Provider Access · CMS-0057F · §422.119(c) · PDex STU 2.1.0 · ATR STU 2.1.0

In-network providers retrieve their attributed members' clinical and claims data through standards-based bulk FHIR. SMART Backend Services. No member login. For provider-organization and EHR technical teams.

1. 1

   Get provisioned

   Provider Access is provisioned by Acme Health, not self-service. Acme Health registers your organization, confirms your NPI, and issues SMART Backend Services credentials (a client ID bound to your signing key).

2. 2

   Retrieve your attributed panel

   Each organization is attributed to a member group. Fetch the group to see the members you are authorized to pull.

   Copy

   GET /fhir/r4/Group/{group-id} HTTP/1.1
   Host: provider-access.acmehealth.example
   Authorization: Bearer <access_token>
   Accept: application/fhir+json

3. 3

   Start a bulk export

   Kick off an asynchronous export for the group. Filter by member, date, and resource type. You get a 202 Accepted with a status URL to poll.

   Copy

   POST /fhir/r4/Group/{group-id}/$davinci-data-export HTTP/1.1
   Host: provider-access.acmehealth.example
   Authorization: Bearer <access_token>
   Prefer: respond-async
   Accept: application/fhir+json
   
   # Optional filters: patient, _since, _type, _typeFilter

4. 4

   Poll and download

   Poll the status URL until the export completes, then download the NDJSON files (one resource per line). Members who have opted out are excluded automatically.

   Copy

   GET /fhir/r4/$export-poll-status?jobId={jobId} HTTP/1.1
   Host: provider-access.acmehealth.example
   Authorization: Bearer <access_token>
   Accept: application/json
   
   # 202 Accepted -> still running (Retry-After header set)
   # 200 OK       -> complete; body.output[] lists NDJSON download URLs

1. 5

   Submit your patient list

   Don't have a Group ID? Submit your own patient panel and Acme Health will match it against its attribution records.

   Copy

   POST /fhir/r4/Group/$provider-member-match HTTP/1.1
   Host: provider-access.acmehealth.example
   Authorization: Bearer <access_token>
   Content-Type: application/fhir+json
   Accept: application/fhir+json
   
   {
     "resourceType": "Parameters",
     "parameter": [
       { "name": "MemberPatient", "resource": { "resourceType": "Patient", "...": "..." } }
     ]
   }
   
   # 202 Accepted -> Content-Location header carries the poll URL / jobId

2. 6

   Poll the match job, then export

   Poll until matching completes. The response carries a matchedGroupId — use it as {group-id} in the bulk export step above.

   Copy

   GET /fhir/r4/$match-poll-status?jobId={jobId} HTTP/1.1
   Host: provider-access.acmehealth.example
   Authorization: Bearer <access_token>
   Accept: application/json
   
   # 202 Accepted -> still matching
   # 200 OK       -> complete; body.matchedGroupId is your Group ID

curl -X POST https://auth.acmehealth.example/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "scope=system/Group.read system/Patient.read system/Observation.read system/Condition.read system/MedicationRequest.read system/Encounter.read system/AllergyIntolerance.read system/Immunization.read system/Procedure.read system/DocumentReference.read" \
  -d "client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer" \
  -d "client_assertion=$SIGNED_JWT"

Tokens are system-scoped and short-lived. Treat them and the data they return as PHI.