EHR / EMR
What does ONC's 2026 deregulatory rule mean for senior housing operators?
Clicks …Last reviewed
Direct answer
ONC's final rule, effective December 28, 2026, removes 14 of 60 health IT certification criteria, revises seven and drops the AI "model card" disclosure requirements from decision support certification. Certification is voluntary and mainly affects EHR developers. For operators, the practical effect is more vendor flexibility and fewer federally required explanations of how AI outputs are produced, so the operator must decide which outputs it accepts.
The executive view
Fewer certification requirements do not reduce the operator's accountability. When vendors are no longer required to describe their AI, the operator's own definitions, source authority and approval records become the main evidence of why a number or recommendation was accepted. Information-blocking obligations remain in force.
Why this happens
The rule reflects ONC's stated shift toward FHIR-based APIs and newer AI-connection standards, such as Model Context Protocol, rather than functionality-specific certification. More systems will be able to exchange the same data more easily.
Easier exchange increases the number of sources reporting the same census, care level or labor figure. Connected data is not automatically governed data: the systems can still disagree, and certification never decided which figure an operator should report.
Questions to ask before December 28, 2026
Educational guidance, not legal advice or an implemented SeniorCRE control. Confirm obligations with qualified counsel and your vendors.
Inventory certified products
List each EHR, eMAR and health IT product you use and ask the vendor which certification criteria it will keep, drop or revise under the rule.
Accountable owner: CIO or IT lead
Acceptance check: A written vendor response for each product, dated.
Replace lost AI disclosures
For any AI-supported decision support, require the vendor to describe in writing its sources, intended use and known limits, even where certification no longer requires it.
Accountable owner: Clinical and compliance leadership
Acceptance check: A disclosure on file for every AI feature in use.
Record who approves AI outputs
Name the role that may accept, reject or escalate each AI-supported output, and record the decision.
Accountable owner: COO with clinical leadership
Acceptance check: A named approver and decision record for each AI use.
Review information-blocking exposure
Ask counsel whether any system you operate, or any data you control, falls under information-blocking rules.
Accountable owner: General counsel
Acceptance check: A documented legal position.
Measures to baseline before expanding
- Products with a dated vendor certification statement
- AI features in use with a written vendor disclosure
- AI-supported decisions with a named approver
These are buyer and governance checks, not compliance determinations. This summary covers the rule's main provisions and should be checked against the full Federal Register text.
The governance question
The EHR can be the authoritative source for clinical data while the operator still governs how that data becomes a financial, staffing or reporting decision. That cross-system step needs its own authority rules and record.
Evidence → Disagreement → Authority → Operator-Controlled Operating Record → SeniorCRE Intelligence → Execution
What good operating infrastructure should do
- Read clinical events without altering the clinical record.
- Map clinical events to their financial and staffing consequences.
- Surface timing gaps between clinical, billing and scheduling systems.
- Govern across communities that use different clinical systems.
- Keep clinical authority with clinical leadership.
SeniorCRE perspective
Coherence before Intelligence. Replacement remains the operator’s choice. SeniorCRE is designed to govern what retained clinical systems produce. Its clinical record surfaces are built, but medication administration and eMAR remain roadmap — not built and excluded from Road 2 starting scope. A future clinical system-of-record configuration requires function-specific build, clinical-safety review and sign-off, end-to-end validation, data readiness and operator acceptance before production entry; it is not currently deployable. Status: the Operator-Controlled Operating Record is designed and not yet implemented in any community. Current capability states and production-entry gates are published in the Evidence Record at the Trust Center; nothing here should be read as a production result.
Sources and scope
References support only the scope described below, not independent product validation or endorsement.
- ONC final rule: Health Data, Technology, and Interoperability — ONC Deregulatory Actions To Unleash Prosperity (45 CFR Parts 170 and 172, RIN 0955-AA09)
Effective dates, removed and revised certification criteria, decision support interventions changes.
- ONC Health IT Certification Program
Voluntary certification program background.