Standardized API Terms and Conditions

These Terms and Conditions govern access to and use of the Thyra EHR standardized FHIR API (45 CFR 170.315(g)(7), (g)(9), and (g)(10)). By registering for or using the API, an application developer agrees to these Terms.

Thyra EHR provides API access on terms no more restrictive than those it applies to itself, its affiliates, or its business partners. API documentation is publicly available without preconditions or fees. Thyra EHR will not impose conditions prohibited by 45 CFR 170.404.

Application developers register with the Thyra EHR authorization server to obtain a client identifier and, for confidential clients, credentials. Registration is available on non-discriminatory terms using standard SMART App Launch / OAuth 2.0, with no unnecessary preconditions.

Approved applications may access electronic health information consistent with the scopes authorized by the patient or user and with applicable law. Applications must not exceed the scopes granted and must handle all data in accordance with applicable privacy and security laws, including HIPAA where applicable.

Any fees charged in connection with the API are limited to those permitted under 45 CFR 170.404(a)(3)–(4) and are based on objective, verifiable criteria applied uniformly. No fees are charged to access API documentation or to register an application.

All connections require TLS 1.2 or above. Authentication and authorization use SMART App Launch / OAuth 2.0 with PKCE (S256). Thyra EHR may revoke an application authorization consistent with its published token-revocation process and applicable law.

Production: https://api.thyrahealth.com/fhir/R4

Sandbox: https://api.dev.thyrahealth.com/fhir/R4

Thyra EHR maintains these Terms consistent with the ONC API conditions and maintenance requirements that will apply on certification. Material changes will be published at this location. Continued use constitutes acceptance of the then-current Terms.