{"id":23644,"date":"2024-12-19T12:31:39","date_gmt":"2024-12-19T17:31:39","guid":{"rendered":"https:\/\/healthit-gov.go-vip.net\/buzz-blog\/?p=23644"},"modified":"2026-01-17T21:35:19","modified_gmt":"2026-01-17T21:35:19","slug":"app-registration-delay-no-more","status":"publish","type":"post","link":"https:\/\/healthit.gov\/blog\/information-blocking\/app-registration-delay-no-more\/","title":{"rendered":"App Registration, Delay No More"},"content":{"rendered":"\n

In recent blog posts \u201cIB the API, I Think Not<\/em><\/a>\u201d<\/em> and \u201cGetting Real about Information Blocking and APIs<\/em><\/a>\u201d we discussed concerns about practices, actions, and behaviors that run counter to our policies promoting an open, standards-based approach to interoperability. Recent and ongoing reports received from \u201cAPI Users,\u201d which includes, among others, health care providers and app developers, indicate that certified health IT developers (in this context \u201cCertified API developers\u201d) have been engaging in activities that could be non-conformities under the ONC Health IT Certification Program (Certification Program).<\/p>\n\n\n\n

In particular, we have received feedback that the registration process for third-party applications intended to be used by patients to access their electronic health information (EHI) is being obstructed by Certified API developers through delays, unnecessary requirements, and limited access to essential registration information. In this blog post we outline specific compliance areas associated with API registration that require developers\u2019 attention to support an API user\u2019s ability to utilize a third-party application to access EHI without special effort. Further clarification is provided in the API Certification Companion Guide<\/a> (CCG) and the Information Blocking Reminders Related to API Technology Fact Sheet<\/a>.<\/p>\n\n\n\n

Delays and obstacles in third-party application verification and registration <\/strong><\/h2>\n\n\n\n

Certified API developers are permitted to institute a process to verify the authenticity of API Users (e.g., third party apps). However, if they do so, they must complete their authenticity verification<\/a> within ten business days of receipt of the API User\u2019s request to register their software application for use with the \u201c(g)(10)-certified API,\u201d and must register and enable production<\/a> use of verified apps within 5 business days thereafter.<\/p>\n\n\n\n

Third-party app developers facilitating an API user\u2019s access to EHI should not have to wait more than 15 business days for a Certified API developer to \u201capprove\u201d the app to be technically ready to support a patient seeking access to their EHI via that app. API Users have brought to our attention that in many cases, this process takes significantly longer. Such delays are unacceptable and represent potential non-compliance with Certification Program requirements. Certified API developers need to adhere to established timeliness standards and should bear in mind that these types of non-conformities are more easily identifiable given their quantifiable requirements.<\/p>\n\n\n\n

API Users have also reported practices such as mandating additional agreements (e.g., business associate agreements or non-disclosure agreements), and the requirement that a patient or healthcare provider authorize the app before registering the app. These sorts of practices add unjustified barriers and are not allowed (see<\/em> 85 FR 25813<\/a> and 84 FR 7520<\/a>; see also<\/em> HIPAA FAQ #5<\/a>) at all for patient access, and not allowed if they unjustifiably impede business-to-business access.<\/p>\n\n\n\n

Lack of accessible and transparent registration information <\/strong><\/h2>\n\n\n\n

Reports of missing and inaccurate contact information, or unresponsive requests for third-party app registration on publicly accessible service base URLs<\/a> indicate that some Certified API developers have not provided clear, accessible instructions, directly impeding the registration process. ASTP expects all information necessary to initiate and complete app registration to be consistently maintained, accessible, and easy to locate. Failure to comply with this expectation will likely implicate a violation of API and Information Blocking Conditions and Maintenance of Certification requirements.<\/p>\n\n\n\n

Other barriers to API registration<\/strong><\/h2>\n\n\n\n

Other concerns we\u2019ve heard about include:<\/p>\n\n\n\n