Terms of service

These terms govern use of AuthPrior by a medical practice and the people it authorises. They sit alongside the Business Associate Agreement and the order form; where those disagree with this page, they win.

What the service is

AuthPrior prepares and submits prior authorization requests to health plans on a practice's behalf, using the X12 278 transaction over a clearinghouse, and reads and writes limited information in the practice's EHR where the practice has enabled that.

The human gate

This is a product commitment, not a configuration option, and it cannot be switched off at any autonomy level:

• No authorization is transmitted to a health plan without a named licensed human releasing that specific request.
• No adverse determination is communicated or acted on by software.
• No referral or authorization is attached to a clinical record without a licensed human release.
• A release is single-use and bound to the exact content approved. Approving one request does not authorise a different one, even a very similar one.

Your responsibilities

• Accounts are individual. Shared logins defeat the audit trail, which is the thing that protects the practice in a dispute.
• Access reflects role. The practice manages who has which role and removes access when someone leaves.
• You are the source of truth for clinical content. We do not verify clinical accuracy of what the practice submits.
• Lawful use. The service is used only for the practice's own treatment, payment and operations, for patients it has a relationship with.

What we do not warrant

Prior authorization outcomes are decided by health plans. We do not warrant that a request will be approved, that a plan will answer within a regulatory window, or that a plan's systems will be available. Where the platform cannot establish something - a payer rule that has not been verified against a published source, a plan that will not say whether authorization is required - it abstains and tells you rather than estimating. That abstention is the product working correctly, and it is the behaviour we do warrant.

Availability and clearinghouse dependency

The service depends on a clearinghouse and on health plan systems that we do not control. When an upstream link fails, work is queued and retried rather than dropped, and a request that cannot be completed becomes a task for a human. Nothing is silently abandoned. Specific availability commitments, if any, are in the order form.

Data

The practice owns its data. We process it as a Business Associate under the BAA and for no other purpose. We do not train models on it. On termination the practice can export its data, and after the agreed window it is purged with a verification pass. See Privacy for the detail.

Agents acting for you

Where the practice enables software agents, or connects an external agent through an integration, the practice remains responsible for what is submitted under its identity. Every agent action is recorded against the agent, the practice and the purpose. The practice can switch any agent off for itself at any time without contacting us, and we can stop the entire fleet immediately if we believe something is wrong.

Suspension

We may suspend access immediately where there is a credible security or patient-safety concern, and we will say why. Suspension for that reason is not a penalty and it is not a payment dispute; it is us stopping something before it causes harm, and we would rather explain it afterwards than wait.

Fees, term and termination

Fees, term, notice periods and renewal are in the order form. Either party may terminate for material breach that is not cured within the period the order form states. On termination we provide an export and then purge.

Warranties disclaimed

Except as expressly stated in these terms or an order form, the service is provided as is and as available, and we disclaim all other warranties, express or implied, including merchantability, fitness for a particular purpose, non-infringement, and any warranty arising from course of dealing or usage of trade. We do not warrant that the service will be uninterrupted, error-free or secure, that defects will be corrected, or that any payer, plan or clearinghouse will accept, process or approve anything. No uptime commitment exists unless an order form states one.

Limitation of liability

To the maximum extent permitted by law: (a) neither party is liable for indirect, incidental, special, consequential, exemplary or punitive damages, or for lost profits, lost revenue, lost data or business interruption, even if advised of the possibility; and (b) our total aggregate liability arising out of or relating to the service is capped at the fees the practice actually paid us in the twelve months before the first event giving rise to the claim, or one hundred US dollars if no fees were paid. If an order form states a different cap, the order form wins.

These limits do not apply where the law does not allow them to - including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for either party's breach of its data-protection obligations to the extent a cap on that breach is unenforceable. Claims must be brought within one year of the date the claiming party knew or should have known of the claim, where a shortened period is lawful.

Your representations

The practice represents and warrants, on signing and on every use, that:

• it is lawfully constituted, licensed where licensure is required, and authorised to bind itself to these terms;
• neither it nor any user it authorises is excluded, debarred or suspended from participation in any federal healthcare program, and it will tell us promptly if that changes;
• it holds every consent, authorisation and legal basis needed for us to receive and process the information it sends us, including PHI, on its behalf;
• the clinical and billing information it submits or approves is, to the best of its knowledge, accurate and drawn from the medical record - codes are never altered to obtain an approval, which is also a documented refusal built into the software itself; and
• it will comply with all laws applicable to its use of the service, including HIPAA, state privacy law, and fraud and abuse law.

Acceptable use

The practice and its users must not:

• submit information they know to be false, misleading or unsupported by the record;
• use the service for any patient with whom the practice has no treatment relationship;
• share accounts, circumvent access controls, or probe, scan or test the security of the service without our prior written consent;
• reverse engineer, decompile or copy the service except where the law grants that right notwithstanding this clause;
• use the service to build a competing product, or scrape or bulk-extract data that is not the practice's own;
• resell or provide the service to third parties except through an agreement with us; or
• use any output of the service as a substitute for professional medical judgement.

Indemnification

The practice will defend and indemnify us against third-party claims to the extent arising from: the clinical or billing content it submits or approves; its breach of these terms or of law; its own relationships with patients, payers and staff; or use of the service in combination with systems or data we did not supply. We will defend and indemnify the practice against third-party claims that the service, as we supplied it, infringes a US patent, copyright or trade secret - and if it does, we may modify it, replace it, or refund prepaid unused fees and end the affected service. Each side must give the other prompt notice, control of the defence to the indemnifying party, and reasonable cooperation.

Intellectual property

We own the service, its software, models, documentation and everything we make available, and we grant the practice a limited, non-exclusive, non-transferable licence to use it for the practice's own operations during the term. The practice owns its data. If the practice gives us feedback or suggestions, we may use them without restriction or payment - feedback is how the product improves, and it never includes an obligation to buy anything.

Confidentiality

Each party will protect the other's non-public information with at least the care it uses for its own, use it only to perform under these terms, and disclose it only to people who need it and are bound to protect it. This survives termination. It does not cover information that is public without breach, independently developed, or lawfully received from someone else - and a disclosure required by law is not a breach if the disclosing party gives notice where notice is lawful. PHI is governed by the BAA, not by this clause.

Dispute resolution

Before either party starts formal proceedings, it must give the other written notice and thirty days to resolve the matter informally. Any dispute not resolved that way will be finally settled by binding arbitration administered by the American Arbitration Association under its Commercial Arbitration Rules, by one arbitrator, seat and hearing in the state named below, judgment enterable in any court of competent jurisdiction. Both parties waive jury trial, and disputes are individual - no class, collective or representative proceedings. Either party may instead bring an individual claim in small-claims court, and either party may seek injunctive relief in court for infringement of intellectual property, breach of confidentiality, or a security incident, without first arbitrating.

Governing law

These terms are governed by the law of the State of Delaware, excluding its conflict-of-laws rules, unless the order form names a different state, in which case the order form wins. Where the practice's patients are located does not change the law that governs this contract.

General

• Force majeure. Neither party is liable for delay or failure caused by events beyond its reasonable control - including payer and clearinghouse outages, internet failures, government action, epidemics and natural disasters - except payment obligations.
• Assignment. The practice may not assign these terms without our written consent; we may assign them to an affiliate or in a merger, acquisition or sale of substantially all assets, with notice.
• Survival. Sections on data, confidentiality, warranties disclaimed, limitation of liability, indemnification, dispute resolution and governing law survive termination.
• Severability and waiver. If a clause is unenforceable it is modified to the minimum extent necessary, and the rest stands. A failure to enforce is not a waiver.
• No third-party beneficiaries. These terms create no rights in anyone but the parties. Patients are not parties to these terms.
• Notices. Legal notices go in writing to the contacts below and to the practice's administrative contact on the order form, and are effective on receipt.
• Publicity. Neither party uses the other's name or logo publicly without written consent.
• Export and sanctions. The practice will not use the service in violation of US export controls or sanctions. The service is offered for use in the United States.
• Entire agreement. These terms, the BAA and the order form are the entire agreement about the service and supersede prior discussions. In conflict: BAA first for PHI, then the order form, then these terms.

Changes

We give notice before a change that materially reduces what the practice gets or widens what we do with its data. Changes that add a control or narrow our access take effect when we ship them.

Contact

legal@authprior.com · Security: security@authprior.com

Signing in to the console constitutes acceptance of these terms.