Dated: November 24, 2025
On October 1, 2025, through November 12, 2025, the Assistant Secretary for Technology Policy (ASTP) and the Office of the National Coordinator for Health Information Technology (ONC) (collectively, “ASTP/ONC”) experienced a lapse in appropriations. ASTP/ONC has determined that this lapse in appropriations impacted the ability of entities to comply with certain regulatory requirements.
In the ONC Cures Act Final Rule (85 FR 25642), we finalized the “Attestations” Condition and Maintenance of Certification requirements (45 CFR 170.406). A health IT developer, or its authorized representative that is capable of binding the health IT developer, must provide to the Secretary of Health and Human Services (HHS) an attestation of compliance with the following Conditions and Maintenance of Certification requirements in 45 CFR part 170, subpart D:
- Information blocking (§ 170.401);
- Assurances (§ 170.402), subject to more limited requirements if the health IT developer certified a Health IT Module(s) that is part of a health IT product which can store electronic health information;
- Communications (§170.403);
- Application programming interfaces (APIs) (§ 170.404), if the health IT developer has a Health IT Module(s) certified to certain certification criteria; and such health IT developer must also ensure that health IT allows for health information to be exchanged, accessed, and used, in the manner described in § 170.404; and
- Real world testing (§ 170.405), if the health IT developer has a Health IT Module(s) certified to certain certification criteria.
Under § 170.406(b)(1), a health IT developer, or its authorized representative that is capable of binding the health IT developer, must provide the attestation, as recited above (hereinafter referred to simply as “attestation”), semiannually for any Health IT Modules that have or have had an active certification at any time under the ONC Health IT Certification Program (Certification Program) during the prior six months. Per Certification Program guidance, a health IT developer is required to submit its attestation to an ONC-Authorized Certification Body (ACB) within a designated 30-day window twice a year (every six months). These attestation windows occur during the months of April and October. April attestations cover the months of October–March, while October attestations cover April–September.[1]
Health IT developers’ attestations were due by October 31, 2025. This deadline, however, was impacted by the lapse in appropriations. During the entirety of the lapse in appropriations, the ASTP/ONC website for attestation submissions and related compliance resources was unavailable. Additionally, ASTP/ONC staff were unavailable to provide operational or program support for ONC-ACBs or health IT developers and their authorized representatives. Therefore, ASTP/ONC is exercising the following enforcement discretion:
- ASTP/ONC will not exercise its direct review authority under 45 CFR 170.580 for any non-conformity, potential or actual, that arises solely from a health IT developer not complying with 45 CFR 170.406 until January 1, 2026. Specifically, ASTP/ONC will not exercise its direct review authority over a health IT developer’s obligation to submit their semiannual attestation that would have been due by October 31, 2025, until January 1, 2026, for such attestation.
- ASTP/ONC will not conclude that an ONC-ACB has failed to review and submit health IT developer attestations to ASTP/ONC as required by 45 CFR 170.523(q), failed to ensure that health IT developers meet their attestation responsibilities as required by 45 CFR 170.550(l), or violated the good standing provisions of 45 CFR 170.560(a); or take any enforcement action under 45 CFR 170.565 against an ONC-ACB if an ONC-ACB does not review and submit health IT developers’ attestations originally due to ASTP/ONC by October 31, 2025, until January 1, 2026.
This enforcement discretion will be in effect immediately and will remain in effect until January 1, 2026. The effect of this enforcement discretion gives health IT developers and ONC-ACBs through December 31, 2025, to ensure submission of attestations for the period covering April 2025 through September 2025. The deadline for the April 2026 attestation submission, covering the period from October 2025 through March 2026, will remain the same (April 30, 2026).
For additional information on the attestation requirements, please see the Certification Companion Guide for Attestations and the Attestations Resource Guide.
ID:EDN2025.05
[1] https://www.healthit.gov/condition-ccg/attestations