From 568334df7d5d183632dcf533ae9be49a3799c9d8 Mon Sep 17 00:00:00 2001 From: Greg Pfadenhauer Date: Thu, 14 Nov 2024 13:37:05 -0500 Subject: [PATCH 1/3] Update credential management guidelines --- _includes/build/bcda_credentials.html | 44 +++++++++++++++------------ build.html | 4 +-- 2 files changed, 27 insertions(+), 21 deletions(-) diff --git a/_includes/build/bcda_credentials.html b/_includes/build/bcda_credentials.html index 272130a..cef4357 100644 --- a/_includes/build/bcda_credentials.html +++ b/_includes/build/bcda_credentials.html @@ -1,22 +1,28 @@ -

- In production, BCDA protects its endpoints with OAuth2 access tokens. -

+

Production credentials authorize your organization's access to the Beneficiary Claims Data API (BCDA). Eligible model entities can manage BCDA credentials by logging into their model-specific system:

+ +

Your registered contact can contact the ACO-MS and 4i help desk to assign these roles.

-
-
-

Your credentials are protected data.

-

- Please store them safely and securely. -

-
-
+

Create your credentials

+

BCDA credentials are formatted as a client ID and secret, which your organization will use every time it makes an API request and exports data. Production credentials are Personally Identifiable Information (PII) that must be stored securely.

+

Create BCDA credentials by visiting the API Credentials page in your model-specific system. Choose the BCDA Credentials tab, then select Create New API Credentials. You'll need to provide a public, static IP address for every system, including vendors, that will access the API (up to 8 IP addresses). It may take up to an hour for the allow list to be updated.

-

-Model Entities Gain Access to BCDA through ACO-MS or 4i -

+

Rotate your credentials

+

Your organization's credentials will expire and deactivate after a set period of time. You can rotate BCDA credentials in the API Credentials page to generate a new, active client ID and secret.

+

You'll need to rotate credentials every 90 days in 4i or every 12 months in ACO-MS. Once you choose the BCDA Credentials tab, select the rotate icon under the Actions column.

-

-

ACOs in the Medicare Shared Savings Program: Create and manage your organization's BCDA credentials from the ACO Management System.

-

REACH ACOs and KCEs or KCFs in the Kidney Care Choices Model: Create and manage your organization's BCDA credentials from the 4i portal.

-

When creating new credentials, be prepared to provide the IP address(es) for each system that will make requests to BCDA. It may take up to an hour for the allow list to be updated after the IP address(es) are added.

-

+

Revoke your credentials

+

You may need to revoke (deactivate) your organization's credentials if they are leaked or compromised. You can create new credentials as a replacement afterward.

+

Revoke BCDA credentials in the API Credentials page. Choose the BCDA Credentials tab, then select the delete (x) icon under the Actions column.

+ +

If your credentials have been compromised

+

Please revoke or rotate your BCDA credentials immediately. Afterward, notify the BCDA team at bcapi@cms.hhs.gov to review recent activity.

\ No newline at end of file diff --git a/build.html b/build.html index 30e84c8..07685f4 100644 --- a/build.html +++ b/build.html @@ -38,7 +38,7 @@