diff --git a/Gemfile b/Gemfile index f9106181..369d2e56 100644 --- a/Gemfile +++ b/Gemfile @@ -21,7 +21,7 @@ end # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem # and associated library. install_if -> { RUBY_PLATFORM =~ %r!mingw|mswin|java! } do - gem "tzinfo" + gem "tzinfo", "~> 1.2", ">= 1.2.10" gem "tzinfo-data" end diff --git a/Gemfile.lock b/Gemfile.lock index f51a2fa1..076f73c2 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -64,8 +64,9 @@ GEM ffi (~> 1.9) terminal-table (2.0.0) unicode-display_width (~> 1.1, >= 1.1.1) - tzinfo (2.0.4) - concurrent-ruby (~> 1.0) + thread_safe (0.3.6) + tzinfo (1.2.10) + thread_safe (~> 0.1) tzinfo-data (1.2022.1) tzinfo (>= 1.0.0) unicode-display_width (1.8.0) @@ -80,9 +81,9 @@ DEPENDENCIES json minima (~> 2.5.1) rexml (>= 3.2.5) - tzinfo + tzinfo (~> 1.2, >= 1.2.10) tzinfo-data wdm (~> 0.1.1) BUNDLED WITH - 2.3.18 + 2.1.4 diff --git a/_includes/_footer.html b/_includes/_footer.html index e8aeeb27..a2590a07 100644 --- a/_includes/_footer.html +++ b/_includes/_footer.html @@ -29,19 +29,23 @@
- You MUST create different client tokens for every vendor that works with the API. A single client token should not be shared with multiple vendors. + You MUST create different client tokens for every provider organization that works with the API.
- Your access token and JWT will expire every five minutes. + Your JWT must contain an expiration of five minutes.
const jsrsasign = require('jsrsasign')
const fetch = require('node-fetch')
@@ -587,31 +598,31 @@ fetch('https://sandbox.dpc.cms.gov/api/v1/Token/auth', {
# Attestation & Attribution
------------------
-Before accessing Patient data, DPC must establish that you have a valid Patient-Practitioner relationship with CMS Medicare and Medicaid Beneficiaries. This process is referred to as Attestation/Attribution in the DPC API.
+Before accessing patient data, DPC must establish that you have a valid patient-practitioner relationship with CMS Medicare and Medicaid Beneficiaries. This process is referred to as Attestation/Attribution in the DPC API.
-You will need to register Practitioners in your Organization, register Patients in your care, and attribute Patients to the Practitioners treating them. You must also keep these attributions up-to-date by submitting an attestation that testifies these relationships are valid with each submission.
+You will need to register practitioners in your organization, register patients in your care, and attribute patients to the practitioners treating them. You must also keep these attributions up-to-date by submitting an attestation that testifies these relationships are valid with each submission.
- The DPC sandbox environment does not contain any preloaded test data.
+ The DPC Sandbox Environment does not contain any preloaded test data.
-## Load Sample Data
-The DPC team has created a collection of sample Practitioner, Patient, and Group resources which can be used to get started in the sandbox environment. These Resources can be found in our public [GitHub repository](https://github.com/CMSgov/dpc-app/tree/master/src/main/resources) as JSON files. More details included in this [README](https://github.com/CMSgov/dpc-app/blob/master/src/main/resources/README.md) file.
+## Load sample data
+The DPC Team has created a collection of sample Practitioner, Patient, and Group Resources which can be used to get started in the sandbox environment. These resources can be found in our public GitHub repository as JSON files. More details included in this README file.
-**Uploading Practitioners:** We have included 4 Practitioner Resources that represent fictitious Practitioners that you can add to your Organization.
+**Uploading Practitioners:** We have included four Practitioner Resources that represent fictitious practitioners that you can add to your organization.
-**Uploading Patients:** The Beneficiary FHIR Data Server (BFD) maintains a list of 101 Patients, along with their MBIs, that can be used for matching existing synthetic data in the sandbox environment. More details and the corresponding data files can be found on the Blue Button 2.0 API’s documentation under [Sample Beneficiaries](https://bluebutton.cms.gov/developers/#sample-beneficiaries).
+**Uploading Patients:** The Beneficiary FHIR Data Server (BFD) maintains a list of 101 patients, along with their MBIs, that can be used for matching existing synthetic data in the sandbox environment. More details and the corresponding data files can be found on the Blue Button 2.0 API’s documentation under Sample Beneficiaries.
-_Users can provide their own sample FHIR resources that fulfill the required FHIR profiles to DPC, but will need to ensure that all Patient resources have a Medicare Beneficiary Identifier (MBI) that matches a record in the Beneficiary FHIR Data Server (BFD)._
+_Users can provide their own sample FHIR resources that fulfill the required FHIR profiles to DPC, but will need to ensure that all Patient Resources have a Medicare Beneficiary Identifier (MBI) that matches a record in BFD._
### Find Organization ID
-You will need your organization ID to create an Attribution Group for Attestation. The Organization endpoint supports a GET /Organization operation, which allows the user to retrieve their Organization ID.
+You will need your Organization ID to create an Attribution Group for Attestation. The Organization endpoint supports a GET /Organization operation, which allows the user to retrieve their Organization ID.
-To find your Organization ID, sign-in to your account in the DPC Portal and locate your Organization ID underneath the organization name. You can also make a request to `/Organization` via the API and retrieve your Organization ID from the response.
+To find your Organization ID, sign-in to your account in the DPC Portal and locate your Organization ID underneath the Organization name. You can also make a request to `/Organization` via the sandbox API and retrieve your Organization ID from the response.
![Dashboard Org Id](/assets/images/guide_org_id.png)
@@ -626,7 +637,7 @@ Accept: application/fhir+json
Prefer: respond-async
-#### cURL Command
+#### cURL command
curl -v https://sandbox.dpc.cms.gov/api/v1/Organization
-H 'Authorization: Bearer {access_token}'
-H 'Accept: application/fhir+json' \
@@ -675,7 +686,7 @@ Prefer: respond-async
}
-It is still possible to retrieve your organization using `/Organization/{id}`, in which case you will receive a single Resource instead of a Bundle.
+It is still possible to retrieve your organization using `/Organization/{id}`, in which case you will receive a single resource instead of a bundle.
#### Request:
@@ -688,7 +699,7 @@ Accept: application/fhir+json
Prefer: respond-async
-#### cURL Command
+#### cURL command
curl -v https://sandbox.dpc.cms.gov/api/v1/Organization/{id}
-H 'Authorization: Bearer {access_token}' \
-H 'Accept: application/fhir+json' \
@@ -735,28 +746,21 @@ Prefer: respond-async
## Practitioners
-Add a Practitioner
-Add Multiple Practitioners
-List all Practitioners
-List a specific Practitioner
+Add a practitioner
+Add multiple practitioners
+List all practitioners
+List a specific practitioner
-Every organization is required to keep a list of [Practitioner](https://dpc.cms.gov/ig/StructureDefinition-dpc-profile-practitioner.html) Resources who are authorized to have access to DPC data. The DPC Team has included four Practitioner Resources that represent fictitious Practitioners that can be added to your Organization.
+Every organization is required to keep a list of Practitioner Resources who are authorized to have access to DPC data. The DPC Team has included four Practitioner Resources that represent fictitious practitioners that can be added to your organization.
-### Prerequisites:
-- A registered account in the DPC Portal
-- Access to the API: active Bearer {access_token}
-- Practitioner information:
- - First and Last Name
- - Type 1 National Provider Identifier (NPI)
+### Add a practitioner
+To register a practitioner at your organization, you must send a FHIR-formatted Practitioner Resource as the BODY of your request. Do not use encoding (raw) when uploading via a POST request to the /Practitioner endpoint.
-### Add a Practitioner
-To register a Practitioner at your Organization, you must send a FHIR-formatted [Practitioner](https://dpc.cms.gov/ig/StructureDefinition-dpc-profile-practitioner.html) Resource as the BODY of your request. Please use no encoding (raw) when uploading via a POST request to the /Practitioner endpoint.
+The Practitioner Resource may include additional attributes detailed in the FHIR Implementation Guide within DPC Practitioner Profile, but at a minimum must include the practitioner’s:
-The Practitioner Resource may include additional attributes detailed in the FHIR Implementation Guide within [DPC Practitioner Profile](https://dpc.cms.gov/ig/StructureDefinition-dpc-profile-practitioner.html), but at a minimum must include the Practitioner’s:
-
- - First and Last Name
+ - First and last name
- Type 1 National Provider Identifier (NPI)
-
+ - Note: If an existing practitioner is found with the same NPI, the `/practitioner` endpoint will return that same practitioner and not return a new one.
#### Request:
~~~
@@ -773,12 +777,12 @@ POST /api/v1/Practitioner
-d @practitioner.json
### Add Multiple Practitioners
-The Practitioner endpoint supports a $submit operation, which allows you to upload a Bundle of resources for registration in a single batch operation.
+The Practitioner endpoint supports a $submit operation, which allows you to upload a bundle of resources for registration in a single batch operation.
-Each individual Practitioner Resource in your Bundle must satisfy the requirements on how to add a [Practitioner Resource](#add-a-practitioner), otherwise a 422-Unprocessable Entity error will be returned.
+Each individual Practitioner Resource in your bundle must satisfy the requirements on how to add a [Practitioner Resource](#add-a-practitioner); otherwise, a 422-Unprocessable Entity error will be returned.
#### Request:
@@ -797,8 +801,8 @@ POST /api/v1/Practitioner/$submit
-d @practitioner_bundle.json
-### List all Practitioners
-The Practitioner endpoint supports a GET /Practitioner operation, which allows you to retrieve a [Bundle](https://www.hl7.org/fhir/STU3/bundle.html) of Practitioner resources. You will need to retrieve a Practitioner’s NPI when you get to the Attribution section.
+### List all practitioners
+The Practitioner endpoint supports a GET /Practitioner operation, which allows you to retrieve a bundle of Practitioner Resources. You will need to retrieve a Practitioner’s NPI when you get to the Attribution section.
#### Request:
@@ -814,8 +818,8 @@ GET /api/v1/Practitioner
-H 'Content-Type: application/fhir+json' \
-X GET
-### List a specific Practitioner
-The Practitioner endpoint also supports a GET /Practitioner operation where you can supply an NPI number and receive the Practitioner resource. You will use this to identify a Practitioners’ system ID based off of an NPI when adding a Patient and/or creating a Group.
+### List a specific practitioner
+The Practitioner endpoint also supports a GET /Practitioner operation where you can supply an NPI number and receive the Practitioner Resource. You will use this to identify a Practitioners’ DPC ID based off of an NPI when adding a practitioner and/or creating a group.
#### Request:
@@ -869,34 +873,26 @@ The Practitioner endpoint also supports a GET /Practitioner operation where you
## Patients
-Add a PatientGET /api/v1/Patient?identifier={{Patient MBI}}
@@ -1091,28 +1084,23 @@ The Patient endpoint also supports a GET /Patient operation where you can supply
## Attestation
-Create an Attestation
+Create an attestation
-CMS requires Practitioners to attest that they have a treatment related purpose for adding a patient to their Group each time they make a Group addition. This is accomplished by submitting an attestation with every request. Attestations are posted as a [Provenance](https://www.hl7.org/fhir/provenance.html) Resource via the X-Provenance header, as outlined in the [FHIR specification](https://www.hl7.org/fhir/implementationguide.html).
+CMS requires practitioners to attest that they have a treatment related purpose for adding a patient to their group each time they make a group addition. This is accomplished by submitting an attestation with every request. Attestations are posted as a Provenance Resource via the X-Provenance header, as outlined in the FHIR specification.
-**Prerequisites:**
-- Access to the API: active Bearer {access_token}
-- At least one registered Practitioner
-- At least one registered Patient
-
-### Create an Attestation
-Details on Provenance resources are given in the [FHIR implementation guide](https://www.hl7.org/fhir/implementationguide.html), but at a minimum, each attestation must include:
+### Create an attestation
+Details on Provenance Resources are given in the FHIR implementation guide, but at a minimum, each attestation must include:
- **Timestamp:** Time when attestation was made.
- **Reason:** Reason for the attestation (currently only: http://hl7.org/fhir/v3/ActReason#TREAT is supported).
- **Organization ID:** The agent making the attestation referenced by their Organization Resource ID.
- - _Your Organization ID can be found by referencing the {id} variable in the resource object of your Practitioner._
+ - _Your Organization ID can be found by referencing the {id} variable in the resource object of your practitioner._
- **Practitioner ID:** The practitioner attached to the attestation referenced by their Practitioner ID.
- - _Your Practitioner ID can be found by referencing the {id} variable in the resource object of your Practitioner._
+ - _Your Practitioner ID can be found by referencing the {id} variable in the resource object of your practitioner._
-The attestation is then included in the X-Provenance header as part of any operations which add patients to the Group resource.
+The attestation is then included in the X-Provenance header as part of any operations which add patients to the Group Resource.
-### Example Attestation for X-Provenance header
+### Example attestation for X-Provenance header
~~~
{
@@ -1154,48 +1142,45 @@ The attestation is then included in the X-Provenance header as part of any opera
## Groups (Attribution)
-Create a Group- Parameter and Bundle Resources are NOT to be used when adding, updating, or overwriting Groups. + Parameter and Bundle Resources are NOT to be used when adding, updating, or overwriting groups.
- Attribution Groups must be updated every 90 days! + Attribution groups must be updated every 90 days!
POST /api/v1/Group/{Group.id}/$add
@@ -1350,8 +1335,26 @@ Additions are handled through a custom $add operation on the /Group endpoint. Th
]
~~~
-### Removing Patients from a Group
-Removals are handled through a custom remove operation on the /Group endpoint. This takes the members listed into a given resource and removes them from the existing Group.
+### Delete a group
+You may want to delete a group if you no longer require data for the patients within the group. This can be done by sending a DELETE request to the /Group endpoint using the unique ID of the group.
+
+Group IDs can be found either at creation or as the result of [locating your Group ID](#locate-your-groupid).
+
+#### Request:
+api/v1/Group?characteristic-value=attributed-to${Group.id}
+
+#### cURL command:
+curl -v https://sandbox.dpc.cms.gov/api/v1/Group?characteristic-value=attributed-to${Group ID} \
+ -H 'Authorization: Bearer {access_token}' \
+ -H 'Accept: application/json' \
+ -H 'Content-Type: application/json' \
+ -X DELETE
+
+### Reponse:
+200 - Group was removed
+
+### Removing patients from a group
+Removals are handled through a custom remove operation on the /Group endpoint. This takes the members listed into a given resource and removes them from the existing group.
Content-Location: https://sandbox.dpc.cms.gov/api/v1/Jobs/{unique ID of export job}
-## Specify which Resources to Download
-The _type query parameter allows you to specify which FHIR resources you wish to export. If you do not specify a _type parameter in your request, all three resources will be exported. Currently, DPC makes Explanation of Benefit, Patient, and Coverage resources available, which can be specified individually or as a group using a comma delimited list and the syntax `?_type=ExplanationOfBenefit,Patient,Coverage`.
+## Specify which resources to download
+The _type query parameter allows you to specify which FHIR resources you wish to export. If you do not specify a _type parameter in your request, all three resources will be exported. Currently, DPC makes Explanation of Benefit, Patient, and Coverage Resources available, which can be specified individually or as a group using a comma delimited list and the syntax `?_type=ExplanationOfBenefit,Patient,Coverage`.
-The following request will export the Patient and Coverage esources, but NOT the Explanation of Benefit Resource.
+The following request will export the Patient and Coverage Resources, but NOT the Explanation of Benefit Resource.
### Request:
GET /api/v1/Group/{attribution group ID}/$export?_type=Patient,Coverage
-The following request, by contrast, will export the Explanation of Benefit resource, but NOT the Patient or Coverage resources.
+The following request, by contrast, will export the Explanation of Benefit Resource, but NOT the Patient or Coverage Resources.
### Request:
GET /api/v1/Group/{attribution group ID}/$export?_type=ExplanationOfBenefit
@@ -1624,21 +1622,21 @@ You can filter data using the _since parameter with either the /Patient or /Grou
**You can make two types of filtered requests for data:**
-1. Request the most recent data for all beneficiaries: [Use _since within the /Group endpoint](#requesting-data-using-_since-with-the-group-endpoint)
-2. Request data synchronously for an individual patient: [Use _since within the /Patient endpoint](#requesting-data-using-_since-with-the-patient-endpoint)
+1. Request the most recent data for all beneficiaries: [Use _since within the /Group endpoint](#requesting-data-using-_since-with-the-group-endpoint).
+2. Request data synchronously for an individual patient: [Use _since within the /Patient endpoint](#requesting-data-using-_since-with-the-patient-endpoint).
### Steps
Each request will follow the same four-step process as an unfiltered request:
-1. Obtain an access token
-2. Start a job to acquire data (you will input the _since parameter here)
-3. Check the job status
-4. Download the data
+1. Obtain an access token.
+2. Start a job to acquire data (you will input the _since parameter here).
+3. Check the job status.
+4. Download the data.
-The only difference appears in the request of Step 2: Start a job to acquire data. We show examples of this step below.
+The only difference appears in the request of step 2: "start a job to acquire data". We show examples of this step below.
-**Dates and times submitted in _since must be listed in the FHIR [Instant](https://www.hl7.org/fhir/datatypes.html#instant) format** (YYYY-MM-DDThh:mm:sss[-/+]zz:zz).
+**Dates and times submitted in _since must be listed in the FHIR Instant format** (YYYY-MM-DDThh:mm:sss[-/+]zz:zz).
* Sample Date: February 20, 2020 12:00 PM EST
* Instant Format: YYYY-MM-DDThh:mm:sss[-/+]zz:zz
@@ -1655,45 +1653,45 @@ The only difference appears in the request of Step 2: Start a job to acquire dat
- Due to limitations in the Beneficiary FHIR Data (BFD) Server, data from before 02-12-2020 is marked with the arbitrary lastUpdated date of 01-01-2020. If you input dates between 01-01-2020 and 02-11-2020 in the _since parameter, you will receive all historical data for your beneficiaries. Data loads from 02-12-2020 onwards have been marked with accurate dates. + Due to limitations in the Beneficiary FHIR Data (BFD) Server, data from before 02-12-2020 is marked with the arbitrary lastUpdated date of 01-01-2020. If you input dates between 01-01-2020 and 02-11-2020 in the _since parameter, you will receive all historical data for your beneficiaries. Data loads from 02-12-2020 onwards have been marked with accurate dates.
GET /api/v1/Group/{id}/$export?_type=Patient&_since=2020-02-13T08:00:00.000-05:00
-#### Request Headers:
+#### Request headers:
Authorization: Bearer {access_token}
Accept: application/fhir+json
Prefer: respond-async
-#### cURL Command using the _since parameter within the /Group endpoint:
+#### cURL command using the _since parameter within the /Group endpoint:
curl -X GET 'https://sandbox.dpc.cms.gov/api/v1/Group/{id}/$export?_since=2021-05-13T08:00:00.000-05:00' \
-H "Accept: application/fhir+json" \
-H "Prefer: respond-async" \
-H "Authorization: Bearer {access token}
-#### Response Example: Successful Request
+#### Response example: successful request
202 Accepted
-This operation will start a job for filtered data for existing beneficiaries since 8PM EST on May 13th, 2021 and will include all 7 years of historical data for all patients in the Group who have a `lastUpdated` date that falls after the `_since` date. In the example, we request the Patient resource type. The steps and format would work similarly for other resource types.
+This operation will start a job for filtered data for existing beneficiaries since 8PM EST on May 13th, 2021 and will include all seven years of historical data for all patients in the Group who have a `lastUpdated` date that falls after the `_since` date. In the example, we request the Patient Resource Type. The steps and format would work similarly for other resource types.
GET /api/v1/Patient/{id}/$everything?_since=2020-02-13T08:00:00.000-05:00
-#### Request Headers:
+#### Request headers:
Authorization: Bearer {access_token}
Accept: application/fhir+json
X-Provenance: {provenance header}
-#### cURL Command using the _since parameter within the /Patient endpoint:
+#### cURL command using the _since parameter within the /Patient endpoint:
curl -X GET 'https://sandbox.dpc.cms.gov/api/v1/Patient/{id}/$everything?_since=2021-05-13T08:00:00.000-05:00' \
-H "Accept: application/fhir+json" \
-H "X-Provenance: {provenance header}" \
-H "Authorization: Bearer {access token}"
-#### Response Example: Successful Request
+#### Response example: successful request
200 Success
-This operation will return all data for the specified Patient since the selected date: May 13, 2021. Notice that we are seeking data from the /Patient/{id}/$everything endpoint. This is a synchronous request for an individual Patient referenced by the internal ID (UUID) and would behave differently if it was made from the /Group endpoint as data is returned immediately.
+This operation will return all data for the specified patient since the selected date: May 13, 2021. Notice that we are seeking data from the /Patient/{id}/$everything endpoint. This is a synchronous request for an individual patient referenced by the internal ID (UUID) and would behave differently if it was made from the /Group endpoint as data is returned immediately.
GET /api/v1/Patient/{id}/$everything
-**cURL Command**
+**cURL command**
curl -v https://sandbox.dpc.cms.gov/api/v1/Patient/{id}/$everything
-H 'Authorization: Bearer {access_token}' \
diff --git a/common/docsV2.md b/common/docsV2.md
index ccd95fd0..e0aa3431 100644
--- a/common/docsV2.md
+++ b/common/docsV2.md
@@ -2,7 +2,7 @@
layout: page-sidenav
title: DPC Documentation
banner_title: Documentation
-permalink: /docsV2
+permalink: /docsV2.html
id: docsV2
button: Sign Up for Sandbox
button_url: https://sandbox.dpc.cms.gov/users/sign_in
diff --git a/common/faq.html b/common/faq.html
index 7c860815..571d185b 100644
--- a/common/faq.html
+++ b/common/faq.html
@@ -3,7 +3,7 @@
title: Frequently asked questions
banner_title: Frequently asked questions
description: Frequently asked questions about the Data at the Point of Care pilot
-permalink: /faq
+permalink: /faq.html
id: faq
button: DPC Google Group
button_url: "https://groups.google.com/d/forum/dpc-api"
@@ -257,4 +257,18 @@
Good news: our sandbox environment matches the production environment, and we'll roll out new functionality in sandbox before sending it into production. Even if you are not able to participate in the production pilot at this juncture, please continue to test in the sandbox environment with synthetic data. Your feedback through the Google Group is invaluable to our researchers and engineers as we all work together to shape the future of DPC.
+
+
+
+
+
+ Yes, you can inherit AWS’ HITRUST certification if your DPC solution meets the following requirements:
+
+ - The DPC solution is contained entirely within AWS Services that have received a HITRUST certification. See AWS' list of HITRUST-certified services under HITRUST CSF.
+ - The DPC solution applies the controls listed on the HITRUST website. You should download the AWS Custom HITRUST Shared Responsibility Matrix to determine which HITRUST controls AWS customers can inherit as part of the Shared Responsibility Model.
+ - You submit a valid and accepted External Inheritance request through the HITRUST website. Follow the instructions in the User Guide to do so.
+
+
- Please do not plan to fill out the application unless your organization has tested your solution in sandbox and is able to share security documentation with CMS. + Please do not fill out the application unless your organization has tested your solution in sandbox and is able to share security documentation with CMS.