Provider Access API
Standards-based access for EHR systems to retrieve member, claims and prior authorization data from payer systems using SMART Backend Services and FHIR Bulk Data.
Overview
The Provider Access API enables secure, standards-based access for EHR systems (consumers) to retrieve relevant member, claims, and prior authorization data from payer systems (producers).
It aligns with CMS-recommended implementation guides - the CARIN Common Payer Consumer Dataset (CPCDS), HL7® Da Vinci PDex, and FHIR® Bulk Data - and leverages HL7® FHIR® with SMART Backend Services Authorization.
New to the Provider Access API? The Provider Access API user guide (PDF) opens in a new tab explains consent management, the bulk data export operations and how an EHR system connects.
User Guide
Capability Statement
Developers can access the Acentra Health FHIR server capabilities for the Provider Access API using the CapabilityStatement endpoint:
View JSONThe CapabilityStatement describes the supported profiles, interactions, search parameters, and authorization and token endpoints.
API Access Setup
Clients can retrieve SMART configuration details by invoking the SMART configuration endpoint at /.well-known/smart-configuration, appended to the FHIR Base URL.
Getting an Access Token
The Provider Access API uses SMART Backend Services (system-to-system) authorization. Authenticate with a signed JWT client_assertion, signed with the private key that matches the public key you registered. No secret is sent over the wire. Request the token with the client_credentials grant.
| Header | Value |
|---|---|
| content-type | application/x-www-form-urlencoded |
| accept | application/json |
| Parameter | Value |
|---|---|
| grant_type | client_credentials |
| scope | {scopes} (space-separated; only scopes approved for your registration) |
| client_assertion_type | urn:ietf:params:oauth:client-assertion-type:jwt-bearer |
| client_assertion | {signed_jwt} |
| Claim | Value |
|---|---|
| iss | {client_id} |
| sub | {client_id} |
| aud | https://sb.fhir.mhbapp.com/sof/oauth2/token |
| iat | Issue time (current time, in seconds since epoch) |
| exp | Expiry; keep it short, for example 5 minutes after iat |
| jti | Unique ID. Each assertion can be used once; a repeated jti is rejected. |
access_token as the Bearer token on API requests. The sandbox also accepts client_id with client_secret for quick testing, but client_assertion is the recommended method.Operations
The Provider Access API supports the following operations.
Resources
$davinci-data-export bulk export operation - individual REST endpoints are not available for these profiles.Request Headers
All requests for Provider Access API profiles require the following headers:
| Header | Value |
|---|---|
| content-type | application/json |
| accept | application/json |
| authorization | Bearer {access_token} |
Sample Responses & Data
Important Information for EHR Systems
| Topic | Reference |
|---|---|
| CARIN Alliance Code of Conduct | carinalliance.com - Trust Framework and Code of Conduct |
| Privacy, Security and HIPAA | healthit.gov - Privacy, Security and HIPAA |
| ONC Model Privacy Notice | healthit.gov - Model Privacy Notice |