CMS — Centers for Medicare & Medicaid Services Patient API

openapi: 3.2.0
info:
  title: Cms Gov Patient API
  version: '1.0'
  description: 'Operations tagged Patient across 4 of this provider''s published API definitions: cms-gov-bfd-openapi.yml, cms-gov-blue-button-2-openapi.yml, cms-gov-dpc-openapi.yml, cms-patient-api-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://prod.bfd.cms.gov/v2/fhir
  description: Production (peering only)
- url: https://sandbox.bfd.cms.gov/v2/fhir
  description: Sandbox (peering only)
- url: https://api.bluebutton.cms.gov/v2/fhir
  description: Production FHIR R4 endpoint
- url: https://sandbox.bluebutton.cms.gov/v2/fhir
  description: Sandbox FHIR R4 endpoint
- url: https://api.dpc.cms.gov/api/v1
  description: Production
- url: https://sandbox.dpc.cms.gov/api/v1
  description: Sandbox
tags:
- name: Patient
paths:
  /Patient:
    get:
      summary: Search Patient Resources
      operationId: searchPatient
      tags:
      - Patient
      parameters:
      - name: identifier
        in: query
        schema:
          type: string
          description: HICN, MBI, or BENE_ID identifier
      - name: _has:Coverage.extension
        in: query
        schema:
          type: string
      - name: _lastUpdated
        in: query
        schema:
          type: string
      responses:
        '200':
          description: Bundle of Patients
      security:
      - MutualTLS: []
    post:
      summary: Create Patient
      operationId: createPatient
      tags:
      - Patient
      requestBody:
        required: true
        content:
          application/fhir+json:
            schema:
              type: object
      responses:
        '201':
          description: Patient created
      security:
      - MutualTLS: []
    servers:
    - url: https://api.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 production FHIR server
    - url: https://sandbox.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 sandbox FHIR server
  /Patient/{id}:
    get:
      summary: Read Patient
      operationId: readPatient
      tags:
      - Patient
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Patient resource
      security:
      - MutualTLS: []
    servers:
    - url: https://api.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 production FHIR server
    - url: https://sandbox.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 sandbox FHIR server
  /api/v1/Patient/$export:
    get:
      tags:
      - Patient
      summary: Start FHIR STU3 data export job for the specified group identifier and resource…
      description: 'Initiates a job to collect data from the Beneficiary FHIR Data API for your ACO.


        If used when specifying `_since`: all claims data which has been updated since the specified date will be returned for beneficiaries which have been attributed to the ACO since before the specified date.'
      operationId: bulkPatientRequest
      parameters:
      - name: _type
        in: query
        description: Resource types requested
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
          x-go-name: ResourceType
        x-go-name: ResourceType
      - name: _since
        in: query
        description: Only include resource versions that were created at or after the given instant in time.  Format of string must align with the FHIR Instant datatype (i.e., `2020-02-13T08:00:00.000-05:00`)
        schema:
          type: string
          x-go-name: DateTime
        x-go-name: DateTime
      - name: Prefer
        in: header
        required: true
        schema:
          type: string
          enum:
          - respond-async
      responses:
        '202':
          description: 'A data export job has been started successfully. '
          headers:
            Content-Location:
              description: Returns a URI to the jobs status endpoint, along with the job id. `/jobs/<jobId>`
              schema:
                type: string
          content: {}
        '400':
          description: Malformed request
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/OperationOutcomeResponse'
        '401':
          description: Unauthorized. The provided credentials are invalid for the requested resource.
          content: {}
        '429':
          description: Too many requests. A bulk export job of this resource type is already in progress for the ACO.
          content: {}
        '500':
          description: 'Internal Server Error. '
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/OperationOutcomeResponse'
      security:
      - bearer_token: []
    servers:
    - url: https://api.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 production FHIR server
    - url: https://sandbox.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 sandbox FHIR server
  /api/v2/Patient/$export:
    get:
      tags:
      - Patient
      summary: Start FHIR R4 data export job for the specified group identifier and resource…
      description: 'Initiates a job to collect data from the Beneficiary FHIR Data API for your ACO.


        If used when specifying `_since`: all claims data which has been updated since the specified date will be returned for beneficiaries which have been attributed to the ACO since before the specified date.'
      operationId: bulkPatientRequestv2
      parameters:
      - name: _type
        in: query
        description: Resource types requested
        style: form
        explode: false
        schema:
          type: array
          items:
            type: string
          x-go-name: ResourceType
        x-go-name: ResourceType
      - name: _since
        in: query
        description: Only include resource versions that were created at or after the given instant in time.  Format of string must align with the FHIR Instant datatype (i.e., `2020-02-13T08:00:00.000-05:00`)
        schema:
          type: string
          x-go-name: DateTime
        x-go-name: DateTime
      - name: Prefer
        in: header
        required: true
        schema:
          type: string
          enum:
          - respond-async
      responses:
        '202':
          description: 'A data export job has been started successfully. '
          headers:
            Content-Location:
              description: Returns a URI to the jobs status endpoint, along with the job id. `/jobs/<jobId>`
              schema:
                type: string
          content: {}
        '400':
          description: Malformed request
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/OperationOutcomeResponse'
        '401':
          description: Unauthorized. The provided credentials are invalid for the requested resource.
          content: {}
        '429':
          description: Too many requests. A bulk export job of this resource type is already in progress for the ACO.
          content: {}
        '500':
          description: 'Internal Server Error. '
          content:
            application/fhir+json:
              schema:
                $ref: '#/components/schemas/OperationOutcomeResponse'
      security:
      - bearer_token: []
    servers:
    - url: https://api.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 production FHIR server
    - url: https://sandbox.bluebutton.cms.gov/v2/fhir
      description: Blue Button 2.0 sandbox FHIR server
components:
  schemas:
    Patient:
      type: object
      properties:
        resourceType:
          type: string
          enum:
          - Patient
        id:
          type: string
        identifier:
          type: array
          items:
            type: object
        name:
          type: array
          items:
            type: object
        gender:
          type: string
          enum:
          - male
          - female
          - other
          - unknown
        birthDate:
          type: string
          format: date
        address:
          type: array
          items:
            type: object
    Bundle:
      type: object
      properties:
        resourceType:
          type: string
          enum:
          - Bundle
        type:
          type: string
        total:
          type: integer
        link:
          type: array
          items:
            type: object
        entry:
          type: array
          items:
            type: object
            properties:
              resource:
                type: object
              fullUrl:
                type: string
    FHIRResource:
      type: object
      description: A generic FHIR R4 resource.
      properties:
        resourceType:
          type: string
        id:
          type: string
      additionalProperties: true
    FHIRBundle:
      type: object
      description: A FHIR R4 Bundle resource wrapping a collection of resources.
      properties:
        resourceType:
          type: string
          const: Bundle
        type:
          type: string
        total:
          type: integer
        entry:
          type: array
          items:
            type: object
            additionalProperties: true
      additionalProperties: true
    OperationOutcomeResponse:
      type: object
      properties:
        Issue:
          type: object
          required:
          - Severity
          - Code
          - Diagnostics
          properties:
            Severity:
              description: 'Severity of the outcome: fatal | error | warning | information'
              type: string
            Code:
              description: Error or warning code
              type: string
            Diagnostics:
              description: Additional diagnostic information about the issue
              type: string
      x-go-package: github.com/CMSgov/bcda-app/bcda/models
  responses:
    NotFound:
      description: The requested resource was not found.
      content:
        application/fhir+json:
          schema:
            $ref: '#/components/schemas/FHIRResource'
    Unauthorized:
      description: Authentication credentials are missing or invalid.
      content:
        application/fhir+json:
          schema:
            $ref: '#/components/schemas/FHIRResource'
  securitySchemes:
    MutualTLS:
      type: mutualTLS
      description: BFD requires X.509 client certificates issued by the CMS PKI; access is restricted to peering applications.
    OAuth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.bluebutton.cms.gov/v2/o/authorize/
          tokenUrl: https://api.bluebutton.cms.gov/v2/o/token/
          scopes:
            patient/Patient.read: Read Patient resource
            patient/Coverage.read: Read Coverage resources
            patient/ExplanationOfBenefit.read: Read ExplanationOfBenefit resources
            profile: OpenID profile claims
    BearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: DPC uses asymmetric SMART Backend Services authentication.
    basic_auth:
      type: http
      scheme: basic
    bearer_token:
      type: apiKey
      description: The Group and Patient endpoints require a Bearer Token. 1) Put your credentials in Basic Authentication, 2) Request a bearer token from /auth/token, 3) Put "Bearer {TOKEN}" in this field (no quotes) using the bearer token retrieved in step 2
      name: Authorization
      in: header
    oauth2:
      type: oauth2
      description: OAuth 2.0 authorization code flow used by Medicare beneficiaries to grant access to a third-party application.
      flows:
        authorizationCode:
          authorizationUrl: https://api.bluebutton.cms.gov/v2/o/authorize/
          tokenUrl: https://api.bluebutton.cms.gov/v2/o/token/
          scopes:
            patient/Patient.read: Read beneficiary Patient resource.
            patient/Coverage.read: Read beneficiary Coverage resources.
            patient/ExplanationOfBenefit.read: Read beneficiary claims.
externalDocs:
  description: CMS Blue Button 2.0 API Documentation
  url: https://bluebutton.cms.gov/api-documentation/
x-refined-from:
- cms-gov-bfd-openapi.yml
- cms-gov-blue-button-2-openapi.yml
- cms-gov-dpc-openapi.yml
- cms-patient-api-openapi.yml