medicare Advantage (MA), Medicaid, CHIP, and Qualified Health Plan (QHP) issuers on the Federally-facilitated Exchanges (FFEs). 1upHealth is already working with health plans to ensure they meet all these regulatory requirements. See our discussion on this rule during our Virtual Health Conference March 11, 2020 with Alexandra Mugge, CMS Deputy Chief Health Informatics Officer here.
Mandates for Health Plans
This rule requires certain health plans to implement additional technology to improve interoperability and exchange of information.
Patient Access API (by July 1, 2021)
The Patient Access API is the greatest technical and operational requirement for health plans. It requires claims and encounter information, including cost, as well as a defined sub-set of the members’ clinical information be made available to third-party applications of their choice via a secure HL7 FHIR (Release 4.0.1) API endpoint. Mandate details:
- Who - MA organizations, State Medicaid FFS programs, Medicaid managed care plans, CHIP FFS programs, CHIP managed care entities, QHP issuers on the FFEs
- Data Standard - FHIR 4.0.1 (R4) API
- Required Data - Adjudicated claims (including Pharmacy), Encounters with capitated providers, Provider remittances, Enrollee cost-sharing, Subset of clinical data, including lab results (where maintained by the impacted health plan), Formularies or preferred drug lists*
- Timing - No later than 1 business day after a claim is adjudicated or encounter data is received
Security - 3rd party access managed by OAuth 2.0 tokensAuthentication - OpenID Connect serves as identity layer on top of the OAuth 2.0 to enable clients to verify end-user identityImplementation Guide - CARIN Alliance Blue Button® Framework and Common Payer Consumer Data Set (CPCDS) IG
To deliver this successfully, health plans will have to implement multiple components including the following:
- Data transformation > FHIR (claims, encounters, subset of clinical data)
- FHIR Server
- 3rd Party Access Management (OAuth 2.0)
- Member Consent Management
- Developer + Member Support
All of these are already part of the 1up API platform and are being used by hundreds of organizations including developers, healthcare providers, and health plans today. Learn more about requirements and technology for the CMS Patient Access Rule for Health Plans.
Provider Directory API (by July 1, 2021)
Health plans must make available a FHIR API based list of providers that are in-network. This is the same approach we’ve taken with the public NPPES provider directory FHIR API already on the 1up platform. Mandate details:
- Who - MA organizations, State Medicaid FFS programs, Medicaid managed care plans, CHIP FFS programs, CHIP managed care entities, QHP issuers on the FFEs
- Data Standard - FHIR 4.0.1 (R4) API
- Required Data - Provider names and network status, addresses, Phone numbers, Specialties*
- Timing - Provider directory updates must be available via API within 30 days of receipt of new data or changes to directory data
Security - API endpoint on public websiteImplementation Guide - Da Vinci Payer Data Exchange (PDEX) Plan Network IG
To support this further, we would deploy documentation and the ability for developers to use the same keys for the patient access API for the provider directory API.
Payer-to-Payer Data Exchange (by January 1, 2022)
Payers are required to exchange patient data at the member’s request so members can take all their data with them as they move between payers. This is the only payer requirement due to take effect in 2022. The USCDI data set is basically FHIR resources with specific attributes and coding terminologies required. We propose building on top of the FHIR APIs from the Patient Access API requirement to support this requirement for payers and their members. Mandate details:
- Who - MA organizations, Medicaid managed care plans, CHIP managed care entities, QHP issuers on the FFEs
- Data Standard - FHIR 4.0.1 (R4) API
- Required Data - Clinical data specified under U.S. Core Data for Interoperability (USCDI) version 1
Implementation Guide - Clinical Data (in USCDI v1) HL7 FHIR® US Core IG STU 3.1.0
Non-payer requirements in the rule
- Improving the Dually Eligible Experience by Increasing the Frequency of Federal-State Data Exchanges
- Public Reporting and Information Blocking (late 2020)
- Digital Contact Information (late 2020)
- Admission, Discharge, and Transfer Event Notifications (late 2020)
Why 1upHealth
1upHealth is well positioned to support health plans in meeting the CMS requirements for the July 2021 deadline.
Direct Payer Experience
We have direct experience through our work with as one of the first approved Blue Button 2.0 apps, with health plans supporting millions of health plan members and the Da Vinci Project through workgroups and connectathons.
Extensive Clinical Data Network
We've worked with 100s of health systems across the US in meeting Meaningful Use 3 (MU3) requirements. We’ve now connected to 10,000+ hospital and health centers, allowing patients to authorize access to their EHR medical records with 3rd party applications.
We are FHIR Experts
Our team is comprised of leading FHIR experts who have presented alongside CMS and ONC leaders like Don Rucker, had led HL7 standard balloting, and participate in numerous FHIR connectathons
Proven Platform for Regulation
Because our award-winning FHIR solution is already in production, we can ensure timely deployment and meeting the requirements of the new rules.