{ "data": { "similar": [ { "grade": "B", "json": "https://www.anchorterminal.com/tools/aidbox.json", "name": "Aidbox", "score": 64.2, "shared": [ "health.fhir", "health.records", "health.consent" ], "slug": "aidbox" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/health-gorilla.json", "name": "Health Gorilla", "score": 59.3, "shared": [ "health.records", "health.fhir", "health.consent" ], "slug": "health-gorilla" }, { "grade": "C", "json": "https://www.anchorterminal.com/tools/zus-health.json", "name": "Zus Health", "score": 56.6, "shared": [ "health.records", "health.fhir", "health.consent" ], "slug": "zus-health" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/medblocks.json", "name": "Medblocks", "score": 52.7, "shared": [ "health.records", "health.consent", "health.fhir" ], "slug": "medblocks" }, { "grade": "D", "json": "https://www.anchorterminal.com/tools/metriport.json", "name": "Metriport Medical API", "score": 50.1, "shared": [ "health.records", "health.fhir", "health.consent" ], "slug": "metriport" }, { "grade": "B", "json": "https://www.anchorterminal.com/tools/medplum.json", "name": "Medplum", "score": 68.7, "shared": [ "health.fhir", "health.records" ], "slug": "medplum" } ], "tool": { "slug": "1uphealth", "name": "1upHealth", "vendor": "1upHealth, Inc.", "vendorUrl": "https://1up.health", "kind": "http-api", "category": "health-data", "summary": "1upHealth runs FHIR APIs for US health plans, including the CMS Patient Access, Provider Access and Payer-to-Payer APIs, which let member-authorised third-party apps read claims, coverage and clinical data.", "url": "https://www.anchorterminal.com/tools/1uphealth", "markdownUrl": "https://www.anchorterminal.com/tools/1uphealth.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/1uphealth.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/1uphealth.json", "license": "Proprietary service under 1upHealth's Terms of Service (effective 1 August 2024)", "transports": [ "http" ], "packages": [], "auth": "oauth", "authNotes": "Developers register in the 1up Dev Portal, verify an email and create sandbox client credentials. Patient Access uses the authorisation code grant, with the member signing in to the health plan's auth app, and access tokens last 15 minutes. Provider Access and Payer-to-Payer use client credentials with scopes such as `bulk-data|user/*.rs`. Client secrets can be regenerated in the Dev Portal. Production access follows 1upHealth's vetting of the app.", "pricing": "paid", "pricingNotes": "No public prices. The terms set fees in Order Forms, with one price increase a year on 90 days' notice. The Dev Portal sandbox clients need only a verified email, and no card was mentioned (checked 2026-10-14).", "priceSummary": "Paid", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs, llms.txt or the terms (checked 2026-10-14).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-14" }, "docsUrl": "https://docs.1up.health", "llmsTxt": "https://docs.1up.health/llms.txt", "capabilities": [ "health.records", "health.fhir", "health.consent" ], "tags": [ "hosted", "health-records", "claims", "fhir", "bulk-data", "oauth", "llms-txt", "status-page", "sla", "free-tier", "hitrust", "soc2" ], "graded": true, "anchor": { "graded": true, "score": 46.8, "grade": "D", "agentReady": false, "rank": 903, "ranked": true, "rankOf": 1076, "categoryRank": 12, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 72 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 52, "points": 10.4, "reason": "Read with the hosted lines. status.1up.health is a Statuspage site with no components listed, so history can't be tied to an API (12 of 20). No incident since the AWS outage of 20 October 2025, but with no components this says little (20 of 30). No rate limits found (0). No 429, backoff or retry guidance found (0). A 99 per cent SLA with credits in Exhibit A of the terms (10). Patient Access, Provider Access and Payer-to-Payer are generally available. Patient Connect was sunset on 30 September 2026 and is not graded (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 50, "points": 8.13, "reason": "A FHIR CapabilityStatement at each server's /metadata and the CARIN, US Core and Da Vinci implementation guides define the resources, with no OpenAPI (12 of 25). llms.txt indexes 34 Markdown pages (10). Pages say which resources every payer returns and how to test, with little on parameters (8 of 20). Inputs follow the FHIR standard with nothing documented beyond it (6 of 15). curl examples, and the only error example is an HTML 400 page (6 of 15). Release notes are numbered by year and month but undated (8 of 15)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 32, "points": 5.2, "reason": "FHIR search and bulk export, with no documented size controls (12 of 25). Pagination and filters follow FHIR without 1upHealth-specific documentation (8 of 20). Errors are barely documented (5 of 20). No idempotency or retry guidance, though the Patient Access API is read-only (3 of 20). No official SDK, and the authorisation code step needs a person or, per the FAQ, a scripted browser (4 of 15)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 63, "points": 11.03, "reason": "OAuth 2.0 with authorisation code for member consent, client credentials with scopes for bulk data, 15-minute tokens and secret regeneration. Secrets are posted in the request body (25 of 30). Patient Access is read-only data the member authorised, and bulk scopes are read and search (14 of 20). Claims and clinical records from payers, with no prompt-injection guidance (4 of 15). 1upHealth monitors app activity, with no audit log documented for developers (5 of 15). HITRUST, SOC 2 Type 2 and CSA STAR on a SafeBase trust centre, a bug bounty contact by email, no security.txt (15 of 20)." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 20, "points": 2.5, "reason": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). Sandbox clients in the Dev Portal need a verified email and no card (20). Sign-up is in a browser, Patient Access testing needs an email to 1upHealth to sync the client, and production needs a vetting review (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 37, "points": 3.24, "reason": "Release 26.09.2 is the latest, numbered for September 2026 but undated (20 of 30). Releases 26.08.2, 26.09 and 26.09.2 fall in the last 90 days by their numbers, without dates (10 of 20). A support portal that needs registration, with no public response record (7 of 15). No official SDK found (0 of 15). Nothing public to judge package health (0 of 10)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 72, "points": 6.3, "note": "editorial 61, provenance 82", "reason": "Closed service under Terms of Service effective 1 August 2024 (15 of 30). The privacy policy (June 2026) gives retention periods for logs and deletion, keeps data in the US and leaves PHI to BAAs (22 of 30). Patient Connect's sunset was announced with a date, 30 September 2026, with no general deprecation policy (12 of 20). The trust centre lists AWS as a sub-processor and the policy states US-only processing (12 of 20)." } ], "assessment": { "date": "2026-10-14", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "FHIR search and bulk export, with no documented size controls (12 of 25). Pagination and filters follow FHIR without 1upHealth-specific documentation (8 of 20). Errors are barely documented (5 of 20). No idempotency or retry guidance, though the Patient Access API is read-only (3 of 20). No official SDK, and the authorisation code step needs a person or, per the FAQ, a scripted browser (4 of 15).", "maintenance": "Release 26.09.2 is the latest, numbered for September 2026 but undated (20 of 30). Releases 26.08.2, 26.09 and 26.09.2 fall in the last 90 days by their numbers, without dates (10 of 20). A support portal that needs registration, with no public response record (7 of 15). No official SDK found (0 of 15). Nothing public to judge package health (0 of 10).", "payments": "Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). Sandbox clients in the Dev Portal need a verified email and no card (20). Sign-up is in a browser, Patient Access testing needs an email to 1upHealth to sync the client, and production needs a vetting review (0).", "reliability": "Read with the hosted lines. status.1up.health is a Statuspage site with no components listed, so history can't be tied to an API (12 of 20). No incident since the AWS outage of 20 October 2025, but with no components this says little (20 of 30). No rate limits found (0). No 429, backoff or retry guidance found (0). A 99 per cent SLA with credits in Exhibit A of the terms (10). Patient Access, Provider Access and Payer-to-Payer are generally available. Patient Connect was sunset on 30 September 2026 and is not graded (10).", "schema": "A FHIR CapabilityStatement at each server's /metadata and the CARIN, US Core and Da Vinci implementation guides define the resources, with no OpenAPI (12 of 25). llms.txt indexes 34 Markdown pages (10). Pages say which resources every payer returns and how to test, with little on parameters (8 of 20). Inputs follow the FHIR standard with nothing documented beyond it (6 of 15). curl examples, and the only error example is an HTML 400 page (6 of 15). Release notes are numbered by year and month but undated (8 of 15).", "security": "OAuth 2.0 with authorisation code for member consent, client credentials with scopes for bulk data, 15-minute tokens and secret regeneration. Secrets are posted in the request body (25 of 30). Patient Access is read-only data the member authorised, and bulk scopes are read and search (14 of 20). Claims and clinical records from payers, with no prompt-injection guidance (4 of 15). 1upHealth monitors app activity, with no audit log documented for developers (5 of 15). HITRUST, SOC 2 Type 2 and CSA STAR on a SafeBase trust centre, a bug bounty contact by email, no security.txt (15 of 20).", "transparency": "Closed service under Terms of Service effective 1 August 2024 (15 of 30). The privacy policy (June 2026) gives retention periods for logs and deletion, keeps data in the US and leaves PHI to BAAs (22 of 30). Patient Connect's sunset was announced with a date, 30 September 2026, with no general deprecation policy (12 of 20). The trust centre lists AWS as a sub-processor and the policy states US-only processing (12 of 20)." }, "sources": [ { "what": "documentation index", "url": "https://docs.1up.health/llms.txt", "seen": "2026-10-14" }, { "what": "third-party developers", "url": "https://docs.1up.health/docs/patient-access/dev-implementation.md", "seen": "2026-10-14" }, { "what": "client credentials and OAuth", "url": "https://docs.1up.health/docs/get-started/o-auth.md", "seen": "2026-10-14" }, { "what": "third-party app vetting", "url": "https://docs.1up.health/docs/get-started/third-party-apps.md", "seen": "2026-10-14" }, { "what": "Patient Connect sunset", "url": "https://docs.1up.health/docs/patient-connect.md", "seen": "2026-10-14" }, { "what": "release notes", "url": "https://docs.1up.health/docs/release-notes.md", "seen": "2026-10-14" }, { "what": "FAQ", "url": "https://docs.1up.health/docs/get-started/faq.md", "seen": "2026-10-14" }, { "what": "status incidents", "url": "https://status.1up.health/api/v2/incidents.json", "seen": "2026-10-14" }, { "what": "terms of service", "url": "https://1up.health/terms-of-service/", "seen": "2026-10-14" }, { "what": "privacy policy", "url": "https://1up.health/privacy-policy/", "seen": "2026-10-14" }, { "what": "trust centre", "url": "https://trust.1up.health/", "seen": "2026-10-14" } ], "openQuestions": [ "Release dates are not published, so recency is inferred from version numbers", "No rate limits were found in the documentation", "unchecked: the full sub-processor list behind the trust centre's 'View more' link" ] }, "negative": 0, "verdict": "Self-serve Dev Portal sandbox clients and a demo health plan let an app test the CMS Patient Access, Provider Access and Payer-to-Payer FHIR APIs, backed by HITRUST and SOC 2 Type 2. No rate limits, error formats or dated releases are documented, and the Patient Access OAuth step needs the member in a browser.", "bestFor": "Consumer and care apps that read a member's health plan claims and clinical data under the CMS rules, and payers meeting those rules.", "strengths": [ "Sandbox client credentials from the Dev Portal with only an email verification", "Patient Access client IDs work across every payer production environment 1upHealth runs, once vetted", "Privacy policy with stated retention periods and US-only processing", "HITRUST, SOC 2 Type 2 and CSA STAR on a public trust centre" ], "weaknesses": [ "No rate limits, 429 handling or error formats documented", "Release notes are undated", "The status page lists no components", "Patient Connect, the patient-mediated exchange across health systems, was sunset on 30 September 2026" ], "agentNotes": [ "Hand the Patient Access sign-in to the member, who must authorise in the health plan's auth app", "Exchange the authorisation code within five minutes, and refresh before the 15-minute token expires", "Email payer-patient-access@1up.health with the client ID to get the app synced to the demo environment", "Expect only claims and coverage resources from some payers, and read /r4/metadata first" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 46.8 } ], "editorialScores": { "ergonomics": 32, "maintenance": 37, "payments": 20, "reliability": 52, "schema": 50, "security": 63, "transparency": 61 }, "provenanceScore": 82 }, "connect": { "http": "GET https://api.1uphealthdemo.com/r4/ExplanationOfBenefit\nAuthorization: Bearer \u003caccess-token\u003e" }, "letme": { "capability": "https://letme.dev/health.records", "tool": "https://letme.dev/1uphealth" }, "notable": [ "Third-party apps register in the Dev Portal, test against a demo health plan with a test member, then pass a privacy and security review before production (https://docs.1up.health/docs/get-started/third-party-apps.md)", "At a minimum every payer returns `ExplanationOfBenefit`, `Coverage`, `Organization`, `Patient`, `Practitioner` and `Location` (https://docs.1up.health/docs/patient-access/dev-implementation.md)", "1up Patient Connect, the patient-mediated exchange product, was sunset on 30 September 2026 (https://docs.1up.health/docs/patient-connect.md)", "The FAQ suggests a browserless webdriver such as Selenium to complete the OAuth step in tests (https://docs.1up.health/docs/get-started/faq.md)", "Release 26.09.2 lets Dev Portal users regenerate client secrets, invalidating the old one (https://docs.1up.health/docs/release-notes.md)", "The trust centre on SafeBase lists HITRUST, SOC 2 Type 2, CSA STAR and NIST CSF (https://trust.1up.health/)" ], "area": "domain-data", "details": [ { "label": "APIs", "value": "Patient Access (FHIR R4 read for member-authorised apps), Provider Access and Payer-to-Payer (FHIR Bulk Export), electronic prior authorisation (CRD, DTR, PAS), Provider Directory" }, { "label": "Implementation guides", "value": "CARIN Blue Button for claims, US Core for clinical data, Da Vinci PDEX Plan Net and US Drug Formulary" }, { "label": "Endpoints", "value": "Demo FHIR at https://api.1uphealthdemo.com/r4 with auth at https://auth.1uphealthdemo.com, client credentials at https://gateway.1up.health" }, { "label": "Credentials", "value": "Dev Portal client ID and secret, authorisation code grant for Patient Access, client credentials with scopes for bulk data, 15-minute access tokens, secret regeneration" }, { "label": "Contract", "value": "FHIR CapabilityStatement at {baseUrl}/r4/metadata" }, { "label": "Rate limits", "value": "None found in the documentation" }, { "label": "SLA", "value": "99 per cent availability in Exhibit A of the terms, credits of 1 to 20 per cent, Severity 1 response in 30 minutes" }, { "label": "Status", "value": "status.1up.health on Statuspage, with no components listed and the last incident on 20 October 2025" }, { "label": "Certifications", "value": "HITRUST, SOC 2 Type 2, CSA STAR, NIST CSF and HIPAA per the trust centre. The platform overview says HITRUST i1" } ], "provenance": { "legalEntity": "1upHealth, Inc.", "domain": "1up.health", "domainRegistered": "2017-07-20", "endpointOnVendorDomain": true, "terms": "https://1up.health/terms-of-service/", "privacy": "https://1up.health/privacy-policy/", "statusPage": "https://status.1up.health", "changelog": "https://docs.1up.health/docs/release-notes", "securityTxt": "none", "checked": "2026-10-14", "notes": [ "The Terms of Service (effective 1 August 2024) name 1upHealth, Inc., 280 Summer Street, Boston, MA 02210, and include the SLA as Exhibit A.", "The privacy policy (last updated 25 June 2026) covers the website, keeps logs up to 24 months, clears production data within 30 days and backups within 90 days of a deletion request, keeps data in the US, and leaves PHI to customer BAAs.", "The demo API answers on 1uphealthdemo.com, a separate domain.", "1up.health/.well-known/security.txt returns 404. The trust centre sends vulnerability reports to security@1up.health.", "Release notes carry version numbers such as 26.09.2 but no dates.", "RDAP gives 1up.health a registration date of 2017-07-20." ], "score": 82, "checks": [ { "check": "Legal entity named", "value": "1upHealth, Inc.", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "1up.health, registered 2017-07-20 (9 years)", "points": 11, "max": 15, "state": "part" }, { "check": "Endpoint on the vendor's domain", "value": "1up.health", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "read, states 5 of the 7 things a reader expects, and has 1 clause that costs points", "points": 6.3, "max": 10, "state": "part" }, { "check": "Privacy policy", "value": "read, states 8 of the 8 things a reader expects", "points": 10, "max": 10, "state": "ok" }, { "check": "Status page", "value": "status.1up.health", "points": 10, "max": 10, "state": "ok" }, { "check": "Changelog", "value": "published", "points": 10, "max": 10, "state": "ok" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "https://1up.health/terms-of-service/", "state": "read", "readAt": "2026-10-14", "words": 5861, "points": 6.3, "max": 10, "expected": [ { "key": "terms.date", "label": "Gives the date it was last updated", "found": false }, { "key": "terms.law", "label": "Names the governing law or courts", "found": true, "quote": "These Terms of Service will be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts without reference to its conflict of laws provisions.", "says": "The law of the Commonwealth of Massachusetts" }, { "key": "terms.liability", "label": "States a limit on its liability", "found": true, "quote": "…THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS BASED ON CONTRACT, TORT, OR OTHERWISE, WILL NOT EXCEED THE FEES PAID BY CUSTOMER TO 1UPHEALTH DURING THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENTS GIVING RISE TO THE CLAIM.", "says": "Capped at the fees paid in the 12 months before the claim" }, { "key": "terms.termination", "label": "Says how the agreement or account can be ended", "found": true, "quote": "1upHealth may immediately and without notice limit, suspend, or terminate Customer’s access to or use of the Services to correct or prevent a breach of 1upHealth’s privacy policies, terms and conditions, and the provisions of the Agreement, including without limitation those contained in an SOW by Customer or End User…" }, { "key": "terms.changes", "label": "Says how changes to the terms are announced", "found": false }, { "key": "terms.use", "label": "Lists what users may not do", "found": true, "quote": "Customer may not use the Services if Customer is a resident of a country embargoed by the United States, or are a foreign person or entity blocked or denied by the United States government." }, { "key": "terms.sla", "label": "Refers to a service level or uptime commitment", "found": true, "quote": "For the avoidance of all doubt, in addition to Scheduled Maintenance and Service Outages, the foregoing Service Level is not applicable to outages caused by external circumstances beyond the control of 1upHealth such as weather, acts of terror (“Force Majeure Event”) or any third-party systems;" } ], "toKnow": [ { "key": "terms.benchmark", "label": "Restricts benchmarking or competitive use", "found": true, "quote": "(vii) Perform security, benchmark, or penetration testing of the Services or related infrastructure, or disclose the results of such testing, without the prior written consent of 1upHealth’s Chief Security Officer;", "costsPoints": true }, { "key": "terms.cutoff", "label": "Says access can be ended without notice or for any reason", "found": true, "quote": "1upHealth may immediately and without notice limit, suspend, or terminate Customer’s access to or use of the Services to correct or prevent a breach of 1upHealth’s privacy policies, terms and conditions, and the provisions of the Agreement" } ], "notes": [ { "date": "2026-10-14", "text": "After the initial term of an order form, 1upHealth may raise fees once a calendar year, with 90 days' written notice.", "quote": "Following the termination of the Initial Term (as defined herein) of any Order Form or SOW, 1upHealth shall be entitled to increase the fees charged for any Service once per calendar year." }, { "date": "2026-10-14", "text": "1upHealth may use and display the customer's name and logo to identify it as a customer.", "quote": "Notwithstanding any provision of this Agreement to the contrary, 1upHealth may use and display the Customer’s name, logo and similar indicia to identify Customer as a customer of 1upHealth and may use Customer’s name in connection with the Services and as otherwise set forth herein." } ] }, { "kind": "privacy", "url": "https://1up.health/privacy-policy/", "state": "read", "readAt": "2026-10-14", "statedDate": "2026-06-25", "words": 3809, "points": 10, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last Updated: June 25, 2026", "says": "Last updated 2026-06-25" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "This Policy applies to Personal Data that we collect from or about Users, including Personal Data collected through our website and related marketing activities." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "We retain Personal Data only as long as necessary to provide the Services, comply with our legal and regulatory obligations, resolve disputes, and enforce our agreements.", "says": "For as long as needed, with no period named" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Your Personal Data will be collected, processed, and stored by 1upHealth or its Service Providers in the United States only." }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": true, "quote": "opt out of the processing of your Personal Data for purposes such as targeted advertising, the sale of Personal Data, or certain profiling in furtherance of decisions that produce legal or similarly significant effects (note that 1upHealth does not sell your Personal Data);", "says": "Says it does not sell personal data" }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "The right to access the Personal Data we hold about you." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "If you have questions about this Privacy Policy, wish to exercise a privacy right, request account deletion, report a security concern, or file a complaint, please contact us:" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "The Services are operated from the United States, and Personal Data collected through the Services is collected, stored, and processed in the United States only.", "says": "Data goes to the United States" } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/1uphealth.json", "live": { "slug": "1uphealth", "vendorStatus": { "page": "https://status.1up.health", "indicator": "none", "summary": "All Systems Operational", "checkedAt": "2026-10-14T09:38:50.511902685Z" }, "updatedAt": "2026-10-14T09:38:50.511902685Z" } }, "verify": { "accepts": "a page on 1up.health or one of its subdomains", "badgeUrl": "https://www.anchorterminal.com/badges/1uphealth.svg", "body": { "slug": "1uphealth", "url": "the page with the badge or the link" }, "docs": "https://www.anchorterminal.com/builders/#verify", "effect": "none, it never changes a grade, rank or review", "endpoint": "https://www.anchorterminal.com/api/v1/verify", "listingUrl": "https://www.anchorterminal.com/tools/1uphealth", "mcpTool": "verify_listing", "recheck": "weekly; two failed checks in a row and it lapses, a later pass restores it", "snippets": { "html": "\u003ca href=\"https://www.anchorterminal.com/tools/1uphealth\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/1uphealth.svg\" alt=\"1upHealth on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e", "markdown": "[![1upHealth on Anchor Terminal](https://www.anchorterminal.com/badges/1uphealth.svg)](https://www.anchorterminal.com/tools/1uphealth)", "link": "\u003ca href=\"https://www.anchorterminal.com/tools/1uphealth\"\u003e1upHealth on Anchor Terminal\u003c/a\u003e" } } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/tools/1uphealth", "json": "https://www.anchorterminal.com/tools/1uphealth.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/tools/1uphealth.md", "slim": "https://www.anchorterminal.com/tools/1uphealth.min.md" }, "markdown": "## Overview\n\n**Grade D · 46.8/100 · rank #903 of 1076 · #12 in Health records \u0026 wellness data · not agent-ready · confidence medium**\n\n\n## Assessment\n\nSelf-serve Dev Portal sandbox clients and a demo health plan let an app test the CMS Patient Access, Provider Access and Payer-to-Payer FHIR APIs, backed by HITRUST and SOC 2 Type 2. No rate limits, error formats or dated releases are documented, and the Patient Access OAuth step needs the member in a browser.\n\n## Facts\n\n| Field | Value |\n| --- | --- |\n| Vendor | 1upHealth, Inc. (https://1up.health) |\n| Kind | HTTP API |\n| Category | Health records \u0026 wellness data (https://www.anchorterminal.com/categories/health-data) |\n| Transport | HTTP |\n| Auth | OAuth · Developers register in the 1up Dev Portal, verify an email and create sandbox client credentials. Patient Access uses the authorisation code grant, with the member signing in to the health plan's auth app, and access tokens last 15 minutes. Provider Access and Payer-to-Payer use client credentials with scopes such as `bulk-data\\|user/*.rs`. Client secrets can be regenerated in the Dev Portal. Production access follows 1upHealth's vetting of the app. |\n| Pricing | Paid (Paid) · No public prices. The terms set fees in Order Forms, with one price increase a year on 90 days' notice. The Dev Portal sandbox clients need only a verified email, and no card was mentioned (checked 2026-10-14). |\n| x402 | No · No x402, MPP or L402 in the docs, llms.txt or the terms (checked 2026-10-14). |\n| Licence | Proprietary service under 1upHealth's Terms of Service (effective 1 August 2024) |\n| Docs | https://docs.1up.health |\n| llms.txt | https://docs.1up.health/llms.txt |\n| APIs | Patient Access (FHIR R4 read for member-authorised apps), Provider Access and Payer-to-Payer (FHIR Bulk Export), electronic prior authorisation (CRD, DTR, PAS), Provider Directory |\n| Implementation guides | CARIN Blue Button for claims, US Core for clinical data, Da Vinci PDEX Plan Net and US Drug Formulary |\n| Endpoints | Demo FHIR at https://api.1uphealthdemo.com/r4 with auth at https://auth.1uphealthdemo.com, client credentials at https://gateway.1up.health |\n| Credentials | Dev Portal client ID and secret, authorisation code grant for Patient Access, client credentials with scopes for bulk data, 15-minute access tokens, secret regeneration |\n| Contract | FHIR CapabilityStatement at {baseUrl}/r4/metadata |\n| Rate limits | None found in the documentation |\n| SLA | 99 per cent availability in Exhibit A of the terms, credits of 1 to 20 per cent, Severity 1 response in 30 minutes |\n| Status | status.1up.health on Statuspage, with no components listed and the last incident on 20 October 2025 |\n| Certifications | HITRUST, SOC 2 Type 2, CSA STAR, NIST CSF and HIPAA per the trust centre. The platform overview says HITRUST i1 |\n| Capabilities | health.records, health.fhir, health.consent |\n| Tags | hosted, health-records, claims, fhir, bulk-data, oauth, llms-txt, status-page, sla, free-tier, hitrust, soc2 |\n| JSON | https://www.anchorterminal.com/api/v1/tools/1uphealth.json |\n\n## Score breakdown (methodology v0.4, October 2026 research run)\n\nAssessed 2026-10-14 from public evidence against the published checklist (https://www.anchorterminal.com/benchmark/#checklist). Confidence: medium. Performance and Task success pending (no score, not in the total); the total is Σ(score × weight) ÷ 80 over the 7 assessed categories. \"This run\" is each category's share of the 100 points.\n\n| Category | Weight | This run | Score (0–100) | Points |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% | 20 | 52 | 10.4 |\n| Performance | 10% | pending | pending | n/a |\n| Schema \u0026 documentation | 13% | 16.2 | 50 | 8.1 |\n| Agent ergonomics | 13% | 16.2 | 32 | 5.2 |\n| Security \u0026 auth | 14% | 17.5 | 63 | 11.0 |\n| Payments \u0026 pricing | 10% | 12.5 | 20 | 2.5 |\n| Task success | 10% | pending | pending | n/a |\n| Maintenance \u0026 community | 7% | 8.8 | 37 | 3.2 |\n| Transparency \u0026 trust (editorial 61, provenance 82) | 7% | 8.8 | 72 | 6.3 |\n| Negative events | up to −15 | up to −15 | none recorded | 0 |\n| **Total** | | | | **46.8 → D** |\n\n### Why each score\n\n- Reliability 52: Read with the hosted lines. status.1up.health is a Statuspage site with no components listed, so history can't be tied to an API (12 of 20). No incident since the AWS outage of 20 October 2025, but with no components this says little (20 of 30). No rate limits found (0). No 429, backoff or retry guidance found (0). A 99 per cent SLA with credits in Exhibit A of the terms (10). Patient Access, Provider Access and Payer-to-Payer are generally available. Patient Connect was sunset on 30 September 2026 and is not graded (10).\n- Performance: Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes.\n- Schema \u0026 documentation 50: A FHIR CapabilityStatement at each server's /metadata and the CARIN, US Core and Da Vinci implementation guides define the resources, with no OpenAPI (12 of 25). llms.txt indexes 34 Markdown pages (10). Pages say which resources every payer returns and how to test, with little on parameters (8 of 20). Inputs follow the FHIR standard with nothing documented beyond it (6 of 15). curl examples, and the only error example is an HTML 400 page (6 of 15). Release notes are numbered by year and month but undated (8 of 15).\n- Agent ergonomics 32: FHIR search and bulk export, with no documented size controls (12 of 25). Pagination and filters follow FHIR without 1upHealth-specific documentation (8 of 20). Errors are barely documented (5 of 20). No idempotency or retry guidance, though the Patient Access API is read-only (3 of 20). No official SDK, and the authorisation code step needs a person or, per the FAQ, a scripted browser (4 of 15).\n- Security \u0026 auth 63: OAuth 2.0 with authorisation code for member consent, client credentials with scopes for bulk data, 15-minute tokens and secret regeneration. Secrets are posted in the request body (25 of 30). Patient Access is read-only data the member authorised, and bulk scopes are read and search (14 of 20). Claims and clinical records from payers, with no prompt-injection guidance (4 of 15). 1upHealth monitors app activity, with no audit log documented for developers (5 of 15). HITRUST, SOC 2 Type 2 and CSA STAR on a SafeBase trust centre, a bug bounty contact by email, no security.txt (15 of 20).\n- Payments \u0026 pricing 20: Read with the hosted rubric. No x402, MPP or L402 (0). No published prices (0). Sandbox clients in the Dev Portal need a verified email and no card (20). Sign-up is in a browser, Patient Access testing needs an email to 1upHealth to sync the client, and production needs a vetting review (0).\n- Task success: Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored.\n- Maintenance \u0026 community 37: Release 26.09.2 is the latest, numbered for September 2026 but undated (20 of 30). Releases 26.08.2, 26.09 and 26.09.2 fall in the last 90 days by their numbers, without dates (10 of 20). A support portal that needs registration, with no public response record (7 of 15). No official SDK found (0 of 15). Nothing public to judge package health (0 of 10).\n- Transparency \u0026 trust 72: Closed service under Terms of Service effective 1 August 2024 (15 of 30). The privacy policy (June 2026) gives retention periods for logs and deletion, keeps data in the US and leaves PHI to BAAs (22 of 30). Patient Connect's sunset was announced with a date, 30 September 2026, with no general deprecation policy (12 of 20). The trust centre lists AWS as a sub-processor and the policy states US-only processing (12 of 20).\n\nFix list for a coding agent, everything this grade says the listing lacks, the biggest gain first (13 items): https://www.anchorterminal.com/fixes/1uphealth.md (JSON https://www.anchorterminal.com/fixes/1uphealth.json)\n\n### What we couldn't check\n\n- Release dates are not published, so recency is inferred from version numbers\n- No rate limits were found in the documentation\n- unchecked: the full sub-processor list behind the trust centre's 'View more' link\n\n### Sources\n\n- documentation index: \u003chttps://docs.1up.health/llms.txt\u003e (seen 2026-10-14)\n- third-party developers: \u003chttps://docs.1up.health/docs/patient-access/dev-implementation.md\u003e (seen 2026-10-14)\n- client credentials and OAuth: \u003chttps://docs.1up.health/docs/get-started/o-auth.md\u003e (seen 2026-10-14)\n- third-party app vetting: \u003chttps://docs.1up.health/docs/get-started/third-party-apps.md\u003e (seen 2026-10-14)\n- Patient Connect sunset: \u003chttps://docs.1up.health/docs/patient-connect.md\u003e (seen 2026-10-14)\n- release notes: \u003chttps://docs.1up.health/docs/release-notes.md\u003e (seen 2026-10-14)\n- FAQ: \u003chttps://docs.1up.health/docs/get-started/faq.md\u003e (seen 2026-10-14)\n- status incidents: \u003chttps://status.1up.health/api/v2/incidents.json\u003e (seen 2026-10-14)\n- terms of service: \u003chttps://1up.health/terms-of-service/\u003e (seen 2026-10-14)\n- privacy policy: \u003chttps://1up.health/privacy-policy/\u003e (seen 2026-10-14)\n- trust centre: \u003chttps://trust.1up.health/\u003e (seen 2026-10-14)\n\n## Who's behind it (provenance 82/100, checked 2026-10-14)\n\n| Check | Finding | Points |\n| --- | --- | --- |\n| Legal entity named | 1upHealth, Inc. | 20/20 |\n| Domain age | 1up.health, registered 2017-07-20 (9 years) | 11/15 |\n| Endpoint on the vendor's domain | 1up.health | 15/15 |\n| Terms of service | read, states 5 of the 7 things a reader expects, and has 1 clause that costs points | 6.3/10 |\n| Privacy policy | read, states 8 of the 8 things a reader expects | 10/10 |\n| Status page | status.1up.health | 10/10 |\n| Changelog | published | 10/10 |\n| security.txt | not found | 0/10 |\n\nThe Terms of Service (effective 1 August 2024) name 1upHealth, Inc., 280 Summer Street, Boston, MA 02210, and include the SLA as Exhibit A.\n\nThe privacy policy (last updated 25 June 2026) covers the website, keeps logs up to 24 months, clears production data within 30 days and backups within 90 days of a deletion request, keeps data in the US, and leaves PHI to customer BAAs.\n\nThe demo API answers on 1uphealthdemo.com, a separate domain.\n\n1up.health/.well-known/security.txt returns 404. The trust centre sends vulnerability reports to security@1up.health.\n\nRelease notes carry version numbers such as 26.09.2 but no dates.\n\nRDAP gives 1up.health a registration date of 2017-07-20.\n\n### Terms and privacy, as read\n\nA reading by a fixed set of rules, each answered with the vendor's own sentence. Not legal advice.\n\n**Terms of service** (https://1up.health/terms-of-service/), read 2026-10-14, gives no date, states 5 of the 7 things a reader expects.\n\n- To know. Restricts benchmarking or competitive use (costs points). \"(vii) Perform security, benchmark, or penetration testing of the Services or related infrastructure, or disclose the results of such testing, without the prior written consent of 1upHealth’s Chief Security Officer;\"\n- To know. Says access can be ended without notice or for any reason. \"1upHealth may immediately and without notice limit, suspend, or terminate Customer’s access to or use of the Services to correct or prevent a breach of 1upHealth’s privacy policies, terms and conditions, and the provisions of the Agreement\"\n- Not found in the text. Gives the date it was last updated.\n- Names the governing law or courts. The law of the Commonwealth of Massachusetts.\n- States a limit on its liability. Capped at the fees paid in the 12 months before the claim.\n- Not found in the text. Says how changes to the terms are announced.\n- Also in the text (2026-10-14). After the initial term of an order form, 1upHealth may raise fees once a calendar year, with 90 days' written notice. \"Following the termination of the Initial Term (as defined herein) of any Order Form or SOW, 1upHealth shall be entitled to increase the fees charged for any Service once per calendar year.\"\n- Also in the text (2026-10-14). 1upHealth may use and display the customer's name and logo to identify it as a customer. \"Notwithstanding any provision of this Agreement to the contrary, 1upHealth may use and display the Customer’s name, logo and similar indicia to identify Customer as a customer of 1upHealth and may use Customer’s name in connection with the Services and as otherwise set forth herein.\"\n\n**Privacy policy** (https://1up.health/privacy-policy/), read 2026-10-14, dated 2026-06-25, states 8 of the 8 things a reader expects.\n\n- Gives the date it was last updated. Last updated 2026-06-25.\n- Says how long data is kept. For as long as needed, with no period named.\n- Says whether personal data is sold or shared for advertising. Says it does not sell personal data.\n- Says where data is transferred or stored. Data goes to the United States.\n\n## Live (updated 2026-10-14 09:38 UTC)\n\n- Vendor status page: none, All Systems Operational\n- Always current: https://www.anchorterminal.com/api/v1/live/1uphealth.json\n\n## Probe metrics\n\nNot measured yet. Our benchmark probes haven't run, so there's no availability, latency or error rate from a run and Performance is pending. Live uptime, where we poll the endpoint, is under Live and doesn't change the score.\n\n## Strengths\n\n- Sandbox client credentials from the Dev Portal with only an email verification\n- Patient Access client IDs work across every payer production environment 1upHealth runs, once vetted\n- Privacy policy with stated retention periods and US-only processing\n- HITRUST, SOC 2 Type 2 and CSA STAR on a public trust centre\n\n## Weaknesses\n\n- No rate limits, 429 handling or error formats documented\n- Release notes are undated\n- The status page lists no components\n- Patient Connect, the patient-mediated exchange across health systems, was sunset on 30 September 2026\n\n## Before you call it (notes for agents)\n\n1. Hand the Patient Access sign-in to the member, who must authorise in the health plan's auth app\n2. Exchange the authorisation code within five minutes, and refresh before the 15-minute token expires\n3. Email payer-patient-access@1up.health with the client ID to get the app synced to the demo environment\n4. Expect only claims and coverage resources from some payers, and read /r4/metadata first\n\n## Connect\n\nFirst request:\n\n```bash\nGET https://api.1uphealthdemo.com/r4/ExplanationOfBenefit\nAuthorization: Bearer \u003caccess-token\u003e\n```\n\nThrough letme (picks today, calling later): https://letme.dev/1uphealth. letme answers with the pick and how to call it direct; calling through letme (one key, the vendor's own price) comes later. How it works: https://www.anchorterminal.com/letme/index.md\n\n## Similar tools\n\nRanked by shared capabilities, then score. Same-category tools with no shared capability key are listed last.\n\n| Tool | Grade | Score | Rank | Shared capabilities | x402 | Markdown |\n| --- | --- | --- | --- | --- | --- | --- |\n| Aidbox | B | 64.2 | 385 | health.fhir, health.records, health.consent | no | https://www.anchorterminal.com/tools/aidbox.md |\n| Health Gorilla | C | 59.3 | 583 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/health-gorilla.md |\n| Zus Health | C | 56.6 | 669 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/zus-health.md |\n| Medblocks | D | 52.7 | 773 | health.records, health.consent, health.fhir | no | https://www.anchorterminal.com/tools/medblocks.md |\n| Metriport Medical API | D | 50.1 | 833 | health.records, health.fhir, health.consent | no | https://www.anchorterminal.com/tools/metriport.md |\n| Medplum | B | 68.7 | 216 | health.fhir, health.records | no | https://www.anchorterminal.com/tools/medplum.md |\n\n## Panel reviews (0)\n\nReviewed by the Anchor panel (https://www.anchorterminal.com/reviewers/index.md): .\n\nDesk reviews, written from public documentation, pricing, terms, source and status history on 1 October 2026. No calls made. For a desk review, the outcome says whether the reviewer's questions could be answered from public material: success, partial or failure. How reviews work: https://www.anchorterminal.com/reviews/how-it-works.md\n\n## Notable\n\n- Third-party apps register in the Dev Portal, test against a demo health plan with a test member, then pass a privacy and security review before production (source: \u003chttps://docs.1up.health/docs/get-started/third-party-apps.md\u003e)\n- At a minimum every payer returns `ExplanationOfBenefit`, `Coverage`, `Organization`, `Patient`, `Practitioner` and `Location` (source: \u003chttps://docs.1up.health/docs/patient-access/dev-implementation.md\u003e)\n- 1up Patient Connect, the patient-mediated exchange product, was sunset on 30 September 2026 (source: \u003chttps://docs.1up.health/docs/patient-connect.md\u003e)\n- The FAQ suggests a browserless webdriver such as Selenium to complete the OAuth step in tests (source: \u003chttps://docs.1up.health/docs/get-started/faq.md\u003e)\n- Release 26.09.2 lets Dev Portal users regenerate client secrets, invalidating the old one (source: \u003chttps://docs.1up.health/docs/release-notes.md\u003e)\n- The trust centre on SafeBase lists HITRUST, SOC 2 Type 2, CSA STAR and NIST CSF (source: \u003chttps://trust.1up.health/\u003e)\n\n- #12 of 12 in Best health record and wellness data APIs for AI agents: https://www.anchorterminal.com/best/health-data/index.md\n- All 63 health comparisons: https://www.anchorterminal.com/compare/health-data/index.md\n\n## Compare\n\n- [1upHealth vs ROOK](https://www.anchorterminal.com/compare/1uphealth-vs-rook.md): D 46.8 vs C 54.9\n- [1upHealth vs Terra API](https://www.anchorterminal.com/compare/1uphealth-vs-terra.md): D 46.8 vs B 65.9\n- [1upHealth vs Aidbox](https://www.anchorterminal.com/compare/1uphealth-vs-aidbox.md): D 46.8 vs B 64.2\n- [1upHealth vs Health Gorilla](https://www.anchorterminal.com/compare/1uphealth-vs-health-gorilla.md): D 46.8 vs C 59.3\n- [1upHealth vs Medblocks](https://www.anchorterminal.com/compare/1uphealth-vs-medblocks.md): D 46.8 vs D 52.7\n- [1upHealth vs Medplum](https://www.anchorterminal.com/compare/1uphealth-vs-medplum.md): D 46.8 vs B 68.7\n- [1upHealth vs Metriport Medical API](https://www.anchorterminal.com/compare/1uphealth-vs-metriport.md): D 46.8 vs D 50.1\n- [1upHealth vs Particle Health](https://www.anchorterminal.com/compare/1uphealth-vs-particle-health.md): D 46.8 vs D 48.6\n- [1upHealth vs Redox](https://www.anchorterminal.com/compare/1uphealth-vs-redox.md): D 46.8 vs C 58.3\n- [1upHealth vs Zus Health](https://www.anchorterminal.com/compare/1uphealth-vs-zus-health.md): D 46.8 vs C 56.6\n- [1upHealth vs Validic Inform](https://www.anchorterminal.com/compare/1uphealth-vs-validic.md): D 46.8 vs C 57.9\n\n## Verify this listing\n\nFor the vendor. The badge or a plain link to this page verifies the listing, from a page on 1up.health or one of its subdomains. It shows the listing is the vendor's and that the vendor knows it's here, and it never changes a grade, rank or review. The vendor sends the page's address to `POST https://www.anchorterminal.com/api/v1/verify` as `{\"slug\": \"1uphealth\", \"url\": \"…\"}`, or calls the `verify_listing` tool at https://www.anchorterminal.com/mcp. We fetch the page once, then again every week; two failed checks in a row and the verification lapses, and a later pass restores it. What we check: https://www.anchorterminal.com/builders/index.md#verify\n\nHTML badge:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/1uphealth\"\u003e\u003cimg src=\"https://www.anchorterminal.com/badges/1uphealth.svg\" alt=\"1upHealth on Anchor Terminal\" height=\"20\"\u003e\u003c/a\u003e\n```\n\nMarkdown badge, for a README:\n\n```markdown\n[![1upHealth on Anchor Terminal](https://www.anchorterminal.com/badges/1uphealth.svg)](https://www.anchorterminal.com/tools/1uphealth)\n```\n\nPlain link:\n\n```html\n\u003ca href=\"https://www.anchorterminal.com/tools/1uphealth\"\u003e1upHealth on Anchor Terminal\u003c/a\u003e\n```\n\n## Share this listing\n\nFor the vendor. Sharing assets for social media, two PNGs of 1200 × 630 that say 1upHealth is listed on Anchor Terminal, with the vendor's logo and this page's address and no grade or score.\n\n- Dark: https://www.anchorterminal.com/assets/share/1uphealth-dark.png\n- Light: https://www.anchorterminal.com/assets/share/1uphealth-light.png\n- Create a video and download its frames: https://www.anchorterminal.com/assets/listing-video/index.html?listing=1uphealth\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-14", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Terminal", "url": "https://www.anchorterminal.com/tools/" }, { "name": "Health records \u0026 wellness data", "url": "https://www.anchorterminal.com/categories/health-data" }, { "name": "1upHealth", "url": "" } ], "description": "1upHealth runs FHIR APIs for US health plans, including the CMS Patient Access, Provider Access and Payer-to-Payer APIs, which let member-authorised third-party apps read claims, coverage and clinical data.", "facts": [ "rank #903 of 1076", "OAuth auth", "0 desk reviews" ], "h1": "1upHealth", "image": "https://www.anchorterminal.com/assets/og/tools-1uphealth.png", "path": "/tools/1uphealth", "published": "2026-10-01", "section": "tools", "title": "1upHealth review (2026): pricing, alternatives and grade D", "toc": null, "updated": "2026-10-14", "url": "https://www.anchorterminal.com/tools/1uphealth" }, "tokens": { "markdown": 5300, "slim": 1330 }, "version": 1 }