ONC EHR Certification in 2026: Process, Criteria, Cost and Timeline

ONC EHR certification means getting your product certified under the federal Health IT Certification Program, run by ASTP/ONC (the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT). You test against the certification criteria you choose with an authorized testing lab, an authorized certification body certifies the product, and it is listed on the Certified Health IT Product List (CHPL). Today two firms do both jobs: Drummond Group and SLI Compliance. Drummond Group, one of the two, says to expect roughly two weeks for engagements without live testing and six months or more for those with it. Then plan for ongoing duties: attestations twice a year and real world testing every year.

You need it when your customers must use certified technology for a CMS program. You usually do not need it for an app that reads data from an EHR that is already certified.

This guide covers who needs certification, what the HTI-5 final rule changed in October 2026, the steps, the (g)(10) FHIR API criterion and its test kit, what certification costs, and how long it takes. Every rule links to its source.

Do you need ONC certification?

Certification is voluntary under the law. Your customers' programs are what make it necessary.

You need it if:

• Your customers are hospitals or critical access hospitals in the Medicare Promoting Interoperability Program. CMS requires them to use certified EHR technology (CEHRT) that stores data in a structured format, in place by the first day of the reporting period (CMS).
• Your contracts or your buyers ask for it. If a buyer's vendor requirements name a CHPL listing, certification becomes a sales requirement even without a CMS program.
• You will sell an EHR that replaces a certified one at practices that report to CMS programs.

You probably do not need it if:

• Your product is a specialty app that reads and writes data through a certified EHR's API. The EHR carries the certification.
• Your product serves direct-pay, cash-only or non-US practices with no CMS reporting.
• You are building an internal tool for one organization that already runs a certified EHR alongside it.

A middle path is common: certify only the criteria your customers need, as a Health IT Module, rather than a full EHR. The certification body certifies modules criterion by criterion.

What changed in 2026: HTI-5 and the rules around it

ASTP/ONC released the HTI-5 final rule on 26 October 2026 (Federal Register public inspection document 2026-21943). It takes effect 60 days after publication in the Federal Register, which was scheduled for 28 October 2026, and some removals start on 1 January 2027. Here is what it means for a product you plan to certify:

• 14 criteria are removed. (a)(9), (b)(7), (b)(8), (b)(9), (g)(6) and (h) go first; (a)(12), (c)(4), (e)(3), (g)(1), (g)(2), (g)(7) and (g)(9) go on 1 January 2027.
• 7 criteria are revised: (b)(1), (b)(2), (b)(11), (c)(3), (e)(1), (f)(6) and (g)(3).
• All privacy and security criteria in 170.315(d) stay. The proposal would have removed them; the final rule kept them.
• (g)(10), the standardized FHIR API criterion, stays.
• Real world testing plans are gone. Testing itself stays for the criteria in scope, and full results reports are now required only for (g)(10) and the new prior authorization API criteria (g)(31) to (g)(33), still due 15 March each year (rule text, PDF p. 254).
• The Insights condition shrinks. Most of its measures are removed, but the "use of FHIR bulk data access" measure is kept (HTI-5 fact sheet).

Two earlier changes still shape your plan:

• USCDI v3 is the data baseline. HTI-1 set 31 December 2025 for the move to USCDI v3 and US Core 6.1.0; an enforcement discretion notice effectively moved that to 28 February 2026 (ASTP/ONC notice).
• HTI-4 added prior authorization API criteria. (g)(31), (g)(32) and (g)(33) cover the provider side of Da Vinci CRD 2.2.1, DTR 2.2.0 and PAS 2.2.1 (HTI-4).

For the full list of removals and what each one did, see our HTI-5 final rule guide.

The ONC certification process, step by step

1. Choose your criteria. List what your customers need, criterion by criterion from 45 CFR 170.315. Ask the certification body which criteria apply to your product type after HTI-5, before you build.
2. Build to the named standards. Each criterion points to exact versions, for example FHIR R4.0.1, US Core 6.1.0 and SMART App Launch 2.0.0 for (g)(10) (45 CFR 170.215).
3. Test yourself with the official tools first. ASTP/ONC publishes a test method for each criterion. For (g)(10) it is the (g)(10) Standardized API Test Kit on Inferno; for (b)(1) transitions of care it is the C-CDA validators and the Edge Testing Tool (test method).
4. Test with an ONC-Authorized Testing Lab (ONC-ATL). The lab runs or witnesses the tests. Some criteria are met by attestation instead: you attest yes or no, and the certification body checks it. The (d)(12) credential encryption criterion is one example, where the test method says testing tools are not required (test method).
5. Get certified by an ONC-Authorized Certification Body (ONC-ACB). The body reviews the lab results and your documentation, issues the certification and keeps watch over the product afterwards.
6. Get listed on the CHPL. The Certified Health IT Product List is what your customers and CMS look up.
7. Keep the certification. Meet the Conditions and Maintenance of Certification every year (below).

Two firms hold both authorizations today: Drummond Group and SLI Compliance, a division of Gaming Laboratories International (ONC-ATLs, ONC-ACBs). Older articles list four labs; two of those are no longer listed.

The (g)(10) FHIR API criterion

(g)(10) is the criterion most custom EHRs meet first, because it is how patients and apps reach the data. It requires a FHIR API for one patient at a time and for groups of patients, secured with SMART App Launch.

The standards it names today (45 CFR 170.215):

SVAP, the Standards Version Advancement Process, lets you certify to a newer approved version voluntarily (test method).

The test kit is open source: onc-certification-g10-test-kit. Version 8.0.7 (released 9 September 2026) has 641 tests in seven groups:

What we learned running it in October 2026

We build custom EHRs on our own open-source FHIR server, headless-ehr-fhir, so we run this kit ourselves. On 27 October 2026 we ran version 8.0.7 against it over HTTPS. The Standalone Patient App group passed 47 of 47. That is one of the seven groups, not the full criterion. A certification test covers all seven, and a client build that targets certification runs all seven before the lab.

The run taught us four things worth knowing before your own:

• Kit versions change what they ask for. Version 8.0.7 requests access one data type at a time (patient/Observation.rs and so on) instead of all types at once. Our server granted the broad form but dropped the narrow one, and 22 tests failed until we fixed how it matches the two. Run the current kit, not the one you passed last year.
• Use real HTTPS from the start. The kit checks TLS on the authorization and token endpoints, and those tests cannot pass on a local HTTP server.
• Give the validator room. The data group sends every resource to the HL7 FHIR validator, which needs several gigabytes of memory on its own. On a crowded laptop it stops, and the tests report connection errors that are not your server's fault.
• Mind token lifetimes. The data group runs long. If your access tokens expire in an hour, plan a refresh between groups, or late tests fail for a reason that has nothing to do with the data.

Conditions and Maintenance of Certification

Certification is not a one-time event. Seven conditions apply to developers of certified health IT (45 CFR 170.401 to 170.407):

The certification body also runs surveillance: it can review a listed product, and a confirmed problem leads to a corrective action plan.

What ONC certification costs

Neither lab publishes a fee schedule. SLI Compliance describes its pricing as a one-time base charge plus a fee per criterion that depends on the criterion's complexity, and it may ask for a non-refundable 50 percent deposit (SLI testing program guide). Ask both labs for a quote on your exact criteria list.

The government's own estimates help with the rest of the budget. In the HTI-5 regulatory impact analysis, ASTP/ONC estimates:

• $8,000 to $12,000 per product, per criterion, per year for safety-enhanced design (usability) testing, for criteria that require it (rule text, PDF p. 218).
• About $4,400 a year per developer for real world testing of (g)(10) (PDF p. 226).
• 3,000 to 4,000 hours to build the (b)(1) transitions of care criterion, an estimate first made for the 2015 Edition (PDF p. 214).

The biggest cost is usually your own engineering: building each criterion to its standard, passing the test kits, and writing the documentation the lab asks for. At Nirmitee, ONC certification readiness is a published add-on to a custom EHR build: $35K to $60K and 6 to 8 weeks, covering the build to (g)(10) and the other criteria you will claim, Inferno test runs, and the documentation for the testing lab. Lab and certification fees are separate and paid to the lab. Our custom EHR cost guide shows how it fits with the build tiers.

How long ONC certification takes

ASTP/ONC publishes no standard timeline. The labs give rough guides:

• Drummond Group: "For engagements that don't require live testing, expect roughly two weeks," and engagements requiring live testing can take "six months or more" (Drummond).
• SLI Compliance: its testing guide says the process requires 2 days in addition to the interactive testing (SLI guide).

Getting the product ready comes before any of that, which is why our readiness add-on is 6 to 8 weeks on top of the build. Ask the lab for its scheduling lead time when you request a quote.

Three ways to reach certified status

• Certify your whole product. Best when the EHR is your product and your buyers report to CMS programs. Highest cost; you control everything.
• Certify a module. Certify only the criteria your customers need, for example (g)(10) and the (d) security criteria, and rely on certified partners for the rest, such as e-prescribing. Lower cost; you depend on the partners staying certified.
• Do not certify yet. Build on FHIR, US Core and SMART from the first release so certification later is a test-and-document project, not a rebuild. This is the path we recommend for most first releases, because it keeps the option open at a small cost.

If you are weighing a custom build against a certified product, our custom EHR vs off-the-shelf guide compares the paths, and the open-source EHR guide compares the open-source bases you can build on.

ONC certification checklist

1. List your customers' programs and the criteria they need.
2. Confirm the list with Drummond Group or SLI Compliance, after HTI-5.
3. Build to the exact standard versions named in 45 CFR 170.215 and the criteria.
4. Run the current ASTP/ONC test kits over HTTPS, with every group, before you book the lab.
5. Prepare the documentation and attestations the lab asks for.
6. Ask each lab for a quote and its scheduling lead time, and budget lab fees separately.
7. After listing: attest twice a year, run real world testing, and report (g)(10) results by 15 March.
8. Keep (d) privacy and security criteria in scope; HTI-5 kept all of them. Our HIPAA compliant EHR guide maps those safeguards to features.

Planning an EHR that may need certification? See our prices, timelines and test evidence on the custom EHR development services page, read how we approach FHIR integration, or talk to our team.