When Flexpa published its November 2025 State of the Payer Patient Access API Report, the results were quietly stunning.
Out of 493 payers evaluated across the United States, the second-highest score went to VillageCareMAX, a community-focused health plan serving New York, with a Core Implementation score of 91 out of 100, trailing only CMS itself at 92.
This isn't a participation trophy. Flexpa's evaluation is one of the most rigorous real-world tests of payer API performance in the industry, measuring not just technical compliance but actual usability — how well a patient or developer can connect, authenticate, and retrieve data in practice.
Why This Result Matters
Most people outside of healthcare IT have never heard of the Patient Access API. But it's quietly becoming one of the most important infrastructure pieces in American healthcare.
Under CMS-9115-F, payers are required to give patients access to their own health data (claims, coverage, clinical records) through standardized FHIR APIs that work with third-party apps. The idea is simple: your health data should be as portable as your bank statement.
The reality has been messier. Flexpa's data tells the story: over 428,000 patient authorization attempts tracked, 100+ million FHIR resources synced, and a wide spectrum of implementation quality across the industry. Many large national plans are still struggling with the basics. VillageCareMAX isn't.
What Flexpa Actually Tests
Flexpa's scoring goes beyond checkbox compliance. Their Core Implementation score (100 points) covers FHIR R4 standards adherence, SMART on FHIR/OAuth 2.0 authentication, essential data resources, and API stability. Their Beyond Compliance score (40 additional points) tests data completeness, documentation clarity, error handling, response speed, and real end-user experience.
This distinction matters. A payer can technically "comply" with CMS requirements while still delivering an API that frustrates developers and fails patients at the moment of authentication. Flexpa measures what actually happens in production.
VillageCareMAX scores well on both dimensions — which is why their ranking has been consistent, not a one-time fluke. In Flexpa's 2024 report, they ranked #1 among payers.
The technology behind the score
VillageCareMAX built their implementation on Aidbox, Health Samurai's certified FHIR platform, first deployed to meet the CMS-9115-F deadline back in July 2021 — a milestone many plans missed entirely.
What started as a compliance project has since evolved into a central data layer powering multiple internal applications. That's the compounding advantage of getting the foundation right early: the infrastructure becomes an asset, not just a regulatory box checked.
The next deadline is already coming
Here's the strategic angle most health plans are missing.
CMS-0057-F (the Interoperability and Prior Authorization Final Rule) goes live January 1, 2027. It requires four new FHIR APIs:
- expanded Patient Access
- Provider Access
- Payer-to-Payer data exchange
- fully electronic Prior Authorization workflow.
The technical foundation is identical to what's already required under CMS-9115-F: FHIR R4, OAuth 2.0, SMART on FHIR. Payers who built their Patient Access API correctly the first time have a significant head start. Those who cut corners, or haven't started yet, are facing a much steeper climb.
VillageCareMAX's #2 ranking isn't just a benchmark result. It's a signal that thoughtful, well-executed interoperability infrastructure pays dividends — in compliance, in usability, and in readiness for what comes next.
The takeaway
The payers winning at interoperability aren't necessarily the biggest ones. They're the ones that treated FHIR infrastructure as a long-term investment rather than a last-minute compliance sprint.
With 2027 approaching and the scope of CMS-0057-F far exceeding anything required before, the gap between prepared and unprepared payers is about to become very visible.
Health Samurai's platform powers VillageCareMAX's top-ranking Patient Access API implementation and is available to payers preparing for CMS-9115-F and CMS-0057-F compliance.
Top comments (0)