TheFhirStorm

NextGen Healthcare API notes: Enterprise and Office

Vendor APIs · · Abhinav Srivastava

NextGen Healthcare sells two different products under one name, and their APIs do not match. NextGen Enterprise is the EHR and PM for mid-size and large practices. NextGen Office is the cloud product for small practices. When a practice says it is on NextGen, find out which one before you read any documentation. The sources here are the public API page and its regulatory pages for Enterprise and Office.

NextGen Enterprise

Two API sets

The API page lists Patient Access APIs, which are read-only FHIR in DSTU2 and R4 for patient-facing apps, and Enterprise APIs, which it describes as over 800 JSON REST routes with read and write across EHR and PM data in a proprietary NextGen JSON format. The Enterprise routes carry the practice management data. The page states that full Enterprise documentation is provided after you submit developer details through the onboarding form.

FHIR R4 endpoints

The Patient Access API page publishes the production endpoints.

FHIR R4 base:    https://fhir.nextgen.com/nge/prod/fhir-api-r4/fhir/r4/
FHIR DSTU2 base: https://fhir.nextgen.com/nge/prod/fhir-api/fhir/dstu2/
Authorize:       https://fhir.nextgen.com/nge/prod/patient-oauth/authorize
Token:           https://fhir.nextgen.com/nge/prod/patient-oauth/token

The page states that DSTU2 "will be sunset on December 31, 2026". It also states that USCDI v3 routes need the practice to run Enterprise 8.3.1 or higher; older practices fall back to USCDI v1 routes. A practice search tells you whether a given practice has the Patient Access API installed. No contracting is required for read-only USCDI GETs.

Partner access

The developer program page and the Enterprise regulatory page describe three programs.

  • Patient Access API Program. No fees. Only for apps that use solely the Patient Access APIs. Self-register on the Developer Portal, test with the portal's test patients, then email the API program before production.
  • Open Access Developer Program. For NextGen clients that build apps for their own use. No fees. Requires Enterprise 5.9.0 or higher and an executed API Terms of Service with Open Access terms.
  • API Distributor Program. For third-party vendors. No charge to develop or to use the sandbox. The page states that fees "may apply" based on data scope, read-only versus read-and-write access, and whether the data is USCDI, non-USCDI EHI, or non-EHI. GET routes for certified data are free. Payment is not expected until General Release.

Every developer except a Patient Access developer starts with the API Onboarding form. The form triggers an email about the Terms of Service and portal registration. Portal registration is required for production credentials and optional for the sandbox. The regulatory page says the portal has sandboxes for both FHIR R4 and the Enterprise APIs.

Enterprise apps have two authentication models. The Global Service Account (GSA) is the only model that runs without a NextGen user launching the app, and it cannot reach some routes, such as routes that need provider-level permissions or auditing. The External Application Launcher provides user-level authentication for all routes and needs Enterprise 5.9.2 or higher. A GSA route status list and a GSA authentication guide are linked from the regulatory page as Salesforce documents.

Before beta, an Enterprise app needs OAuth2 credentials from the portal, a signed Terms of Service, and development completed in the sandbox. NextGen provides two beta documents that you adapt and send to each beta client.

NextGen Office

Office implements FHIR R4 and C-CDA. The Office regulatory page states that only GET is supported for USCDI v1 data; PUT, POST and DELETE are not. Three APIs are offered.

  • Patient Access API. No fee and no contract for USCDI v1 GETs.
  • SMART App Launch API for providers. $2,400 one-time onboarding, then $50 per month.
  • Bulk FHIR API for providers. $2,400 one-time onboarding, then $100 per month.

Fees are per vendor, per practice. The Patient Access page gives the endpoints.

FHIR R4 base:  https://fhir.meditouchehr.com/api/fhir/r4
Bulk FHIR R4:  https://fhir.meditouchehr.com/api/bulkfhir/r4
Token:         https://idp-prod.prod.ngo.nextgenaws.net/auth/realms/nextgen/protocol/openid-connect/token

Rate limits are stated: 20 requests per minute from one IP address; up to 1,480 requests per 12 hours per SMART App Launch application; one Bulk request per patient per week. Higher limits can be requested from Office support. Swagger files for the R4 and Bulk APIs are public, and three developer guides are linked from the regulatory page. Questions go to nextgen-office-api@nextgen.com.

What the public pages do not state

  • Enterprise API route documentation, base URLs and sandbox URLs. These sit inside the Developer Portal after onboarding.
  • Enterprise rate limits.
  • Distributor fee amounts.
  • An Office sandbox. The Office page does not mention one.
  • Whether the Enterprise routes expose claims, remits or eligibility. The page describes PM data in general terms. The NGE API Data Details Grid spreadsheet is the public document that lists USCDI elements per interface.
All posts