The CMS Medicare App Library: What a Health App Must Meet

CMS calls its Health Technology Ecosystem "a movement, not a mandate" and "a call to action, not a regulation". The Medicare App Library is the part of it a consumer health app can join: in CMS's words, "a trusted, centralized directory where people with Medicare can discover and access vetted digital health care options." This page sets out what CMS's own pages say about it, read on November 5, 2026: Requirements for the Medicare App Library, Submit your app, Health Tech Ecosystem Categories and the library itself at medicare.gov/health-apps. It is general information, not legal advice.

What the library is#

CMS uses "apps" as "an inclusive term that encompasses traditional mobile and web applications, technology-enabled care services, digital health platforms, and innovative care delivery tools", and says every option in the library "will have undergone rigorous evaluation to ensure they meet high standards for security, privacy, clinical evidence, usability, and equity."

On Medicare.gov the library is headed "Third-party apps that connect to Medicare". It tells beneficiaries the apps were "developed by private companies", are "Independently verified to ensure they meet high standards for protecting and exchanging your health information", and "Can only access the Medicare data you choose to share." On November 5, 2026 it also listed a group of "Apps that are almost ready for Medicare", where "Medicare is finishing the final checks".

What CMS offers in return, from its requirements page: "Access to 68+ million Medicare enrollees seeking trusted digital health solutions", "Placement in the Medicare.gov App Library", "Negotiated identity verification pricing through ID.me and CLEAR", and access to the CMS Aligned Networks and the identity services on Medicare.gov. CMS's pages do not publish fees for the vetting reviews or for identity verification.

Who can apply#

CMS says the library is for "Apps that integrate with CMS Aligned Networks and meet one of three use cases":

The categories page adds a caution for all three: "The below criteria are meant to be visionary and to illustrate the goals of the initiative. For criteria that are less mature, early adopters will collaborate with CMS to document and publish implementation guidelines." It also lists optional extras an app can add, such as modern scheduling, price transparency, real-time benefits and clinical trial matching.

The six core requirements#

On top of a use case, CMS says "Patient-facing apps must meet these six core requirements":

1. Identity verification. "Support secure patient identity verification using CMS-approved IAL2/AAL2 standards (e.g., mDLs, passkeys) to enable access to health records from CMS Aligned Networks." The submit page names the services: "Partner with ID.me or CLEAR to implement secure identity verification."
2. Medicare connectivity. "Enable Medicare.gov notifications for Beneficiaries (notices, EOBs, fraud alerts)".
3. CMS review. Disclose data sources and terms or agreements, and complete a security checklist.
4. Trial access. "Provide trial access for Medicare patients if the app charges a fee".
5. Discovery experience. Allow the app to be featured in the Medicare.gov "app store" interface as a recommended option.
6. HIPAA compliance. "Operate consistent with HIPAA Rules when functioning as a covered entity or business associate".

Participants in CMS's ACCESS Model are exempt from the CMS review and trial-access requirements, which CMS says the ACCESS Model covers instead.

The interoperability and accreditation bar#

CMS's submit page groups the pledge requirements into "security and privacy, interoperability, and independent accreditation", and is specific on the standards:

• Interoperability. "Your app must support FHIR R4, SMART on FHIR authorization, and integrate with a CMS Aligned Network." A CMS Aligned Network is a health data network that meets the CMS Interoperability Framework; the categories page says networks "will self-attest to meet the interoperability criteria and agree to be reviewed if suspected to not be meeting the criteria." An app can reach one directly or through a personal health record app.
• Accreditation. "Choose either the DiMe Seal or CARIN Alliance Code of Conduct with DirectTrust Accreditation." The requirements page says DiMe's review covers "clinical evidence, privacy and security, usability, equity, and technical standards", and that "Regardless of which path you choose, you will need to sign the CARIN Code of Conduct and get reviewed by either DirectTrust or DiME."

The process, step by step#

CMS lists seven steps:

1. Pledge. Sign the Health Tech Ecosystem pledge and apply as a patient-facing app participant.
2. Identity verification. Implement IAL2/AAL2 verification with ID.me or CLEAR.
3. CMS Aligned Network connection. Connect directly or through a personal health record app "to enable secure FHIR-based health data exchange."
4. Third-party review. DiMe or DirectTrust, plus the CARIN Code of Conduct.
5. Medicare App Library application. CMS says it covers "developer information, ecosystem integration details, identity provider confirmation, vetting documentation, privacy disclosures, and materials needed for the App Library listing (logos, screenshots, promotional video, and app store links)."
6. CMS review. "CMS validates Medicare-specific requirements, including use case alignment, CMS Aligned Network connectivity, data handling capabilities, and legal agreements."
7. Launch. The app is featured in the library on Medicare.gov.

Timeline#

CMS's pages give no single launch date for the library, and they state no application deadline. The CMS press release is White House, Tech Leaders Commit to Create Patient-Centric Healthcare Ecosystem. Samsung's announcement is on Samsung Mobile Press, and the library's Samsung Health listing is live on Medicare.gov.

What it means for fitness and health app developers#

Our reading of CMS's pages, as judgment rather than CMS's words:

• A fitness app alone is not the target. Every use case requires a connection to a CMS Aligned Network for clinical records. A step counter, workout logger or wearable dashboard that never touches clinical data does not meet any of the three. The nearest fit is the diabetes and obesity use case, which names "nutrition/activity tracking" but only as part of coaching built from the clinical record.
• Wearable data is a feature, not the entry ticket. Samsung's Medicare.gov listing describes activity, food and medication tracking alongside health records. The library rewards an app that joins everyday wellness data to the clinical record, which is the integration job covered in wearable data to an EHR with FHIR.
• Joining does not make you a HIPAA covered entity. CMS's core requirement is to operate consistent with HIPAA "when functioning as a covered entity or business associate", and its pages say nothing in them is intended to "contravene, supersede, or preempt" HIPAA or state privacy laws. Whether HIPAA applies to you is the same question it always was; see does your fitness app need HIPAA. Consumer-health laws such as the FTC Health Breach Notification Rule still apply where HIPAA does not.
• Budget for three outside parties. An identity provider (ID.me or CLEAR), a reviewer (DiMe or DirectTrust) and a network connection, before CMS's own review. None of their prices appear on CMS's pages, so ask each one.
• Plan the paid-app rule early. If you charge, CMS requires trial access for Medicare patients, which affects how a subscription paywall is built.

For reading clinical records on the device, see the clinical records APIs page; for Samsung's own developer route, see how to integrate Samsung Health.