HHS cuts dozens of security and privacy requirements for hospital EHR vendors
The Health and Human Services Department eliminated 14 of 60 certification criteria for electronic health-record systems, aiming to ease regulatory burdens.
The Trump administration’s Health and Human Services Department issued a final rule that strips 14 of the 60 criteria used to certify electronic health-record (EHR) systems. The move targets vendors like Epic and Oracle, whose products must meet these standards to be used by hospitals. In addition to the removals, seven remaining criteria were significantly altered.
Regulators argued the adjustments will reduce regulatory complexity and encourage innovation in health-tech, while several public commenters warned that the cuts could weaken safeguards for sensitive patient information and the safety of AI-based applications. The Office of the National Coordinator for Health Information Technology oversaw the rulemaking process. The revised certification framework is now in effect.
Why it matters
Relaxed EHR certification rules could speed health-tech innovation but may also affect patient data security.
In this story
