In October 2026, the federal office that runs the health IT certification program finalized a rule that removes and revises parts of it. For a practice shopping for an EMR, that raises a fair question: what does "certified" actually tell you?
Start with your own week
Before you compare feature lists, write down how your practice actually runs. A short list beats a long demo.
- Which visit types you offer, and how many are on video
- How patients pay: cash, packages, memberships, insurance or a mix
- Who touches the chart: providers, nurses, MAs, front desk, billing, an outside marketer
- How you document today and what takes the longest
If you plan to add services in the next 2 years, such as video visits or memberships, put those on the list too. It is easier to ask now than to switch later.
Bring that list to every demo and ask the vendor to show your workflow, not theirs.
What ONC certification means
The ONC Health IT Certification Program is voluntary. ONC manages it as a third-party conformity assessment program.
Developers test their software against defined certification criteria. Certified products appear on the Certified Health IT Product List (CHPL), and certification bodies keep checking that products still conform once practices are using them.
Certified health IT can be used to meet requirements in various federal, state and private programs. If you take part in one of them, look up the exact product and version on the CHPL before you buy.
If a certified product does not do what its certification says, HealthIT.gov directs complaints to the developer first, then to the certification body, and then to ONC.
What certification does not mean
Certification checks conformance to specific criteria. It is not a rating of usability, support, price or fit for your specialty.
It is also not a HIPAA stamp. In its October 2026 final rule, ONC restated its view that its privacy and security certification criteria do not guarantee compliance with the HIPAA Privacy and Security Rules and do not serve as an affirmative defense.
ONC kept those criteria for now and said future rulemaking may remove, update or restructure them. Expect this area to keep moving.
The comments ONC received are telling. Most commenters opposed dropping the privacy and security criteria. Providers worried that, without them, the job of checking these features would fall on practices, and that concern was sharpest among small and rural providers.
Questions to ask every vendor
- Will you sign a business associate agreement before we enter any patient data?
- Can we export all of one patient's data, and all patients' data, without your help? In what format?
- What does the audit log record, and can anyone turn it off or edit it?
- Is two-factor sign-in available for every user?
- Can roles limit what front desk, billing and marketing staff can see?
- What is in the base price, and what costs extra?
- What happens to our data if we leave, and how quickly do we get it?
The first question matters for a legal reason. Under 45 CFR 164.308(b)(1), a practice may let a business associate handle electronic patient data only after getting satisfactory assurances that it will safeguard the information.
The export question matters later. Certified products must support a full export of a single patient's or the whole population's electronic health information under criterion 170.315(b)(10). For any product, ask to see a sample file.
Test it on an ordinary day
Run 3 typical visits from start to finish during a trial or guided demo: book, remind, check in, chart, sign, charge and follow up.
Have your front desk do the booking and a provider do the charting. Time each step and note every workaround.
Then ask to see the audit log entry for what you just did, and run a single-patient export on a test patient. If either one needs a support ticket, you have learned something useful.
Read the contract closely
Look for unclear export fees, auto-renewal with long notice periods, missing BAA terms and data deleted soon after termination. Ask your attorney or compliance advisor to review anything you are unsure about.
EMR MD has role-based access, two-factor sign-in and a hash-chained audit log live today, so you can check those answers yourself before you sign anything.
Sources
- About the ONC Health IT Certification Program HealthIT.gov (ONC), 2026
- Certification of Health IT HealthIT.gov (ONC), 2026
- Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity (final rule, 91 FR 67916) Federal Register via GovInfo, 2026
- 45 CFR 164.308: Administrative safeguards Electronic Code of Federal Regulations (eCFR), 2026
- 45 CFR 170.315: 2015 Edition health IT certification criteria Electronic Code of Federal Regulations (eCFR), 2026
This article is general information, not legal or medical advice. Rules change; check the source and your compliance advisor before acting.