HHS Finalizes Rule Cutting Health IT Compliance Costs, Drops Security and Transparency Requirements

Federal regulators finalized a rule streamlining health IT certification, projecting billions in savings while dropping several security and transparency requirements for EHR vendors.

A federal rule projected to save billions in compliance costs has been finalized by HHS's health IT arm, the Office of the National Coordinator for Health Information Technology (ONC), reshaping the certification landscape for electronic health record software used by hospitals and clinics. The final rule retains most core objectives from the December 2024 proposal but represents a significant scaling back from what regulators originally envisioned. The Trump administration's version of the rule removed multiple security, privacy, and transparency requirements that had been proposed for vendors of EHR software. Notably, ONC stopped short of finalizing its information blocking proposals, effectively deferring that contentious area to a future rulemaking. The changes affect the certification requirements that EHR vendors must meet to sell their products to healthcare providers, a market that touches virtually every U.S. hospital and medical practice.

Why it matters

EHR software underpins patient records and care coordination across virtually every U.S. hospital and clinic, so changes to certification and security requirements directly affect how safely and transparently patient data is handled. The removal of security and transparency requirements has raised concerns among patient advocates and health IT observers who worry about reduced accountability for vendors.

What's next

ONC is expected to address the deferred information blocking proposals in a separate future rulemaking.

Key facts

• The rule was finalized by HHS's Office of the National Coordinator for Health Information Technology (ONC)
• The final rule projects billions of dollars in savings in compliance costs for health IT vendors
• Several security, privacy, and transparency requirements for EHR software vendors were removed in the final rule
• The rule was based on a proposal first published in December 2024
• ONC declined to finalize its information blocking proposals, punting them to a future rulemaking
• The certification requirements apply to EHR software used by hospitals and medical practices across the U.S.

Bias & framing notes

STAT News framed the story around what was lost — emphasizing the removal of security, privacy, and transparency requirements — while Fierce Healthcare led with the cost-savings framing and the regulatory streamlining angle. Neither source provided extensive quotes from administration officials explaining the rationale for dropping security requirements specifically, making it difficult to fully represent the government's stated reasoning on that point.

NewsClear — neutral news & congressional tracking · Bill of the Week