CMS Rule Requirements Overview

This rule requires certain health plans to implement additional technology to improve interoperability and exchange of information.

The Patient Access API is the greatest technical and operational requirement for health plans. It requires claims and encounter information, including cost, as well as a defined sub-set of the members’ clinical information be made available to third-party applications of their choice via a secure HL7 FHIR (Release 4.0.1) API endpoint. Mandate details:

• Who - MA organizations, State Medicaid FFS programs, Medicaid managed care plans, CHIP FFS programs, CHIP managed care entities, QHP issuers on the FFEs
• Data Standard - FHIR 4.0.1 (R4) API
• Required Data - Adjudicated claims (including Pharmacy), Encounters with capitated providers, Provider remittances, Enrollee cost-sharing, Subset of clinical data, including lab results (where maintained by the impacted health plan), Formularies or preferred drug lists*
• Timing - No later than 1 business day after a claim is adjudicated or encounter data is received
• Security - 3rd party access managed by OAuth 2.0 tokens
• Authentication - OpenID Connect serves as identity layer on top of the OAuth 2.0 to enable clients to verify end-user identity
• Implementation Guide - CARIN Alliance Blue Button® Framework and Common Payer Consumer Data Set (CPCDS) IG

• Data transformation > FHIR (claims, encounters, subset of clinical data)
• FHIR Server
• 3rd Party Access Management (OAuth 2.0)
• Member Consent Management
• Developer + Member Support

Health plans must make available a FHIR API based list of providers that are in-network. This is the same approach we’ve taken with the public NPPES provider directory FHIR API already on the 1up platform. Mandate details:

• Who - MA organizations, State Medicaid FFS programs, Medicaid managed care plans, CHIP FFS programs, CHIP managed care entities, QHP issuers on the FFEs
• Data Standard - FHIR 4.0.1 (R4) API
• Required Data - Provider names and network status, addresses, Phone numbers, Specialties*
• Timing - Provider directory updates must be available via API within 30 days of receipt of new data or changes to directory data
• Security - API endpoint on public website
• Implementation Guide - Da Vinci Payer Data Exchange (PDEX) Plan Network IG

Payers are required to exchange patient data at the member’s request so members can take all their data with them as they move between payers. This is the only payer requirement due to take effect in 2022. The USCDI data set is basically FHIR resources with specific attributes and coding terminologies required. We propose building on top of the FHIR APIs from the Patient Access API requirement to support this requirement for payers and their members. Mandate details:

• Who - MA organizations, Medicaid managed care plans, CHIP managed care entities, QHP issuers on the FFEs
• Data Standard - FHIR 4.0.1 (R4) API
• Required Data - Clinical data specified under U.S. Core Data for Interoperability (USCDI) version 1
• Implementation Guide - Clinical Data (in USCDI v1) HL7 FHIR® US Core IG STU 3.1.0

• Improving the Dually Eligible Experience by Increasing the Frequency of Federal-State Data Exchanges
• Public Reporting and Information Blocking (late 2020)
• Digital Contact Information (late 2020)
• Admission, Discharge, and Transfer Event Notifications (late 2020)