By the EHR Association Certification Workgroup

When federal agencies, including those under HHS, began exploring opportunities for deregulation and burden reduction pursuant to several of President Trump’s Executive Orders (EO), the EHR Association seized the opportunity to voice our unique perspective and deregulation recommendations in the ASTP/ONC Health IT Certification Program. Since then, we’ve been encouraged by and appreciative of the tangible steps ASTP/ONC has taken towards reducing regulatory burdens, specifically its publication of enforcement discretion for both the Insights and Real World Testing (RWT) Condition and Maintenance of Certification.

The Insights enforcement discretion significantly reduced the burden for mandatory measurements that have been a source of consternation for developers since they were first adopted in the HTI-1 final rule. Similarly, the RWT enforcement discretion reduced the burden imposed by required testing plans and results that delivered highly questionable value for their intended purpose.

Most recently, ASTP/ONC published enforcement discretion for the Electronic Case Reporting (eCR) criterion, giving developers an extra year to update eCR public health reporting features to meet the latest standards set by HTI-1. This extra runway comes on the heels of a pause in eCR onboarding by the CDC and delays to eCR measurement under the CMS Promoting Interoperability program.

While there may not be additional enforcement discretion publications, it is highly plausible that future rulemaking will involve the rollback of some existing requirements to satisfy the directives of the aforementioned EOs. In our April 2025 letter to ASTP/ONC with certification program deregulation suggestions, we prioritized recommendations highlighting areas that we believe are particularly ripe for burden reduction.

Next Steps toward Deregulation

The obvious question now is what other deregulatory measures we can expect to see from ASTP/ONC. While there may not be additional enforcement discretion publications, it is highly plausible that future rulemaking will involve the rollback of some existing requirements to satisfy the directives of the aforementioned EOs. In our April 2025 letter to ASTP/ONC with certification program deregulation suggestions, we prioritized recommendations highlighting areas that we believe are particularly ripe for burden reduction. These include:

• Reconstructing USCDI-based program criteria to allow flexibility for developers (and their healthcare provider customers) to support only the set of data that they manage discretely within their system, as opposed to an all-or-nothing approach.
• Rethinking Decision Support Interventions (DSI) criterion requirements to simplify and center around the most beneficial components for healthcare providers.
• Eliminate redundant and/or valueless criteria (e.g., Patient Health Information Capture and EHI Export) from the program. 
• Relieve certified developers of quarterly reporting requirements for anything other than a significant or material change directly impacting certified functionality.
• Remove randomized and in-the-field surveillance as requirements for ONC-Authorized Certification Bodies (ONC-ACB) in favor of a go-forward focus on reactive surveillance.

What Comes Next?

The follow-up question is what comes next for Insights and RWT. The enforcement discretion publications are a temporary measure and both reference an intent for deregulatory action to remove or revise the relevant portions of the Code of Federal Regulations (CFR). However, it will not be as simple as eliminating the requirements; there are statutory obligations under the 21^st Century Cures Act that compel ASTP/ONC to implement some form of each program. Accordingly, there is still a need for ASTP/ONC to collaborate with certified developers and other industry stakeholders to land on a more suitable model for these regulations.

This has been the source of significant feedback and discussion with ASTP/ONC since its original adoption due to the relative infeasibility of deriving percentages at an individual hospital and/or clinician level for reporting. 

There are also some remaining issues that the enforcement discretion publications do not address. First, while the Insights enforcement discretion makes significant strides in relieving unnecessary burden, it leaves one significant issue unresolved: within the requirements for Insights measure responses, developers are required to provide the “Percentage of total customers (e.g., hospital sites, individual clinician users) represented in provided data.” This has been the source of significant feedback and discussion with ASTP/ONC since its original adoption due to the relative infeasibility of deriving percentages at an individual hospital and/or clinician level for reporting. 

Second, while the RWT enforcement discretion provides significant relief, its December 31, 2026, expiration date creates a potential issue. As published, the enforcement discretion relieves any requirement to produce RWT plans for execution in calendar year CY2026. However, the current expiration date means developers are still required to publish RWT results for CY2026, which have a publication deadline of March 15, 2027, if ASTP/ONC does not act to officially amend the regulations.

Open to Collaboration

The EHR Association is eagerly awaiting the next steps on the certification program’s deregulatory journey. We remain open to any opportunities for collaboration with ASTP/ONC on those efforts. In the meantime, we are focused on the recently published HTI-4 final rule. Stay tuned for our next blog, which will provide reactions to the certification program updates.