STAT+: HHS relaxes security, transparency rules for health record software used by hospitals

The Trump administration changed the federal rules that vendors must meet to have electronic health record systems certified. The Office of the National Coordinator for Health IT removed 14 requirements and substantially revised seven others. The stated goal was to reduce regulatory burdens and encourage new technology.

The rules covered security, privacy, transparency, and other certification criteria. These criteria are used to evaluate electronic record-keeping systems sold by vendors such as Epic and Oracle. Removing a requirement means vendors no longer need to meet that specific condition for certification.

The change remains controversial. Commenters warned that weakening or removing requirements could reduce protections for sensitive health information. They also raised concerns about the safety of products that depend on artificial intelligence. The final rule therefore changes the balance between regulatory streamlining and safeguards for health technology.

An electronic health record is a digital version of a patient’s medical record. It can organize health information in software rather than paper files. Hospitals and other healthcare organizations use these systems to record, retrieve, and manage clinical information. The article refers to them as electronic record-keeping systems.

Software is certified when it meets specified requirements in a government certification program. Certification criteria can address security, privacy, transparency, and related product capabilities. In this case, the Office of the National Coordinator for Health IT used 60 criteria to evaluate systems sold by vendors such as Epic and Oracle.

The final rule changed that evaluation framework. Fourteen criteria were eliminated, and seven were substantially revised. Certification still exists, but the requirements are different. Commenters argued that the changes could weaken protections for sensitive health information and affect the safety of artificial-intelligence products.

The change affected 21 certification criteria in total. The final rule eliminated 14 of the 60 criteria used to certify electronic record-keeping systems. It also substantially revised seven other criteria. Together, those changes altered more than one-third of the framework.

The eliminated criteria no longer apply as certification conditions. The seven revised criteria remain, but their requirements were materially changed. The article does not list each criterion individually. It does identify the broader areas involved, including security, privacy, transparency, and safety concerns related to artificial intelligence.

The scale matters because certification is meant to define the conditions vendors must meet. A change to 21 criteria can affect how products are assessed before being sold as certified systems. The administration described the shift as regulatory streamlining, while commenters warned that it could weaken safeguards for sensitive health information and AI-dependent products.

Health record systems handle sensitive health information, so security and privacy requirements help protect data from misuse, exposure, or unauthorized access. Transparency requirements can also make software practices easier to examine. Safety requirements matter when software influences processes involving patient care.

The article gives a specific warning from commenters. They objected that eliminating or revising requirements could undermine the security and privacy of sensitive health information. They also raised concerns about efforts to ensure the safety of products that rely on artificial intelligence. These are potential consequences, not reported incidents.

The administration presented the changes as a way to streamline government regulation and support new technologies. The central policy question is whether fewer or different certification conditions will make innovation easier without reducing safeguards. Future effects will depend on how vendors and users operate under the revised framework, which the article does not detail.

Certified health record systems are made and sold by health technology vendors. The article names Epic and Oracle as examples of companies selling electronic record-keeping systems. Certification is the government-facing process that evaluates whether those products meet specified criteria.

Hospitals and other healthcare organizations are the typical users of these systems. They use electronic records to manage patient information and support their work. The certification rules therefore affect both the companies building the software and the organizations choosing or operating it. The article specifically identifies vendors, while the broader role of hospitals follows from how electronic health records are used.

The rule changed the conditions vendors must satisfy for certification. Fourteen criteria were removed, and seven were substantially revised. That may reduce compliance work for companies and support new technology, which was the administration’s goal. Commenters feared it could also weaken protections relied on by organizations handling sensitive health information.

Government certification standards give buyers and users a common baseline for judging health record software. This matters because electronic records contain sensitive health information, and software failures can affect privacy, security, and safe operation. The article does not provide a detailed history of the program, so this broader explanation relies on the established purpose of certification standards.

In the system described, the Office of the National Coordinator for Health IT used 60 criteria to certify electronic record-keeping products. Those criteria included requirements connected with security, privacy, and transparency. Companies such as Epic and Oracle sell systems evaluated under this framework.

The final rule reduced the framework by eliminating 14 criteria and revising seven. The administration said this would streamline regulation and support technology development. Commenters argued that standards also serve as safeguards. The debate reflects the government’s challenge: encouraging innovation while maintaining a dependable baseline for software used to handle health information.

Artificial intelligence makes strong safeguards especially important because health software may rely on complex systems that are difficult to understand or evaluate. Privacy and cybersecurity controls protect sensitive health information. Transparency helps users and regulators understand how systems work. Safety standards help identify problems before products affect healthcare processes.

The article directly connects the debate to products that rely on artificial intelligence. Commenters objected that removing or revising certification requirements could undermine efforts to ensure their safety. The article does not describe a particular AI product or failure. It identifies the concern as part of the broader effect of weakening certification requirements.

The final rule eliminated 14 of 60 criteria and substantially revised seven. The administration said this would support new technologies, including innovation involving health software. The forward challenge is maintaining meaningful oversight as technology changes. The article leaves open how the revised requirements will affect AI products in practice.