CMS Blue Button 2.0: the Medicare claims it returns as FHIR R4, the sandbox, OAuth authorization, production review, and how to turn claims into a useful patient history.
Blue Button 2.0 is CMS's FHIR R4 API that lets people with Original Medicare share their Medicare claims (Parts A, B and D) with an app they choose. Your app registers in the Blue Button sandbox, tests with synthetic beneficiaries, asks the person to sign in with their Medicare.gov account and approve access through OAuth 2.0, then reads Patient, Coverage and ExplanationOfBenefit resources. Production access requires an app review by CMS.
What the API returns
Resource
What it holds
Patient
The beneficiary's demographic details
Coverage
Medicare Parts A, B, C and D coverage
ExplanationOfBenefit
Claims: inpatient, outpatient, carrier (physician), durable medical equipment, home health, hospice, skilled nursing and Part D prescription drug events
The claims follow the CARIN Blue Button profiles from version 2 of the API. Diagnoses come as ICD-10 codes, procedures as CPT/HCPCS or ICD-10-PCS, drugs as NDC codes; dates of service and amounts are included. Claims arrive after they are processed, so they lag behind the visit.
How to connect
Register in the sandbox on the Blue Button 2.0 developer portal and create an application with a redirect URI.
Test with synthetic beneficiaries provided in the sandbox; they have realistic claims history.
Authorize with OAuth 2.0 authorization code flow (PKCE supported). The person signs in with their Medicare.gov account and chooses whether to share demographic data along with claims.
Read the data from the FHIR endpoints with the access token and follow paging links.
Request production access. CMS reviews your app, privacy policy and terms before issuing production credentials.
Turning claims into a useful history
Claims tell you what was billed, not every clinical detail, but they are a reliable map of visits, diagnoses and filled prescriptions over years. A practical approach:
deduplicate claims that are adjusted or replaced;
keep the original ExplanationOfBenefit and derive simpler items for the person's timeline (a visit, a condition, a medication fill);
label everything as claims data, so a clinician reading it later knows it came from billing, not from a chart.
Where Anpheros fits
Anpheros Platform keeps one FHIR R4 record per person, so Medicare claims can sit next to lab results, documents, wearable data and data from other plans and providers. Every write carries Provenance with the source, every read is logged, and other apps or clinicians see the record only with the person's consent.
Anpheros is hosted in the EU. A US data region and a HIPAA business associate agreement (BAA) are available on request for production customers; production for US patient data starts only after the BAA is signed. Prototype on the free sandbox with synthetic patients.
Frequently asked questions
What is Blue Button 2.0?
The CMS API that gives Original Medicare beneficiaries a way to share their Medicare Parts A, B and D claims with apps, using FHIR R4 and OAuth 2.0.
Does Blue Button 2.0 include Medicare Advantage data?
No. Medicare Advantage plans offer their own Patient Access APIs under the CMS interoperability rule; Blue Button 2.0 covers Original (fee-for-service) Medicare and Part D drug events.
How do I get production access?
Build and test in the sandbox, then apply for production; CMS reviews the app, its privacy policy and terms of service before granting production credentials.
