Real World Testing Condition and Maintenance of Certification Requirements Enforcement Discretion Notice

Dated: June 30, 2025

On January 31, 2025, President Donald J. Trump signed Executive Order (EO) 14192, “Unleashing Prosperity Through Deregulation.” Section 1 of EO 14192 states that it is the policy of the Administration to significantly reduce the private expenditures required to comply with federal regulations to secure America's economic prosperity and national security and the highest possible quality of life for each citizen.

In consideration of potential future deregulatory actions under the Assistant Secretary for Technology Policy (ASTP) and the Office of the National Coordinator for Health Information Technology (ONC) (collectively, “ASTP/ONC”) authorities and consistent with EO 14192, ASTP/ONC has identified certain regulatory requirements for which the exercise of enforcement discretion would reduce burden and costs for regulated entities.

Section 3001(c)(5)(D)(v) of Title XXX of the Public Health Service Act (PHSA), as amended by the 21st Century Cures Act (Cures Act), requires, as a Condition and Maintenance of Certification under the ONC Health IT Certification Program (Program), that health IT developers successfully test the real world use of their technology for interoperability in the type of setting in which such technology would be marketed. [1]

In the Cures Act final rule (85 FR 25768-25775), we finalized the application of the statutory real world testing requirement to health IT certified to the following certification criteria:

  • The “care coordination” criteria in § 170.315(b);
  • The “clinical quality measures” criteria in § 170.315(c)(1) through (3);
  • The “view, download, and transmit to 3rd party” criterion in § 170.315(e)(1);
  • The “public health” criteria in § 170.315(f);
  • The “application programming interface” criteria in § 170.315(g)(7) through (10); and
  • The “transport methods and other protocols” criteria in § 170.315(h).

For these certification criteria, developers are required to submit annual testing plans and report real world testing results in accordance with § 170.405(b)(1) and (2), respectively. In relation to these requirements, ASTP/ONC is exercising the following enforcement discretion:

For calendar year (CY) 2025:

  1. ASTP/ONC will not exercise its direct review authority under 45 CFR 170.580 for any non-conformity, potential or actual, that arises solely from a health IT developer not complying with 45 CFR 170.405(b)(1). This means that a developer with a Health IT Module(s) certified to one or more of the criteria referenced in 45 CFR 170.405(a) is not expected to submit an annual real world testing plan to its ONC-Authorized Certification Body (ONC-ACB) for the 2026 real world testing year.
  2. ASTP/ONC will not conclude that an ONC-ACB has failed to adhere to 45 CFR 170.523(p)(1) and (3), find a violation of 45 CFR 170.560(a), or take any enforcement action under 45 CFR 170.565 against an ONC-ACB for not reviewing CY 2026 real world testing plans and submitting the plans to ASTP/ONC for public availability.

For calendar year (CY) 2026:

  1. ASTP/ONC will not exercise its direct review authority under 45 CFR 170.580 for any non-conformity, potential or actual, that arises solely from a health IT developer not complying with 45 CFR 170.405(b)(2), except with respect to Health IT Modules certified to the certification criteria specified in 45 CFR 170.315(g)(7) through (10). This means that ASTP/ONC only expects a developer with a Health IT Module(s) certified to the (g)(7) through (10) certification criteria, as of August 31, 2024, will submit a CY 2025 real world testing results report to its ONC-ACB by March 2026.
  2. ASTP/ONC will not conclude that an ONC-ACB has failed to adhere to 45 CFR 170.523(p)(2) and (3), find a violation of 45 CFR 170.560(a), or take any enforcement action under 45 CFR 170.565 against an ONC-ACB if an ONC-ACB does not review and confirm that applicable health IT developers submit real world testing results reports, except with respect to Health IT Modules certified to the criteria specified in 45 CFR 170.315(g)(7) through (10).

This enforcement discretion will be in effect immediately, and will remain in effect until December 31, 2026, or until the Department of Health and Human Services completes a deregulatory action to revise 45 CFR 170.405 and 45 CFR 170.523(p), whichever comes first.


 

[1] 21st Century Cures Act, P. L. 114-255, Sec. 4002(a).