What it does
Today, a treating provider who wants a patient's history from their health plan usually gets it by fax, a records request, or not at all. The Provider Access API gives in-network providers a standing FHIR connection to pull claims, encounter, clinical, and prior-authorization data for their own patients directly from the payer.
Unlike the Patient Access API, this one defaults to on: members are enrolled automatically and can opt out if they don't want their in-network providers pulling this data. That's the reverse of the consent model most payers have already built for member-facing APIs.
Who calls it
Providers currently in-network with the plan for that specific member, verified against the plan's own attribution and network data. Not open to any provider who asks.
In practice, this is usually the provider's EHR system calling on their behalf, not a human clicking through a portal.
Technical standards
| Standard | Version | Notes |
|---|---|---|
| HL7 FHIR | 4.0.1 | Base data format, shared with every other API on this site. |
| Da Vinci PDex | STU 2 | Same clinical/claims data profiles as the Patient Access API. |
| Da Vinci PDex Plan-Net | STU 1.1 | The provider-directory standard used to verify in-network status. See the Provider Directory page for how that data actually gets built and kept current. |
| SMART App Launch (backend services) | 2.0.0 | System-to-system authorization between the provider's system and the payer's API, with no user present. |
Attribution is the hard part, not FHIR
Standing up the endpoint is the easy half. Correctly and continuously determining which providers count as "in-network for this member," and keeping that current as networks and PCP assignments change, is where most timelines actually slip.
Previous API
Patient Access API
The member-facing API from the 2020 rule, now required to also expose prior-authorization requests, statuses, and denial reasons.
Read it →Next API
Provider Directory
A public, query-only FHIR API exposing a payer's provider network, required since 2020, that the new Provider Access API now leans on to decide who's actually in-network.
Read it →Ready to see where you stand?
Every requirement on this page is one line item in our free CMS-0057-F readiness survey.