ONC Health IT Certification Program

ONC Health IT Certification Program
Name	ONC Health IT Certification Program
Established	2010
Jurisdiction	United States
Parent agency	Office of the National Coordinator for Health Information Technology

ONC Health IT Certification Program

The ONC Health IT Certification Program is a United States federal program that establishes criteria and processes for certifying health information technology products used in clinical care, enabling interoperability, privacy, and security mandates tied to federal initiatives. It connects regulatory frameworks from the Health Information Technology for Economic and Clinical Health Act to implementation strategies within agencies such as the Office of the National Coordinator for Health Information Technology, integrating standards promulgated by bodies like the National Institute of Standards and Technology, the Centers for Medicare & Medicaid Services, and technical specifications developed by organizations including Health Level Seven International and Integrating the Healthcare Enterprise.

Overview

The program defines certification criteria for electronic health record technology to comply with statutory objectives in the American Recovery and Reinvestment Act of 2009, aligns with measurement and payment models used by the Centers for Medicare & Medicaid Services and the Centers for Disease Control and Prevention, and interfaces with accreditation infrastructures such as the Joint Commission and College of American Pathologists. It establishes outcomes for data exchange with networks governed by standards from HL7 FHIR, vocabulary systems from the National Library of Medicine and the United States Pharmacopeia, and security controls informed by NIST Special Publication 800-53 and the Federal Information Security Management Act. The program also coordinates with initiatives led by Social Security Administration and Department of Veterans Affairs systems where health IT certification supports clinical workflows.

History and Development

The program originated after passage of the Health Information Technology for Economic and Clinical Health Act and national policy direction set by the American Recovery and Reinvestment Act of 2009, following reports and recommendations from advisory entities including the President's Council of Advisors on Science and Technology and hearings before the United States Congress. Early milestones include rulemaking by the Department of Health and Human Services and certification criteria updates responding to interoperability roadmaps from JASON (advisory group) and standards harmonization efforts with International Organization for Standardization and International Electrotechnical Commission. Subsequent certification versions—reflecting policy shifts under administrations from Barack Obama to Donald Trump and Joe Biden—incorporated mandates for APIs, patient access influenced by rulings from the Office for Civil Rights (OCR) and privacy frameworks considered by the Federal Trade Commission.

Certification Criteria and Standards

Certification criteria specify functional capabilities, data elements, and conformance to interoperability profiles using specifications from Health Level Seven International such as FHIR (Fast Healthcare Interoperability Resources), message standards like HL7 v2, and document models from CDA (Clinical Document Architecture). Vocabulary and code set alignment rely on systems managed by the National Library of Medicine including SNOMED CT, RxNorm, and LOINC. Security and privacy requirements are shaped by controls referenced in NIST Special Publication 800-66 and federal statutes including the Health Insurance Portability and Accountability Act of 1996. Usability and safety considerations echo guidance from the Food and Drug Administration and standards committees such as ISO/TC 215.

Certification Process and Bodies

Accredited certification bodies evaluate health IT products against ONC criteria using processes overseen by the Office of the National Coordinator for Health Information Technology and accreditation frameworks provided by the American National Standards Institute and the National Voluntary Laboratory Accreditation Program. Authorized bodies include certification entities accredited under agreements aligned to standards from International Accreditation Forum partners and technical testing laboratories that leverage test harnesses developed by stakeholders like Drummond Group and consortia such as IHE (Integrating the Healthcare Enterprise). Certified health IT developers often engage with trade groups including the Healthcare Information and Management Systems Society and Electronic Health Record Association during the attestation and surveillance phases.

Impact on Health IT and Adoption

The certification program influenced adoption of certified electronic health record technology across hospital systems such as Mayo Clinic, integrated delivery networks like Kaiser Permanente, and ambulatory vendors including Epic Systems and Cerner Corporation. It shaped interoperability practices in health information exchanges coordinated by organizations such as Sequoia Project and regional networks under the Direct Project, and supported public health reporting to agencies like the Centers for Disease Control and Prevention and immunization registries run by state public health departments. Economic and contractual impacts extended to procurement policies in agencies such as the Department of Defense and Department of Veterans Affairs, and influenced research infrastructures at institutions like Harvard Medical School and Johns Hopkins University.

Criticisms and Legal/Policy Issues

Critiques have targeted certification scope, test methodology, and market effects, raising concerns in analyses by think tanks such as the Brookings Institution and litigation involving health IT vendors and provider organizations subject to enforcement by the Department of Justice or disputes adjudicated in federal courts. Policy debates addressed information blocking rules promulgated by the Centers for Medicare & Medicaid Services and rulings enforced by the Office of the National Coordinator for Health Information Technology and the Office of Inspector General (HHS), while privacy advocates and consumer groups including the ACLU and Consumer Reports questioned adequacy of protections under HIPAA (Health Insurance Portability and Accountability Act). Legislative proposals in the United States Congress and oversight by the Government Accountability Office continue to shape reform discussions.

Category:Health information technology