CMS Interoperability API
Developer Portal

Data Scope Rules

Provider Access API

The Provider Access API implements the Provider Access API requirement of the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F): sharing an attributed patient's claims and clinical data with their treating provider, in bulk, subject to the inclusion and exclusion rules on this page.

Who a Request Can Return Data For

Holding a valid system.all.read (or resource-specific) role is necessary but not sufficient — see the Roles Reference. Every request is also checked against two additional, per-patient conditions:

Condition Behavior
Attribution The requesting provider organization must have an active, non-expired attribution record for the patient — i.e., a recorded treatment relationship. Requests for a non-attributed patient are rejected with a 403 OperationOutcome, even with a valid role.
Patient opt-out CMS-0057-F requires that patients be notified of, and able to exercise, an opt-out of provider data sharing. A patient who has opted out is excluded entirely — every resource type returns a 403 OperationOutcome for that patient, distinct from the "not attributed" 403.

Exclusions Within Claims & Benefits Data

Beyond who can be queried, certain claims and prior-authorization data is excluded from every response regardless of attribution or role — these rules apply consistently across ExplanationOfBenefit, Claim, and ClaimResponse, and to bulk export output.

Excluded Where Why
Drug / pharmacy prior authorizations Claim, ClaimResponse, and prior-authorization entries within ExplanationOfBenefit CMS Data Scope Rules exclude drug prior authorizations from provider access. Only professional and institutional prior authorization requests and their determinations are returned.
Provider remittance (payment amount) ExplanationOfBenefit The amount paid to the provider is redacted from every EOB a provider retrieves. Patients may see this on their own claims via the Patient Access API — providers may not.
Enrollee cost-sharing ExplanationOfBenefit The member-liability total (copay, coinsurance, deductible amounts) is redacted from every EOB a provider retrieves, for the same reason as provider remittance above.