ONC Certification Program

Not yet updated for 2026
Roles: Investigator Research Leaders Informaticist Software Engineer Clinician Scientist/Trainee
Learning objectives
  1. Identify FHIR-related certifications and their associated standards.

The ONC Health Certification Program includes several certifications for FHIR and related standards. Certified systems are required to support a common set of data and API interactions, which can greatly simplify obtaining data from multiple sources provided each source is using certified software.

Use cases covered by one of the APIs required for certified systems are much more likely to have broad support in EHRs compared to use cases that don’t align with one of the APIs.

1 FHIR Certifications

1.1 45 CFR 170.315(g)(10): Standardized API for Patient and Population Services

The Cures Act Final Rule includes a provision requiring that patients be able to access their electronic health information via a standard API (FHIR), and (g)(10) certification verifies that an Electronic Health Records (EHR) system meets these requirements. The HTI-1 final rule identifies updated versions of the specifications (called Implementation Guides) describing FHIR implementations that must be implemented by EHRs for certification. While the this certification is voluntary, CMS provides a financial incentive to health systems that use certified EHRs, and as a result the vast majority of EHR systems in the United States have received this certification. The various required standards and their relationships are described in the table below.

Standard Cures Act Required Version HTI-1 Required Version (effective Jan. 1, 2026) Description
USCDI V1 V3 The data elements which must be exposed
US Core v3.1.1 v6.1.0 How to represent the USCDI elements via FHIR, and the required FHIR API interactions to access the data
Bulk Data Access v1.0.0 v1.0.0 How to perform a bulk export of multiple patients’ data
SMART App Launch v1.0.0 v2.0.0 How to obtain authorization to access data
OpenID Connect Core 1.0 incorporationg errata set 1 1.0 incorporating errata set 1 How to authenticate the current user

1.2 45 CFR 170.315(g)(31/32/33): Provider Prior Authorization API - Coverage Requirements Discovery/Documentation Templates and Rules/Prior Authorization Support

The CMS-0057-F Final Rule requires payers and providers to implement a variety of different APIs, effective January 1, 2027. The rule does not require specific implementations for each of these APIs, but it does recommend that particular FHIR implementation guides be used. Table H3 from the final rule contains a complete list.

ASTP has established voluntary certifications covering three of these recommended implementation guides related to prior authorization workflows.

For three APIs related to prior authorization (collectively referred to as “burden reduction”)

2 Identifying Certified Software

ASTP hosts the Certified HealthIT Product List (CHPL, pronounced “chapel”), a website which lists all software which has been certified by the ONC Health IT Certification program. It allows users to see which certifications a piece of software has received, as well as the underlying standards included in each certification.