Make your systems talk to each other — and to CMS-0057

FHIR integrations, EHR/EMR connections, and clinical decision support that actually ship — plus, if you're on the hook for it, the prior authorization APIs CMS-0057-F requires before January 1, 2027.

If any of this is where you're stuck

  • Patient data lives in three or more disconnected systems — EHR, billing, lab portal, imaging viewer — and nobody has the full picture.
  • Your EHR doesn't support something you need — a device data feed, a custom field, a decision-support prompt at the point of care — and the vendor isn't going to build it for you.
  • You're integrating with Epic or Cerner and need a SMART on FHIR app that opens with patient context already loaded, not a separate login.
  • Standards like FHIR, CommonWell, Carequality exist on paper — but nobody has implemented them for your specific stack, especially if part of it is legacy.
  • Someone on your team was told "we need CRD support" for CMS-0057 and started googling CDS Hooks an hour ago.

Interoperability, in four parts

What we build

FHIR & EHR Integration

FHIR extensions for data your EHR doesn't natively support. SMART on FHIR apps that launch inside Epic or Cerner with patient context already loaded. CDS Hooks that surface decision-support recommendations right in the clinician's existing workflow — not a separate tab they have to remember to check.

Custom Integration Layer

For practices and platforms running a mix of systems that were never meant to share data: an HL7/FHIR translation layer wrapping what you already have, so every tool — reporting, AI, a unified dashboard — has one complete data source instead of five partial ones. Built incrementally: highest-pain systems connected first, not a big-bang rebuild.

Registry & Reporting Gateways

Mapping between your system's data format and whatever an external registry, payer, or regulator requires on the other end.

Patient-facing FHIR access

SMART on FHIR apps that give your patients real access to their own data in your product — built on the same FHIR/OAuth foundation as CMS-0057's Patient Access API, for your systems, not as that payer obligation.

CMS-0057, the deep end

CMS-0057-F requires Medicare Advantage, Medicaid, CHIP and federal exchange plans to run prior authorization over FHIR APIs. Fax and phone don't go away — but from January 1, 2027 the API channel has to exist alongside them, under the same decision deadlines. If you build software for providers — RCM, DME, imaging, home health, telehealth, a smaller EHR — your clients will expect this in your product before then.

  1. Jan 1, 2026 Already in force: decision deadlines — 7 calendar days standard, 72 hours expedited, with a specific reason for any denial (excludes QHP issuers on the federal exchanges) — and prior authorization metrics reporting, posted publicly by March 31 each year.
  2. Apr 14, 2026 Separate rule extending the same requirements to drugs published. Proposed, not finalized.
  3. Jan 1, 2027 The prior authorization API channel has to exist, under those same decision deadlines.
  4. CY2027 → CY2028 Hospitals' separate electronic prior authorization measure under the Medicare Promoting Interoperability Program: optional bonus reporting for CY2027, required from CY2028.

Three specifications, one pipeline

  1. Trigger — the clinician signs the order
  2. CRD Coverage Requirements Discovery

    At the moment a clinician places an order, their EHR asks the payer in real time whether it's covered, whether prior auth is required, what documentation is needed. The answer shows up as a card on screen.

    • EHR → your product → payer CDS Hooks order-sign request
    • payer → your product → EHR CRD card — prior authorization required
  3. DTR Documentation Templates and Rules

    If documentation is required, a SMART on FHIR app auto-fills what it can from the EHR; the clinician fills in the rest.

    • EHR → your product → payer SMART app launch, fetch the questionnaire the CRD card pointed at
    • EHR → your product → payer QuestionnaireResponse — pre-filled from US Core, clinician completes the rest
  4. PAS Prior Authorization Support

    The actual submission. The response comes back approved, denied with a reason, or pended, with a way to check status without another phone call.

    • your product → payer PAS Bundle → Claim/$submit
    • payer → your product Claim response
    • Approved Ready to proceed
    • Denied With a stated reason
    • Pended Awaiting documentation — poll for status instead of phoning

Each stage can be built and tested independently — you don't need all three live on day one to start reducing manual work. What implementing a client actually involves, request by request, is on the sandbox page.

If you only sell to hospitals, not payers

CMS-0057-F binds payers, not your product directly. But hospitals attesting under the Medicare Promoting Interoperability Program carry their own, separate electronic prior authorization reporting obligation — optional bonus reporting for the CY2027 EHR reporting period, required starting with CY2028. That measure is satisfied through certified EHR technology submitting prior authorization requests electronically via a PA API, which makes it a requirement on the software, not just on the hospital's internal process. For a hospital-facing product, the case for a working CRD/DTR/PAS client isn't only "your clients will ask" — for that measure, there's a reporting year attached to it.

CMS-0057-F requires four APIs total — Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization. We lead with Prior Authorization because that's where the engineering complexity and the deadline both concentrate, and it's what our sandbox demonstrates end to end.

Even if enforcement slips, the APIs still have to exist — the sandbox and the work don't expire with the date. Last reviewed: September 2026.

Try it yourself · a free tool we host

See the pipeline run, before you build it

Real payers rarely open production access to a third party — it's PHI, it's compliance, it's legal review, and most don't have anything to test against yet anyway. We run a hosted mock payer — synthetic data only, backed by HL7's own Da Vinci reference implementation — that runs the full CRD → DTR → PAS cycle end to end.

What you'll see

  1. Sign up with your work email — a magic link gets you a bearer token and a synthetic patient in under a minute, no credit card, no sales call.
  2. A CRD hook comes back with a card flagging that prior authorization is required.
  3. The DTR questionnaire that card points to is already pre-filled from the fixture's data, with the rest left for the clinician.
  4. Submitting the PAS request gets back approved, denied with a reason, or pended.
  5. Polling the pended one returns a status update — the same way your product would, instead of a phone call.

What it looks like

Scenario catalog screen listing clinical modules with approval, denial, and pended outcomes, filterable by outcome
Scenario catalog — every clinical module the sandbox ships, filterable by outcome.
An expanded scenario card showing the CRD, DTR, and PAS flow steps, field pickers, and run buttons
An expanded scenario — CRD → DTR → PAS steps, with a run button and curl for each.
Request inspector detail view of a PAS submit call, showing a 200 response with an 8-entry FHIR Bundle
Request inspector — a logged PAS submit call, 200 response, full JSON body.

Synthetic data only, free, for development use — it's a live counterparty to test your client against, not a conformance checker.

Full walkthrough, with the request-by-request detail and the scenario catalog, lives at the sandbox page — or jump straight to the live sandbox.

Fixed scope, either track

Interoperability track

  • Integration audit

    Map what's connected, what isn't, and what's blocking your AI or reporting tools from having complete data.

    $4,500 · 2–3 weeks · up to 6 systems

  • Custom Integration Layer

    HL7/FHIR translation layer over your existing systems, built incrementally.

  • SMART on FHIR / CDS Hooks build

    A specific app or decision-support integration inside Epic, Cerner, or your own product.

  • Registry / reporting gateway

    Mapping to one external format.

Get an interoperability assessment

CMS-0057 track

  • Readiness Assessment

    Gap list against what your product needs to support, fixed scope, fixed timeline.

    $3,500 · 2 weeks · one product, one prior-auth workflow

  • CRD client implementation

    Typically 4–6 weeks

  • DTR documentation flow

    Typically 6–8 weeks

  • PAS submission and status

    Typically 4–6 weeks

  • Full conformance pass (optional)

    Tested against the Inferno test kits for the Da Vinci IGs, for teams that need demonstrable conformance, not just a working demo.

    Typically 2–3 weeks

Check your CMS-0057 readiness

These are fixed-scope stages, not a quote. The audit and the readiness assessment are fixed-fee at the scope shown, and the fee is credited toward implementation if you go ahead. Bigger estates and multi-product reviews get scoped first, then quoted. Implementation stages are quoted once scope is known — the durations above are what they typically take.

Why us

19Years in business
200+Projects delivered
70Clients worldwide
4.9Rating for cost

Company-wide totals across all industries since 2007, not healthcare-specific.

  • 19 years building software for regulated US and EU clients, HIPAA and BAA experience built in.
  • The pattern here — "the standard exists on paper, nobody implemented it for this stack" — is one we've run repeatedly in other regulated domains. Healthcare is the same problem with a different rulebook.
  • We built and ran the full CRD → DTR → PAS flow against HL7's own Da Vinci reference implementation and the Inferno test kits while building our sandbox.
  • Fixed scope, fixed dates on audits and first-stage engagements.
  • 200+ projects since 2007, 70 clients worldwide.

Frequently asked questions

We're not affected by CMS-0057 — do you still do FHIR integration work?
Yes — FHIR & EHR Integration and Registry & Reporting Gateways (two of our four interoperability offerings) aren't tied to the CMS-0057-F deadline at all. Most of our interoperability work has nothing to do with prior authorization.
Does CMS-0057-F apply to my organization?
The rule applies directly to impacted payers — Medicare Advantage plans, state Medicaid and CHIP programs, and federal exchange (QHP) issuers (excluding issuers offering only stand-alone dental plans or only SHOP plans). It doesn't directly regulate commercial-only plans, and CMS-0057-F itself doesn't directly regulate providers either — though hospitals attesting under the separate Medicare Promoting Interoperability Program do pick up their own electronic prior authorization reporting obligation starting with the CY2027 EHR reporting period, addressed below. In practice, the APIs are only useful if the software on the provider side — EHRs, RCM systems, DME and imaging platforms — can call them. If you build software providers use to manage prior authorization, this is a product requirement even though CMS-0057-F's text is aimed at payers.
Can we test the prior auth flow without a real payer connection?
Yes — that's exactly why we built the mock payer sandbox. It runs the full CRD, DTR and PAS cycle end to end using only synthetic data, so you can validate against it before any real payer will give you access.
How is this different from point-to-point EHR integrations we've tried before?
Point-to-point means a separate custom integration for every pair of systems — and it breaks again the next time either system changes. We build a translation layer once: every tool connects to that layer instead of to each other, so adding or replacing one system doesn't mean rebuilding every connection to it.
Do you need access to real patient data?
No, not for the sandbox — everything in it runs on synthetic data. If a project moves into a production integration, patient data handling is a separate conversation with its own HIPAA and BAA requirements, scoped explicitly before it starts.
Our EHR vendor says they'll support CRD — why do we need you?
Epic, Cerner and the other big EHRs are building CRD support for their own product — the workflow their clinicians see inside the EHR. That doesn't cover software that sits beside the EHR: RCM platforms, DME and imaging systems, home health and telehealth tools. If your product isn't the EHR itself, nobody else is going to write its CRD client for you. And the vendor's rollout timeline is theirs, not yours — it doesn't move your January 1, 2027 deadline.
What already applies today?
Two things, both ahead of the January 1, 2027 API deadline. Since January 1, 2026, impacted payers — except QHP issuers on the federal exchanges, who are excluded from the decision-timeframe requirements — must decide standard prior authorization requests within 7 calendar days and expedited requests within 72 hours, and must give a specific reason for any denial. A denial reason required in that form is machine-readable and actionable, not just a compliance disclosure — which is what makes automating the DTR documentation step worth building now rather than treating it as a future compliance chore. The prior authorization metrics-reporting requirement took effect January 1, 2026 too, with the metrics posted publicly by March 31 each year. Neither requirement is about APIs yet — but they set the SLAs the CRD/DTR/PAS pipeline is built to meet, and they're already in effect.
We only sell to hospitals — does anything in this apply to us directly?
CMS-0057-F itself doesn't — it binds payers, not provider-side software. But if your hospital clients attest under the Medicare Promoting Interoperability Program, they carry their own electronic prior authorization measure: optional bonus reporting in the CY2027 EHR reporting period, required from CY2028. That measure is satisfied through certified EHR technology making PA requests electronically via a PA API — which makes it a requirement on the software those hospitals run, not just on their internal process. For a hospital-facing product, that means the demand for a working CRD/DTR/PAS client isn't only "your clients will ask someday" — it has a reporting year attached to it, independent of whether any of your clients' own payers are impacted under CMS-0057-F.

Two ways to start

Option A — general interoperability

Get an integration audit, fixed scope, fixed timeline.

Get an interoperability assessment

Option B — CMS-0057 specifically

Get a prioritized gap list against CMS-0057-F.

Check your CMS-0057 readiness

Not sure which one fits? Let's talk.

OR LEAVE YOUR EMAIL AND WE’LL CONTACT YOU WITHIN THE SAME BUSINESS DAY

We reply within one business day, with a person, not a sequence. No newsletter, no drip campaign.