Also known as: Health API, FHIR API, Healthcare data API, Medical API
Key facts
- Dominant clinical standard
- HL7 FHIR, with Release 4 referenced in U.S. regulations
- App authorization
- SMART App Launch framework, built on OAuth 2.0
- Certified EHR API criterion
- 45 CFR 170.315(g)(10)
- CMS payer API rules
- CMS-9115-F (2020) and CMS-0057-F (2024)
What is a healthcare API?
An API lets one program talk to another without a person copying data between them. In health care, APIs let patient apps download records, let payers exchange claims history, let clinical tools read EHR data and let analysts pull reference data from public sources.
Modern clinical APIs mostly follow Fast Healthcare Interoperability Resources (FHIR), an HL7 standard that represents data as resources such as Patient, Observation, MedicationRequest and Coverage, exchanged over web protocols in JSON or XML. Older interfaces still use HL7 version 2 messages, X12 transactions for claims and eligibility, and NCPDP standards for pharmacy.
Many public health data sources also offer APIs, including openFDA, the NPPES NPI Registry, ClinicalTrials.gov and the National Library of Medicine's RxNorm services.
Types of healthcare APIs
Federal rules and industry standards define several common API types:
- Patient and population APIs: certified EHRs must offer standardized FHIR APIs under the (g)(10) certification criterion, so patients can use apps of their choice and authorized systems can export data for groups of patients.
- Payer APIs: CMS requires Medicare Advantage organizations, Medicaid and CHIP programs and qualified health plan issuers on federal exchanges to offer a Patient Access API, and most of them a Provider Directory API.
- Newer payer APIs: a 2024 CMS rule adds Provider Access, Payer-to-Payer and Prior Authorization APIs, with most API deadlines in 2027.
- Workflow APIs: SMART on FHIR and CDS Hooks let outside apps launch inside the EHR and return guidance during care.
- Public data APIs: government agencies publish APIs for drug, provider, trial and coverage data that need no patient permissions.
Why healthcare APIs matter
APIs determine how quickly and reliably data can move:
- Health IT and AI companies: FHIR APIs reduce custom integration work, but EHRs still differ in supported resources, access rules and app registration processes.
- Payers and providers: CMS API mandates create deadlines and budget needs for building, testing and monitoring FHIR endpoints.
- Data teams: public APIs keep drug, provider and trial reference data current without manual downloads, but they impose rate limits and change versions.
- Privacy: once a patient directs data to a consumer app that is not a covered entity or business associate, HIPAA generally no longer protects that copy.