API questions

Learn who can register for Blue Cross NC interoperability APIs, what information is required, how the review process works, and how approval notifications are communicated.

To register for Blue Cross NC Interoperability APIs, you must be an authorized representative of your organization. Begin by creating an account through the API Registration Portal and following the registration process for your organization type (e.g., payer, provider, ePA coordinator, or third-party application). During registration, you will be asked to provide organizational, technical, and security information required to support access to the applicable APIs. Once your registration is submitted, Blue Cross NC will review the application and notify you of the approval status.

Blue Cross NC has 10 business days to approve your application from the time registration is submitted with proper information. Once approved, an email will be sent to your address on file within five business days with instructions for obtaining access tokens.

As part of the API access registration process, Blue Cross NC asks for a contact email and phone number. We will send an email requesting additional information, expecting that your application’s owner will respond. Any additional responses should be updated in the registration portal by the application’s owner.

An email will be sent to the address you list on your registration form with instructions for obtaining authentication tokens.

Approved: The application is approved and is allowed to use Blue Cross NC APIs.

Pending: The application request is submitted and being reviewed by Blue Cross NC.

Suspended: There is an issue with the application's security and how it is interacting with Blue Cross NC infrastructure. Blue Cross NC is blocking the application's access to its APIs.

Terminated: Blue Cross NC has determined that the application's security is an issue to Blue Cross NC. Access has been revoked. To regain access, the application's owner will have to re-register.

Yes. After approval, Blue Cross NC reserves the right to suspend or terminate an application's API access if security, privacy, compliance, or other operational concerns are identified.

If your application's access is suspended or terminated, the application owner should log in to the API Registration Portal and contact Blue Cross NC to request a review of the access status. Blue Cross NC will evaluate the request and provide guidance on any actions required to restore access, if applicable.

To register as a payer, you must provide the following organizational information:

• Payer name
• Tax Identifier (TIN)
• Payer contact information
• Privacy Policy URL
• Redirect URL

In addition, you must attest that your organization can meet applicable technical and security requirements.

To register a third-party app with Blue Cross NC, you must provide information about your organization and attest to your app’s privacy, security, and technical capabilities.

To register as a Provider or an authorized representative of a provider organization, you will need to provide:

Provider or organization name

• Tax Identifier (TIN)
• Contact information
• Privacy Policy URL
• Redirect URL

To register as an ePA Coordinator, you will need to provide:

• Organization name
• Tax Identifier (TIN)
• Organization contact information
• Privacy Policy URL
• Redirect URL

Please note that ePA Coordinators may only register for Interoperability APIs that support prior authorization workflows. In addition, all applicants must attest that they meet certain technical requirements

For additional information, questions, or issues related to the Interoperability APIs registration, please email Cms-AppRegistration@bcbsnc.com with a description of your inquiry. The team will review your request and provide guidance or assistance as appropriate.

Find answers to common questions about the Provider Access API, including provider eligibility, treatment relationships, member data access, and compliance requirements.

The Provider Access API is a secure, standards-based interface that allows participating in-network providers to electronically access member health information maintained by Blue Cross NC. The API supports the exchange of claims, clinical, encounter, and certain prior authorization information to improve care coordination and clinical decision-making.

Only participating in-network providers that have a treatment relationship with the member are eligible to access data through the Provider Access API.

No. Under the Centers for Medicare & Medicaid Services (CMS) Interoperability and Prior Authorization Final Rule (CMS-0057-F), access to member data through the Provider Access API is limited to participating in-network providers who have a valid treatment relationship with the member. Out-of-network providers are not eligible to access member information through the Provider Access API.

A valid treatment relationship exists when a provider is actively involved in a member’s care. This includes situations where the member has previously received services from the provider or has an upcoming appointment scheduled with the provider for the first time.

As part of the Provider Access API request process, providers must attest that a valid treatment relationship exists with the member. Blue Cross NC will only share member health information through the Provider Access API when the provider has confirmed a treatment relationship and all applicable access requirements have been met.

Yes. Providers may submit Provider Access API requests for BlueCard and out-of-state members. Blue Cross NC will route the request to the member’s home plan for processing and will return the response received from the home plan to the requesting provider. This process helps facilitate access to member information across participating Blue Plans while maintaining consistent provider experience.

Blue Cross NC will make member claims, encounter, clinical, and certain prior authorization information available through the Provider Access API for dates of service from January 1, 2016, through the date of the request, consistent with CMS-0057-F interoperability requirements.

Blue Cross NC will share the following information through the Provider Access API:

• Claims and encounter data (excluding remittance information)
• Clinical data elements aligned with the U.S. Core Data for Interoperability (USCDI) Version 3 standard
• Prior authorization information, including authorization status and related details

Under the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F), members are included in the Provider Access API data exchange by default. As a result, explicit member consent is not required before information is shared with eligible in-network providers who have a valid treatment relationship with the member. However, members have the right to opt out of sharing their information through the Provider Access API at any time.

Members can manage their Provider Access API data-sharing preferences through the member portal. If a member opts out, their information will not be shared through the Provider Access API.

Providers should verify:

• Their organization is registered and approved.
• A treatment relationship exists with the member.
• The member has not opted out of data sharing.
• The API request meets all technical requirements.

If issues persist, contact the Provider Access API support team at Cms-AppRegistration@bcbsnc.com.

For additional information, questions, or issues related to the Provider Access API, please email Cms-AppRegistration@bcbsnc.com with a description of your inquiry. The team will review your request and provide guidance or assistance as appropriate.

Understand how providers can use the Prior Authorization API to identify authorization requirements, exchange information, and manage authorization requests more efficiently.

The Prior Authorization API is a secure, standards-based interface that allows a provider to query Blue Cross and Blue Shield of North Carolina’s (Blue Cross NC) system to determine whether prior authorization (PA) is required for specific medical items and services (excluding drugs), as well as to view a list of all covered items and services for which Blue Cross NC requires prior authorization. In addition, the API identifies Blue Cross NC’s documentation requirements for the items or services that require prior authorization. The API also supports the creation and exchange of prior authorization requests from providers and responses from Blue Cross NC (including whether the request was approved or denied, and a specific reason for any such denial).

The CMS 0057 Final Rule does not require impacted payers including Blue Cross NC to use the Prior Authorization API to make real-time decisions on prior authorization requests, but the automation that the API provides could improve decision timeframes. Though we anticipate that some responses or decisions may be made in real-time, other decisions will continue to necessitate review and evaluation by clinical reviewers. Blue Cross NC will make all prior authorization decisions in accordance with any timeframes required by law.

Blue Cross NC’s response to a prior authorization request indicates whether BCBSNC approves the request (and for how long) or denies the request (and the specific reason for the denial). In addition, Blue Cross NC’s may request more information from the provider to support the provider’s prior authorization request, if necessary.

Get information about how member health data is exchanged between current and previous health plans to support continuity of care and coverage transitions.

Under the Centers for Medicare & Medicaid Services (CMS) Interoperability and Prior Authorization Final Rule (CMS-0057-F), Blue Cross NC is required to request patient data only from prior payers with whom the member had coverage within the five years preceding the date of the request. Coverage that ended more than five years before the request date is not required to be included in the data exchange process.

Previous and concurrent payers may share the following information through the API:

• Claims and encounter data
• Clinical data elements aligned with the U.S. Core Data for Interoperability (USCDI) Version 3 standard
• Prior authorization information, including authorization status and related details

To request data from a prior or concurrent payer, Blue Cross NC requires the member's first name, last name, date of birth, and the complete subscriber identifier exactly as issued by the prior or concurrent payer. This information is necessary to accurately identify the member and process the data request.

Previous and/or concurrent payers may share claims, encounter, clinical, and prior authorization data with dates of service from up to five years prior to the request date, consistent with CMS interoperability requirements.

Yes. Members can access data received from previous or concurrent payers through a third-party application that is connected to Blue Cross NC and authorized by the member. Data obtained through the Payer-to-Payer API is identified with the name of the source payer, allowing members to distinguish information received from prior or concurrent payers.

No. Member data is not requested without the member’s explicit consent. Members are opted out by default and must take affirmative action to participate by logging in to the Blue Cross NC member portal and opting in to the Payer-to-Payer data exchange. Data is only requested after the member has provided the required authorization.

No. Requests for data from previous payers are typically a one-time transaction initiated in accordance with CMS interoperability requirements. Once the requested data has been received and incorporated into Blue Cross NC systems, revoking consent would not affect data that has already been obtained. Therefore, there is no revoke option for a completed data request from a previous payer.

Yes. Members may opt in or revoke their consent at any time by logging in to the Blue Cross NC member portal. Once consent is revoked, Blue Cross NC will stop requesting data from concurrent payers as permitted under applicable CMS interoperability requirements.

Yes. Data received from previous or concurrent payers becomes part of the member’s record maintained by Blue Cross NC. This information may be shared with providers to support care coordination, treatment, and healthcare operations. It may also be shared with other payers through the Payer-to-Payer API when authorized by the member and in accordance with applicable CMS interoperability requirements.

Data received through the Payer-to-Payer API is tagged with the name of the source payer that provided the information. This allows members, providers, and current or concurrent payers to clearly identify the origin of the data and distinguish information received from prior or concurrent payers.

For members with concurrent coverage from multiple payers, Blue Cross NC requests data from concurrent payers on a quarterly basis, as required under CMS interoperability regulations. These periodic exchanges help ensure that member information remains current and supports continuity of care across covered health plans.

For additional information, questions, or issues related to the Payer-to-Payer API, please email Cms-AppRegistration@bcbsnc.com with a description of your inquiry. The team will review your request and provide guidance or assistance as appropriate.