Developer Terms of Service

Effective date: January 1, 2025

These Developer Terms of Service ("Agreement") govern access to and use of the Provider Access API ("API") provided under this developer portal by a provider organization identified by its National Provider Identifier ("NPI"). By registering a system for Provider Access API access, you agree to be bound by this Agreement on behalf of the provider organization you represent.

1. Permitted Use

Access to the API is granted solely to support treatment and care coordination for patients with whom the registered provider organization has an active treatment relationship, consistent with the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) and applicable federal and state law. Access to any given patient's data is limited to patients attributed to your organization's NPI under this portal's attribution rules, and is unavailable for any patient who has opted out of provider data sharing — regardless of whether an attribution otherwise exists.

You may use the API only to:

• Retrieve health data for patients with whom your organization has an active, attributed treatment relationship.
• Support treatment, care coordination, and related activities for which your organization is independently authorized to use patient health information under HIPAA as a treating provider.
• Integrate retrieved data into your organization's own clinical systems solely for the purposes above.

You may not use the API for underwriting, marketing, advertising targeting, sale of data to third parties, re-identification of de-identified data, or any purpose not directly related to treating an attributed patient, nor for any use prohibited by HIPAA or applicable state privacy law. A response indicating that a patient has opted out must be treated as a hard stop — you may not attempt to obtain that patient's data through repeated requests or any other means.

2. Provider Organization Obligations

You agree to the following obligations as a condition of API access:

• Attribution accuracy: You must promptly notify us of any change to your organization's NPI, group composition, or the termination of a provider's affiliation with your organization that would affect who may legitimately be attributed to you.
• Minimum necessary: You must retrieve and retain only the data reasonably necessary to support the treatment relationship, and must not retain data beyond what is necessary for that purpose or required by law.
• Security: You must implement and maintain reasonable administrative, physical, and technical safeguards to protect patient data accessed through the API, consistent with HIPAA Security Rule standards.
• Sensitive records: Where data obtained through the API includes records subject to 42 CFR Part 2 (substance use disorder treatment records) or other heightened confidentiality protections, you must comply with those requirements in addition to HIPAA.
• Credential security: You are responsible for generating and safeguarding the private key corresponding to the public key certificate you submit at registration. You must not share your private key with us or anyone else, embed it in publicly accessible code, or use it outside the system registered with this portal, and must notify us promptly if you suspect it has been compromised so we can register a replacement certificate.
• Compliance: You are responsible for ensuring your organization's use of the API complies with all applicable federal and state laws, including but not limited to HIPAA, 42 CFR Part 2 where applicable, and applicable state breach notification requirements.
• Accurate registration: You must keep your registered NPI, organization details, and contact information current. Notify us promptly of any changes.

3. Termination and Revocation

We reserve the right to suspend or revoke your API access at any time, with or without notice, if we reasonably determine that:

• You have violated any provision of this Agreement.
• Your system poses a security risk to patients or our systems.
• You have misrepresented information in your registration request, including your NPI or organizational affiliation.
• Your organization no longer has an active treatment relationship justifying continued attribution-based access.
• Continued access would violate applicable law or regulatory requirements.

Upon termination, you must immediately cease use of the API and delete any data obtained through the API unless retention is required by law or independently permitted under your organization's own HIPAA obligations as a treating provider.

All termination decisions will be documented with a specific reason consistent with the information-blocking requirements of the 21st Century Cures Act.

4. Disclaimers and Limitation of Liability

The API is provided "as is" without warranties of any kind, express or implied. We do not warrant that the API will be uninterrupted, error-free, or that data returned will be complete or accurate. We are not liable for any damages arising from your use of or inability to use the API.

5. Governing Law

This Agreement shall be governed by and construed in accordance with the laws of [Governing State Placeholder], United States, without regard to its conflict of law provisions.

6. Changes to This Agreement

We may update this Agreement from time to time. Continued use of the API after the effective date of any revision constitutes acceptance of the updated terms. The current effective date is shown at the top of this page.

Questions about this Agreement? Contact api-support@wasatch.org.