CMS-0057-F Patient Access API

The Patient Access API lets a patient's chosen app retrieve their claims, encounter, and clinical data over FHIR R4. It has existed since CMS-9115-F; CMS-0057-F extends it to also serve the patient's prior authorization requests and decisions, with the extension due January 1, 2027. The required content baseline is FHIR R4.0.1 with US Core 3.1.1 and SMART App Launch 1.0 (45 CFR 170.215 as adopted); US Core 6.1 (USCDI v3) is the ecosystem target most implementations build to, not a requirement.

Example

Readiness checklist
 1. Inventory the USCDI data classes your systems hold: claims, encounters,
    clinical data, and prior authorization decisions.
 2. Map each class to its US Core profile; this reference indexes the 103
    US Core 6.1 profile pages under us-core-6.0.
 3. Publish a CapabilityStatement at /metadata declaring every supported
    resource type and profile; the conformance walk reads it.
 4. Add prior authorization requests and decisions to the API payload, the
    CMS-0057-F addition to the existing CMS-9115-F API.
 5. Wire SMART on FHIR app authorization and test with a patient-facing app.
 6. Gate every release in CI:

pidgeon data install fhir-us-core-6.0   # package id says 6.0; installs US Core STU 6.1
pidgeon conform \
  --endpoint https://fhir.example.com \
  --ig http://hl7.org/fhir/us/core/ \
  --walk --ci

The CI gate produces dated structural conformance evidence against US Core, one sampled instance per declared (resource, profile) pair, exit code 1 on any error or must-support finding. The scorecard stamps the exact IG version graded against.

Validation context

Strict and compatibility validation notes land here with the phase-1 data export.