Sharing your health care data with insurers and providers

Blue Cross and Blue Shield of North Carolina (Blue Cross NC) is committed to helping you get the care you need by making it easier to securely share your health care data while protecting your privacy.

As part of federal requirements under the CMS Interoperability and Prior Authorization Final Rule (CMS‑0057‑F), we support safe, secure, and timely access to your health care data to improve care coordination, reduce administrative burden, and empower you to make informed decisions about your health.

Blue Cross NC maintains a Payer-to-Payer Application Programming Interface (API) to enable data sharing between insurers when a member changes insurers or has two or more insurers at the same time.

Blue Cross NC also maintains a Provider Access API to share member data with in-network providers with whom the member has a treatment relationship.

Blue Cross NC maintains three Prior Authorization APIs to support electronic prior authorization. These APIs allow providers to determine whether prior authorization is required, identify documentation requirements, submit and exchange prior authorization requests, and receive Blue Cross NC decisions directly through their electronic health records (EHRs) or other health IT systems.

You control whether we request your health care data from your previous insurer or exchange data with your concurrent insurer(s) through the API and can “opt in” at any time.  This means your data is not shared through the API automatically – you decide when and if API data sharing is allowed.

Opting into data sharing has several potential benefits, which could include better coordination of your care, improved completeness of your medical records if you change insurance carriers, reduction in care disruptions, improved continuity of care, better outcomes, and a better overall health care experience.  If you “opt in” to having your data shared with other insurers through the API, you can opt back out again at any time.

If you give us information about your last insurer, we will ask them for your data.  This means that you will continue to have access to those records in the same place as your new records.  If you have two or more insurers, we will exchange your data with your other insurer(s) at least every three months to ensure we can work with them to align your coverage as best as possible.

• To opt in or opt out, log in to your member portal and visit the Account Settings page, or call the Customer Service number on the back of your member ID card.
• If you have been enrolled in multiple plans with Blue Cross NC over the last five (5) years, you will need to complete the authorization process separately for each plan to request data from the other health plans.
• Even if you opt out, certain information may still be shared when required by law to support treatment, payment, or healthcare operations.

The data we exchange may include claims data (services and treatment you received), clinical data (health conditions and care details), prior authorization information, as well as sensitive information such as mental health treatment, substance use disorder treatment and HIV-related information. Your health care data is protected by privacy and security measures.  You should review our privacy policy to ensure you understand how information will be used and disclosed.

You control who has access to your health care data through the API and can decline or “opt out” of API data sharing at any time.

Allowing your health care data to be shared with your provider can help them better coordinate your care, improve prior authorization processes, ensure you receive care in a timely manner, help you achieve better outcomes, and improve your overall health care experience. Your health care data is only available to in-network providers whom we have determined to have a record of caring for you.

• To opt in or opt out, log in to your member portal and visit the Account Settings page, or call the Customer Service number on the back of your member ID card.
• If you opt out of API data sharing, existing laws, such as HIPAA or state law, may still allow your provider to request and receive certain information they need to treat you.

The data we exchange may include claims data (services and treatment you received), clinical data (health conditions and care details), prior authorization information, as well as sensitive information such as mental health treatment, substance use disorder treatment and HIV-related information.

Your health care data is protected by privacy and security measures.

Beginning January 1, 2027, the Centers for Medicare & Medicaid Services (CMS) will require insurers serving Medicare, Medicaid, and other impacted business segments to maintain three Prior Authorization APIs to support electronic prior authorization. These APIs are designed to help providers determine whether prior authorization is required through the Coverage Requirements Discovery (CRD) API, identify required prior authorization information and documentation through the Documentation Templates and Rules (DTR) API, and exchange prior authorization requests and decisions through the Prior Authorization Support (PAS) API directly from their electronic health records (EHRs), practice management systems, or other health IT systems.

This capability supplements existing channels for receiving prior authorization requests from provider offices and modernizes the process through a secure, standardized, patient- and provider-friendly approach that improves care coordination and helps reduce delays. Accordingly, Blue Cross NC, in collaboration with the Blue Cross Blue Shield Association, has extended the API implementation across all lines of business, including commercial and Federal Employees Program (FEP) coverage.

The U.S. Department of Health and Human Services’ Office for Civil Rights (OCR) enforces the HIPAA Privacy, Security and Breach Notification Rules. Blue Cross NC and other payers are subject to HIPAA, as are most health care providers, such as hospitals, doctors, clinics and dentists. You can find more information about your rights under HIPAA and who is obligated to comply with HIPAA at the U.S. Department of Health and Human Services (HHS)⁠. To learn more about filing a complaint with OCR related to HIPAA requirements, visit the HHS page on filing a claim⁠.

You may also file a complaint with Blue Cross NC by calling the Customer Service phone number on the back of your Member ID card. If your physical card is unavailable, you can find your card online through the member portal for 18 months after the coverage end date. Alternatively, if you have a Medicare Advantage plan through Blue Cross NC, you can call Customer Service at 888-310-4110 (TTY: 711), seven days a week, 8 AM to 8 PM, Eastern Standard Time. Individual Members can call Customer Service at 888-206-4697 (TTY 800-442-7028) Monday-Friday, 8 AM to 7 PM, Eastern Standard Time.