# Patient Access API for Health Apps and AI Agents

A patient access API lets an app retrieve health records with the patient's authorization. Flexpa provides a FHIR R4 API for records returned by supported insurers, medical record systems, and national exchange sources. Flexpa Consent handles source sign-in or, for the exchange route, identity verification. Your app obtains a patient access token to query the records; an agent can use that token with Flexpa's records MCP server.

How it works: Flexpa Consent -> Token exchange -> Records access -> Your product. Patient records require a patient access token. An application access token does not grant access to records through the MCP server.

## Three sources, one API

- **Health insurers:** Claims, coverage, and plan-held clinical data through patient access APIs required by CMS-9115-F.
- **Medical record systems:** Clinical records from EHRs through ONC (g)(10) APIs.
- **Nationwide exchange:** Record location across participating facilities through TEFCA Individual Access Services, with IAL2 identity proofing.

## How it works

### Integration

1. Launch Flexpa Consent from your app. The patient picks their sources and authorizes access.
2. Exchange the result for a patient access token.
3. Query the Flexpa FHIR R4 API for claims, coverage, and clinical resources.
4. For agents, connect to https://api.flexpa.com/mcp/consent with the same patient access token.

## Data you can retrieve

Supported resource types include Coverage and ExplanationOfBenefit for payer data, and clinical resources such as Condition, DiagnosticReport, DocumentReference, Immunization, MedicationRequest, and Observation. Availability depends on the connected source; support for a resource type does not mean every patient has that data.

Payer data covered by CMS-9115-F reaches back to January 1, 2016 or the start of the member's enrollment, whichever is more recent.

## Try it

Run the interactive demo to launch a real Flexpa Consent session against sandbox sources, then use Test Mode and the quickstart to build against sample data before going live.

## Questions

**What is a patient access API?** A patient access API lets patients authorize an app to retrieve their health records electronically. Flexpa connects supported health plan and provider APIs and national exchange sources, then returns available records through its FHIR R4 API.

**How does Flexpa authorize access to patient data?** Patients authorize through Flexpa Consent using source sign-in or identity verification for the national exchange. Your app then obtains a patient access token. Flexpa's FHIR API uses that token to authorize patient-specific record requests.

**What format is the data in?** Flexpa returns FHIR R4 resources, including CARIN Blue Button resources for claims and US Core clinical resources. The available record types and fields depend on the source.

**Can AI agents use it?** Flexpa's records MCP server at https://api.flexpa.com/mcp/consent uses the same patient access tokens as the FHIR API. An application access token does not grant access to patient records through that server.

**How do I get started?** Complete the interactive demo at flexpa.com/demo, then follow Flexpa's Quickstart documentation and use Test Mode with sample data before connecting real patient records.

## More

- [Quickstart (docs)](https://www.flexpa.com/docs/guides/quickstart)
- [FHIR API reference (docs)](https://www.flexpa.com/docs/records)
- [Health records for agents (docs)](https://www.flexpa.com/docs/guides/agents)
- [Test Mode (docs)](https://www.flexpa.com/docs/test-mode)
- [Pricing](https://www.flexpa.com/pricing)

Last updated 2026-11-11.