Automated FHIR Compliance Tools You Own and Operate

info@yourdata.health

CMS-9115-F Compliance Checklist

Interoperability and Patient Access Final Rule. Self-assess against the rule before TAP scoring. For Medicare Advantage, Medicaid Managed Care, CHIP, and ACA Exchange-issuer payers. CARIN Blue Button and DaVinci PDex Plan-Net Implementation Guides apply.

Section 1

Patient Access API

Live since 2021-07-01 · Ongoing conformance and Bulk FHIR expectations

FHIR R4 Endpoint Conformance

Patient Access API FHIR R4 endpoint deployed and publicly discoverable (§ 422.119 / 431.60 / 457.730 / 156.221)

CapabilityStatement returned at /metadata; declares supported resources and interactions

SMART on FHIR discovery document (/.well-known/smart-configuration) live and conformant

US Core 3.1.1 (or current) profiles supported for clinical resources

Required Data Classes

Claims and encounters exposed via ExplanationOfBenefit (CARIN Blue Button IG)

Clinical data equivalent to USCDI v1 (or current required version) for the prior 5 years

Coverage resource exposed; member can verify plan details

Data adjudicated by the payer (no later than 1 business day after adjudication) flows into the API

Authentication and Authorization

OAuth 2.0 / SMART on FHIR member-app authorization implemented (token endpoint, authorize endpoint)

Public-app registration documented for third-party member-facing apps

Member education materials cover third-party app data sharing risks

Section 2

Provider Directory API (DaVinci PDex Plan-Net)

Live since 2021-01-01 · Quarterly directory updates required

Plan-Net Directory FHIR API

Provider Directory endpoint live and publicly accessible (no authentication required for read) (§ 422.120 / 431.70 / 457.760 / 156.230)

DaVinci PDex Plan-Net IG STU 2 (or current) conformance verified

Practitioner, PractitionerRole, Organization, Location, HealthcareService, InsurancePlan resources exposed

Network membership clearly indicated per provider / facility

Directory Freshness

Directory updated within 30 days of any received update from a provider

No-Surprises Act provider directory data accuracy practices aligned with the API

Pharmacy Directory (Medicare Part D plans only) exposed where applicable

Section 3

Payer-to-Payer Data Exchange (CMS-9115 baseline)

Original requirement; expanded scope under CMS-0057 deadline 2027-01-01

Member Data Exchange Between Payers

Mechanism in place to receive USCDI clinical data from a prior payer at member request (§ 422.119(f))

Mechanism in place to send USCDI clinical data to a new payer at member request

Member-opt-in workflow documented and auditable

Data retained for member's coverage period plus required retention window

Migration path planned for CMS-0057 P2P expansion (claims, encounters, PA data added by 2027-01-01)

Section 4

Admit, Discharge, Transfer (ADT) Notifications

Applies to hospitals with electronic patient event notification capability · CMS Conditions of Participation

ADT Notification Capability

Hospital sends electronic patient event notifications at admit, discharge, and transfer (42 CFR 482.24 / 485.638)

Notifications sent to applicable post-acute care, primary care, and other practitioners or practitioner groups

DaVinci Notifications IG (or equivalent HL7 v2 ADT messaging) used as the transport

Patient consent and opt-out controls aligned with applicable state law

Section 5

Information Blocking and Ongoing Operations

Continuous · ONC information-blocking rules apply

Anti-Information-Blocking Posture

Documented assessment that API access fees, app review processes, and authentication flows do not constitute information blocking (45 CFR Part 171)

Public-facing documentation of API access, data scope, and supported authentication clearly available

Third-party app developer onboarding documented; reasonable timeline; non-discriminatory

Audit, Logging, and Drift Detection

API call logs retained per HIPAA Security Rule (6-year minimum)

Conformance test cadence (monthly or quarterly) catches regressions before the buyer or auditor does

Inferno / Touchstone / equivalent automated test suite integrated into CI/CD or scheduled runs

Not sure where you stand? TAP runs your CMS-9115 endpoints against the rule, CARIN Blue Button IG, DaVinci PDex Plan-Net IG, and the information-blocking framework, then synthesizes a citation-level scorecard. Starter Audit Guarantee: refund if zero critical or high findings.

Book a Call