HHS Keeps Core EHR Privacy and Security Certification Rules
Summary
HHS's final HTI-5 rule retains 13 core EHR privacy and security certification criteria after proposing to eliminate them, while removing other certification requirements, including transparency and risk-management provisions for predictive clinical decision support.
Key points
- HHS's final rule retains all 13 core EHR privacy and security certification criteria, reversing its proposal to eliminate them.
- The rule removes 14 of 60 certification criteria and revises seven others.
- The removed criteria include transparency and related risk-management requirements for predictive clinical decision support tools.
- Commenters said certification provides a baseline for verifying privacy and security capabilities and warned that removing it could shift verification burdens to healthcare providers, particularly small and rural providers.
- Most provisions are scheduled to take effect Dec. 28, with some taking effect Jan. 1, 2027.
Article Details
- Event Type
- Federal health IT certification rule finalized after scaling back proposed privacy and security requirement removals.
- Impact
- The final HTI-5 rule removes 14 of 60 certification criteria and revises seven, but retains all 13 core EHR privacy and security certification criteria that the proposal would have eliminated. It removes predictive decision-support transparency and related risk-management requirements. HHS estimates savings of more than $1.5 billion in regulatory costs, including about $108 million in annualized net savings beginning in 2027. Most provisions are scheduled to take effect December 28, with some taking effect January 1, 2027.
People
KeaneDiscussed ONC's approach to embedding privacy and security capabilities in certification criteria through adopted consensus-based standards.Michael LipinskiIdentified as division director of regulatory affairs in ONC's Office of Programs and Implementation; discussed the decision to retain privacy and security criteria and possible future rulemaking.