Compliant Health Plan gives members secure, standards-based access to their claims, encounters, clinical information, and drug coverage — and the ability to share it with any app they choose.
Aligned to CMS-9115-F (Interoperability & Patient Access) and CMS-0057-F (Interoperability & Prior Authorization).
All endpoints are HL7® FHIR® R4 and follow the CARIN Blue Button, Da Vinci PDex, Da Vinci Plan-Net, and Da Vinci PAS/PDex implementation guides.
| API | What it contains | Standard | Access | Status |
|---|---|---|---|---|
| Patient Access | Adjudicated claims, encounters, cost-sharing, clinical data (USCDI) | CARIN Blue Button IG | Member-authorized | Live |
| Formulary / Drug Coverage | Covered drugs, tiers, cost-sharing, utilization management rules | Da Vinci US Drug Formulary IG | Public | Live |
| Provider Directory | Practitioners, roles, organizations, locations, networks | Da Vinci Plan-Net IG | Public, no auth | Live |
| Payer-to-Payer Exchange | Up to 5 years of claims, encounters and clinical data at plan switch | Da Vinci PDex IG | Member opt-in | Live |
| Provider Access | Member data shared with treating in-network providers | Da Vinci PDex IG | Provider attributed, member opt-out | Live |
| Prior Authorization (PAS) | Submit, track and receive decisions on prior auth requests | Da Vinci PAS IG | Provider-authorized | Phased rollout |
| Coverage Requirements (CRD/DTR) | Documentation rules surfaced inside the provider’s EHR workflow | Da Vinci CRD / DTR IG | Provider-authorized | Phased rollout |
Any app that supports SMART on FHIR can request access. You approve it once, and the app receives a token that only works for the data you allowed.
Most apps list “Compliant Health Plan” in their insurer directory.
You authenticate with us — the app never sees your password.
See exactly which categories of data the app is asking for before you approve.
Portal → Sharing → Connected apps → Revoke.
Once you share data with an app, that app’s privacy policy governs it — not ours. Read it before you connect, especially the sections on selling and secondary use of data.
We verify an app’s registration and attest that it has a public privacy policy. We do not endorse any app, and we cannot restrict access based on privacy practices alone.
An authorized representative can be granted the same access you have, with a full audit trail of every request.
GET /fhir/r4/metadata
GET /.well-known/smart-configuration
POST /oauth2/token
grant_type=authorization_code
scope=patient/ExplanationOfBenefit.read
GET /fhir/r4/ExplanationOfBenefit?
patient=<id>&_count=50
SMART App Launch 2.0, OAuth 2.0 with PKCE, and refresh tokens valid for 90 days without re-authentication.
Register an application, get synthetic member data, and test the full authorization flow before you go anywhere near production.
Adjudicated claims and encounter data (including what you paid), clinical data the plan maintains in the USCDI data set, your drug formulary and coverage rules, and provider directory information. Data is available from January 1, 2016 forward.
Claims and encounter data are published no later than one business day after we adjudicate or receive them.
You keep access to your Patient Access data for at least five years after your coverage ends. If you opt in, we can also send your history directly to your new payer.
Yes. Under the Provider Access API, in-network providers treating you can request your claims and clinical history. You can opt out at any time from the portal, and opting out never affects your coverage.
No. Access to your own health information is free, and we do not charge apps to connect to the Patient Access API.
Call member services at 1-800-555-0142 (TTY 711) or use the contact form. If you believe a record is inaccurate, you can request an amendment.
Walk through the member authorization flow, the API responses, and the admin view behind it.