Solution

With the deadline to comply with the CMS-9115-F Patient Access Final Rule looming, Clever Care selected WSO2 Open Healthcare in early 2021 to implement this on a SaaS basis, hosted on WSO2 Open Healthcare.

According to the CMS Patient Access Final Rule (see Figure 1), a Patient Access API must “expose your claims, encounter, clinical, coverage, and drug formulary data via FHIR APIs (no later than one business day).” In practice, this requires a solution with the following characteristics:

• Developers must have a way to register their third-party applications
• Patients must be able to access those applications via the Internet
• The payer organization must have a way to authenticate users and request their consent to provide patient data via these third-party applications
• Patients must be able to provide their consent
• The third-party applications must then have a way to access patient data via APIs

The Final Rule in Action

WSO2 Open Healthcare includes a Developer Portal for third-party application developers to discover, subscribe, and get access to Clever Care’s FHIR APIs.

Another benefit is the library of pre-built FHIR API accelerators, which speed time-to-market. In the case of Clever Care, WSO2 implemented three FHIR APIs: Coverage, Explanation of Benefits, and Patient—where the access of the APIs are controlled by its members. Members must authenticate and authorize third-party applications to access these APIs. In this case, the organization maintains only claims and encounter data, so the Patient Access API implementation had to expose Clever Care’s claims, encounters, drug formularies, and coverage data residing in its database.

Accelerator Templates for Rapid Integration

As highlighted in Figure 3, the FHIR templates:

• Are optimized for integration developers
• Allow Business Analysts to speed up the data mapping process
• Enable customers or consultants to build FHIR APIs rapidly with a low-code editor
• Only need to connect to source systems and fill a mapping file as most of it is pre-coded
• Are auto-generated and support any FHIR implementation guide

As part of the Provider Directory API, Clever Care is required to expose providers and organizations via a set of public, unsecured APIs. Using WSO2’s pre-built connectors (see Figure 3), the organization was able to quickly extract and expose only the required data to satisfy the requirement for rapid integration and disclosure of in-network providers.

The solution also incorporates Provider Directory APIs, which are unsecured and are publicly accessible. To protect the server infrastructure from possible denial of service (DoS) attacks, WSO2 implemented rate-limiting policies.

WSO2 incorporated Clever Care branding into the developer portal and other UIs, approval workflows for third-party application developer onboarding, and email notifications on approval requests to the organization’s admin team.