70.1.1Actors and Roles

• Payer System – Hosts the FHIR server containing claims, clinical, and prior authorization (PA) data. Validates provider access and enforces patient opt-out preferences.
• Provider System (EHR) – Authenticated client system that requests patient data for treatment. Registers with the payer as a SMART on FHIR client system.
• Member (Patient) – The individual whose data is being accessed. May opt out to restrict data sharing.

70.1.2Data Flow Overview

1. The provider’s EHR registers with the payer as a SMART on FHIR client.
2. The provider authenticates and obtains an OAuth 2.0 access token.
3. The provider queries the payer’s FHIR server using approved scopes (for example, patient/*.read or user/*.read) set by the Payer.
4. The payer validates the provider-patient relationship and checks opt-out status.
5. The payer returns relevant FHIR resources, scoped to the patient’s data.