HealthBridge API — Secure Clinical Data Exchange

Compliance & Certifications

HealthBridge maintains HIPAA/HITECH compliance across all API endpoints. Protected health information (PHI) is encrypted using TLS 1.3 with AES-256-GCM in transit and AES-256 at rest. All API access is logged and auditable per 45 CFR § 164.312 requirements.

HIPAA / HITECH

SOC 2 Type II

HITRUST CSF v11

HL7 FHIR R4

CMS Interoperability Final Rule

Authentication

All API requests require OAuth 2.0 bearer tokens issued via the SMART on FHIR authorization framework. Tokens are scoped to specific FHIR resources and patient populations per your organization's Business Associate Agreement (BAA).

Production access requires an executed BAA. Contact your account manager to initiate the BAA process. Sandbox environments are available for development and testing without a BAA.

                Authorization Request
            

# Request an access token using client credentials
curl -X POST https://auth.healthbridgeapi.io/oauth2/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=client_credentials" \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "scope=patient/*.read observation/*.read claim/*.read"
            

Core Endpoints

The HealthBridge API exposes FHIR R4 resources for clinical data exchange, claims adjudication, eligibility verification, and formulary access. All endpoints accept and return application/fhir+json.

GET /fhir/r4/Patient/{id} Retrieve patient demographics

GET /fhir/r4/ExplanationOfBenefit Retrieve explanation of benefits (EOB) records

POST /fhir/r4/Claim Submit a healthcare claim for adjudication

GET /fhir/r4/Coverage/{id} Retrieve health plan coverage details

POST /fhir/r4/CoverageEligibilityRequest Submit real-time eligibility verification (270/271)

GET /fhir/r4/MedicationKnowledge Query formulary and drug tier information

POST /fhir/r4/ClaimResponse Receive claim adjudication results (835)

GET /fhir/r4/Observation Retrieve clinical observations and lab results

POST /fhir/r4/PriorAuthRequest Submit prior authorization (X12 278)

GET /fhir/r4/Practitioner/{npi} Provider directory lookup by NPI

Example Response

All responses conform to the HL7 FHIR R4 specification. Below is a sample ExplanationOfBenefit resource returned for a processed medical claim.

                GET /fhir/r4/ExplanationOfBenefit/eob-12345
            

{
  "resourceType": "ExplanationOfBenefit",
  "id": "eob-12345",
  "status": "active",
  "type": {
    "coding": [{
      "system": "http://terminology.hl7.org/CodeSystem/claim-type",
      "code": "professional"
    }]
  },
  "use": "claim",
  "patient": { "reference": "Patient/pat-67890" },
  "created": "2026-06-15",
  "insurer": {
    "display": "HealthBridge Partner Plan"
  },
  "provider": {
    "reference": "Practitioner/1234567890"
  },
  "diagnosis": [{
    "diagnosisCodeableConcept": {
      "coding": [{
        "system": "http://hl7.org/fhir/sid/icd-10-cm",
        "code": "M54.5",
        "display": "Low back pain"
      }]
    }
  }],
  "total": [{
    "category": { "text": "Submitted Amount" },
    "amount": { "value": 285.00, "currency": "USD" }
  }]
}
            

Rate Limits & Data Residency

Production API calls are rate-limited to 1,000 requests per minute per client credential. PHI data is stored exclusively in HITRUST-certified data centers located within the continental United States. Cross-border data transfers of protected health information are not supported per HIPAA regulatory requirements.

Bulk data export for population health analytics is available via the FHIR Bulk Data Access (Flat FHIR) specification. Bulk exports are processed asynchronously and delivered as NDJSON files to your designated SFTP endpoint.

Sandbox & Testing

A synthetic data sandbox is available at sandbox.healthbridgeapi.io with pre-populated FHIR resources for development testing. Synthetic patient data includes realistic clinical narratives, ICD-10/CPT coding, and claims adjudication workflows. No BAA is required for sandbox access.