MDLand iClinic@ FHIR API Subscription Agreement

This FHIR API Subscription Agreement (as may be updated, the "API Agreement") is entered into by and between MDLand International ("MDLand") and the MDLand Customer that has accepted this API Agreement ("You"). You license MDLand Software that enables You to create, maintain, and receive Electronic Health Information and other data. This API Agreement provides You with both:

(1) a license to use the FHIR API Components across Your enterprise and with third parties (whether chosen by You or Your patients), and

(2) a right to sublicense use of the FHIR APIs to third-party software developers and service providers, all subject to the terms below and in conjunction with Your licensed use of MDLand Software. This API Agreement applies only to the FHIR API Components and does not apply to any other APIs or interoperability technology made available by MDLand. In consideration of the mutual covenants set forth below, MDLand and You agree as follows:

1. Definitions. All capitalized terms used in this API Agreement will have the meanings assigned to them in this API Agreement (including in Appendix A).

2. License. For the term of this API Agreement (as described in Section 8), MDLand grants You a nonexclusive, non-transferable license to:

(a) use the FHIR API Components across Your enterprise (including with affiliated healthcare organizations that are permitted to access Your MDLand Software), and

(b) use the FHIR API APIs with, and the right to sublicense use of the FHIR APIs to, API Users, in each case of (a) or (b) subject to this API Agreement and only in conjunction with Your licensed use of MDLand Software. The license to the FHIR APIs includes the rights reasonably necessary for You and API Users to access and use the FHIR APIs with Your MDLand Software environments. This license enables You to develop, market, offer, and distribute Products designed to interact with the FHIR APIs and to enable API Users to do the same; provided that any use of MDLand’s name or logos must follow MDLand's Trademark Usage Guidelines for MDLand Customers and third parties. This API Agreement does not give You ownership of any part of the FHIR API Components. You are responsible to MDLand for all use of the FHIR API Components under this API Agreement, whether by You or others You permit to use any FHIR API Component.

3. Responsibilities, API User Requirements, and Infrastructure.

a. Responsibilities. This API Agreement gives You the right to control how Products interact with Your MDLand Software using the FHIR API Components. With this freedom comes the responsibility to make sure all Products are behaving appropriately, whether those Products interact with Your MDLand Software via patient-directed connections or otherwise. Products that connect to Your MDLand Software could create issues such as: data corruption in Your MDLand or other downstream systems; mapping or saving data to patient records incorrectly (e.g., sending correct data to the wrong patient or incorrect data to the right patient); fraudulent or other unethical conduct; degraded system response times, performance, or availability; and security vulnerabilities or privacy breaches, including by acting as a vector for hacking, ransomware, or other cybersecurity attacks. These risks are more significant for Products that write data into Your MDLand Software. MDLand will not test or otherwise oversee the Products that interact with Your MDLand Software, and You should not assume that MDLand has tested those interactions in any way. It is Your responsibility to ensure the FHIR API Components and interactions between Your MDLand Software and Products operate as You intend, including by doing each of the following to the extent permitted by applicable law and consistent with the last paragraph of this Section 3.a.:

i. vetting each API User and its Product(s) to assure Yourself of the accuracy, completeness, and appropriateness of any Products before You enable such Product to interact with the FHIR APIs and Your MDLand Software;

ii. ensuring each API User appropriately registers its Product(s) on https://api.mdland.com/Mdland_FHIR_API.html

iii. testing and, as applicable, authorizing all FHIR API Components and Products that interact with Your MDLand Software using any FHIR API Component across all Your intended use cases (including testing each Product in Your non-production environments after Updates and after functionality or configuration changes to Your MDLand Software or the Products);

iv. ensuring that interactions with the FHIR API Components and their consequences in Your MDLand Software are tested (e.g., are APIs being called in the right sequence, is the timing between API calls appropriate, and is data from APIs filing correctly in Your MDLand Software?) and that any issues are addressed promptly;

v. confirming appropriateness of configuration decisions (including workflow modifications, the use and mapping of appropriate terminologies, and the scope of data to release) that You make regarding each FHIR API Component and its use with Products; vi. confirming the accuracy, completeness, and relevance of information made available to or from Products via any FHIR API Component;

vii. ensuring API Users and their Product(s) meet Your organization’s security and privacy requirements, and appropriate audit trails are maintained in each such Product;

viii. ensuring all use of the FHIR API Components is in accordance with the Support Materials;

ix. establishing unavailability procedures that will permit You to preserve Your operations if an FHIR API Component or Product becomes unavailable;

x. maintaining appropriately current versions of Your MDLand Software, including promptly applying updates to Your MDLand Software to address identified issues with FHIR API Components;

xi. assessing, planning for, and mitigating potential impacts of planned or unplanned downtimes of Your MDLand Software on API Users and Products; and

xii. evaluating, planning for, and mitigating any negative impact on the performance of Your MDLand Software due to Your use of or integration with Products (including impacts that affect individuals or other entities’ ability to use Your MDLand Software or might require You to obtain additional hardware or software).

3. Accordingly, as between You and MDLand, You are solely responsible for all liabilities and consequences (including the risks described in the preceding paragraphs, non-compliance of any Product with applicable laws and regulations, and any Claims by or on behalf of patients or related to patient harm) that arise from or relate to the use of or inability to use any Product, or that arise from or relate to data transmitted by or through any FHIR API Component or direct or indirect use of that data. Pursuant to the ONC Rule and requirements under the CMS Promoting Interoperability Program for patient electronic access, your patients should be able to access EHI through certain APIs and EHI Export. Therefore, clauses 3(a)(i)-(viii) above do not apply when You use the FHIR API Components to respond to requests to access, exchange, and use EHI that originate from Your patients (including Products chosen by Your patients) or from API Users acting on behalf of Your patients pursuant to a valid authorization or consent.

b. API User Requirements. If You elect to sublicense the use of the FHIR API APIs to API Users pursuant to a written agreement with such API Users, You will require each API User that is granted a sublicense to:

i. not materially interfere in any way with the operation of the FHIR APIs, MDLand Software, or any server, network, or system associated with the FHIR API APIs or MDLand Software, including in ways that could create a risk of patient harm or disrupt Your users’ ability to use MDLand Software;

ii. not attempt to breach, defeat, bypass, remove, deactivate, or otherwise circumvent any firewall, encryption, security, authentication routines, or software protection mechanisms in the FHIR APIs or MDLand Software, including any such mechanism used to restrict or control the functionality of the FHIR APIs; and

iii. warrant that its Product, if applicable, does not contain and will not introduce any viruses or other harmful or malicious or insecure code, software, computer instructions, devices, or techniques that may threaten, infect, damage, disable, or shut down the FHIR APIs or MDLand Software, or any related software, hardware, or computer systems (e.g., no viruses, worms, Trojan horses, malware, etc.). c. Infrastructure. You are responsible for all Your own costs to use the FHIR API Components and sublicense use of the FHIR API APIs, including any costs from Your hosting or infrastructure provider. You are responsible for maintaining the appropriate software, hardware, and other technology needed for You to use the FHIR API Components and for API Users to use the FHIR API APIs.

4. Use Considerations and Recommendations. MDLand provides information on recommended practices when working with the FHIR API Components and API Users at https://FHIR API.com. This information might be a useful reference as You evaluate how You will use the FHIR API Components and work with API Users as a part of Your overall interoperability efforts.

5. Subscription and Other Fees.

a. Subscription Fees.

i. The FHIR API APIs and EHI Export are licensed on a subscription fee basis. You agree to pay MDLand subscription fees at the Subscription Rate applicable to such FHIR API Components. The "Subscription Rate" means the then-current standard subscription rate charged by MDLand for each FHIR API Core Functionality or for each FHIR API or group of APIs You use that is not FHIR API Core Functionality, as applicable. You may use FHIR APIs that are not FHIR API Core Functionality for Internal and Non-commercial Use without incurring subscription fees under this API Agreement. The current Subscription Rates for the FHIR API Components are available on the FHIR API Pricing Information summary.

ii. The FHIR API Core Functionality includes certain functionality that participants in CMS payment and other quality reporting programs are expected to implement and use as part of certified EHR technology. Therefore, subscription fees for each FHIR API Core Functionality are payable regardless of Your actual use of such functionality.

iii. Subscription fees will be payable on a quarterly basis, with each fee due within 30 days after the end of the quarter with respect to which the subscription fee is payable, subject to Section 5.b. below. Subscription fees for each FHIR API Core Functionality and for other FHIR API APIs that You use will be calculated and chargeable separately for each Production Directory (see the FHIR API Pricing Information summary).

b. Subscription Fee

b.1. USCDI v1 FHIR APIs: Subscription fees payable at the Subscription Rate.

b.2. Use of Industry Standard and MDLand Public APIs in Qualifying Established Connections: Free by 6/30/2023 and subscription fees payable at the Subscription Rate

4. Ending or Suspending Use. You may end or temporarily suspend Your use of any of the FHIR APIs at any time, and Your subscription fees will be updated to reflect usage per Sections 4.a. and 4.b. above. In addition, You may stop accruing subscription fees for all of the FHIR Components on a prospective basis beginning as of the first day of the billing quarter following the then-current billing quarter if You:

(i) notify MDLand of such intention at least 30 days prior to the end of the then-current billing quarter; and

(ii) You end all use of the FHIR API Components, affirm to MDLand that You have ended all such use, and permit MDLand to disable Your access to the FHIR API Components by the end of the then-current billing quarter. Your rights under this API Agreement will be suspended during any period in which You stop paying subscription fees. If You later resume use of any FHIR API Component, your use will be subject to the then-current fees and terms.

e. Additional Services. MDLand will charge You at its then-current rates for any additional services that You and MDLand mutually agree upon (beyond the maintenance and support described in Section 5 below), including any consultation and assistance for Product-related issues or software modification services You request for an FHIR API Component. Categories of additional services available for the FHIR API APIs are listed in the FHIR API Pricing Information summary. All hourly fees under this API Agreement are due as incurred and payable as specified on the invoice for such fees. In connection with use of the FHIR API Components, You also may require additional software, hardware, and services, which may result in additional charges, including from Your hosting or infrastructure provider.

f. Payments and Invoicing. You agree to pay fees due under this API Agreement as specified on the invoice for such fees. Interest will accrue for overdue amounts at the lesser of one percent (1%) per month or the maximum rate allowed by law. Your non-payment of any fees under this API Agreement will be a material breach.

g. Taxes. Any amounts payable by You under this API Agreement are exclusive of taxes and similar assessments. You are responsible for all sales, use and excise taxes, and any other similar taxes, duties and charges of any kind imposed by any federal, state, or local governmental or regulatory entity on any amounts payable by You hereunder, other than any taxes imposed on MDLand’s income.

5. Support for FHIR API Components by MDLand. As long as You are participating in MDLand's maintenance program for qualifying MDLand Software and paying all fees due in accordance with Section 5, MDLand will provide maintenance and support for the FHIR API APIs and EHI Export, which may include: (a) consultation and assistance, including reasonable cooperation with You and API Users, to help You enable use of such FHIR API Components with MDLand Software, (b) Updates, and (c) reasonable workarounds when necessary to help address Code Errors. MDLand may have access to and may receive Protected Health Information (as defined in HIPAA) from You in connection with its provision of services for the FHIR API Components. Any access to Protected Health Information pursuant to MDLand’s performance of services under this API Agreement will be governed by the HIPAA business associate terms in place between You and MDLand pursuant to a separate agreement, but any liability between the parties related to such access will be governed solely by this API Agreement. MDLand's support under this Section 6 does not include troubleshooting or correcting issues with Products or other non-Code Errors, such as issues that may be caused by Products interacting with Your MDLand Software via the FHIR API Components. These issues may include data corruption or other data-related errors, security vulnerabilities, privacy breaches, user or system performance degradation, downtimes, or failure of Products and MDLand Software to function with one another as intended, including when You make configuration changes or updates to MDLand Software.

6. Changes to these Terms and the FHIR API Components. MDLand may change this API Agreement from time to time in accordance with this Section 7, and changes will be effective upon the date specified by MDLand. MDLand will inform You of (a) any material changes to Your obligations under this API Agreement at least 90 days in advance of the effective date of such changes, and (b) any increases to the Subscription Rates for the FHIR API Components at least 12 months in advance of the effective date of such increases. However, modifications to this API Agreement to reflect changes to the law or regulatory guidance will become effective immediately. Your continued use of any FHIR API Component after changes to this API Agreement (including to the Subscription Rates) become effective means that You have accepted the changes. MDLand also may modify, temporarily suspend, or discontinue certain APIs or other FHIR API Components from time to time in its sole discretion, subject to the remainder of this section. MDLand will make reasonable efforts to inform You in advance of discontinuing any FHIR API APIs that You are then using in Your production environments. In addition, except as exigent circumstances require, MDLand will provide You advance notice of any material changes to the FHIR API Certified APIs or related terms of this API Agreement to give You a reasonable opportunity to work with API Users to preserve compatibility with the FHIR API Certified APIs and comply with such updated terms. MDLand will make reasonable efforts to avoid disrupting Your use of the FHIR API Certified APIs.

7. Term and Termination. This API Agreement is effective as of the date You first accept any version of its terms. This API Agreement (including all licenses and sublicenses granted under its terms) will continue in effect until it is terminated in accordance with this Section 8, subject to any suspension of rights under Section 5.d. You may end all use of the FHIR API Components in accordance with Section 4.d. above. In addition, a party (the "Notifying Party") may terminate this API Agreement if the other party (the "Breaching Party") materially breaches its obligations and does not cure the breach within 60 days of receipt of notice from the Notifying Party. The notice will be provided in accordance with Section 15.g., will state it is a notice of material breach of this API Agreement, and will describe the breach in sufficient detail to permit the Breaching Party to cure the breach. This API Agreement will automatically terminate if You are no longer an MDLand Customer. In the event of any termination of this API Agreement, You will:

(a) end all use of the FHIR API Components, affirm to MDLand that You have ended such use, and permit MDLand to disable Your access to the FHIR API Components; and

(b) promptly pay MDLand any outstanding fees that You incurred pursuant to this API Agreement prior to the effective date of such termination.

8. Confidentiality. This API Agreement does not provide You a right to grant access to MDLand Software or disclose other MDLand Confidential Information, including any code for or used by an FHIR API Component, to API Users or otherwise. For clarity, Support Materials are not MDLand Confidential Information. Notwithstanding anything to the contrary (including in any other agreement You have entered with MDLand), as long as MDLand remains subject to 45 CFR 170 as a developer of certified health, You are permitted to make certain communications about MDLand's certified applications, in accordance with Section 4002 of the 21st Century Cures Act and 45 CFR 170.403 (the "Communications Rule"). You recognize that MDLand needs to avoid outright copying of its intellectual property by third parties to remain viable as a company.