Production Access

Only active, stand-alone Prescription Drug Plan (PDP) sponsors can access enrollee claims data in the production environment. Before accessing production claims data, make sure you’ve followed the steps listed in API Documentation.

1. Attest to AB2D data protocols

   Completed by Attestor

   A current CEO, CFO, or COO (“Attestor”) from your organization first needs to agree (“attest") to our Claims Data Usage Protocols. These protocols include legal limitations on data use and disclosure.

   Log in to the Health Plan Management System (HPMS) and select Claims Data Attestation (under Contract Management). We encourage you to have multiple Attestors. This prevents gaps in access if Attestors leave the organization.

   How do I complete attestation?

   Once you log in to the HPMS and select Claims Data Attestation (under Contract Management):

   1. Choose single, multiple, or all contracts in the Contracts Without Attestation window.
   2. Select Attest.
   3. Agree to the Claims Data Usage Protocols.

   To add multiple Attestors, follow the same steps and select Re-attest during step 2.

   What are the requirements to be an Attestor?

   • Be part of an active, stand-alone PDP organization (PACE and MAPD are ineligible)
   • Hold a current CEO, CFO, or COO role within the organization
   • Attest to each contract that will connect to AB2D

   How does attestation affect your claims data?

   • PDP sponsors can retrieve claims data for their active plan enrollees from the date of attestation onwards. Claims data prior to their attestation date will not be provided.
   • PDP sponsors must have an active Attestor at all times. Your organization will not be able to receive data during periods without an active Attestor. Access to data will only be restored once another active CEO, CFO, or COO attests.

   When does attestation take effect?

   Once an organization attests, it must complete all the remaining steps for production access. This includes choosing a technical point of contact, testing synthetic data in the sandbox, and receiving production credentials. Once these steps are complete, the organization will have access to claims data starting from the attestation date. Claims data previous to that date will not be available.

2. Choose an AB2D Data Operations Specialist

   Completed by Attestor

   Once attestation is complete, the Attestor will receive an email with instructions on how to assign an AB2D Data Operations Specialist (ADOS). This is a primary technical point of contact for your organization.

   What are the requirements to be an ADOS?

   • Employee or vendor with authority to access and view your organization’s enrollee data
   • Expertise to connect to and retrieve data from the sandbox and production environments
   • Ability to provide static IP address(es) and/or CIDR ranges for every system accessing the API

3. Retrieve sandbox data

   Completed by AB2D Data Ops Specialist

   Verify sandbox data retrieval

   The ADOS will receive an email with instructions on next steps. They must send the AB2D team the job ID from a successful data export in the sandbox. The sandbox is a test environment that allows anyone to try the API and retrieve synthetic claims data. Learn how to get a bearer token and access sandbox data.

   Provide your IP addresses

   Your organization must provide the AB2D team with the public, static IP address(es) of every system that will use the API. These will be reviewed, approved, and allowlisted as an additional layer of security.

4. Get production credentials

   Completed by Attestor and Completed by AB2D Data Ops Specialist

   The Attestor will receive an email with details on their organization's production credentials. Credentials allow the organization and ADOS to get a bearer token and access production claims data.

   Production claims data contains Personally Identifiable Information (PII) that should not be shared under any circumstances. If you have questions or need help, visit Support or contact the AB2D team at ab2d@cms.hhs.gov.