ONC Health IT Certification Program

Key facts

Run by

ASTP/ONC (formerly ONC), U.S. Department of Health and Human Services

Regulations

45 CFR Part 170

Testing and certification

ONC-Authorized Testing Laboratories and Certification Bodies

Public listing

Certified Health IT Product List (CHPL)

Participation

Voluntary for developers; needed for CMS programs that require CEHRT

What is the ONC Health IT Certification Program?

The Office of the National Coordinator for Health Information Technology (ONC) set up the program after the HITECH Act of 2009 tied Medicare and Medicaid incentive payments to the use of certified EHR technology. Developers choose to participate, but CMS programs that require Certified EHR Technology (CEHRT) make certification a practical necessity for products sold to hospitals and clinicians.

In 2024, an HHS reorganization renamed ONC the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology (ASTP/ONC) and gave it broader technology policy duties. The certification program, its regulations and many official documents still use the ONC name.

How certification works

The program separates the rule writer, the tester and the certifier:

• ASTP/ONC writes certification criteria and program rules through notice-and-comment rulemaking.
• ONC-Authorized Testing Laboratories (ONC-ATLs) test products against the criteria.
• ONC-Authorized Certification Bodies (ONC-ACBs) issue certifications, report them to the Certified Health IT Product List (CHPL) and conduct ongoing surveillance.
• Developers must meet Conditions and Maintenance of Certification added under the 21st Century Cures Act, including information blocking prohibitions, API requirements, annual real world testing and attestations.
• ASTP/ONC can directly review certified products and suspend or terminate a certification.

Why certification matters

Certification status has direct commercial and compliance effects:

• Hospitals and clinicians need certified products to report to the Medicare Promoting Interoperability Program and the MIPS Promoting Interoperability performance category.
• Buyers and investors use certification status and CHPL history to vet EHR developers and spot products with surveillance findings.
• Health IT and AI developers use the certified FHIR API requirements to plan integrations that work across many EHRs.

Certification editions vs current criteria

Criteria were once grouped into dated editions (2011, 2014 and 2015). The 2020 Cures Act Final Rule updated the 2015 Edition, and the HTI-1 final rule, released at the end of 2023, dropped edition years in favor of one set of ONC certification criteria revised over time, with deadlines for developers to update.

Later rules have proposed or finalized further changes, so the criteria in force depend on the date. Check the current text of 45 CFR Part 170 before relying on a specific requirement.