⚖️ Learn how MedicalEase finds the providers personal injury clients forget to mention →

For companies

One patient access API for apps and agents.

A patient access API lets an app retrieve health records with the patient's authorization. Flexpa provides a FHIR R4 API for records returned by supported insurers, medical record systems, and national exchange sources. Flexpa Consent handles source sign-in or, for the exchange route, identity verification. Your app obtains a patient access token to query the records; an agent can use that token with Flexpa's records MCP server.

Updated 2026-11-11

How it works

  1. Flexpa Consent
    patient authorizes supported sources
  2. Token exchange
    obtain a patient access token
  3. Records access
    query FHIR or records MCP
  4. Your product
    use returned records
Patient records require a patient access token. An application access token does not grant access to records through the MCP server.

Three sources, one API

Health insurers
Claims, coverage, and plan-held clinical data through patient access APIs required by CMS-9115-F.
Medical record systems
Clinical records from EHRs through ONC (g)(10) APIs.
Nationwide exchange
Record location across participating facilities through TEFCA Individual Access Services, with IAL2 identity proofing.

How it works

Integration

  1. 1Launch Flexpa Consent from your app. The patient picks their sources and authorizes access.
  2. 2Exchange the result for a patient access token.
  3. 3Query the Flexpa FHIR R4 API for claims, coverage, and clinical resources.
  4. 4For agents, connect to https://api.flexpa.com/mcp/consent with the same patient access token.

Data you can retrieve

Supported resource types include Coverage and ExplanationOfBenefit for payer data, and clinical resources such as Condition, DiagnosticReport, DocumentReference, Immunization, MedicationRequest, and Observation. Availability depends on the connected source; support for a resource type does not mean every patient has that data.

Payer data covered by CMS-9115-F reaches back to January 1, 2016 or the start of the member's enrollment, whichever is more recent.

Try it

Run the interactive demo to launch a real Flexpa Consent session against sandbox sources, then use Test Mode and the quickstart to build against sample data before going live.

Questions

What is a patient access API?

A patient access API lets patients authorize an app to retrieve their health records electronically. Flexpa connects supported health plan and provider APIs and national exchange sources, then returns available records through its FHIR R4 API.

How does Flexpa authorize access to patient data?

Patients authorize through Flexpa Consent using source sign-in or identity verification for the national exchange. Your app then obtains a patient access token. Flexpa's FHIR API uses that token to authorize patient-specific record requests.

What format is the data in?

Flexpa returns FHIR R4 resources, including CARIN Blue Button resources for claims and US Core clinical resources. The available record types and fields depend on the source.

Can AI agents use it?

Flexpa's records MCP server at https://api.flexpa.com/mcp/consent uses the same patient access tokens as the FHIR API. An application access token does not grant access to patient records through that server.

How do I get started?

Complete the interactive demo at flexpa.com/demo, then follow Flexpa's Quickstart documentation and use Test Mode with sample data before connecting real patient records.

More

See it with real flows. Run the demo.

Launch a Flexpa Consent session against sandbox sources and see the FHIR records it returns.

Try the interactive demo