Skip to main content
CMS-0057-F, the CMS Interoperability and Prior Authorization final rule (2024), requires impacted payers to operate a set of FHIR APIs. Impacted payers are Medicare Advantage organizations, state Medicaid and CHIP agencies, and QHP issuers on the federally-facilitated exchanges. The API compliance dates are generally January 1, 2027.

​
What the rule requires

The rule requires four payer FHIR APIs:
  • Patient Access API
  • Provider Access API
  • Payer-to-Payer API
  • Prior Authorization API
The required standards baseline is FHIR R4.0.1, US Core 3.1.1, SMART App Launch 1.0, and Bulk Data 1.0 (45 CFR 170.215, as adopted). Not everything in the Da Vinci ecosystem is mandated, and keeping that straight decides what you test against.

​
What Conform covers today

Conform ships the Implementation Guides that matter for this rule: Install an IG package with pidgeon data install <package>, then point Conform at your endpoint. The US Core 3.1.1 readiness pack grades a walk against the required baseline and writes an evidence envelope. See Evidence and CI.

​
What Conform does not do

Conform tests conformance to these Implementation Guides. It does not:
  • certify CMS-0057-F compliance, or assert that an endpoint is “compliant”;
  • exercise SMART App Launch or OIDC end-user authorization flows (it authenticates with a static bearer token or SMART Backend Services);
  • run the complete Bulk Data kick-off, poll, and download lifecycle.
The evidence it produces states what was tested and what was not. Treat it as conformance evidence you present, not a verdict on the regulation as a whole.

​
Next