Provider Access API
The Provider Access API allows payers to share patient data—including claims, encounter data, USCDI clinical elements, and prior auth details—with in-network providers who have an existing treatment relationship with the patient. This helps payers meet their obligations under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F).
Registering a Provider
Data feeds into Orchestrate Server from the connected payer system. When a provider requests access to payer’s member data (typically via email or a contact form on the payer’s website), the payer will vet the request and then contact Orchestrate support to register the provider. This registration process happens “out of band” before any requests are made.
Warning
Establishing a provider connection allows direct access to patient data, which may be considered Protected Health Information (PHI). It is the payer’s responsibility to fully vet the requestor and establish any necessary legal agreements (including a HIPAA Business Associate Agreement, if applicable).
To register a provider, the following information is needed:
- Provider Name
- JWKS URL (a URL containing the JSON Web Key Set public keys used for authentication)
- One or more National Provider Identifiers (NPI)
- Optionally one or more Taxpayer Identification Numbers (TIN)
Requesting Data
Once the provider connection to Orchestrate is provisioned, the provider can request data in accordance with the FHIR standard for Provider Access API (v2).
The provider authenticates using the SMART Backend Services, then makes a request using the $provider-member-match operation. Orchestrate Server determines matching members (accounting for treatment relationships and data sharing status) and returns a FHIR Group with the member list.
Authentication
All information necessary for the provider to authenticate (JWKS URL, supported signature algorithms, etc.) is available at the SMART Configuration URL:
[base endpoint]/.well-known/smart-configuration
For example: https://yourorchestrateserver.careevolution.com/api/fhir/r4/.well-known/smart-configuration
Endpoint
[base endpoint]/Group/$provider-member-match
Accessing Resources
Once the provider has used the $provider-member-match operation to determine eligible members, it can use regular FHIR operations to access health data resources for those members. See the Programming Guide for more information.
Note
Certain member data, such as financial information, is not available to providers.
Member Treatment Relationship
Providers may only access data for members with whom they have an established treatment relationship. Orchestrate Server enforces this by checking if there is at least one claim (ExplanationOfBenefit resource) in the payer system that:
- References a practitioner or organization associated with the provider requesting the data.
- Has been paid.
- (Optionally) Is not older than a number of days specified in the Orchestrate Server configuration.
When determining whether a practitioner/organization is associated with the provider, the system compares the provider and payee.party fields of the claim with the NPI information specified during provider setup. It also checks the provider directory (if available) to see if the practitioner/organization belongs to the requesting provider. This allows hospital systems to request data for their constituent practitioners/billing entities.
Member Data Sharing / Opt-Out
The CMS rules require that payers allow members to opt out of sharing data with providers. Payers can use the Data Sharing API to inform Orchestrate Server when their members opt in or out of data sharing.