Do members need to provide consent before their information is shared?

Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), members are included in the Provider Access API data exchange by default. As a result, explicit member consent isn’t required before information is shared with eligible in-network providers who have a valid treatment relationship with a member.

However, members have the right to opt out of sharing their information through the Provider Access API at any time.