Source: https://www.healthit.gov/condition-ccg/application-programming-interfaces
Timestamp: 2020-08-14 12:14:19
Document Index: 515769205

Matched Legal Cases: ['§ 170', '§170', '§ 170', '§ 171', '§ 171', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 171', '§ 171', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§\u2009170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§\u2009170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170', '§ 170']

Application Programming Interfaces | HealthIT.gov
§ 170.404 Application Programming Interfaces
§170.404 Application programming interfaces.
The following Condition and Maintenance of Certification requirements apply to developers of Health IT Modules certified to any of the certification criteria adopted in § 170.315(g)(7) through (10).
Condition of certification requirements—
General. A Certified API Developer must publish APIs and allow electronic health information from such technology to be accessed, exchanged, and used without special effort through the use of APIs or successor technology or standards, as provided for under applicable law, including providing access to all data elements of a patient’s electronic health record to the extent permissible under applicable privacy laws.
Transparency conditions—
Complete business and technical documentation. A Certified API Developer must publish complete business and technical documentation, including the documentation described in paragraph (a)(2)(ii) of this section, via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps.
Material information. A Certified API Developer must publish all terms and conditions for its certified API technology, including any fees, restrictions, limitations, obligations, registration process requirements, or other similar requirements that would be:
Needed to develop software applications to interact with the certified API technology;
Needed to distribute, deploy, and enable the use of software applications in production environments that use the certified API technology;
Needed to use software applications, including to access, exchange, and use electronic health information by means of the certified API technology;
Needed to use any electronic health information obtained by means of the certified API technology;
Used to verify the authenticity of API Users; and
Used to register software applications.
API fees. Any and all fees charged by a Certified API Developer for the use of its certified API technology must be described in detailed, plain language. The description of the fees must include all material information, including but not limited to:
The persons or classes of persons to whom the fee applies;
The circumstances in which the fee applies; and
The amount of the fee, which for variable fees must include the specific variable(s) and methodology(ies) that will be used to calculate the fee.
Fees conditions—
All fees. All fees related to certified API technology not otherwise permitted by this section are prohibited from being imposed by a Certified API Developer. The permitted fees in paragraphs (a)(3)(ii) and (iv) of this section may include fees that result in a reasonable profit margin in accordance with § 171.302.
Permitted fees. For all permitted fees, a Certified API Developer must:
Ensure that such fees are based on objective and verifiable criteria that are uniformly applied to all similarly situated API Information Sources and API Users;
Ensure that such fees imposed on API Information Sources are reasonably related to the Certified API Developer’s costs to supply certified API technology to, and if applicable, support certified API technology for, API Information Sources;
Ensure that such fees to supply and, if applicable, support certified API technology are reasonably allocated among all similarly situated API Information Sources; and
Ensure that such fees are not based on whether API Information Sources or API Users are competitors, potential competitors, or will be using the certified API technology in a way that facilitates competition with the Certified API Developer.
Prohibited fees. A Certified API Developer is prohibited from charging fees for the following:
Opportunity costs unrelated to the access, exchange, or use of electronic health information; and
The permitted fees in this section cannot include any costs that led to the creation of intellectual property if the actor charged a royalty for that intellectual property pursuant to § 171.303 and that royalty included the development costs for the creation of the intellectual property.
Record-keeping requirements. A Certified API Developer must keep for inspection detailed records of any fees charged with respect to the certified API technology, the methodology(ies) used to calculate such fees, and the specific costs to which such fees are attributed.
Permitted fee – development, deployment, and upgrades. A Certified API Developer is permitted to charge fees to an API Information Source to recover the costs reasonably incurred by the Certified API Developer to develop, deploy, and upgrade certified API technology.
Permitted fee – recovering API usage costs. A Certified API Developer is permitted to charge fees to an API Information Source related to the use of certified API technology. The fees must be limited to the recovery of incremental costs reasonably incurred by the Certified API Developer when it hosts certified API technology on behalf of the API Information Source.
Permitted fee – value-added services. A Certified API Developer is permitted to charge fees to an API User for value-added services related to certified API technology, so long as such services are not necessary to efficiently and effectively develop and deploy production-ready software that interacts with certified API technology.
Openness and pro-competitive conditions; general condition. A Certified API Developer must grant an API Information Source the independent ability to permit an API User to interact with the certified API technology deployed by the API Information Source.
A Certified API Developer must provide certified API technology to an API Information Source on terms that are no less favorable than it provides to itself and its own customers, suppliers, partners, and other persons with whom it has a business relationship.
The terms on which a Certified API Developer provides certified API technology must be based on objective and verifiable criteria that are uniformly applied to all substantially similar or similarly situated classes of persons and requests.
A Certified API Developer must not offer different terms or services based on:
Whether a competitive relationship exists or would be created;
The revenue or other value that another party may receive from using the API technology.
Rights to access and use certified API technology—
Rights that must be granted. A Certified API Developer must have and, upon request, must grant to API Information Sources and API Users all rights that may be reasonably necessary to:
Prohibited conduct. A Certified API Developer is prohibited from conditioning the receipt of the rights described in paragraph (a)(4)(ii)(A) of this section on:
Receiving a fee, including but not limited to a license fee, royalty, or revenue-sharing arrangement;
Agreeing to not compete with the Certified API Developer in any product, service, or market;
Agreeing to deal exclusively with the Certified API Developer in any product, service, or market;
Obtaining additional licenses, products, or services that are not related to or can be unbundled from the certified API technology;
Licensing, granting, assigning, or transferring any intellectual property to the Certified API Developer;
Meeting any Certified API Developer-specific testing or certification requirements; and.
Providing the Certified API Developer or its technology with reciprocal access to application data.
Service and support obligations. A Certified API Developer must provide all support and other services reasonably necessary to enable the effective development, deployment, and use of certified API technology by API Information Sources and API Users in production environments.
Changes and updates to certified API technology. A Certified API Developer must make reasonable efforts to maintain the compatibility of its certified API technology and to otherwise avoid disrupting the use of certified API technology in production environments.
Changes to terms and conditions. Except as exigent circumstances require, prior to making changes to its certified API technology or the terms and conditions thereof, a Certified API Developer must provide notice and a reasonable opportunity for API Information Sources and API Users to update their applications to preserve compatibility with certified API technology and to comply with applicable terms and conditions.
Maintenance of certification requirements—
Authenticity verification and registration for production use. The following apply to a Certified API Developer with a Health IT Module certified to the certification criterion adopted in § 170.315(g)(10):
Authenticity verification. A Certified API Developer is permitted to institute a process to verify the authenticity of API Users so long as such process is objective and the same for all API Users and completed within ten business days of receipt of an API User’s request to register their software application for use with the Certified API Developer’s Health IT Module certified to § 170.315(g)(10).
Registration for production use. A Certified API Developer must register and enable all applications for production use within five business days of completing its verification of an API User’s authenticity, pursuant to paragraph (b)(1)(i) of this section.
Service base URL publication. A Certified API Developer must publish the service base URLs for all Health IT Modules certified to § 170.315(g)(10) that can be used by patients to access their electronic health information. The Certified API Developer must publicly publish the service base URLs:
For all of its customers regardless of whether the Health IT Modules certified to § 170.315(g)(10) are centrally managed by the Certified API Developer or locally deployed by an API Information Source; and
In a machine-readable format at no charge.
Rollout of (g)(10)-certified APIs. A Certified API Developer with certified API technology previously certified to the certification criterion in § 170.315(g)(8) must provide all API Information Sources with such certified API technology deployed with certified API technology certified to the certification criterion in § 170.315(g)(10) by no later than May 2, 2022.
Compliance for existing certified API technology. By no later than November 2, 2020 a Certified API Developer with Health IT Module(s) certified to the certification criteria in § 170.315(g)(7), (8), or (9) must comply with paragraph (a) of this section, including revisions to their existing business and technical API documentation and make such documentation available via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps.
API Information Source means an organization that deploys certified API technology created by a “Certified API Developer;”
API User means a person or entity that creates or uses software applications that interact with the “certified API technology” developed by a “Certified API Developer” and deployed by an “API Information Source;”
Certified API Developer means a health IT developer that creates the “certified API technology” that is certified to any of the certification criteria adopted in § 170.315(g)(7) through (10).
Certified API technology means the capabilities of Health IT Modules that are certified to any of the API-focused certification criteria adopted in § 170.315(g)(7) through (10).
Certification Companion Guide: Application Programming Interfaces
This Certification Companion Guide (CCG) is an informative document designed to assist health IT developers to meet the Conditions and Maintenance of Certification requirements. This CCG is not a substitute for the 21st Century Cures Act: Interoperability, Information Blocking, and the ONC Health IT Certification Program Final Rule (ONC Cures Act Final Rule). This CCG extracts key portions of the ONC Cures Act Final Rule’s preamble and includes subsequent clarifying interpretations. To access the full context of regulatory intent please consult the ONC Cures Act Final Rule or other included regulatory reference. This CCG is for public use and should not be sold or redistributed.
Outlined below is a summary of the attestation requirements for the Condition and Maintenance of Certification for 170.404 Application Programming Interfaces. For additional details related to the requirements please refer to the ONC Cures Act Final Rule.
The health IT developer provides certified API technology to an API Information Source on terms that are no less favorable than it provides to itself and its own customers. The terms on which we provided certified API technology were based on objective and verifiable criteria that are uniformly applied to all substantially similar or similarly situated classes of persons and requests.
The health IT developer charges fees for the use of the certified API technology described in detailed, plain language. The description of the fees includes all material information, including but not limited to: the persons or classes of persons to whom the fee applies; the circumstances in which the fee applies; and the amount of the fee, which for variable fees must include the specific variable(s) and methodology(ies) that will be used to calculate the fee.
The health IT developer does not charge fees for the following: costs associated with intangible assets other than actual development or acquisition costs of such assets; opportunity costs unrelated to the access, exchange, or use of electronic health information; and any costs that led to the creation of intellectual property if the actor charged a royalty for that intellectual property pursuant to § 171.303 and that royalty included the development costs for the creation of the intellectual property.
The health IT developer keeps for inspection detailed records of any fees charged with respect to the certified API technology, the methodology(ies) used to calculate such fees, and the specific costs to which such fees are attributed.
The health IT developer does not condition the receipt of the rights described in paragraph (a)(4)(ii)(A) of this section.
All fees related to certified API technology not otherwise permitted by this section are prohibited from being imposed by the health IT developer. The permitted fees in paragraphs (a)(3)(ii) and (a)(3)(iv) of this section may include fees that result in a reasonable profit margin in accordance with § 171.302.
The health IT developer provides all support and other services reasonably necessary to enable the effective development and use of certified API technology by API Information Sources and API Users in production environments.
The health IT developer makes reasonable efforts to maintain the compatibility of its certified API technology and to otherwise avoid disrupting the use of certified API technology in production environments.
The health IT developer institutes a process to verify the authenticity of API Users that is objective and the same for all API Users and completed within 10 business days of receipt of an API User’s request to register its software application for use with its Health IT Module certified to § 170.315(g)(10).
The health IT developer registers and enables all applications for production use within five business days of completing its verification of an API User’s authenticity, pursuant to paragraph (b)(1)(i) of this section.
The health IT developer publishes the service base URLs for all Health IT Modules certified to § 170.315(g)(10) that can be used by patients to access their electronic health information.
The health IT developer with certified API technology previously certified to the certification criterion in § 170.315(g)(8), provides all API Information Sources with such certified API technology deployed with certified API technology certified to the certification criterion in § 170.315(g)(10) no later than May 2, 2022 (with enforcement discretion until August 2, 2022).
A health IT developer with Health IT Module(s) certified to the certification criteria in § 170.315(g)(7), (8), or (9) complies with paragraph (a) of this section, including revisions to its existing business and technical API documentation and makes such documentation available via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps no later than November 2, 2020 (with enforcement discretion until February 1, 2022).
Applicability: Health IT Modules certified to any one or more certification criteria in § 170.315 (g)(7) through (10)
Applies to Conditions and Maintenance of Certification Requirements
The Conditions and Maintenance of Certification requirements only apply to practices of Certified API Developers with respect to the capabilities included in § 170.315(g)(7) through (10).
(a) Conditions of certification requirements–(1) General.
The data required and that must be supported to demonstrate conformance to the final § 170.315(g)(10) certification criterion (including all of its associated standards and implementation specifications) constitutes “all data elements of a patient’s electronic health record to the extent permissible under applicable privacy laws.”
(a) Conditions of certification requirements–(2) Transparency conditions.
This provision of the Condition of Certification requirements does not prohibit additional content or limit the type of content a Certified API Developer may include in its terms and conditions. A Certified API Developer would be permitted to include consumer protections in its terms and conditions documentation.
(a) Conditions of certification requirements–(3) Fees conditions–(i) General conditions.
Certified API Developers and API Users have the ability to collaborate and form relationships, so long as these relationships do not conflict with any of the provisions of the ONC Cures Act Final Rule or other applicable federal and state laws and regulations.
While the permitted fees set the boundaries for the fees Certified API Developers are permitted to charge and to whom those permitted fees can be charged, they do not prohibit who may pay the Certified API Developer’s permitted fee. In other words, these conditions limit the party from which a Certified API Developer may require payment, but they do not speak to who may pay the fee.
Fees charged for “value-added services” can arise between an API Information Source and Certified API Developer or API User.
Our goal with the requirement that fees be “objective and verifiable” is to require Certified API Developers to apply fee criteria that, among other things, will lead the Certified API Developer to come to the same conclusion with respect to the permitted fee’s amount each time it administers a fee to an API Information Source or API User. Accordingly, the fee cannot be based on the Certified API Developer’s subjective judgment or discretion.
Non-exhaustive examples of fees for services that Certified API Developers would be prohibited from charging:
Any fee for access to the documentation that a Certified API Developer is required to publish or make available under this Condition of Certification requirement.
Any fee for access to other types of documentation or information that a software developer may reasonably require to make effective use of certified API technology for any legally permissible purpose.
Any fee in connection with any services that would be essential to a developer or other person’s ability to develop and commercially distribute production-ready applications that use certified API technology. These services could include, for example, access to “test environments” and other resources that an application developer would need to efficiently design and develop apps. The services could also include access to distribution channels if they are necessary to deploy production-ready software and to production resources, such as the information needed to connect to certified API technology (e.g., service base URLs) or the ability to dynamically register with an authorization server.
Fees for requirements beyond what a Certified API Developer considers necessary to successfully deploy applications in production are considered supplemental to the development, testing, and deployment of software applications that interact with certified API technology, and can be classified as permitted fees for value-added services as finalized in § 170.404(a)(3)(iv).
The API Condition and Maintenance of Certification covers a narrower scope of potential fees than the information blocking section. The fees in this Condition and Maintenance of Certification are specific to certified API technology while the fees discussed in the information blocking section relate to the access, exchange, or use of EHI regardless of the particular technology used.
(a) Conditions of certification requirements–(3) Fees conditions–(ii) Permitted fee – development, deployment, and upgrades.
The nature of the costs charged under § 170.404(a)(3)(ii) depends on the scope of the work to be undertaken by a Certified API Developer (i.e., how much or how little labor an API Information Source requires of the Certified API Developer to deploy and upgrade the certified API technology).
Regarding the “development, deployment, and upgrades” described in § 170.404(a)(3)(ii), while we understand that there is overlap between features of the certified API technology and the “broader EHR product,” we refer specifically to development, deployment, and upgrades made to “certified API technology” as defined in § 170.404(c). Namely, development, deployment, and upgrades made to the capabilities of certified Health IT Modules that fulfill the API-focused certification criteria adopted at § 170.315(g)(7) through (10).
Regarding the use of the term “developing” in § 170.404(a)(3)(ii), fees for “developing” certified API technology comprise the Certified API Developer’s costs of designing, developing, and testing certified API technology. Fees for developing certified API technology must not include the Certified API Developer’s costs of updating the non-API related capabilities of the Certified API Developer’s existing Health IT Modules, including its databases, as part of its development of the certified API technology. These costs are typically connected to past business decisions made by the Certified API Developer and typically arise due to Health IT Modules being designed or implemented in nonstandard ways that unnecessarily increase the complexity, difficulty or burden of accessing, exchanging, or using EHI.
Regarding the use of the term “deploying” in § 170.404(a)(3)(ii), a Certified API Developer’s fees for “deploying” certified API technology comprise the Certified API Developer’s costs of operationalizing certified API technology in a production environment. Such fees include, but are not limited to, standing up hosting infrastructure, software installation and configuration, and the creation and maintenance of API Information Source administrative functions. Fees for “deploying” certified API technology do not include the costs associated with managing the traffic of API calls that are used to access the certified API technology, which a Certified API Developer can only recover under the permitted fee for usage support costs (§ 170.404(a)(3)(iii)). We emphasize that for the purpose of this Condition of Certification, we consider that certified API technology is “deployed” by the customer—the API Information Source—that purchased or licensed it.
Regarding the use of the term “upgrading” in § 170.404(a)(3)(ii), a Certified API Developer’s fees for “upgrading” certified API technology comprise the Certified API Developer’s costs of supplying an API Information Source with an updated version of certified API technology. Such costs would include the costs required to bring certified API technology into conformity with new requirements of the Program, upgrades to implement general software updates (not otherwise covered by development fees or under warranty), or developing and releasing newer versions of the certified API technology at the request of an API Information Source. The nature of the costs that can be charged under this category of permitted fees depends on the scope of the work undertaken by a Certified API Developer (i.e., how much or how little labor an API Information Source requires of the Certified API Developer to upgrade the certified API technology being supplied from one version or set of functions to the next).
Should API Users generate revenue from the use of their apps, any fee an API Information Source may impose would not be in scope for this Condition and Maintenance of Certification, but could be covered by the information blocking provisions. Accordingly, we emphasize that such stakeholders should take care to ensure they are compliant with the information blocking provisions and other Federal and State laws and regulations that may prohibit or limit certain types of relationships involving remuneration.
(a) Conditions of certification requirements–(3) Fees conditions–(iii) Permitted fee – recovering API usage costs.
“Usage-based” fees are fees imposed by a Certified API Developer to recover costs typically incurred for supporting API interactions at increasing volumes and scale within established service levels. That is, “usage-based” fees recover costs incurred by a Certified API Developer due to the actual use of the certified API technology once it has been deployed (e.g., costs to support a higher volume of traffic, data, or number of apps via the certified API technology).
A Certified API Developer's “incremental costs” comprise the Certified API Developer's costs that are directly attributable to supporting API interactions at increasing volumes and scale within established service levels.
A Certified API Developer should “price” its costs of supporting access to the certified API technology by reference to the additional costs that the Certified API Developer would incur in supporting certain volumes of API use.
Usage fees for certified API technology will only apply when the Certified API Developer acts on behalf of the API Information Source to deploy its certified API technology. In scenarios where the API Information Source, such as a large hospital system, assumes full responsibility for the technical infrastructure necessary to deploy and host the certified API technology it has acquired, the volume and scale of its usage would be the API Information Source’s sole responsibility, and a Certified API Developer would not be permitted to charge usage-based fees.
The costs recovered under “usage-based” fees can only reflect “post-deployment” costs. As such, “usage-based” fees cannot include any costs necessary to prepare and “get the certified API technology up, running, and ready for use,” which are costs that must be recovered as part of the deployment services delivered by the Certified API Developer if permitted under § 170.404(a)(3)(ii).
We clarify that API usage fees related to API “read” services for multiple patients would be calculated using a similar methodology to calculate API usage fees related to API “read” services for single patients. These “usage-based” fees are fees imposed by a Certified API Developer to recover the costs typically incurred to support API interactions for API “read” services for multiple patients once these services have been deployed. This could include, but not be limited to, costs to support a higher volume of traffic, data, or number of apps via the certified API technology (which could include higher costs for hardware, including server space).
(a) Conditions of certification requirements–(3) Fees conditions–(iv) Permitted fee – value-added services.
We clarify that the value-added services need to be provided in connection with and supplemental to the development, testing, and deployment of production-ready software applications that interact with certified API technology. A fee is permitted if it relates to a service that a software developer can elect to purchase from a Certified API Developer, but is not required to purchase in order to develop and deploy production-ready apps for certified API technology.
We note that examples used to illustrate when a fee would or would not qualify as a “value-added service,” such as app store listing, are demonstrative, but not required unless otherwise noted in the regulation text.
We permit fees for services associated with the listing and promotion of apps beyond basic application placement so long as the Certified API Developer ensures that basic access and listing in the app store is provided free of charge (if an application developer depended on such listing to efficiently and effectively develop and deploy production-ready apps for use with certified API technology).
To the degree that a health IT developer offers value-added services associated with certified API technology, the Condition of Certification covers its practices related to certified API technology only. Conversely, this Condition of Certification would not apply to any practices that do not involve certified API technology.
(a) Conditions of certification requirements–(4) Openness and pro-competitive conditions.
For the requirement that a Certified API Developer must provide notice and a reasonable opportunity for API Information Sources and API Users to update their applications to preserve compatibility with certified API technology and to comply with applicable terms and conditions, we note that the notice could include a public notice made available on a website, but also encourage Certified API Developers to contact API Information Source customers and registered API Users (application developers) directly prior to updating business and technical documentation.
For third-party applications chosen by individuals to facilitate their access to their electronic health information (EHI) held by actors, there would not be a need for a business associate agreement as discussed in the ONC Cures Act Final Rule. There would also generally not be a need for “vetting” on security grounds and such vetting actions otherwise would be an interference.
We clarify that this rule does not prohibit Certified API Developers from forming business relationships with API Users.
(b) Maintenance of certification requirements—(1) Authenticity verification and registration for production use.
This requirement applies to a Certified API Developer with a Health IT Module certified to the certification criterion adopted in § 170.315(g)(10).
The authenticity verification process finalized in § 170.404(b)(1)(i) is optional, but if instituted, the authenticity verification process must be completed within 10 business days.
(b) Maintenance of certification requirements—(2) Service base URL publication.
Certified API Developers must make available appropriately scoped service base URLs that can be used by patients to access their EHI for Health IT Modules certified to § 170.315(g)(10).
As discussed in section VIII.C.6.c of the ONC Cures Act Final Rule, API Information Sources who locally manage their FHIR servers without Certified API Developer assistance cannot refuse to provide to Certified API Developers the FHIR service base URL(s) that is/are necessary for patients to use to access their EHI. Equally, pursuant to this Maintenance of Certification requirement, they would be required to publish the FHIR service base URLs they centrally manage on behalf of API Information Sources.
(b) Maintenance of certification requirements—(3) Rollout of (g)(10)-certified APIs.
A Certified API Developer with certified API technology previously certified to the certification criterion in § 170.315(g)(8) must provide all API Information Sources with such certified API technology with certified API technology certified to the criterion in § 170.315(g)(10) by no later than May 2, 2022 (with enforcement discretion until August 2, 2022).
(b) Maintenance of certification requirements—(4) Compliance for existing certified API technology.
By no later than November 2, 2020 (with enforcement discretion until February 1, 2022), a Certified API Developer with Health IT Module(s) certified to the certification criteria in § 170.315(g)(7), (8), or (9) must comply with § 170.404(a), including revisions to its existing business and technical API documentation and make such documentation available via a publicly accessible hyperlink that allows any person to directly access the information without any preconditions or additional steps.
API Users can include, but are not limited to, software developers, patients, health care providers, and payers.
A person or entity is permitted to serve more than one role for the terms defined in § 170.404(c).
Stakeholders meet the definition of a term defined in § 170.404(c) based on the context in which they are acting.
Content last reviewed on July 7, 2020