Certified EHR Requirements Explained-what They Don't Tell You
- 01. Core certified EHR technology requirements in 2026
- 02. What certified EHR technology actually means
- 03. Key ONC certification criteria (2025-2026)
- 04. Timeline and transitions in EHR certification
- 05. Core capability requirements for certified EHRs
- 06. APIs, interoperability, and information-blocking rules
- 07. How certification connects to incentive programs
- 08. Sample requirements table (illustrative)
- 09. How to verify your EHR is actually certified
Core certified EHR technology requirements in 2026
Certified electronic health record (EHR) technology must meet a set of federal standards issued by the Office of the National Coordinator for Health Information Technology (ONC) and aligned with CMS' Medicare Promoting Interoperability Program rules. To qualify as certified EHR technology, a system must (1) store patient data in a structured format, (2) meet specific ONC Health IT certification criteria such as the 2015 Edition Cures Update or successor criteria, and (3) be listed on the ONC CHPL Certified Health IT Product List with an active certification status as of the reporting period start date. As of 2026, that baseline increasingly pivots on the United States Core Data for Interoperability (USCDI) v3 and API-driven interoperability, rather than older "edition"-style buckets.
Over the last decade, certified EHR technology requirements have shifted from "showing use" of core functionalities (under Meaningful Use Stages 1-3) to enforcing baseline data elements, real-time interoperability, and transparency around tools like clinical decision support and AI-driven algorithms. Providers that use non-certified systems risk exclusion from federal incentive programs, public health reporting pathways, and some federal quality initiatives, which now explicitly require a CEHRT product as a gatekeeper. The 2023-2026 regulatory updates have also layered on staggered adoption timelines, making "certification" less of a one-time snapshot and more of an ongoing compliance posture.
What certified EHR technology actually means
Certified EHR technology refers to any electronic system that has been tested and validated against the ONC Health IT Certification Program criteria and is listed on the official CHPL database. This certification assures that the system can capture, store, and share patient data in a structured way that meets federal government standards for use in programs like Medicare Promoting Interoperability and national health surveys. For eligible hospitals and critical access hospitals, the product must be certified by the last day of the reporting period and must fully support the required functionality for the entire duration of that reporting period.
Most modern EHRs are sold as "certified" out of the box, but practices must still confirm that the exact version and module they are using appears as current on the ONC CHPL list, because older versions can lose currency as new USCDI and API standards roll out. CMS and ONC jointly emphasize that simply installing a certified module is not enough; the system must be actively used for the required functions (e.g., e-prescribing, secure messaging, public health reporting) to satisfy program rules and avoid negative payment adjustments.
Key ONC certification criteria (2025-2026)
Current requirements center on the ONC Health IT Certification Program's "Base EHR" definition plus a growing set of interoperability-focused criteria. For 2025 and 2026, ONC has maintained that a base EHR must at minimum include patient demographics, problem lists, medication lists, allergy lists, and clinical summaries, each tied to explicit certification criteria such as 170.315(a)(5) for demographics and 170.315(a)(14) for implantable device lists. These base capabilities must be certified under the then-current edition, with migration deadlines (for example, the updated demographics criterion required changes by December 31, 2025, and is fully effective January 1, 2026).
Separately, ONC has added new or revised criteria that push certified EHRs toward open, standards-based exchange. These include requirements for FHIR-based APIs (specifically 170.315(g)(10) and related criteria), structured clinical decision support, and the ability to transmit results to public health agencies and registries. In 2026, the formal baseline for data content is USCDI v3, which introduces more granular data elements related to social determinants of health, mental health, and diagnostic imaging. Vendors must update their certified products to align with USCDI v3 by the specified deadlines, and providers must ensure they are using those updated versions to remain compliant.
Timeline and transitions in EHR certification
The evolution from 2014 Edition to 2015 Edition and then the 2015 Edition Cures Update created a multi-year runway during which hospitals could mix editions to meet the CEHRT definition. For example, in 2022, eligible hospitals and CAHs could use either the original 2015 criteria, the Cures Update, or a combination, as long as the composite set met the functional definition of certified EHR technology under the CY 2021 PFS final rule. That "mix-and-match" phase has now largely ended, with CMS and ONC steering toward a single, current edition baseline.
Starting in 2026, the pattern is no longer a periodic "new edition" but a rolling, staggered update model. New certification criteria are adopted on specific effective dates, giving developers months to update their certified EHR products while allowing providers a transition window. For example, USCDI v3 adoption is required by January 1, 2026, but some related criteria (such as those for decision-support interventions under 170.315(b)(11)) carry a later deadline, stretching into 2027. This staggered approach aims to reduce the "big bang" compliance shock that clinics felt when 2015 and 2015 Cures Update rolled out.
Core capability requirements for certified EHRs
Under current ONC rules, a certified EHR system must support several core workflows that align with federal care-quality and interoperability goals. These capabilities are not just features; they are formally mapped to specific certification criteria that an ONC-accredited testing laboratory must validate before listing the product on the CHPL database. If any of these functions fail during certification testing, the entire product or module cannot be listed as certified until the gap is resolved.
- Structured data capture for demographics, problems, medications, allergies, and clinical notes mapped to current USCDI standards.
- Electronic prescribing with controlled-substance support and closed-loop alerts for drug-drug interactions.
- Secure, standards-based messaging with other clinicians and for direct patient communication (e.g., secure messaging portals).
- Automated clinical decision support rules that trigger when specific clinical or lab conditions are met.
- Reporting and transmission to public health agencies, registries, and quality programs via certified public health interfaces.
- Compliance with privacy and security requirements, including role-based access controls and audit logs aligned with HIPAA and ONC security criteria.
APIs, interoperability, and information-blocking rules
One of the most consequential changes in recent years is the requirement that certified Health IT systems expose data via standardized, patient-facing APIs. The FHIR-based APIs must support real-time access to a patient's record, including allergies, medications, and lab results, and must adhere to CMS's Conditions of Participation and ONC's interoperability rules. As of 2026, the ONC "Insights Condition" also requires that certified products submit standardized interoperability and performance metrics, which CMS and ONC can use to monitor and refine the certification program.
These API rules are tightly coupled with the information-blocking regulations under the 21st Century Cures Act. Providers and vendors must not knowingly and willfully restrict the compatibility or interoperability of their certified EHR technology, unless they are relying on one of the eight enumerated exceptions (e.g., privacy, security, or health-IT-related exceptions). Recent proposed rules in 2026 have aimed to clarify and slightly narrow some of these definitions, but the core expectation remains that certified EHRs must be "open by default" and designed to share data when appropriate.
How certification connects to incentive programs
For most hospitals and many physicians, certified EHR technology is not just a technical checkbox; it is a prerequisite for participation in federal incentive programs and avoiding downward payment adjustments. In the Medicare Promoting Interoperability Program, facilities must attest that they are using a certified EHR and that they have not taken actions to limit or restrict its interoperability. Failures in either the certification status or the attestation statement can trigger penalties, which CMS estimates have affected roughly 7-10% of eligible hospitals in recent years when they miss the reporting window or fall short of functional thresholds.
On the Medicaid side, states retain some flexibility, but nearly all have adopted similar rules: only certified EHR products can be used to meet state-level "meaningful use" or equivalent requirements. Beyond incentives, certified EHRs are now required for participation in national health surveys, such as the CDC's National Hospital Care Survey and other federal data collection efforts, which changed their rules in 2020 to mandate use of a CEHRT product for registration. This has effectively turned ONC certification into a de facto licensing layer for federal data infrastructure.
Sample requirements table (illustrative)
The following table illustrates how typical certified EHR technology requirements map to specific certification criteria and program contexts. The data below are calibrated to reflect realistic 2025-2026 thresholds but should be treated as illustrative; providers should always cross-check with the official ONC CHPL and CMS guidance.
| Requirement category | Sample certification criterion | Program relevance | Effective by |
|---|---|---|---|
| Patient demographics capture | 170.315(a)(5) Demographics | Medicare Promoting Interoperability; USCDI v3 | Jan 1, 2026 |
| Medication allergy list | 170.315(a)(1) Allergy list | Clinical quality reporting; interoperability | Dec 31, 2024 |
| Structured clinical decision support | 170.315(b)(11) Decision support interventions | Quality improvement; safety alerts | Dec 31, 2027 (staged) |
| FHIR-based patient API | 170.315(g)(10) Patient-access app | Information-blocking; interoperability | Jan 1, 2025 |
| Public health reporting - surveys | 170.315(f)(7) Transmission to public health agencies | CDC National Health Care Surveys | Jan 2020, refreshed 2025 |
How to verify your EHR is actually certified
Practices cannot rely solely on a vendor's marketing material; they must independently confirm that their specific EHR product and version meet the current certification criteria. The standard workflow is to look up the product on the ONC CHPL Certified Health IT Product List, verify the certification number, and cross-check both the edition (e.g., 2015 Cures Update) and the implementation date against the provider's reporting period. If the product is listed as "inactive" or "revised" for a newer edition, it may no longer qualify as certified EHR technology for the current year.
- Obtain the full product name, version, and module (e.g., inpatient EHR, outpatient EHR, patient portal).
- Search the ONC CHPL database using that product name and filter by certification status and date.
- Confirm that the listed certification criteria match those required by CMS or your state Medicaid program for the current year.
- Validate that the certification date precedes the first day of your EHR reporting period and that the product has not been withdrawn or superseded.
- Document this verification in your internal compliance files and, if applicable, in your attestation packets for the Medicare Promoting Interoperability Program.
Helpful tips and tricks for Certified Ehr Requirements Explained What They Dont Tell You
What counts as certified EHR technology?
Certified EHR technology is any EHR or module that has been tested by an ONC-accredited testing laboratory and listed on the ONC CHPL as meeting the current ONC Health IT Certification Program criteria. To "count" for a given program year, the product must also be certified by the last day of the reporting period and must support all required functions for the full duration of that period. Modules that are not certified (e.g., a standalone scheduling tool) do not themselves qualify as certified EHR technology, even if they interoperate with a certified core system.
Do small practices need certified EHR technology?
Yes; small practices that participate in Medicare Promoting Interoperability or state Medicaid incentive programs must use certified EHR technology to avoid penalties and receive payments. Even if a practice does not pursue incentives, many federal data-collection and reporting pathways (such as public health reporting and national surveys) now require a CEHRT product, which effectively pushes most organizations toward certified systems. In practice, roughly 85-90% of office-based physicians in the U.S. now use some form of certified EHR according to CDC and CMS survey data.
Can you mix different EHRs and still be certified?
Under current rules, providers can combine multiple certified EHR modules from different vendors as long as the composite set meets all required certification criteria for the relevant program. For example, an ambulatory clinic might use one vendor for clinical documentation and another for e-prescribing, provided each module is certified and the combined configuration satisfies the attestation requirements. However, any gap in certification (e.g., a non-certified revenue cycle module handling protected health information) can unsettle the overall CEHRT status when audited.
What are the penalties for using non-certified EHRs?
Organizations that fail to use certified EHR technology in federal programs can face downward payment adjustments, denial of incentive payments, or exclusion from certain quality and reporting programs. CMS has historically applied penalties to a small but meaningful share of eligible hospitals that either miss the certification window or revert to non-certified systems mid-year. State Medicaid programs may also impose their own sanctions, including clawbacks of incentive payments if a practice is later found to have used non-certified software during the attestation period.
How often do certification requirements change?
ONC certification criteria are updated on a rolling, staggered schedule rather than in monolithic "editions" as in the past. New interoperability-focused criteria, API standards, and data-content requirements (such as USCDI v3) are typically phased in over 12-36-month windows, giving vendors and providers time to adapt. However, CMS can still change the program-level rules annually, so providers should budget at least one annual review of their certified EHR posture to ensure alignment with both ONC and CMS updates.