Acentra Health · Interoperability Solution Sandbox Environment

Consumer-Directed Access

Patient Access API

Secure movement of payer data to patients through third-party consumer applications, built on CARIN Blue Button®, Da Vinci PDex and the US Drug Formulary IGs.

Implementation GuideCARIN C4BB - PDex

VersionV 2.0.0 (STU 2)open_in_new

SecuritySMART on FHIR

Base Path/pa/api/v1

medical_information

Overview

The Patient Access API facilitates the secure movement of data from payer systems (producers) to patients (consumers), accessible via third-party consumer applications. It leverages CMS-recommended implementation guides, including the CARIN IG for Blue Button®, Da Vinci Payer Data Exchange (PDex), and the PDex US Drug Formulary IGs.

It also uses the Common Payer Consumer Dataset (CPCDS) as a foundation, along with data-exchange standards such as HL7® FHIR® and the SMART Application Launch Framework (standalone launch sequence).

fact_check

Capability Statement

Developers can access the Acentra FHIR server capabilities for the Patient Access API using the CapabilityStatement endpoint:

METAhttps://sb.fhir.mhbapp.com/pa/api/v1/metadata

View JSON

The CapabilityStatement describes the set of capabilities implemented by the FHIR Server - supported profiles, interactions, search parameters, and authorization and token endpoints.

API Access Setup

linkAuthorization URL Format

https://sb.fhir.mhbapp.com/sof/oauth2/authorize?client_id={your_client_id}&redirect_uri={your_redirect_url}&response_type=code&aud={EHR_Server_BaseURL}

badgeSandbox User IDs

group

There are 10 sandbox user IDs using the format below, where ### ranges from 001 to 010.

Username

sbuser###

Password

Acentra-sb$2024

key

Getting an Access Token

POSTToken Endpointhttps://sb.fhir.mhbapp.com/sof/oauth2/token

HTTP Headers

Header	Value
content-type	application/x-www-form-urlencoded
accept	application/json
authorization	Basic base64({client_id}:{client_secret})

HTTP Body

Parameter	Value
code	{oauth code}
grant_type	authorization_code
redirect_uri	{your_redirect_uri}

dataset

Resources

FHIR R4 resource profiles and endpoint paths. All requests require a Bearer {access_token} authorization header.

Claims & Benefits

GETExplanationOfBenefit/pa/api/v1/ExplanationOfBenefitCARIN

GET-> EOB · Inpatient Institutional /pa/api/v1/ExplanationOfBenefit?type=institutional

GET-> EOB · Outpatient Institutional /pa/api/v1/ExplanationOfBenefit?type=institutional

GET-> EOB · Professional/pa/api/v1/ExplanationOfBenefit?type=professional

GET-> EOB · Oral/pa/api/v1/ExplanationOfBenefit?type=oral

GET-> EOB · Pharmacy/pa/api/v1/ExplanationOfBenefit?type=pharmacy

GET-> Prior Authorization/pa/api/v1/ExplanationOfBenefit?use=preauthorization

Member

GETPatient/pa/api/v1/PatientPDex

GETCoverage/pa/api/v1/CoverageHRex

GETRelatedPerson/pa/api/v1/RelatedPersonPDex

Provider

GETPractitioner/pa/api/v1/PractitionerCPCDS

GETOrganization/pa/api/v1/OrganizationCPCDS

Formulary

GETFormulary Drug/pa/api/v1/MedicationKnowledgePDex

GETFormulary Plan/pa/api/v1/ListPDex

Audit

GETProvenance/pa/api/v1/ProvenanceHRex

http

Request Headers

All requests for Patient Access API profiles require the following headers:

Header	Value
content-type	application/json
accept	application/json
authorization	Bearer {access_token}

science

Sample Responses & Data

gpp_good

Important Information for Application Owners

Topic	Reference
CARIN Alliance Code of Conduct	https://www.carinalliance.com/our-work/trust-frameworkand-code-of-conduct/
Privacy, Security and HIPAA	https://www.healthit.gov/topic/privacy-security-and-hipaa
ONC Model Privacy Notice	https://www.healthit.gov/topic/privacy-security-and-hipaa/model-privacy-notice-mpn