HHS Holds Back on Scrapping Core EHR Privacy & Security Certification Requirements
What Happened — The U.S. Department of Health and Human Services’ Office of the National Coordinator (ONC) issued a final rule (HTI‑5) that removes 14 of the 60 existing certification criteria for health‑IT products and revises seven others, but it retains all 13 core privacy and security certification criteria after strong industry push‑back. The rule, part of a broader deregulatory agenda, aims to cut compliance costs (projected $1.5 B in savings) while still preserving a baseline of privacy and security assurance for electronic health record (EHR) systems. The final rule is slated for Federal Register publication with most provisions effective Dec 28 2026 and a few on Jan 1 2027.
Why It Matters for Trust & Control Assurance — Keeping the core privacy‑security certification criteria preserves a verifiable baseline of vendor‑product controls, a key control objective for third‑party risk assurance.
Who Is Affected — Health‑IT vendors that develop or sell EHR solutions, healthcare providers (especially small and rural), and any organization that relies on certified health‑IT products.
Recommended Actions —
- Map the retained certification criteria to your internal security and privacy controls; collect evidence that each control is in place.
- Update your third‑party risk program to reflect the reduced but still‑required certification set and monitor ONC communications for future changes.
Technical Notes — The final rule eliminates 14 of 60 certification criteria and revises seven; the 13 privacy and security criteria remain untouched. The rule is expected to save $108 M annually beginning 2027. Source: DataBreachToday