CMS-0057-F is the regulation that made FHIR business-critical in US healthcare. Understanding what it actually mandated (vs. what it recommends) helps teams scope compliance work.
Four required APIs
1. Patient Access API. Payers expose patient's data via FHIR. US Core-conformant reads. SMART on FHIR required.
2. Provider Access API. Providers query payer data at point of care. SMART Backend Services required.
3. Payer-to-Payer API. Cross-payer member data exchange. Bulk Data IG.
4. Prior Authorization API. Da Vinci PAS, CRD, DTR IGs.
Timelines (as of 2026)
| API | Mandate |
|---|---|
| Patient Access | Live 2024 |
| Provider Access | Live 2024 |
| Payer-to-Payer | Live 2025 |
| Prior Authorization | Rolling 2026-2027 |
Compliance verification
Inferno test suites verify each API against IG conformance. CMS-attested payers publish Inferno results. Ineligible for CMS contracts without attestation.
What CMS-0057 changed operationally
1. FHIR-based integration is now baseline. Non-FHIR integrations are legacy tech debt. 2. SMART on FHIR is the ubiquitous auth. Custom auth doesn't attest. 3. Bulk data is now table-stakes. $export infrastructure everywhere. 4. Da Vinci profiles are mainstream. PDex, PAS, CRD are common integration surfaces.
Compliance gaps we see
| Gap | Fix |
|---|---|
| SMART v1 only | Add v2 scopes |
No _since on Bulk export |
Add incremental support |
| Custom PAS payload | Use IG-conformant structures |
| Missing race/ethnicity extensions | Required, not optional |
| Rate limits too aggressive | Tune per SMART app |
CMS-0057 compliance is engineering work. The regulation is here; get through Inferno, attest, move on.