{"resourceType":"CapabilityStatement","id":"UPMC-HP-Capability-Statement","url":"https://apis.upmchp.com/fhir/R4/metadata","name":"UPMC-Health-Plan-FHIR-Capability-Statement","title":"UPMC Health Plan FHIR Capability Statement","status":"active","date":"2026-04-05T14:22:57.9320267+00:00","publisher":"UPMC Health Plan Insurance Services Division","contact":[{"name":"Health Plan IT Web Solutions FHIR","telecom":[{"system":"email","value":"HealthPlanITWebSolutionsFHIR@upmc.edu","use":"work"}]}],"description":"# Public Documentation and Developer Portal
https://www.upmchealthplan.com/interop/
# Bulk Data API Implementation
The data exposed through the bulk data API is done so through a bulk data export process ([official implementation guide documentation](http://hl7.org/fhir/uv/bulkdata/STU1.0.1/)). The official documentation is designed around large files being generated on the at the time of the request, but our files are pre-generated and updated daily. For this reason, the kick-off request can be ignored entirely if you so choose and you are strictly looking for the location of the generated bulk data files--in which case, all the needs to be called is the Status endpoint. The bulk data implementation uses FHIR groups to group the data into logical collections of files. The following data is exposed only through the bulk data API with the corresponding group ids:
• Provider Directory API (Group Id: ProviderDirectory)
• RX Formulary data from the Patient Access API (Group Id: RxFormulary)
## Bulk Data API Security
The bulk data API implementation is a completely public bulk data API with no restrictions or protections whatsoever, as everything it exposes is publicly available information.
# Patient Access API
**The Patient Access API is an API the provides all of the data UPMC Health Plan has on its members in a FHIR format (see supported implementation guide's for more information). More specifically, it provides access to the following:**
• Claims
• Member demographics, eligibility, and coverage information
• *Limited* clinical data maintained by UPMC Health Plan's Insurance Services Division. The data is limited by a specific list of patients provided by the UPMC Health Plan HEDIS team who have gaps in care, and the data is also limited to quality measures specified by NCQA (National Committee for QA) for a particular year. **Due to these limitations, UPMC Health Plan's FHIR server should not be accounted on as a reliable source of clinical data.**
• RX Formulary (RX Drug cost information including copay amounts, for each drug tier, and coverage plan)
### RX Formulary API
The only exception to this is the RX Formulary data, which is publicly available and does not require authorization. The RX Formulary data is being exposed through the server's bulk data API, with the group id of \"RxFormulary\".
## Patient Access API Security
Data within the Patient Access API contains HIPAA compliant, protected health information and can only be accessed by a third-party application (which has been approved by UPMC Health Plan) that is fulfilling a valid request on behalf of a UPMC Health Plan member, and only for that member's personal data.
### SMART on FHIR
The PHI data accessible through the Patient Access API is protected via the [SMART App Launch Framework](http://www.hl7.org/fhir/smart-app-launch/). This server supports a standalone launch sequence. In the first step of the sequence, where the app is asking for authorization, the expected scope parameters are as follows:
• launch/patient
• patient/*.read
• openid
• fhirUser
• offline_access
A third party application must fill-out and be approved through our official registration process, which can be found at https://www.upmchealthplan.com/interop/.
# Provider Directory API
The Provider Directory data is being exposed through the server's bulk data API, with the group id of \"ProviderDirectory\".","jurisdiction":[{"coding":[{"system":"urn:iso:std:iso:3166","code":"USA"}]}],"copyright":"Copyright © UPMC Health Plan, Inc.","kind":"instance","implementation":{"description":"# Public Documentation and Developer Portal
https://www.upmchealthplan.com/interop/
# Bulk Data API Implementation
The data exposed through the bulk data API is done so through a bulk data export process ([official implementation guide documentation](http://hl7.org/fhir/uv/bulkdata/STU1.0.1/)). The official documentation is designed around large files being generated on the at the time of the request, but our files are pre-generated and updated daily. For this reason, the kick-off request can be ignored entirely if you so choose and you are strictly looking for the location of the generated bulk data files--in which case, all the needs to be called is the Status endpoint. The bulk data implementation uses FHIR groups to group the data into logical collections of files. The following data is exposed only through the bulk data API with the corresponding group ids:
• Provider Directory API (Group Id: ProviderDirectory)
• RX Formulary data from the Patient Access API (Group Id: RxFormulary)
## Bulk Data API Security
The bulk data API implementation is a completely public bulk data API with no restrictions or protections whatsoever, as everything it exposes is publicly available information.
# Patient Access API
**The Patient Access API is an API the provides all of the data UPMC Health Plan has on its members in a FHIR format (see supported implementation guide's for more information). More specifically, it provides access to the following:**
• Claims
• Member demographics, eligibility, and coverage information
• *Limited* clinical data maintained by UPMC Health Plan's Insurance Services Division. The data is limited by a specific list of patients provided by the UPMC Health Plan HEDIS team who have gaps in care, and the data is also limited to quality measures specified by NCQA (National Committee for QA) for a particular year. **Due to these limitations, UPMC Health Plan's FHIR server should not be accounted on as a reliable source of clinical data.**
• RX Formulary (RX Drug cost information including copay amounts, for each drug tier, and coverage plan)
### RX Formulary API
The only exception to this is the RX Formulary data, which is publicly available and does not require authorization. The RX Formulary data is being exposed through the server's bulk data API, with the group id of \"RxFormulary\".
## Patient Access API Security
Data within the Patient Access API contains HIPAA compliant, protected health information and can only be accessed by a third-party application (which has been approved by UPMC Health Plan) that is fulfilling a valid request on behalf of a UPMC Health Plan member, and only for that member's personal data.
### SMART on FHIR
The PHI data accessible through the Patient Access API is protected via the [SMART App Launch Framework](http://www.hl7.org/fhir/smart-app-launch/). This server supports a standalone launch sequence. In the first step of the sequence, where the app is asking for authorization, the expected scope parameters are as follows:
• launch/patient
• patient/*.read
• openid
• fhirUser
• offline_access
A third party application must fill-out and be approved through our official registration process, which can be found at https://www.upmchealthplan.com/interop/.
# Provider Directory API
The Provider Directory data is being exposed through the server's bulk data API, with the group id of \"ProviderDirectory\".","url":"https://apis.upmchp.com/fhir/R4/","custodian":{"reference":"Organization/1","display":"UPMC Health Plan"}},"fhirVersion":"4.0.1","format":["xml","json"],"implementationGuide":["https://hl7.org/fhir/us/carin-bb/STU1/","https://hl7.org/fhir/us/davinci-drug-formulary/STU1.1/","https://www.hl7.org/fhir/us/davinci-pdex-plan-net/STU1/index.html","https://www.hl7.org/fhir/uv/bulkdata/STU1.0.1/"],"rest":[{"mode":"server","security":{"extension":[{"extension":[{"url":"token","valueUri":"https://apis.upmchp.com/fhir/oauth2/v2.0/token"},{"url":"authorize","valueUri":"https://apis.upmchp.com/fhir/oauth2/v2.0/authorize"},{"url":"revoke","valueUri":"https://apis.upmchp.com/fhir/oauth2/v2.0/revoke"}],"url":"https://www.hl7.org/fhir/R4/extension-oauth-uris.html"}],"service":[{"coding":[{"system":"https://www.hl7.org/fhir/codesystem-restful-security-service.html","code":"SMART-on-FHIR"}],"text":"OAuth2 using SMART-on-FHIR profile (see http://docs.smarthealthit.org/)."}]},"resource":[{"type":"Patient","profile":"http://hl7.org/fhir/StructureDefinition/Patient","supportedProfile":["http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Patient|1.0.0"],"interaction":[{"code":"read"},{"code":"search-type"}],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"}]},{"type":"ExplanationOfBenefit","profile":"http://hl7.org/fhir/StructureDefinition/ExplanationOfBenefit","supportedProfile":["http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-ExplanationOfBenefit-Inpatient-Institutional|1.0.0","http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-ExplanationOfBenefit-Outpatient-Institutional|1.0.0","http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-ExplanationOfBenefit-Pharmacy|1.0.0","http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-ExplanationOfBenefit-Professional-NonClinician|1.0.0"],"interaction":[{"code":"read"},{"code":"search-type"}],"searchInclude":["*","patient","provider","care-team","coverage","insurer","payee"],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"},{"name":"patient","type":"reference"},{"name":"identifier","type":"token"},{"name":"service-date","type":"date"},{"name":"type","type":"token"}]},{"type":"Coverage","profile":"http://hl7.org/fhir/StructureDefinition/Coverage","supportedProfile":["http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Coverage|1.0.0"],"interaction":[{"code":"read"},{"code":"search-type"}],"searchInclude":["payor","*"],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"}]},{"type":"Organization","profile":"http://hl7.org/fhir/StructureDefinition/Organization","supportedProfile":["http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Organization|1.0.0"],"interaction":[{"code":"read"},{"code":"search-type"}],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"}]},{"type":"Practitioner","profile":"http://hl7.org/fhir/StructureDefinition/Practitioner","supportedProfile":["http://hl7.org/fhir/us/carin-bb/StructureDefinition/C4BB-Practitioner|1.0.0"],"interaction":[{"code":"read"},{"code":"search-type"}],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"}]},{"type":"Procedure","profile":"http://hl7.org/fhir/StructureDefinition/Procedure","supportedProfile":["http://hl7.org/fhir/us/core/StructureDefinition/us-core-procedure|4.0.0"],"interaction":[{"code":"read"}],"searchParam":[{"name":"_id","type":"token"},{"name":"_lastUpdated","type":"date"},{"name":"status","type":"token"},{"name":"date","type":"date"},{"name":"patient","type":"token"},{"name":"code","type":"token"}]},{"type":"Group","profile":"http://hl7.org/fhir/StructureDefinition/groupdefinition","interaction":[{"code":"read"}],"operation":[{"extension":[{"url":"http://hl7.org/fhir/StructureDefinition/capabilitystatement-expectation","valueCode":"SHOULD"}],"name":"group-export","definition":"http://hl7.org/fhir/uv/bulkdata/OperationDefinition/group-export"}]}]}]}