> ## Documentation Index
> Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Arizona CSPMP/PDMP Integration — Admin Guide

> Configuring the Arizona PDMP integration: gateway provider, go-live gate, vault credentials, permissions, and the Bamboo Health onboarding path.

## Overview

CL-17 connects Encore to the Arizona CSPMP through a **vendor-agnostic adapter**
(CL-17-EN-01): the production vendor is a configuration choice, not a code change.
Until a gateway vendor is contracted, the electronic path stays **off** and
prescribers use the built-in manual portal flow — which fully satisfies the
prescriber duty under A.R.S. § 36-2606(F).

Two distinct obligations matter:

| Obligation                                                                                                                                             | Who               | Status                                              |
| ------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------- | --------------------------------------------------- |
| Prescriber must review the CSPMP report before prescribing (§ 36-2606(F); becomes (E) on 2026-09-12 and tightens to every prescription **and refill**) | Each prescriber   | Satisfied today via portal check + attestation      |
| EMR vendor must integrate with the CSPMP by **Dec 31, 2026** (§ 36-2606(I); becomes (H))                                                               | Encore (platform) | Adapter shipped; go-live gated on vendor onboarding |

## Configuration (`cl_pdmp_configuration`, one row per organization)

| Field                      | Meaning                                                                                                                                                         |
| -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `gateway_provider`         | `pmp_gateway` / `bamboo_health` (same product — Bamboo Health PMP Gateway) or `arizona_hie` (Contexture; reserved, unverified in 2026)                          |
| `pdmp_adapter_enabled`     | **Go-live gate, default false.** The edge function fails closed (HTTP 412) while false. Enable only after the vendor contract + BAA + credentials are in place. |
| `credentials_vault_ref`    | Platform-vault reference for gateway credentials. Never store secrets in this table or in `adapter_options`.                                                    |
| `adapter_options`          | Vendor-specific, non-secret options (populated during onboarding).                                                                                              |
| `auto_query_enabled`       | Auto-query on controlled-substance prescribing. Strongly recommended once live — from 2026-09-12 the check is required for every prescription and refill.       |
| `interstate_query_enabled` | Adds border states to gateway queries (PMP InterConnect).                                                                                                       |
| `delegate_access_enabled`  | Delegate workflows. Note: gateway integrations do not carry delegate queries — delegates use the AWARxE portal with their own accounts.                         |

## Go-live path (Bamboo Health PMP Gateway — recommended)

1. **File the Integration Interest Form** via Bamboo Customer Connect
   (connect.bamboohealth.com, linked from pharmacypmp.az.gov/pmp-integration).
   Arizona **state-funds** Gateway for non-federal healthcare entities — no
   license charge. New-vendor onboarding takes weeks to months: start early.
2. Sign the state Terms & Conditions; the AZ Board of Pharmacy approves the
   organization (\~1 week) and Bamboo schedules the technical engagement.
3. Platform team implements the Bamboo XML call behind the existing adapter and
   stores credentials in the vault (`credentials_vault_ref`).
4. Set `pdmp_adapter_enabled = true` for the organization. Prescribers gain the
   **Query PDMP** button; the portal flow remains as fallback.

Note: Arizona's funded tier returns the **basic PMP report — NarxCare risk
scores are not included** — so risk indicators may be absent from results.

## Permissions (PF-30)

| Key                      | Grants                                                      |
| ------------------------ | ----------------------------------------------------------- |
| `cl.pdmp.queries.view`   | View PDMP history on a chart                                |
| `cl.pdmp.queries.create` | Run queries (electronic or manual portal record) and attest |

## Compliance notes

* Every check writes an immutable `cl_pdmp_queries` audit row (PHI table, org-scoped
  RLS). Manual portal checks record "checked + reviewed" in one action; gateway
  outages are recorded automatically (`exception_type`) as safe-harbor evidence.
* AHCCCS (AMPM 940) requires the medical record to show CSPMP use before
  prescribing controlled substances — the chart's PDMP history is that evidence.
* Do **not** attempt to embed or scrape the AWARxE portal: embedding is blocked
  by the state (X-Frame-Options), and automated portal access is legally
  restricted (A.R.S. § 36-2604(C), § 36-2610(D)).
* Full connectivity research and citations:
  `specs/cl/research/CL-17-EN-01-RESEARCH.md`.

## Related

* [User guide](./cl-17-user-guide.md) — prescriber/delegate workflows.