{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "1uphealth", "name": "1upHealth", "vendor": "1upHealth, Inc.", "vendorUrl": "https://1up.health", "kind": "http-api", "category": "health-data", "summary": "1upHealth runs FHIR APIs for US health plans, including the CMS Patient Access, Provider Access and Payer-to-Payer APIs, which let member-authorised third-party apps read claims, coverage and clinical data.", "url": "https://www.anchorterminal.com/tools/1uphealth", "markdownUrl": "https://www.anchorterminal.com/tools/1uphealth.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1uphealth.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1uphealth.json", "license": "Proprietary service under 1upHealth's Terms of Service (effective 1 August 2024)", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "Developers register in the 1up Dev Portal, verify an email and create sandbox client credentials. Patient Access uses the authorisation code grant, with the member signing in to the health plan's auth app, and access tokens last 15 minutes. Provider Access and Payer-to-Payer use client credentials with scopes such as `bulk-data|user/*.rs`. Client secrets can be regenerated in the Dev Portal. Production access follows 1upHealth's vetting of the app.", "pricing": "paid", "pricingNotes": "No public prices. The terms set fees in Order Forms, with one price increase a year on 90 days' notice. The Dev Portal sandbox clients need only a verified email, and no card was mentioned (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.1up.health", "llmsTxt": "https://docs.1up.health/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "claims", "fhir", "bulk-data", "oauth", "llms-txt", "status-page", "sla", "free-tier", "hitrust", "soc2" ], "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 903, "ranked": true, "rankOf": 1076, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 52, "points": 10.4, "reason": "Read with the hosted lines. status.1up.health is a Statuspage site with no components listed, so history can't be tied to an API (12 of 20). No incident since the AWS outage of 20 October 2025, but with no components this says little (20 of 30). No rate limits found (0). No 429, backoff or retry guidance found (0). A 99 per cent SLA with credits in Exhibit A of the terms (10). Patient Access, Provider Access and Payer-to-Payer are generally available. Patient Connect was sunset on 30 September 2026 and is not graded (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "A FHIR CapabilityStatement at each server's /metadata and the CARIN, US Core and Da Vinci implementation guides define the resources, with no OpenAPI (12 of 25). llms.txt indexes 34 Markdown pages (10). Pages say which resources every payer returns and how to test, with little on parameters (8 of 20). Inputs follow the FHIR standard with nothing documented beyond it (6 of 15). curl examples, and the only error example is an HTML 400 page (6 of 15). Release notes are numbered by year and month but undated (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 32, "points": 5.2, "reason": "FHIR search and bulk export, with no documented size controls (12 of 25). Pagination and filters follow FHIR without 1upHealth-specific documentation (8 of 20). Errors are barely documented (5 of 20). No idempotency or retry guidance, though the Patient Access API is read-only (3 of 20). No official SDK, and the authorisation code step needs a person or, per the FAQ, a scripted browser (4 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 63, "points": 11.03, "reason": "OAuth 2.0 with authorisation code for member consent, client credentials with scopes for bulk data, 15-minute tokens and secret regeneration. Secrets are posted in the request body (25 of 30). Patient Access is read-only data the member authorised, and bulk scopes are read and search (14 of 20). Claims and clinical records from payers, with no prompt-injection guidance (4 of 15). 1upHealth monitors app activity, with no audit log documented for developers (5 of 15). HITRUST, SOC 2 Type 2 and CSA STAR on a SafeBase trust centre, a bug bounty contact by email, no security.txt (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). Sandbox clients in the Dev Portal need a verified email and no card (20). Sign-up is in a browser, Patient Access testing needs an email to 1upHealth to sync the client, and production needs a vetting review (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 37, "points": 3.24, "reason": "Release 26.09.2 is the latest, numbered for September 2026 but undated (20 of 30). Releases 26.08.2, 26.09 and 26.09.2 fall in the last 90 days by their numbers, without dates (10 of 20). A support portal that needs registration, with no public response record (7 of 15). No official SDK found (0 of 15). Nothing public to judge package health (0 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 61, provenance 82", "reason": "Closed service under Terms of Service effective 1 August 2024 (15 of 30). The privacy policy (June 2026) gives retention periods for logs and deletion, keeps data in the US and leaves PHI to BAAs (22 of 30). Patient Connect's sunset was announced with a date, 30 September 2026, with no general deprecation policy (12 of 20). The trust centre lists AWS as a sub-processor and the policy states US-only processing (12 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "FHIR search and bulk export, with no documented size controls (12 of 25). Pagination and filters follow FHIR without 1upHealth-specific documentation (8 of 20). Errors are barely documented (5 of 20). No idempotency or retry guidance, though the Patient Access API is read-only (3 of 20). No official SDK, and the authorisation code step needs a person or, per the FAQ, a scripted browser (4 of 15).", "maintenance": "Release 26.09.2 is the latest, numbered for September 2026 but undated (20 of 30). Releases 26.08.2, 26.09 and 26.09.2 fall in the last 90 days by their numbers, without dates (10 of 20). A support portal that needs registration, with no public response record (7 of 15). No official SDK found (0 of 15). Nothing public to judge package health (0 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). Sandbox clients in the Dev Portal need a verified email and no card (20). Sign-up is in a browser, Patient Access testing needs an email to 1upHealth to sync the client, and production needs a vetting review (0).", "reliability": "Read with the hosted lines. status.1up.health is a Statuspage site with no components listed, so history can't be tied to an API (12 of 20). No incident since the AWS outage of 20 October 2025, but with no components this says little (20 of 30). No rate limits found (0). No 429, backoff or retry guidance found (0). A 99 per cent SLA with credits in Exhibit A of the terms (10). Patient Access, Provider Access and Payer-to-Payer are generally available. Patient Connect was sunset on 30 September 2026 and is not graded (10).", "schema": "A FHIR CapabilityStatement at each server's /metadata and the CARIN, US Core and Da Vinci implementation guides define the resources, with no OpenAPI (12 of 25). llms.txt indexes 34 Markdown pages (10). Pages say which resources every payer returns and how to test, with little on parameters (8 of 20). Inputs follow the FHIR standard with nothing documented beyond it (6 of 15). curl examples, and the only error example is an HTML 400 page (6 of 15). Release notes are numbered by year and month but undated (8 of 15).", "security": "OAuth 2.0 with authorisation code for member consent, client credentials with scopes for bulk data, 15-minute tokens and secret regeneration. Secrets are posted in the request body (25 of 30). Patient Access is read-only data the member authorised, and bulk scopes are read and search (14 of 20). Claims and clinical records from payers, with no prompt-injection guidance (4 of 15). 1upHealth monitors app activity, with no audit log documented for developers (5 of 15). HITRUST, SOC 2 Type 2 and CSA STAR on a SafeBase trust centre, a bug bounty contact by email, no security.txt (15 of 20).", "transparency": "Closed service under Terms of Service effective 1 August 2024 (15 of 30). The privacy policy (June 2026) gives retention periods for logs and deletion, keeps data in the US and leaves PHI to BAAs (22 of 30). Patient Connect's sunset was announced with a date, 30 September 2026, with no general deprecation policy (12 of 20). The trust centre lists AWS as a sub-processor and the policy states US-only processing (12 of 20)." }, "sources": [ { "what": "documentation index", "url": "https://docs.1up.health/llms.txt", "seen": "2026-10-14" }, { "what": "third-party developers", "url": "https://docs.1up.health/docs/patient-access/dev-implementation.md", "seen": "2026-10-14" }, { "what": "client credentials and OAuth", "url": "https://docs.1up.health/docs/get-started/o-auth.md", "seen": "2026-10-14" }, { "what": "third-party app vetting", "url": "https://docs.1up.health/docs/get-started/third-party-apps.md", "seen": "2026-10-14" }, { "what": "Patient Connect sunset", "url": "https://docs.1up.health/docs/patient-connect.md", "seen": "2026-10-14" }, { "what": "release notes", "url": "https://docs.1up.health/docs/release-notes.md", "seen": "2026-10-14" }, { "what": "FAQ", "url": "https://docs.1up.health/docs/get-started/faq.md", "seen": "2026-10-14" }, { "what": "status incidents", "url": "https://status.1up.health/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://1up.health/terms-of-service/", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://1up.health/privacy-policy/", "seen": "2026-10-14" }, { "what": "trust centre", "url": "https://trust.1up.health/", "seen": "2026-10-14" } ], "openQuestions": [ "Release dates are not published, so recency is inferred from version numbers", "No rate limits were found in the documentation", "unchecked: the full sub-processor list behind the trust centre's 'View more' link" ] }, "negative": 0, "verdict": "Self-serve Dev Portal sandbox clients and a demo health plan let an app test the CMS Patient Access, Provider Access and Payer-to-Payer FHIR APIs, backed by HITRUST and SOC 2 Type 2. No rate limits, error formats or dated releases are documented, and the Patient Access OAuth step needs the member in a browser.", "bestFor": "Consumer and care apps that read a member's health plan claims and clinical data under the CMS rules, and payers meeting those rules.", "strengths": [ "Sandbox client credentials from the Dev Portal with only an email verification", "Patient Access client IDs work across every payer production environment 1upHealth runs, once vetted", "Privacy policy with stated retention periods and US-only processing", "HITRUST, SOC 2 Type 2 and CSA STAR on a public trust centre" ], "weaknesses": [ "No rate limits, 429 handling or error formats documented", "Release notes are undated", "The status page lists no components", "Patient Connect, the patient-mediated exchange across health systems, was sunset on 30 September 2026" ], "agentNotes": [ "Hand the Patient Access sign-in to the member, who must authorise in the health plan's auth app", "Exchange the authorisation code within five minutes, and refresh before the 15-minute token expires", "Email payer-patient-access@1up.health with the client ID to get the app synced to the demo environment", "Expect only claims and coverage resources from some payers, and read /r4/metadata first" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 61 }, "provenanceScore": 82 }, "connect": { "http": "GET https://api.1uphealthdemo.com/r4/ExplanationOfBenefit\nAuthorization: Bearer \u003caccess-token\u003e" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/1uphealth" }, "notable": [ "Third-party apps register in the Dev Portal, test against a demo health plan with a test member, then pass a privacy and security review before production (https://docs.1up.health/docs/get-started/third-party-apps.md)", "At a minimum every payer returns `ExplanationOfBenefit`, `Coverage`, `Organization`, `Patient`, `Practitioner` and `Location` (https://docs.1up.health/docs/patient-access/dev-implementation.md)", "1up Patient Connect, the patient-mediated exchange product, was sunset on 30 September 2026 (https://docs.1up.health/docs/patient-connect.md)", "The FAQ suggests a browserless webdriver such as Selenium to complete the OAuth step in tests (https://docs.1up.health/docs/get-started/faq.md)", "Release 26.09.2 lets Dev Portal users regenerate client secrets, invalidating the old one (https://docs.1up.health/docs/release-notes.md)", "The trust centre on SafeBase lists HITRUST, SOC 2 Type 2, CSA STAR and NIST CSF (https://trust.1up.health/)" ], "area": "domain-data", "details": [ { "label": "APIs", "value": "Patient Access (FHIR R4 read for member-authorised apps), Provider Access and Payer-to-Payer (FHIR Bulk Export), electronic prior authorisation (CRD, DTR, PAS), Provider Directory" }, { "label": "Implementation guides", "value": "CARIN Blue Button for claims, US Core for clinical data, Da Vinci PDEX Plan Net and US Drug Formulary" }, { "label": "Endpoints", "value": "Demo FHIR at https://api.1uphealthdemo.com/r4 with auth at https://auth.1uphealthdemo.com, client credentials at https://gateway.1up.health" }, { "label": "Credentials", "value": "Dev Portal client ID and secret, authorisation code grant for Patient Access, client credentials with scopes for bulk data, 15-minute access tokens, secret regeneration" }, { "label": "Contract", "value": "FHIR CapabilityStatement at {baseUrl}/r4/metadata" }, { "label": "Rate limits", "value": "None found in the documentation" }, { "label": "SLA", "value": "99 per cent availability in Exhibit A of the terms, credits of 1 to 20 per cent, Severity 1 response in 30 minutes" }, { "label": "Status", "value": "status.1up.health on Statuspage, with no components listed and the last incident on 20 October 2025" }, { "label": "Certifications", "value": "HITRUST, SOC 2 Type 2, CSA STAR, NIST CSF and HIPAA per the trust centre. The platform overview says HITRUST i1" } ], "provenance": { "legalEntity": "1upHealth, Inc.", "domain": "1up.health", "domainRegistered": "2017-07-20", "endpointOnVendorDomain": true, "terms": "https://1up.health/terms-of-service/", "privacy": "https://1up.health/privacy-policy/", "statusPage": "https://status.1up.health", "changelog": "https://docs.1up.health/docs/release-notes", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Terms of Service (effective 1 August 2024) name 1upHealth, Inc., 280 Summer Street, Boston, MA 02210, and include the SLA as Exhibit A.", "The privacy policy (last updated 25 June 2026) covers the website, keeps logs up to 24 months, clears production data within 30 days and backups within 90 days of a deletion request, keeps data in the US, and leaves PHI to customer BAAs.", "The demo API answers on 1uphealthdemo.com, a separate domain.", "1up.health/.well-known/security.txt returns 404. The trust centre sends vulnerability reports to security@1up.health.", "Release notes carry version numbers such as 26.09.2 but no dates.", "RDAP gives 1up.health a registration date of 2017-07-20." ], "score": 82, "checks": [ { "check": "Legal entity named", "value": "1upHealth, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "1up.health, registered 2017-07-20 (9 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "1up.health", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.1up.health", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://1up.health/terms-of-service/", "state": "read", "readAt": "2026-10-14", "words": 5861, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms of Service will be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts without reference to its conflict of laws provisions.", "says": "The law of the Commonwealth of Massachusetts" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT, OR OTHERWISE, WILL NOT EXCEED THE FEES PAID BY CUSTOMER TO 1UPHEALTH DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENTS GIVING RISE TO THE CLAIM.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "1upHealth may immediately and without notice limit, suspend, or terminate Customer’s access to or use of the Services to correct or prevent a breach of 1upHealth’s privacy policies, terms and conditions, and the provisions of the Agreement, including without limitation those contained in an SOW by Customer or End User…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Customer may not use the Services if Customer is a resident of a country embargoed by the United States, or are a foreign person or entity blocked or denied by the United States government." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "For the avoidance of all doubt, in addition to Scheduled Maintenance and Service Outages, the foregoing Service Level is not applicable to outages caused by external circumstances beyond the control of 1upHealth such as weather, acts of terror (“Force Majeure Event”) or any third-party systems;" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(vii) Perform security, benchmark, or penetration testing of the Services or related infrastructure, or disclose the results of such testing, without the prior written consent of 1upHealth’s Chief Security Officer;", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "1upHealth may immediately and without notice limit, suspend, or terminate Customer’s access to or use of the Services to correct or prevent a breach of 1upHealth’s privacy policies, terms and conditions, and the provisions of the Agreement" } ], "notes": [ { "date": "2026-10-14", "text": "After the initial term of an order form, 1upHealth may raise fees once a calendar year, with 90 days' written notice.", "quote": "Following the termination of the Initial Term (as defined herein) of any Order Form or SOW, 1upHealth shall be entitled to increase the fees charged for any Service once per calendar year." }, { "date": "2026-10-14", "text": "1upHealth may use and display the customer's name and logo to identify it as a customer.", "quote": "Notwithstanding any provision of this Agreement to the contrary, 1upHealth may use and display the Customer’s name, logo and similar indicia to identify Customer as a customer of 1upHealth and may use Customer’s name in connection with the Services and as otherwise set forth herein." } ] }, { "kind": "privacy", "url": "https://1up.health/privacy-policy/", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-06-25", "words": 3809, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: June 25, 2026", "says": "Last updated 2026-06-25" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Policy applies to Personal Data that we collect from or about Users, including Personal Data collected through our website and related marketing activities." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain Personal Data only as long as necessary to provide the Services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Your Personal Data will be collected, processed, and stored by 1upHealth or its Service Providers in the United States only." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "opt out of the processing of your Personal Data for purposes such as targeted advertising, the sale of Personal Data, or certain profiling in furtherance of decisions that produce legal or similarly significant effects (note that 1upHealth does not sell your Personal Data);", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The right to access the Personal Data we hold about you." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions about this Privacy Policy, wish to exercise a privacy right, request account deletion, report a security concern, or file a complaint, please contact us:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The Services are operated from the United States, and Personal Data collected through the Services is collected, stored, and processed in the United States only.", "says": "Data goes to the United States" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/1uphealth.json", "live": { "slug": "1uphealth", "vendorStatus": { "page": "https://status.1up.health", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:50.511902685Z" }, "updatedAt": "2026-10-14T09:38:50.511902685Z" } } }