Data Privacy,
Data Security,
Healthcare
Regulators Retreat From Removing Certification Regs After Hearing Industry Concerns
In a significant regulatory shift, federal authorities have decided against the complete elimination of essential privacy and security certification requirements associated with electronic health records (EHR). This decision comes after heightened industry scrutiny and various stakeholder concerns. However, the regulators are proceeding with multiple other initiatives aimed at streamlining certification regulations to decrease costs and stimulate innovation in health technology.
The U.S. Department of Health and Human Services’ Office of the National Coordinator for Health Information Technology (ONC) recently published a final rule that reflects these changes. This rule eliminates 14 out of the originally proposed 60 certification criteria for health IT products and revises seven additional criteria. Notably, while the agency initially indicated plans to eradicate 34 criteria—including all privacy and security requirements—they have decided to retain the 13 core criteria that pertain to privacy and security after receiving extensive feedback during the public comment period.
The named regulation, “Health Data, Technology and Interoperability: ONC Deregulatory Actions to Unleash Prosperity,” or HTI-5, is part of a larger deregulatory strategy associated with the previous Trump administration. This initiative is designed to cut compliance costs, enhance competition, and foster innovation within the healthcare sector.
The HHS estimates that the new rule will save developers of health IT more than $1.5 billion in regulatory costs, with annualized net savings calculated at approximately $108 million starting in 2027. The official publication of this rule in the Federal Register is scheduled for Wednesday, with the majority of its provisions set to come into effect on December 28. Some provisions will take effect on January 1, 2027.
During a recent press briefing, ONC officials elaborated on their decision not to proceed with the removal of the 13 core EHR privacy and security certification requirements. Their choice was influenced significantly by the concerns raised by the public in response to the proposed changes. Michael Lipinski, the division director of regulatory affairs at ONC, noted, “We received a lot of comments arguing that these criteria should be kept,” reflecting the importance that various stakeholders place on these foundational privacy and security standards.
Most commenters expressed opposition to ONC’s original proposal to completely eliminate the privacy and security certification criteria, emphasizing that such certification serves as a minimum baseline for essential capabilities. Stakeholders argued that these certification criteria provide healthcare providers a reliable mechanism to verify the privacy and security capabilities of the health IT products they acquire for use in their operations.
Among the concerns cited were the burdens that would be shifted onto healthcare providers if certification requirements were removed. It was pointed out that such a move could compel providers to expend additional resources to verify the existence of critical privacy and security capabilities in health IT products. This was particularly troubling for small and rural healthcare providers, who typically operate with limited resources.
Furthermore, some stakeholders claimed that maintaining robust privacy and security capabilities directly correlates with improved patient safety. The requirements that were nearly eliminated included key components like authentication, access control, and authorization criteria from the certification program. These elements are crucial for safeguarding sensitive health information and ensuring that only authorized personnel have access to it.
Looking towards future regulatory efforts, ONC stated that they might adopt a new approach which would integrate various privacy and security functionalities within the criteria themselves. They indicated a preference for using consensus-based standards to strengthen security protocols while ensuring compliance remains feasible for health tech developers.
Additionally, the newly released rule removes several federal certification requirements, particularly those tied to transparency and risk management regarding predictive clinical decision support technologies. These technologies, which often utilize artificial intelligence to guide clinical decisions, had been under scrutiny due to their associated costs and administrative burdens. The regulations were originally designed to offer standardized disclosures that would assist healthcare organizations in comprehending the efficacy and limitations of these predictive tools.
Despite the removal of these elements from the current rule, ONC officials acknowledged that future rulemaking may revisit the aspects of predictive decision support systems to determine if they warrant reintroduction. As the healthcare landscape continues to evolve, balancing regulatory requirements with technological innovation remains a significant challenge for federal regulators and industry stakeholders alike.