The Secretary adopts the following standards and associated implementation specifications as the available standards for application programming interfaces (API):

1. (a) API base standard. The following are applicable for purposes of standards-based APIs.

   1. (1) Standard. HL7® Fast Healthcare Interoperability Resources (FHIR®) Release 4.0.1 (incorporated by reference, see § 170.299).
   2. (2) [Reserved]

2. (b) API constraints and profiles. The following are applicable for purposes of constraining and profiling data standards.

   1. (1) United States Core Data Implementation Guides—(i) Implementation specification. HL7® FHIR® US Core Implementation Guide STU 3.1.1 (incorporated by reference in § 170.299). The adoption of this standard expires on January 1, 2026.
   2. (ii) Implementation Specification. HL7® FHIR® US Core Implementation Guide STU 6.1.0 (incorporated by reference, see § 170.299).
   3. (2) [Reserved]

3. (c) Application access and launch. The following are applicable for purposes of enabling client applications to access and integrate with data systems.

   1. (1) Implementation specification. HL7® SMART Application Launch Framework Implementation Guide Release 1.0.0, including mandatory support for the “SMART Core Capabilities” (incorporated by reference, see § 170.299). The adoption of this standard expires on January 1, 2026.
   2. (2) Implementation specification. HL7® SMART App Launch Implementation Guide Release 2.0.0, including mandatory support for the “Capability Sets” of “Patient Access for Standalone Apps” and “Clinician Access for EHR Launch”; all “Capabilities” as defined in “8.1.2 Capabilities,” excepting the “permission-online” capability; “Token Introspection” as defined in “7 Token Introspection” (incorporated by reference, see § 170.299).

4. (d) Bulk export and data transfer standards. The following are applicable for purposes of enabling access to large volumes of information on a group of individuals.

   1. (1) Implementation specification. FHIR® Bulk Data Access (Flat FHIR®) (v1.0.0: STU 1), including mandatory support for the “group-export” “OperationDefinition” (incorporated by reference, see § 170.299).
   2. (2) [Reserved]

5. (e) API authentication, security, and privacy. The following are applicable for purposes of authorizing and authenticating client applications.

   1. (1) Standard. OpenID Connect Core 1.0, incorporating errata set 1 (incorporated by reference, see § 170.299).
   2. (2) [Reserved]

6. (f) API-based workflow triggers. The following are applicable for purposes of initiating calls to decision support services or initiating interactions that can be presented to users synchronously in their workflows.

   1. (1) Implementation specification. HL7 FHIR® CDS Hooks Implementation Guide, Version 2.0.1—STU 2 Release 2 (incorporated by reference in § 170.299).
   2. (2) [Reserved]
7. (g) [Reserved]

8. (h) API-based event notifications. The following are applicable for the purposes of supporting proactive notifications from a server to a client when new information has been added or existing information has been updated.

   1. (1) FHIR Subscriptions: Implementation specification. HL7® FHIR® Subscriptions R5 Backport Implementation Guide, Version 1.1.0—Standard for Trial Use (incorporated by reference in § 170.299).
   2. (2) [Reserved]
9. (i) [Reserved]
10. (j) Prior authorization—(1) Coverage requirements discovery—(i) Implementation specification. HL7 FHIR® Da Vinci—Coverage Requirements Discovery (CRD) Implementation Guide, Version 2.0.1—STU 2 (incorporated by reference in § 170.299).
11. (ii) [Reserved]
12. (2) Prior authorization documentation—(i) Implementation specification. HL7 FHIR® Da Vinci—Documentation Templates and Rules (DTR) Implementation Guide, Version 2.0.1—STU 2 (incorporated by reference in § 170.299).
13. (ii) [Reserved]
14. (3) Prior authorization submission—(i) Implementation specification. HL7 FHIR Da Vinci Prior Authorization Support (PAS) FHIR Implementation Guide, Version 2.0.1—STU 2 (incorporated by reference in § 170.299).
15. (ii) [Reserved]
16. (k) Payer data exchange—(1) Blue button—(i) Implementation specification. HL7 FHIR® CARIN Consumer Directed Payer Data Exchange (CARIN IG for Blue Button®) Implementation Guide, Version 2.0.0—STU 2 US (incorporated by reference in § 170.299).
17. (ii) [Reserved]
18. (2) Payer data exchange—(i) Implementation specification. HL7 FHIR® Da Vinci Payer Data Exchange (PDex) Implementation Guide, Version 2.1.0—STU 2.1 (incorporated by reference in § 170.299).
19. (ii) [Reserved]
20. (l) [Reserved]
21. (m) Drug formulary—(1) Implementation specification. HL7 FHIR® Da Vinci Payer Data Exchange (PDex) US Drug Formulary Implementation Guide, Version 2.0.1—STU 2 (incorporated by reference in § 170.299).
22. (2) [Reserved]
23. (n) Directory information—(1) Implementation specification. HL7 FHIR® Da Vinci Payer Data Exchange (PDex) Plan Net Implementation Guide, Version 1.1.0—STU 1.1 US (incorporated by reference in § 170.299).
24. (2) [Reserved]

[89 FR 1428, Jan. 9, 2024, as amended at 90 FR 37208, Aug. 4, 2025]