Captcha?

[bonetechnologies]

Hi,

Was curious if its within the mandate to place a Captcha in front of the MRF files. We deal with heavy bot usage on our web properties and this is a concern, that these files will be retrieved repeatedly by bots.

Looking to ensure that the people who need to download these files can, and that bots don't take all available bandwidth.

Thank you

[Devyandu]

IMHO having a Recaptcha would not be acceptable given that these are "Machine Readable" files and not "Human Readable".
We cannot having any hinderance for machines being able to get to these files.

Please see https://www.govinfo.gov/content/pkg/FR-2021-08-04/pdf/2021-15496.pdf. Page 301 (or search for the word ReCaptcha).
This guidance is for the same MRF regulation as it applies to hospitals, so I would assume similar guidance applies to Payers/Plans as well.

Developing file constructs and web
forms that obscure access to the data in
a single machine-readable file through
the use of Application Programming
Interfaces (APIs). For example, we have
found APIs that use calls for data that
will not return a complete data file, that
do not provide supporting
documentation on the use of the API to
retrieve the file, and that do not allow
a single query to return all data in a
single machine-readable file. These APIs
control access to the data in a way that
prevents or conceals access to the entire
data file. As such, these types of APIs
present barriers to direct access to a
‘single machine-readable file’ and are
therefore not permissible forms of APIs
for use by a hospital.
Given this additional experience, we
are proposing to amend the regulations
by adding paragraph (d)(3)(iv) to
§ 180.50 to specify that the hospital
must ensure that the standard charge
information is easily accessible, without
barriers, including, but not limited to,
ensuring the information is accessible to
automated searches and direct file
downloads through a link posted on a
publicly available website. We believe
this additional requirement will ensure
greater accessibility to the machinereadable file and its contents and would
prohibit practices we have encountered
in our compliance reviews, such as lack
of a link for downloading a single
machine-readable file, using ‘‘blocking
codes’’ or CAPTCHA, and requiring the
user to agreement to terms and
conditions or submit other information
prior to access.

PS : I am not with CMS.

[garysolebc]

These need to be machine readable, and arguably most of them will likely only be useful to machine consumption. The files are going to be super large, typically in the tens of Gigabytes in size for many. Also, would be very hard for a human to really consume manually. I think bots would actually have a tough time trying to read and consume some of these files. Similar discussion here: #180

[shaselton-usds]

@Devyandu is correct. At this point, implementing a Captcha would not be allowed. Current restrictions can be found here in the documentation.