CMS-0057-F prior authorization and payer FHIR APIs

CMS-0057-F, the Interoperability and Prior Authorization final rule, was finalized on January 17, 2024. It applies to "impacted payers" - Medicare Advantage organizations, state Medicaid and CHIP agencies, Medicaid and CHIP managed care plans, and Qualified Health Plan issuers on the federal exchanges - and its obligations arrive in two waves.

All four APIs are defined as HL7 FHIR R4 APIs - the rule builds directly on the FHIR ecosystem rather than defining a new format.

CMS recommends, without strictly mandating, the HL7 Da Vinci and CARIN implementation guides - CARIN Blue Button for Patient Access claims data, Da Vinci PDex for payer data exchange, Plan-Net for provider directories, and the ePA trio for prior authorization - CRD (Coverage Requirements Discovery), DTR (Documentation Templates and Rules) and PAS (Prior Authorization Support).

Because the guides are recommended rather than mandated, an all-FHIR prior authorization flow is allowed under CMS enforcement discretion even where X12 278 transactions would otherwise apply - which is why new implementations typically start FHIR-first.

Payers do not need to rebuild their utilization management and claims systems for this - the pattern is FHIR APIs exposed in front of the existing systems, with an integration layer translating between FHIR and the internal formats. Inbound, a FHIR-shaped request arrives over REST, the layer queries the UM system, and the answer goes back as FHIR resources. Outbound, the layer reads from internal stores and publishes into the FHIR store the APIs serve from.

Zato provides that layer - REST channels for the FHIR-shaped endpoints, outgoing FHIR connections for the payer's FHIR store, and Python services for the translation. It integrates and fronts systems - it is not itself a certified FHIR server, and profile validation belongs to the FHIR store.

The service below is the inbound side of a prior authorization status endpoint - a REST channel receives the query, the service reads the payer's FHIR store and answers with the Claim and its ClaimResponse. OAuth against the store - including SMART Backend Services style client credentials - is configuration on the connection, not code.

# -*- coding: utf-8 -*-

# Zato
from zato.server.service import Service

class PriorAuthEndpoint(Service):
    """ Exposed through a REST channel as part of the Prior Authorization API.
    """
    name = 'demo.cms.prior-auth-endpoint'

    def handle(self) -> 'None':

        # Which patient the caller is asking about
        patient_id = self.request.payload['patient_id']

        # The payer's FHIR store, tokens managed for you
        client = self.fhir['FHIR.Payer']

        # The prior authorization requests ..
        claims = client.resources('Claim').search(
            patient = f'Patient/{patient_id}',
            use = 'preauthorization',
        ).fetch_all()

        # .. and the decisions made about them.
        responses = client.resources('ClaimResponse').search(
            patient = f'Patient/{patient_id}',
        ).fetch_all()

        self.response.payload = {
            'requests': [item.serialize() for item in claims],
            'decisions': [item.serialize() for item in responses],
        }