API Terms of Use
Effective Date: March 1, 2026
1. Acceptance of Terms
By registering for, accessing, or using the FirstMedical Interoperability APIs ("APIs"), you agree to be bound by these Terms of Use. If you are using the APIs on behalf of an organization, you represent that you have the authority to bind that organization to these terms.
2. API Access and Registration
To access the APIs, you must register an application and receive API credentials (Client ID and Client Secret). You are responsible for maintaining the confidentiality of your credentials and for all activities that occur under your account.
- Do not share your Client Secret with unauthorized parties
- Notify us immediately if you suspect unauthorized use of your credentials
- You may not use another developer's credentials without authorization
3. Permitted Use
You may use the APIs solely to:
- Build applications that help patients access their health data (CMS-9115-F)
- Enable provider access to patient data via bulk export (CMS-0057-F)
- Look up provider directory information
- Test and develop using the sandbox environment
4. Prohibited Use
You may not:
- Use the APIs to discriminate against any individual or group
- Sell, rent, or sublicense patient health data obtained through the APIs
- Use data for marketing purposes without explicit patient consent
- Attempt to re-identify de-identified data
- Exceed rate limits or attempt to circumvent API throttling
- Reverse-engineer, decompile, or disassemble the APIs
- Use the APIs for any purpose that violates HIPAA, CMS, or ONC regulations
5. HIPAA and PHI Obligations
If your application processes Protected Health Information (PHI), you must comply with all applicable provisions of HIPAA, including the Privacy Rule, Security Rule, and Breach Notification Rule. A Business Associate Agreement (BAA) may be required prior to production access.
6. Rate Limits
API access is subject to the following rate limits:
- Patient Access API: 100 calls per minute
- Provider Access API: 60 calls per minute
- Provider Directory API: 200 calls per minute
Exceeding rate limits may result in temporary or permanent suspension of API access.
7. Data Retention and Deletion
You must delete patient data when it is no longer necessary for the purpose for which it was collected. Upon termination of your API access, you must delete all data obtained through the APIs within 30 days.
8. Termination
FirstMedical may suspend or terminate your API access at any time for violation of these terms or for any other reason. Upon termination, your right to use the APIs ceases immediately.
9. Regulatory Compliance
These APIs are provided in compliance with CMS-9115-F (Patient Access Final Rule), CMS-0057-F (Prior Authorization Final Rule), ONC HTI-1 (USCDI v3), and 45 CFR 170.404 (API Documentation Requirements). Use of these APIs must comply with all applicable federal and Puerto Rico regulations.
10. Contact
For questions about these terms, contact interop-support@firstmedicalpr.com.