Accessing Beneficiary Data

Sandbox Environment

The sandbox environment allows you to test and develop your applications using mock data. Here's how to get access

1. Complete the Medicaid Connect registration process.
2. Fill out the developer questionnaire to help us understand your needs and use cases.
3. We will review your questionnaire, and upon approval provide access to the sandbox environment.
4. Access our developer documentation and tools to better understand how to interact with the Patient Access APIs.

Production Environment

1. Once you have thoroughly tested your application in the sandbox environment, you can apply for access to the production environment
2. Ensure your application complies with NC Medicaid security and privacy standards.
3. Submit your application for review.
4. Once approved, you'll receive credentials to access the production APIs.

Best Practices

1. Understand your Users and their Experience

If your application is using the Patient Access API, your user is most likely going to be the patient (or beneficiary) themselves. Patients may want access to use your mobile app for any number of reasons; to better track their health, understand and manage medical conditions, coordinate their care, or even receive care through a service such as telehealth. Your application should be intuitive, with a clean and easily navigable interface. You should use familiar or standard iconography, and simple easily understood language. Some of the best apps help take complicated medical concepts and break them down in simple language for users. You should focus on accessibility, as users of your app may suffer from a disability that impairs their ability to use the user interface. Consider reviewing the Web Content Accessibility Guidelines as a guide to designing an app for everyone.

2. Establish a Privacy Policy and Terms of Service

3. Prioritize Security

4. Identify and Comply with any Regulations

Even though when a beneficiary accesses their own data using a third-party app HIPAA protections do not apply, that does not mean that other features of your app aren’t covered by HIPAA, or that your app isn’t subject to other regulations. By virtue of storing health data, your organization is still subject to the FTC’s Health Breach Notification Rule. Depending on how and where your app operates, several laws could apply, the most common of which are the California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR), and the Payment Card Industry Data Security Standard (PCI DSS).

5. Follow Good Engineering Practices

Using good engineering practices and writing well-structured and documented code will ensure that your app can be maintained well into the future. The 12-factor app provides a good outline of common engineering principles. Code should be well tested, using a variety of testing techniques (unit, end-to-end, integration, user acceptance, etc.). Automating test cases using Continuous Integration tools, and integrating tools for automatic code formatting and code coverage will ensure your app is functioning as expected as you build and maintain it.

6. Stay up to date with Industry Trends

Healthcare Information Technology (IT) is constantly evolving; the federal government continues to push for increased interoperability between providers, and access for patients. By staying up to date on the latest developments, you can keep your app, or any future apps, current by integrating new features and data, and benefiting from the latest industry advances. Pay attention to the activities of the Office of the National Coordinator for Health IT (ONC), and Center for Medicare and Medicaid Services (CMS); these agencies drive much of the United State’s Health IT policy.

Frequently Asked Questions