Acentra Health · Interoperability Solution Sandbox Environment

Consumer-Directed Access

Patient Access API

Secure movement of payer data to patients through third-party consumer applications, built on CARIN Blue Button®, Da Vinci PDex and the US Drug Formulary IGs.

Implementation GuideCARIN C4BB - PDex

VersionV 2.0.0 (STU 2)open_in_new

SecuritySMART on FHIR

Base Path/pa/api/v1

User GuidePDFpicture_as_pdf

medical_information

Overview

The Patient Access API facilitates the secure movement of data from payer systems (producers) to patients (consumers), accessible via third-party consumer applications. It leverages CMS-recommended implementation guides, including the CARIN IG for Blue Button®, Da Vinci Payer Data Exchange (PDex), and the PDex US Drug Formulary IGs.

It also uses the Common Payer Consumer Dataset (CPCDS) as a foundation, along with data-exchange standards such as HL7® FHIR® and the SMART Application Launch Framework (standalone launch sequence).

New to the Patient Access API? The Patient Access API user guide (PDF) opens in a new tab explains how a consumer app authorizes, signs the patient in, and retrieves data.

menu_book

User Guide

Patient Access API User Guide

How a consumer app connects end to end: authorization URL format, getting an access token, supported scopes, the patient login, knowledge-based authorization (KBA) and consent screens, and app registration.

PDF · 22 pages · 1.1 MB

open_in_newView Guide downloadDownload PDF

What’s inside

Authorization URLAccess TokenSupported ScopesKBA &Amp; ConsentApp Registration

fact_check

Capability Statement

Developers can access the Acentra FHIR server capabilities for the Patient Access API using the CapabilityStatement endpoint:

METAhttps://sb.fhir.mhbapp.com/pa/api/v1/metadata

View JSON

The CapabilityStatement describes the set of capabilities implemented by the FHIR Server - supported profiles, interactions, search parameters, and authorization and token endpoints.

API Access Setup

linkAuthorization URL Format

https://sb.fhir.mhbapp.com/sof/oauth2/authorize?client_id={your_client_id}&redirect_uri={your_redirect_url}&response_type=code&aud={FHIR_Base_URL}

badgeSandbox User IDs

group

There are 10 sandbox user IDs using the format below, where ### ranges from 001 to 010.

Username

sbuser###

Password

Acentra-sb$2024

key

Getting an Access Token

POSTToken Endpointhttps://sb.fhir.mhbapp.com/sof/oauth2/token

HTTP Headers

Header	Value
content-type	application/x-www-form-urlencoded
accept	application/json
authorization	Basic base64({client_id}:{client_secret})

HTTP Body

Parameter	Value
code	{oauth code}
grant_type	authorization_code
redirect_uri	{your_redirect_uri}

dataset

Resources

FHIR R4 resource profiles and endpoint paths. All requests require a Bearer {access_token} authorization header.

Claims & Benefits

GETExplanationOfBenefit/pa/api/v1/ExplanationOfBenefitCARIN

GET-> EOB · Inpatient Institutional /pa/api/v1/ExplanationOfBenefit?type=institutional

GET-> EOB · Outpatient Institutional /pa/api/v1/ExplanationOfBenefit?type=institutional

GET-> EOB · Professional/pa/api/v1/ExplanationOfBenefit?type=professional

GET-> EOB · Oral/pa/api/v1/ExplanationOfBenefit?type=oral

GET-> EOB · Pharmacy/pa/api/v1/ExplanationOfBenefit?type=pharmacy

GET-> Prior Authorization/pa/api/v1/ExplanationOfBenefit?use=preauthorization

Member

GETPatient/pa/api/v1/PatientPDex

GETCoverage/pa/api/v1/CoverageHRex

GETRelatedPerson/pa/api/v1/RelatedPersonPDex

Provider

GETPractitioner/pa/api/v1/PractitionerCPCDS

GETOrganization/pa/api/v1/OrganizationCPCDS

Formulary

GETFormulary Drug/pa/api/v1/MedicationKnowledgePDex

GETFormulary Plan/pa/api/v1/ListPDex

Audit

GETProvenance/pa/api/v1/ProvenanceHRex

http

Request Headers

All requests for Patient Access API profiles require the following headers:

Header	Value
content-type	application/json
accept	application/json
authorization	Bearer {access_token}

science

Sample Responses & Data

gpp_good

Important Information for Application Owners

Topic	Reference
CARIN Alliance Code of Conduct	carinalliance.com - Trust Framework and Code of Conduct
Privacy, Security and HIPAA	healthit.gov - Privacy, Security and HIPAA
ONC Model Privacy Notice	healthit.gov - Model Privacy Notice