- In production, BCDA protects its endpoints with OAuth2 access tokens. -
+Production credentials authorize your organization's access to the Beneficiary Claims Data API (BCDA). Eligible model entities can manage BCDA credentials by logging into their model-specific system:
+Your registered contact can contact the ACO-MS and 4i help desk to assign these roles.
- +BCDA credentials are formatted as a client ID and secret, which your organization will use every time it requests an authentication token. Production credentials are sensitive information and must be stored securely.
+Create BCDA credentials by visiting the API Credentials page in your model-specific system. Choose the BCDA Credentials tab, then select Create New API Credentials. You'll need to provide a public, static IP address for every system, including vendors, that will access the API (up to 8 IP addresses). It may take up to an hour for the allow list to be updated.
-Your organization's credentials will expire and deactivate after a set period of time. You can rotate BCDA credentials in the API Credentials page to generate a new, active client ID and secret.
+You'll need to rotate credentials every 90 days in 4i or every 12 months in ACO-MS. Once you choose the BCDA Credentials tab, select the rotate icon under the Actions column.
--
ACOs in the Medicare Shared Savings Program: Create and manage your organization's BCDA credentials from the ACO Management System.
-REACH ACOs and KCEs or KCFs in the Kidney Care Choices Model: Create and manage your organization's BCDA credentials from the 4i portal.
-When creating new credentials, be prepared to provide the IP address(es) for each system that will make requests to BCDA. It may take up to an hour for the allow list to be updated after the IP address(es) are added.
- +You may need to revoke (deactivate) your organization's credentials if they are leaked or compromised. You can create new credentials as a replacement afterward.
+Revoke BCDA credentials in the API Credentials page. Choose the BCDA Credentials tab, then select the delete (x) icon under the Actions column.
+ +Please revoke or rotate your BCDA credentials immediately. Afterward, notify the BCDA team at bcapi@cms.hhs.gov to review recent activity.
\ No newline at end of file diff --git a/_updates/2024-11-18.html b/_updates/2024-11-18.html new file mode 100644 index 0000000..022a4e3 --- /dev/null +++ b/_updates/2024-11-18.html @@ -0,0 +1,14 @@ +--- +--- +The BCDA team has updated our guidance for model entities managing their BCDA credentials in 4i and ACO-MS. Please visit Manage your BCDA Credentials for model specific instructions on how to manage and create BCDA credentials for your organization.
+No action is required for BCDA users, but we hope the updated guidance is helpful!
+