FirstMedical Developer Portal

1. Overview

This Privacy Policy describes how FirstMedical Health Plan ("FirstMedical", "we", "us") collects, uses, and protects information through the Developer Portal and Interoperability APIs. This policy applies to developers who register for API access and to the data exchanged through the APIs.

2. Information We Collect

Developer Account Information

Organization name and contact information
Application name and description
Technical details (redirect URIs, OAuth client type)
Email address for communications

API Usage Data

API call logs (endpoint, timestamp, response code)
Client ID associated with each request
Rate limit usage and error rates
IP addresses for security monitoring

Patient Health Information (PHI)

PHI is exchanged through the APIs only at the direction of authorized patients or providers. FirstMedical processes PHI in accordance with HIPAA and CMS regulations. PHI is never stored in the Developer Portal itself.

3. How We Use Information

Authenticate and authorize API access
Monitor API usage and enforce rate limits
Detect and prevent security threats
Generate compliance reports required by CMS
Communicate with developers about API changes or issues
Maintain audit trails per 45 CFR 170.210(e)(1) (7-year retention)

4. Data Sharing

We do not sell developer information or API usage data. We may share information:

With CMS as required for regulatory compliance reporting
With law enforcement when required by law
With Azure cloud services (Microsoft) for infrastructure operations
In aggregate, anonymized form for operational analytics

5. Data Security

We protect data using:

TLS 1.2+ encryption for all API communications
OAuth 2.0 / SMART on FHIR 2.0 for authentication
Azure Entra ID for identity management in production
Encrypted storage for all credentials and secrets
Network isolation via Azure VNet and private endpoints
Regular security audits and penetration testing

6. Data Retention

API audit logs: 7 years (per CMS requirement)
Developer account information: Duration of account plus 1 year
API usage metrics: 3 years for compliance reporting
Sandbox data: Synthetic only, no PHI, retained indefinitely

7. Your Rights

As a developer, you may:

Request access to your account information
Update your organization and application details
Delete your developer account and applications
Request a copy of your API usage data

Patient rights regarding PHI are governed by HIPAA and FirstMedical's member privacy policies.

8. Sandbox Environment

The sandbox environment uses only synthetic (fake) data. No real PHI is present in the sandbox. Test patient records are generated for development purposes only and do not correspond to real individuals.

9. Changes to This Policy

We may update this policy to reflect changes in regulations or our practices. We will notify registered developers via email of material changes at least 30 days before they take effect.

10. Contact

For privacy inquiries, contact interop-support@firstmedicalpr.com.