In January 2025, President Donald J. Trump signed Executive Order 14192, Unleashing Prosperity Through Deregulation. The order directs federal agencies to scale back regulatory costs in cases where compliance investments may not align with long-term policy direction.
In line with this directive, the Assistant Secretary for Technology Policy (ASTP) and the Office of the National Coordinator for Health Information Technology (ONC) (collectively, ASTP/ONC) have announced enforcement discretion for certain aspects of the electronic case reporting (eCR) certification criterion under the ONC Health IT Certification Program.
What This Means for Developers
Under the HTI-1 final rule, developers were required to update certified Health IT Modules for eCR (45 CFR 170.315(f)(5)) by January 1, 2026, using either the HL7 CDA-based eICR standard or the FHIR-based eCR standard along with additional functional requirements.
With this enforcement discretion, ASTP/ONC will not enforce ONC-Authorized Certification Bodies (ONC-ACBs) for certifying Health IT Modules that do not yet implement the referenced HL7 CDA or FHIR standards, so long as the modules demonstrate the core functional capabilities outlined in 170.315(f)(5)(ii). These include the ability to:
- Detect reportable encounters through trigger codes
- Create a case report
- Receive and process a case report response
- Transmit a case report to a capable system
Developers may continue to certify Health IT Modules to the eCR criterion by demonstrating conformance to these core functions, even if they have not implemented the specific HL7 CDA or FHIR standard referenced in the regulation.
Certification Bodies and Compliance
ONC-Authorized Certification Bodies (ONC-ACBs) will not be required to take enforcement action against developers whose modules satisfy the above functional requirements. Certification can be maintained under either the prior criterion at 170.315(f)(5)(i) or the functional pathway described in (f)(5)(ii).
Practical Effect
For developers, this means:
- Through 2025: Compliance can be maintained by meeting either the (f)(5)(i) criterion or the functional requirements of (f)(5)(ii).
- Through 2026: Compliance will hinge on meeting the functional requirements of (f)(5)(ii), regardless of HL7 standard adoption.
Developers who have already implemented the HL7 CDA or FHIR eCR standards may continue certifying without changes.
Looking Ahead
This enforcement discretion takes effect immediately and will remain in place until December 31, 2026, or until HHS completes a deregulatory action revising the eCR certification criterion, whichever comes first.
The intent is to relieve near-term compliance costs while giving developers time to align with evolving HL7 standards. Developers are encouraged to continue preparing for broader adoption of modern eCR standards, but certification status will, for now, rest on meeting the functional capabilities rather than specific technical standards.
Developer Next Steps
- Ensure your Health IT Modules meet the functional requirements in 170.315(f)(5)(ii) (trigger codes, case report creation, response processing, and transmission).
- Maintain certification through either (f)(5)(i) or (f)(5)(ii) compliance in 2025, and through (f)(5)(ii) compliance in 2026.
- Monitor updates from ASTP/ONC and Department of Health and Human Services (HHS) for any further regulation that revise the eCR certification pathway.