Skip to main content

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Secure .gov websites use HTTPS
A lock ( ) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

How to write your terms of service

We require that organizations applying for production access to the Blue Button API have publicly available terms of service. Your application should present your terms of service in a way that is clearly accessible to the user.

Your terms of service must clearly explain to Medicare enrollees how you use, store, and potentially share their healthcare data. It must also explain their rights, your responsibilities, and the rules governing use of your application.

We understand that these are legal documents, but please keep your ultimate audience in mind. Medicare enrollees need to know that they will be protected and want to know exactly how your app will use their data.

When you apply for production access, confirm your terms of service cover all requirements listed in the Blue Button API Terms of Service. Be sure you have read the Blue Button API Terms of Service and checked your own terms of service against them.

Terms of service checklist

The following checklist will help you make sure your terms of service are complete and ready for approval by the Blue Button API team.

Your terms of service should:

  • Be based on industry best practices
  • Be prominent and publicly accessible
  • Be easy to read, especially from a Medicare enrollee’s perspective.
    • We encourage you to ensure that your terms of service are written at no higher than a 9th-grade level.
    • You can use a free editor such as Hemingway App to verify its readability
  • Require users to actively opt in: do not default to agreement on their behalf
  • Have working links that go to the correct destination
  • Have no grammatical or spelling issues
  • Not duplicate or contradict what you have in your privacy policy

Your terms of service should include:

Scope and agreement

  • Defines who the terms apply to, including anyone acting on behalf of an organization
  • Establishes that users agree to the terms by accessing or using your application
  • Incorporates a reference to any related privacy policy or other governing documents

Permitted activities and purposes

  • Outlines what users may and may not do with your application and the data it accesses
  • Specifies that Medicare enrollee data may only be used for the purposes stated at the time of collection
  • Restricts users from requesting, accessing, using, or sharing a Medicare enrollee’s Medicare.gov login credentials

Attribution

  • Require inclusion of the following notice:
    • “This product uses the Blue Button API but is not endorsed or certified by the Centers for Medicare & Medicaid Services or the U.S. Department of Health and Human Services.”

Updates to terms of service

  • Describes how you will notify users if you update your terms of service
    • Note what changed and allow them to update their settings or opt out of the service

Changes to your terms of service

Before rolling out any changes to your terms of service, follow these steps:

  1. Submit drafts of the new document and a draft notification to enrollees by emailing BlueButtonAPI@cms.hhs.gov.
  2. The Blue Button API team will review your documents and respond with feedback or approval within five business days.
  3. You may not roll out the new documents or notify enrollees of changes until you receive CMS approval.

Notifications to enrollees should say what has changed and allow them to update their settings or opt out of the service.

bluebutton.cms.gov

official website of the U.S. Department of Health and Human Services and the Centers for Medicare & Medicaid Services.

Looking for U.S. government information and services?
Visit USA.gov