What the rule actually does
The ONC Health IT Certification Program is voluntary. It sets the criteria a software product must meet to be called certified health IT, and certified products are referenced by CMS payment programs. The final rule removes or revises requirements that ONC judged no longer drive adoption, and ONC states that it intends to rebuild the program around FHIR-based APIs that move beyond read-only access.
- Removes the legacy clinical decision support criterion (§ 170.315(a)(9)), the care plan criterion and both security-tag criteria for summary-of-care documents (§ 170.315(b)(7) through (9)), the Consolidated CDA creation performance criterion (§ 170.315(g)(6)) and the transport-methods criteria (§ 170.315(h)), among others.
- Narrows the “decision support interventions” criterion (§ 170.315(b)(11)): developers no longer need to support source attributes, source attribute access and modification, or intervention risk management for evidence-based and predictive AI tools. Feedback tools for evidence-based interventions remain.
- Keeps C–CDA document exchange and Direct secure messaging for transitions of care until January 1, 2030, after commenters stressed that long-term and post-acute care settings still depend on them.
- Descopes Real World Testing and most Insights reporting obligations for developers, and makes conforming edits to the Assurances, API and Attestations conditions.
- Retains, unchanged, the 39 remaining criteria, including the prior authorization and real-time prescription benefit API criteria adopted earlier in 2026.
The rule reduces what vendors must prove to be certified. It does not reduce what an operator must be able to explain about its own residents, staffing, billing and reporting.
- Effective date
- December 28, 2026; certain amendments effective January 1, 2027
- Certification criteria in effect before the rule
- 60
- Proposed for removal / revision
- 34 removed, 7 revised (proposed rule, 90 FR 60970)
- Finalized
- 14 removed, 7 revised, 39 retained unchanged
- AI decision support
- Source-attribute and intervention risk management requirements removed from § 170.315(b)(11)
- C–CDA and Direct for transitions of care
- Retained until January 1, 2030, then removed
- Information blocking
- Not repealed by this rule; separate regulations continue to apply
- ONC’s estimate
- $1.55 billion present-value cost savings to developers; $0 new compliance cost estimated
Source: ONC final rule, Federal Register, October 28, 2026 (45 CFR Parts 170 and 172). Cost estimate is ONC’s own regulatory impact analysis.
Why senior housing & care operators should care
Most assisted living and memory care communities are not direct participants in CMS programs that require certified EHR technology. Skilled nursing and post-acute settings interact with certification more often. Either way, the rule changes the vendor market every operator buys from, and three effects matter.
- AI transparency moves to the buyer
- Commenters warned that removing source-attribute requirements would shift evaluation, governance and liability burdens to providers, especially long-term and post-acute care organizations without data-science or legal capacity. ONC disagreed that a significant shift would occur. Operators should plan as though the burden has shifted: if certification no longer requires a vendor to describe how an AI recommendation is produced, the operator has to ask.
- More exchange, more disagreement
- ONC’s stated direction is FHIR-based APIs and newer AI-connection standards such as Model Context Protocol. Easier exchange means more systems reporting the same census, care level or labor figure. Connected data is not governed data; certification has never decided which number an operator reports to an owner or a regulator.
- A long runway for transitions of care
- Hospital-to-community referrals and discharge summaries still rely on C–CDA documents and Direct messaging. ONC kept those requirements until January 1, 2030. Operators have time, but should ask vendors now how they will receive transitions-of-care information after that date.
Information blocking deserves separate attention. This rule does not repeal the information blocking regulations, and HHS has publicly emphasized enforcement. Whether any operator or its software is an “actor” under those rules is a legal determination for counsel, not something this article decides.
What operators should do before December 28, 2026
- Inventory
- List every EHR, eMAR, pharmacy, referral and analytics product in use. Ask each vendor, in writing, which certification criteria it will keep, drop or revise and when. Owner: CIO or IT lead.
- Disclose
- For each AI-supported feature, require a written statement of data sources, intended use, known limitations and how performance is monitored, whether or not certification still requires it. Owner: clinical and compliance leadership.
- Authorize
- Name the role that may accept, reject or escalate each AI-supported output, and keep a record of each decision. A model confidence score never creates organizational authority. Owner: COO with clinical leadership.
- Plan the 2030 transition
- Ask referral partners and vendors how transitions-of-care documents will arrive after January 1, 2030, and what you will need to receive and reconcile them. Owner: operations and admissions leads.
- Confirm legal position
- Ask counsel whether information blocking obligations apply to any system you operate or data you control, and whether vendor contracts need updated disclosure terms. Owner: general counsel.
None of these steps depends on buying new software. They are governance steps an operator can begin with a spreadsheet and existing vendor relationships.
How SeniorCRE proposes to address it
SeniorCRE’s position is Coherence before Intelligence: an operator should decide which information governs before any system, AI or not, acts on it. The ONC rule makes that sequence more important, because fewer outside rules now require vendors to explain their outputs. What follows describes intended design. The Operator-Controlled Operating Record is designed and not yet implemented in any community, and no SeniorCRE outcomes are claimed.
- Definition
- A definition and authority register records what each executive measure means, which source is authoritative for each purpose and who approved it. This exists today as an educational guide and downloadable register, not as an implemented product control.
- Authority over AI outputs
- In the intended design, AI-supported recommendations are proposals. They can read, propose or escalate; they do not approve. The operator names who may accept an output, and the acceptance is recorded beside the evidence.
- Reconciliation
- When systems exchanging data through FHIR, C–CDA or spreadsheets disagree, the intended design retains each source assertion, the operator’s determination and the reason, instead of overwriting one number with another.
- Lineage
- Each governed figure is intended to trace back to its source snapshot, definition version and approver, so a report can be reproduced later for an owner, auditor or surveyor.
Deployment remains the operator’s choice: keep the systems you run today and have SeniorCRE govern what they produce, or deploy SeniorCRE itself as a function-specific system of record, subject to prerequisites and acceptance gates. SeniorCRE does not claim ONC certification for any product. Named integrations, including FHIR and C–CDA connections, are roadmap items. Current certification, testing and production status is stated only on the Trust Center.
Before you trust an AI recommendation, can you show which data it used, which definition governed and who accepted it?
Coherence before Intelligence.
Frequently asked questions
- When does ONC’s 2026 deregulatory rule take effect?
- December 28, 2026, except for amendatory instructions 7, 10 and 12, which take effect January 1, 2027. Removal of C–CDA and Direct requirements for transitions of care takes effect January 1, 2030.
- How many certification criteria did ONC remove?
- ONC finalized removal of 14 of the 60 criteria in effect and revised seven. It had proposed removing 34. The remaining 39 criteria were retained without change.
- Did the rule remove AI model card requirements?
- Yes. The decision support interventions criterion no longer requires source-attribute support, source-attribute access and modification, or intervention risk management for evidence-based and predictive decision support.
- Does the rule repeal information blocking regulations?
- No. Information blocking regulations remain in effect. Whether they apply to a particular operator or product is a legal question for counsel.
- Does this rule apply directly to assisted living communities?
- The rule governs a voluntary certification program for health IT developers. Most assisted living operators are affected indirectly, through the products they buy and the information those products must disclose.
- Is SeniorCRE ONC-certified?
- SeniorCRE does not claim ONC certification. The Operator-Controlled Operating Record is designed and not yet implemented in any community; the Trust Center states current status.
Prepare your organization
Bring one AI-supported output or one figure your systems disagree on, and we will walk through definition, authority and lineage with you. Request a 30-Minute Assessment.
Sources
- Federal Register, October 28, 2026 (91 FR 67916): Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity, final rule, 45 CFR Parts 170 and 172, RIN 0955-AA09
- Proposed rule (90 FR 60970)—original proposals and comment record
- ONC Health IT Certification Program—program background
- ONC information blocking—current regulations and guidance