DEPARTMENT OF HEALTH & HUMAN SERVICES 
Centers for Medicare & Medicaid Services 
7500 Security Boulevard, Mail Stop S2-26-12 
Baltimore, Maryland 21244-1850 
SHO # 20-003 
RE: Implementation of the CMS 
Interoperability and Patient Access Final 
Rule and Compliance with the ONC 21st 
Century Cures Act Final Rule 
August 14, 2020
Dear State Health Official:
 
On May 1, 2020, the Centers for Medicare & Medicaid Services (CMS) published the final rule, 
Interoperability and Patient Access for Medicare Advantage Organization and Medicaid 
Managed Care Plans, State Medicaid Agencies, CHIP Agencies and CHIP Managed Care 
Entities, Issuers of Qualified Health Plans on the Federally-Facilitated Exchanges, and Health 
Care Providers, (referred to as CMS Interoperability and Patient Access final rule in this 
letter) to further advance interoperability for Medicaid and Childrens Health Insurance Program 
(CHIP) providers and improve beneficiaries access to their data.1  
This letter describes how state Medicaid agencies, Medicaid managed care plans, CHIP agencies, 
and CHIP managed care entities should implement this final rule in a manner consistent with 
existing guidance and the recently published 21st Century Cures Act: Interoperability, 
Information Blocking, and the ONC Health IT Certification Program final rule (ONC 21st 
Century Cures Act final rule), by the Office of the National Coordinator for Health Information 
Technology, published in the Federal Register on May 1, 2020.2  
Several new requirements in the CMS Interoperability and Patient Access final rule apply to 
Medicaid and CHIP, including the following: 
 Implement and maintain a standards-based Patient Access API: The CMS
Interoperability and Patient Access final rule requires state Medicaid agencies, Medicaid
managed care plans, CHIP agencies, and CHIP managed care entities to make certain
health information about Medicaid and CHIP beneficiaries accessible through a Patient
Access application program interface (API) by January 1, 2021. This policy enables
beneficiaries to have access to their health data on their internet-enabled devices (such as
smartphones).  Due to the COVID-19 public health emergency (PHE), CMS is exercising
enforcement discretion, however, and does not expect to enforce this requirement prior to
July 1, 2021.3
 Payer-to-Payer Data Exchange - Coordinate care between payers by exchanging, at
a minimum, the information contained in the United States Core Data for
1 85 Fed.  Reg.  25,510-25,640 (May 1, 2020), https://www.govinfo.gov/content/pkg/FR-2020-05-01/pdf/2020-
05050.pdf 
2 85 Fed.  Reg.  25,642-25,961 (May 1, 2020). 
3 Additional information is available at CMSs website at https://www.cms.gov/Regulations-and-
Guidance/Guidance/Interoperability/index.    State Health Official  Page 2 
Interoperability (USCDI): The CMS Interoperability and Patient Access final rule 
requires Medicaid managed care plans and CHIP managed care entities to comply with a 
beneficiarys request to have their health data transferred from payer to payer by January 
1, 2022.  For example, if a patient transfers from one Medicaid managed care plan or 
CHIP managed care entity to another, the previous plan must honor the patients request 
to have certain data transferred to the new plan and the new plan must incorporate the 
information into its records.  This new policy may reduce the need for unnecessary letters 
of medical necessity, prior authorization requests and calls or faxes to pharmacies or 
health plans if the receiving plan decides to use the information shared from the prior 
plan in administering the beneficiarys coverage. 
  Make standardized information about provider networks available via a FHIR-
based Provider Directory API: The CMS Interoperability and Patient Access final rule 
requires Medicaid agencies, CHIP agencies, Medicaid managed care plans and CHIP 
managed care entities to provide current provider directory information via an API by 
January 1, 2021. Having this information available through an API will facilitate public 
access to accurate information about which managed care providers are in-network or 
accepting new patients, as well as current contact information for providers.  As 
explained above, due to the COVID-19 PHE, CMS is exercising enforcement discretion 
and does expect to enforce this requirement prior to July 1, 2021.4 
  Improving the Dual Eligible Experience: The CMS Interoperability and Patient Access 
final rule requires state Medicaid agencies, by April 1, 2022, to exchange certain data 
with CMS daily on beneficiaries who are dually eligible for Medicaid and Medicare.  
Currently, many states and CMS exchange these data as infrequently as monthly, which 
delays coverage status changes and leads to inaccuracies, recoupments, and poor 
customer experiences.  Improving the accuracy and timeliness of data on dual eligibility 
status is a strong first step in improving how these systems work together for 
beneficiaries, providers, and payers. 
  The ONC 21st Century Cures Act final rule also has potential implications for 
Medicaid agencies, CHIP agencies, Medicaid managed care plans, and CHIP managed 
care entities.  All such entities should review the final rule, particularly the sections on 
the definition of health information network (HIN) or health information exchange (HIE) 
and the information blocking exceptions.  Those entities should also review existing 
contractual and financial relationshipsespecially those related to API usage and 
accessto evaluate potential compliance implications with regard to the ONC 21st 
Century Cures Act final rule.   
   
4 See supra note 3. 
                                                              State Health Official  Page 3 
The key compliance dates in the CMS final rule are as follows: 
Policy  Compliance Date 
Patient Access Application Program Interfaces (API)  January 1, 20215
Provider Directory API  January 1, 20216
 
Payer-to-Payer Data Exchange  January 1, 2022
 
Improving the Medicare-Medicaid Dually Eligible Experience   April 1, 2022
 
 
 
Each of these policies is described more fully below. 
Patient Access API 
The CMS Interoperability and Patient Access final rule adds 42 CFR 431.60 and 42 CFR 
457.730, which require state Medicaid and CHIP fee for service programs to implement secure, 
standards-based APIs and requires them to provide current beneficiaries or their personal 
representatives with specified claims and encounter data, certain clinical information, and 
information about covered outpatient drugs.  Medicaid managed care plan requirements are 
codified at 42 CFR 438.242(b)(5); CHIP managed care entity requirements are at 42 CFR 
457.1233(d).  These managed care regulations require the plans and entities to comply with the 
same standards that apply to the fee for service programs.  The CMS Interoperability and Patient 
Access final rule requires compliance with the API technical standards adopted by HHS at 45 
CFR 170.215 including the Health Level 7 (HL7)7 Fast Healthcare Interoperability Resources 
(FHIR) standard8 and relevant technical standards.   
State Medicaid agencies implementing the API requirements described in 42 CFR 431.60 might 
be able to claim the enhanced federal financial participation (FFP) described in section 
1903(a)(3)(A)(i) of the Social Security Act (the Act) for the design, development, installation, or 
enhancement of mechanized claims processing and information retrieval systems, and might be 
able to use the enhanced FFP described in section 1903(a)(3)(B) of the Act for the operation of 
mechanized claims processing and information retrieval systems, provided that they meet all 
other requirements applicable to claiming those enhanced federal matching rates.   
States are reminded that 42 CFR 433.112(b)(12) and 433.116(c) require them to ensure that any 
system for which they are receiving enhanced FFP under section 1903(a)(3)(A)(i) or (B) of the 
Act aligns with and incorporates the ONC Health Information Technology standards adopted in 
accordance with 45 CFR part 170, Subpart B.  The Patient Access API complements this 
requirement and will further advance interoperability.  States may be best able to compile all data 
elements described for the Patient Access API in 42 CFR 431.60 through connections to health 
information exchanges or public health agencies, or human services agencies.  Specifically, the 
required data in the United States Core Data for Interoperability (USCDI) described at 45 CFR 
170.213 might include information residing in health information exchanges or public health 
agencies (for immunization data, lab test and result data, etc.), or human service agencies, and 
states should review if establishing such connections would be appropriate.  If so, enhanced FFP 
might be available under section 1903(a)(3)(A)(i) or (B) of the Act to support such connections 
5 .  See supra note 3 and accompanying text. 
 6   .     S  e  e    s  u  p  r a    n   o  t e    3    a  n  d    a  c  c o   m   p  a  n  y  ing text. 
7 Health Level Seven International (HL7) is a not-for-profit, ANSI-accredited standards development organization 
(SDO) focused on developing consensus standards for the exchange, integration, sharing, and retrieval of electronic 
health information that supports clinical practice and the management, delivery and evaluation of health services.   
8 https://www.hl7.org/fhir/overview.html.    State Health Official  Page 4 
between those entities and Medicaid agencies.  For CHIP agencies, section 2105(c)(2)(A) of the 
Act, limiting administrative costs to no more than 10 percent of CHIP payments to the state, 
would apply in developing these systems. 
Provider Directory API 
The CMS Interoperability and Patient Access final rule requires state Medicaid agencies, CHIP 
agencies, Medicaid managed care plans, and CHIP managed care entities to implement an API 
that makes complete and accurate provider directory information available through a public-
facing digital endpoint on the payers website. These requirements are in 42 CFR 431.70 for 
state Medicaid agencies with regard to the provider directory information specified in section 
1902(a)(83) of the Act; 42 CFR 438.242(b)(6) for Medicaid managed care plans with regard to 
provider directory information specified in  438.10(h)(1) and (2);  457.7609 for CHIP agencies 
with regard to specified provider information; and  457.1233 for CHIP managed care entities 
with regard to provider directory information specified in  438.10(h)(1) and (2).  Under these 
regulations, the provider directory API must meet the same technical standards as the Patient 
Access API, excluding the security protocols related to user authentication and authorization.  
These regulations require the provider directory information to be updated no later than 30 
calendar days after the state Medicaid agency, Medicaid managed care plan, CHIP agency or 
CHIP managed care entity receives the provider directory information or updates to provider 
directory information.   
We strongly encourage leveraging theDaVinci PDex PlanNet IG, which is based on FHIR 
Version 4.0., and was developed in cooperation with the ONC with guidance from HL7 
International.10 For state Medicaid age ncies seeking to access the enhanced FFP at section 
1903(a)(3)(A)(i) or (B) of the Act, using the PlanNet IG is required under 42 CFR 
433.112(b)(12) and 433.116(c).  Additionally, state Medicaid agencies are strongly encouraged 
to begin collecting digital contact information (such as Direct addresses or FHIR URLs)11 for 
provider communication and facilitate the populating of this contact information into the CMS 
National Plan and Provider Enumeration System (NPPES)12 as an appropriate part of Medicaid 
provider enrollment. 
Payer-to-Payer Data Exchange 
The CMS Interoperability and Patient Access final rule finalizes requirements in 42 CFR 
438.62(b)(1)(vi) and (vii) for the creation of a process for the electronic exchange of, at a 
minimum, the data classes and elements included in the United States Core Data for 
Interoperability (USCDI)13 content standard adopted at 45 CFR 170.213.  Medicaid managed 
care plans and CHIP managed care entities14 must comply with this requirement beginning 
January 1, 2022.  The USCDI data classes and elements received from other plans must be 
incorporated into the managed care plans records about the enrollee.  At the request of an 
enrollee, the managed care plan must incorporate into its records such enrollee data with a date 
of service on or after January 1, 2016, from any other payer that has provided coverage to the 
9 Per  457.760(b)(1) this includes provider names, addresses, phone numbers, and specialties, updated no later than 
 3  0    c  a l  e n   d  a r    d  a  y  s    a f  t e  r   t h  e    S   t a  t e    r e  c  e  ives provider directory information or updates to provider directory information. 
10 See https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index for more information on 
available IGs to support API implementation. 
11 See https://nppes.cms.hhs.gov/webhelp/nppeshelp/HEALTH%20INFORMATION%20EXCHANGE.html#. 
12 See https://npiregistry.cms.hhs.gov/registry/help-details 
13 For more information see https://www.healthit.gov/isa/united-states-core-data-interoperability-uscdi. 
14 The regulation at 42 CFR 457.1216 requires compliance with these requirements for CHIP managed care entities.    State Health Official  Page 5 
enrollee within the preceding 5 years, as appropriate.  Similarly, at any time the enrollee is 
currently enrolled in the managed care plan and up to 5 years after disenrollment, the managed 
care plan must send, upon an enrollees request, all such data to any other payer that currently 
covers the enrollee, or a payer that the enrollee specifically requests to receive the data classes 
and elements included in the content standard specified at 45 CFR 170.213 (USCDI version 1).  
This requirement will also support dually eligible individuals who are concurrently enrolled in 
Medicare Advantage plans and Medicaid managed care plans or with CHIP managed care 
entities.  Under this requirement, both of the dually eligible individuals payers would be subject 
to the requirement to exchange that individuals data, which should improve the ability of payers 
to coordinate care based on that data.  This obligation applies when a request is made with the 
approval and at the direction of a current or former enrollee or the enrollees personal 
representative.   
CMS encourages state Medicaid agencies and CHIP fee for service entities to accommodate such 
requests from beneficiaries, although facilitating such exchange of beneficiary information is not 
required in the CMS Interoperability and Patient Access final rule for Medicaid agencies and 
CHIP fee for service entities.  Enhanced FFP might be available under section 1903(a)(3)(A)(i) 
or (B) of the Act for state Medicaid agencies expenditures to support accommodating such 
patient requests, provided that all of the applicable conditions for that enhanced FFP are met. 
Improving the Dual Eligible Experience 
The CMS Interoperability and Patient Access final rule requires daily state-CMS exchange of 
certain dual eligibility data by April 1, 2022.  Ensuring information on dual eligibility status is 
accurate and up-to-date by increasing the frequency of federal-state data exchange is an 
important step toward interoperability.   
State payment of Medicare premiums (buy-in) file exchange: CMS and states routinely 
exchange data on who is enrolled in Medicare, and which parties are liable for paying that 
beneficiarys Part A and B premiums.  These buy-in data exchanges support state, CMS, and 
Social Security Administration premium accounting, collections, and enrollment functions.  
Currently, states exchange these data with CMS at least monthly.  Through this final rule, we are 
updating 42 CFR 406.26 and 407.40 to require that all states participate in daily exchange of 
buy-in data, which includes both sending data to CMS and receiving responses from CMS daily. 
Medicare Modernization Act (MMA) file exchange: States submit files at least monthly to CMS 
to identify all dually eligible individuals.  The file is called the MMA file, but is occasionally 
referred to as the State Phasedown file. CMS uses the MMA files for a variety of functions, 
including establishing beneficiary protections related to Medicare cost sharing, auto-enrolling 
full-benefit dually eligible individuals into Medicare prescription drug plans, and deeming dually 
eligible individuals automatically eligible for the Medicare Part D Low Income Subsidy.  
Currently, states exchange these data with CMS at least monthly.  Through this final rule, we are 
updating the frequency requirements in 42 CFR 423.910(d) to require that all states submit the 
required MMA file data to CMS daily, and to make conforming edits to 42 CFR 423.910(b)(1). 
Additional information on the benefits of daily file exchange and technical assistance resources 
are included in SMD #18-012. 
ONC 21st Century Cures Act Final Rule 
State Medicaid agencies, Medicaid managed care plans, CHIP agencies, and CHIP managed care 
entities should review the ONC 21st Century Cures Act final rule, particularly the sections on the  State Health Official  Page 6 
definition of HIN or HIE and the information blocking exceptions.  There may be situations 
when such entities function as a HIN or HIE, as defined in the ONC 21st Century Cures Act final 
rule, and therefore would be considered an actor regulated under section 4004 of the Cures Act 
(42 U.S.C.  300jj-52) (referred to as the information blocking provision).  As such, those entities 
should review existing contractual and financial relationshipsespecially those related to API 
usage and accesswith Medicaid managed care plans, state Medicaid agencies, CHIP agencies, 
and CHIP managed care entities to evaluate potential compliance implications with regard to the 
ONC 21st Century Cures Act final rule.  The CMS Interoperability and Patient Access final rule 
does not authorize entities to charge for access to their API for purposes of the Patient Access 
and Provider Directory APIs.15  
Resources for States 
The timeline for compliance with the CMS Interoperability and Patient Access final rule is 
aggressive, and CMS is committed to providing states with the necessary technical assistance to 
implement these advancements in improving patient access to their data and interoperability.   
States should seriously consider leveraging existing State and Federal investments in health 
information exchanges (HIEs) to implement these new requirements.  For example, HIEs which 
might have received funding under the HITECH Act as discussed in SMD# 16-00316 from their 
state Medicaid agency might be in a position to improve patient access to their data, and would, 
as such, potentially be demonstrating thoughtful re-use as described in SMD# 18-005.17 A few 
key activities a state should undertake immediately are the following: 
  The CMS Interoperability and Patient Access final rule requires Medicaid managed care 
plans and CHIP managed care entities to develop the ability to share the United States 
Core Data for Interoperability (USCDI) as specified in 45 CFR 170.213 with the approval 
and at the direction of a current or former enrollee or the enrollees personal 
representative under the Payer-to-Payer Data Exchange policy.  An assessment of the 
ability to create that data set and the completeness of that data set for all parties and the 
ability to send and receive such data by all parties would be appropriate as a first step in 
preparation for implementation.   
  For purposes of API development, common use of implementation guides ensures better 
interoperability and thus, state Medicaid agencies, Medicaid managed care plans, CHIP 
agencies, and CHIP managed care entities may wish to consider beginning an assessment 
on using the IGs identified by CMS that are available to help facilitate implementation of 
the API policies.  These IGs are listed at https://www.cms.gov/Regulations-and-
Guidance/Guidance/Interoperability/index.  Doing so may also be consistent with the 
requirements at 42 CFR 433.112(b)(10) or (16) for state Medicaid agencies that seek 
enhanced FFP under 42 CFR 433.112 or 433.116. 
  Consider what contract amendments might need to be put in place with managed care 
plans and entities and what advance planning documents might be necessary. 
  Develop a project plan in coordination with the appropriate CMS Medicaid Enterprise 
System (MES) State Officers.  Such project plans might include tasks such as: 
15 The final rule requires public posting of the API documentation without a fee at 42 CFR 431.60(d) and 
4   5  7  . 7  3  0  ( d   ) ,   i n  c  o  r  p  o  r a  t e  d    b  y    r  e  f e  r e  n  c e for Medicaid (42 CFR 438.242) and CHIP (42 CFR 457.1233) managed care 
plans and entities.  85 FR 25542 through 25543.  For a discussion of the costs of implementation of the API and how 
CMS expects those costs to be addressed, see 85 FR 25528, 2553025531, and 2562925631. 
16 Available at https://www.medicaid.gov/federal-policy-guidance/downloads/SMD16003.pdf. 
17 Available at https://www.medicaid.gov/federal-policy-guidance/downloads/smd18005.pdf.  State Health Official  Page 7 
Requesting funding through the states budgetary process and/or submitting an
o
Advance Planning Document (APD) to CMS to request enhanced FFP.
Amending a states information technology vendor contracts and/or procuring
o
new contracts.
Revising current state data system designs, business processes, and related efforts,
o
including assessing how to make their data accessible via APIs.
Evaluating necessary systems changes, which may require contract modifications
o
and/or new procurements with information technology (IT) vendors.
Developing managed care plan contract amendments reflecting revised rates (as
o
appropriate) and new federal requirements.
Providing amendments to managed care plans for review and signature.
o
Developing the required beneficiary education materials to assist individuals in
o
protecting their health information, making informed choices about which third-
party applications they want to use, and informing them about how to submit
complaints to relevant federal entities.18
States arereminded that 42 CFR 433.112(b)(10) explicitly supports exposed APIs as a condition 
of receiving enhanced FFP under section 1903(a)(3)(A)(i) or (B) of the Act.  Similarly, 42 CFR 
433.112(b )(13) requires the sharing and re-use of Medicaid technologies and systems, including 
associated technical documentation, as a condition of receiving enhanced FFP under section 
1903(a)(3)(A)(i) or (B) of the Act, and this would include sharing documentation for connecting 
to APIs.   
CMS will continue advancing policies which improve a patients right of access to their health 
information.  We encourage states to continue to engage with CMS as stakeholders by providing 
feedback on these policies.  States should reach out to their CMS MES State Officers for 
technical assistance on enacting these policies where relevant.  CMS values the states as partners 
in expanding patient access to their health information and anticipates more opportunities to 
support such interoperability. 
Sincerely, 
Calder Lynch 
Deputy Administrator and Director 
18 Additional information to support development of educational resources can be found on CMSs website at 
https://www.cms.gov/Regulations-and-Guidance/Guidance/Interoperability/index.