HHS pares back certification rules for electronic health record software
The Trump administration has moved to loosen federal oversight of electronic health record software used in hospitals, stripping away 14 security, privacy and transparency requirements from the certification framework that governs products sold by major vendors such as Epic and Oracle. The final rule, issued by the Office of the National Coordinator for Health Information Technology, is designed to streamline regulation and encourage development of new technologies. In practice, it lowers the compliance burden for vendors at a moment when hospitals are relying more heavily on digitized records, data exchange, and software functions that increasingly intersect with artificial intelligence.
The change is not minor. Federal certification standards have long served as a gatekeeper for electronic record systems, shaping what hospitals can buy and how vendors must document safety, access controls, and transparency. Removing 14 of 60 criteria alters that balance in a meaningful way, especially because the discarded requirements included safeguards tied to sensitive health information. Seven additional criteria were substantially revised, creating a broad rollback rather than a narrow technical adjustment.
A federal certification system does more than label a product compliant. It sets expectations for how medical data moves, who can access it, and how confidently a hospital can trust the software sitting at the center of clinical care.
Privacy and security concerns sit at the center of the rollback
The most immediate concern raised by critics is straightforward: when federal requirements are softened, the bar for protecting sensitive health information can fall with them. Electronic health records hold diagnoses, medications, laboratory data, imaging reports, and private demographic details. Any weakening of the rules that govern access, auditability, or disclosure can have direct consequences for patient trust and institutional risk.
The administration removed or revised the requirements over objections from commenters who argued the changes could erode privacy protections. Those concerns are grounded in the reality that digital health systems are no longer passive storage tools. They are active platforms that exchange information across hospitals, outpatient practices, payers, and third-party applications, multiplying the number of points where a breach, misuse, or poorly controlled data flow can occur.
Even a small shift in certification language can have outsized downstream effects. Vendors design products to meet whatever the federal standard demands, and hospitals often depend on that certification when selecting and deploying systems. When requirements are relaxed, the line between streamlined procurement and weakened protection becomes thinner.
AI-enabled products face a looser oversight environment
The rollback also reaches products that rely on artificial intelligence, an area where software certification has become more consequential. Several commenters warned that cutting transparency standards could undermine efforts to ensure the safety of AI-dependent tools. That concern is especially relevant because AI features in health record systems can influence documentation workflows, risk stratification, message routing, and other functions that touch clinical decision-making even when they are not making diagnoses on their own.
The need for transparency is obvious in this setting. Hospitals and clinicians need to know what a software system is doing, what data it is using, and where its limitations lie. When certification rules require less disclosure, oversight becomes harder just as AI-enabled tools are becoming more embedded in routine care.
A lighter regulatory framework may speed product development, but it also reduces the amount of standardized information available to hospitals trying to judge whether a system is safe for real-world use.
Hospitals will feel the effect through procurement and deployment
For hospital systems, the practical consequence will likely emerge first in procurement. Certification criteria often function as a checklist for health IT buyers and as a baseline for vendor negotiations. With fewer federal requirements in place, hospitals may encounter products that are easier to bring to market but less constrained by uniform expectations around privacy, transparency, and security documentation.
That shift could appeal to health systems seeking faster software updates or more flexible integration with emerging tools. It may also create pressure on hospitals to do more of their own vetting. In settings where information technology teams are already stretched, reduced federal specificity can transfer responsibility from a national standard to local review processes that vary in sophistication.
The policy change also arrives at a time when electronic health record systems remain foundational to daily clinical operations. Medication reconciliation, order entry, test results, billing, and care coordination all depend on reliable software architecture. Weaknesses in any of those functions can ripple through the care continuum, affecting both efficiency and safety.
Federal regulation now leans further toward innovation than constraint
The administration’s stated aim is to support the development of new technologies. That objective reflects a familiar policy tradeoff in digital health: stricter rules can slow adoption, while looser rules can accelerate product release but leave more of the burden of safety and oversight to vendors and institutions. In a field where software errors can shape patient care as directly as a medication or device issue, the stakes of that tradeoff are high.
Seven criteria were substantially revised rather than eliminated, which suggests the federal government is not abandoning oversight entirely. Still, the removal of 14 criteria represents a meaningful narrowing of the certification framework. For stakeholders focused on cybersecurity, patient confidentiality, and AI accountability, the central question is whether the remaining rules will be enough to protect systems that now carry more clinical weight than ever before.
This is especially relevant because health records are not static archives. They are live operational tools that support real-time care decisions, data sharing, and increasingly automated software functions. If transparency requirements weaken while complexity rises, hospitals may have less visibility into the systems they depend on.
The immediate consequence is a lighter regulatory footprint for vendors. The longer-term consequence will depend on whether hospitals, patients, and independent evaluators can compensate for the missing guardrails without sacrificing privacy or safety.