(a) An MA organization must implement and maintain a publicly accessible, standards-based Application Programming Interface (API) that is conformant with the technical requirements at § 422.119(c), excluding the security protocols related to user authentication and authorization and any other protocols that restrict the availability of this information to particular persons or organizations, the documentation requirements at § 422.119(d), and is accessible via a public-facing digital endpoint on the MA organization's website.

(b) The API must provide a complete and accurate directory of—

(1) The MA plan's network of contracted providers, including names, addresses, phone numbers, and specialties, updated no later than 30 calendar days after the MA organizations receives provider directory information or updates to provider directory information; and

(2) For an MA organization that offers an MA-PD plan, the MA-PD's pharmacy directory, including the pharmacy name, address, phone number, number of pharmacies in the network, and mix (specifically the type of pharmacy, such as “retail pharmacy”) updated no later than 30 calendar days after the MA organization receives pharmacy directory information or updates to pharmacy directory information.

(c) This section is applicable beginning January 1, 2021.