API registration

Complete the form below to register to our APIs and attest to compliance with patient privacy as outlined in the CMS guidelines. For more information, review the CMS Best Practices for Payers and App Developers., opens in a new tab

Please allow up to 14 business days for review.

API registration form

Indicates required fields.

Connection type

API connection type:

Connecting application information

PHR application name:

PHR company name:

URL for vendor's corporate website:

Callback URL/Redirect URL:

Authoritative PHR application representative contact information

First name:

Last name:

Business email:

Business phone number:

Authoritative PHR application representative attestation

Representative must read and attest that the application meets each of the following provisions:

Clearly explains to Medicaid clients (Client) that their PHR data is no longer covered by HIPAA once the Client directs their PHR to be exchanged with most apps.
Provides customer support contact information to Clients who may need assistance.
Assures protection of Client’s privacy as per CMS guidelines (Best Practices for Payers and App Developers).
Privacy policy, notice, and procedures include:
- How a Client’s PHR may be accessed, exchanged, or used by any person or other entity, including whether the Client’s PHR may be shared or sold at any time (including in the future).
- A requirement for express consent from the Client before the Client’s PHR is accessed, exchanged, or used, including receiving express consent before the Client’s PHR is shared or sold (other than disclosures required by law or disclosures necessary in connection with the sale of the application or a similar transaction).
- If the PHR application will access any other information from the Client’s device.
- How the Client can discontinue app access to the Client’s PHR data, and what the app’s policy and process is for disposing of the Client’s data once the Client has withdrawn consent.
- The PHR application assigns unique identifiers to each Client who registers for an account to view the Client’s PHR data.

I attest that the application meets each of the above listed provisions.

Connecting application information

Provider NPI or Provider ID

Provider legal name:

Provider's physical address:

URL for provider's corporate website:

Authentication type:

Authentication type:

Callback URL/Redirect URL:

Provider's primary business point of contact

Contact's name:

Contact's job title:

Contact's phone number:

Contact's email address:

Authoritative provider attestation

The provider must read and attest that the application meets each of the following provisions:

I attest that my organization will only request or access data through the Prior Authorization API and Provider Access API for Medicaid beneficiaries with whom we have an active treatment relationship or an active prior authorization request.
I attest that any data requested through these APIs will be limited to the minimum necessary required to fulfill treatment, prior authorization, or care coordination activities.
I attest that my organization will maintain the security of all issued API credentials (OAuth 2.0 Client IDs, secrets, certificates) and will notify the State Medicaid Agency immediately in the event of any suspected security breach or unauthorized exposure of API endpoints or credentials.
I attest that all provided organization details, National Provider Identifiers (NPIs), contact information, and callback URLs are accurate, current, and belong to the registered provider organization.

I attest that the application meets each of the above-mentioned provisions. I affirm that I have legal authority to submit and sign this form on behalf of the applicant organization.

Connecting application information

Payer ID:

Payer legal name:

Payer type:

Payer federal ID:

URL for payer's corporate website:

Authorization endpoint (prod):

Metadata endpoint (prod):

API base URL (sandbox):

Payer primary contact name:

Payer primary contact email:

Payer primary contact phone number:

Technical contact email:

Authoritative payer attestation

Payer must read and attest to the following provisions:

The Requesting Payer certifies that the individual(s) whose data is being requested is/are currently enrolled as an active member in a health insurance plan offered by the Requesting Payer.
The Requesting Payer (unless the requesting payer is a Managed Care Organizations) certifies that it has obtained valid, affirmative, and unambiguous consent (opt-in) from the member (or their authorized representative) to request, receive, and incorporate their historical health data from previous payers, and this consent has not been revoked.
The Requesting Payer certifies that this request is strictly limited to data generated within the maximum five (5) year lookback window from the date of this request, as mandated by CMS regulations.
The Requesting Payer certifies that the request, receipt, and subsequent use of this data comply with all applicable federal and state laws, including but not limited to HIPAA privacy and security rules. The Requesting Payer confirms that this data exchange is not prohibited by any specific state or federal privacy restrictions regarding the requested data classes.
The Requesting Payer agrees to secure the transmitted data using industry-standard encryption and protocols as outlined in the HL7 Da Vinci Payer Data Exchange (PDex) implementation guide. The requested data will only be used for the purposes of care coordination, coverage determination, and member health management.

Payer must read and attest that the application meets each of the following provisions:

The Requesting Payer certifies that each individual whose data is requested is currently enrolled in a health plan offered by the Requesting Payer.
The Requesting Payer certifies that outbound data requests comply with federal opt-in mandates under 42 CFR § 431.61(b)(2) and § 431.61(b)(4).
The Requesting Payer certifies that all requests are strictly limited to clinical and administrative data generated within a maximum five (5) year lookback window from the date of request. The registrant acknowledges that the P2P API payload explicitly excludes provider remittances, enrollee cost-sharing data, and denied prior authorizations.
The Requesting Payer agrees to secure all API endpoints and data transmissions using OAuth 2.0, SMART Backend services, and industry encryption standards as specified in the HL7 Da Vinci Payer Data Exchange (PDex) and CMS Final Rule.
The Requesting Payer agrees to maintain the strict confidentiality of all issued API credentials (Client IDs, certificates, secrets) and to immediately notify the State Medicaid Agency (SMA) of any credential compromise or security incident involving the API.

I attest that the application meets each of the above-mentioned provisions. I affirm that I have legal authority to submit and sign this form on behalf of the applicant organization.

Regulatory information

Resources
CARIN Alliance Code of Conduct , opens in a new tab
CMS Best Practices for Payers and App Developers , opens in a new tab
CMS Regulations and Guidelines , opens in a new tab
Privacy, Security, and HIPAA , opens in a new tab
ONC Model Privacy Notice , opens in a new tab