Consumer Real-Time Pharmacy Benefit Check FHIR IG
2.0.0-ballot - STU 2 Ballot

Consumer Real-Time Pharmacy Benefit Check FHIR IG, published by HL7 International / Pharmacy. This guide is not an authorized publication; it is the continuous build for version 2.0.0-ballot built by the FHIR (HL7® FHIR® Standard) CI Build. This version is based on the current content of https://github.com/HL7/carin-rtpbc/ and changes regularly. See the Directory of published versions

## Security

Page standards status: Informative | Highlight text changes?

> The initial version of the RTPBC IG did not provide specific guidance for authenticating with data sources and authorizing release of information. STU2 recommends use of the SMART on FHIR specification for accessing RTPBC data sources. All content below that precedes Additional Guidance is new in STU2.

### Using SMART on FHIR in RTPBC client applications

The SMART App Launch implementation guide provides features based on OAuth 2.0 that enable client applications to authorize, authenticate, and integrate with FHIR-based data systems.

This guide recommends use of these patterns to enable patient applications to access RTPBC information in a manner consistent with other Patient Access API services.

#### Capabilities to support retrieval of patient-specific information

The following SMART on FHIR Capability Sets SHOULD be supported when retrieving from RTPBC data sources that return patient-specific information–such as an insurer system that returns responses containing a member's benefit balances and coverage information.§SEC-1

- Patient Access for Standalone Apps

#### Capabilities to support retrieval of non-patient-specific information

Interactions with RTPBC data sources that supply non-patient-specific information such as discount pricing SHOULD support SMART Backend Services.§SEC-2

### Token Introspection

RTPBC data sources SHALL support token introspection defined by the SMART App Launch Guide. For more details and additional consideration, see SMART App Launch's Token Introspection.§SEC-3

### Additional guidance

Implementers are expected to follow core FHIR security principles.

In addition, the FHIR Security and Privacy Module describes how to protect patient privacy.