Skip to main content
U.S. flag

An official website of the United States government

Return to Search

#15 Question [09-10-015-2] I am an EHR technology developer preparing my EHR technology for certification. I am relying on a 3rd party software program to demonstrate my compliance with a specific certification criterion. Does this 3rd party software program need to be independently certified?

Guidance for 3rd party software program to demonstrate compliance with a specific certification criterion. Does this 3rd party software program need to be independently certified

Final

Issued by: Office of the National Coordinator (ONC) of Health Information Technology

#15 Question [09-10-015-2]

I am an EHR technology developer preparing my EHR technology for certification. I am relying on a 3rd party software program to demonstrate my compliance with a specific certification criterion. Does this 3rd party software program need to be independently certified?

No, the 3rd party software program that your EHR technology relies upon does not need to be independently certified. In principle, when presenting your EHR technology to an ONC-ATCB or ONC-ACB you must be able to demonstrate that your EHR technology is in compliance with the certification criterion regardless of whether your EHR technology natively performs the specified capability or relies upon a 3rd party software program. Thus, in practice, if you rely upon a 3rd party software program to successfully demonstrate compliance with a certification criterion, the certification you are issued encompasses the 3rd party software program. In the context of relied upon software, we require ONC-ATCBs and ONC-ACBs:

  1. To include certain information about software that is relied upon when reporting your certification to the National Coordinator, which will result in your EHR technology’s entry on the Certified HIT Products List (45 CFR 170.423(h)(6) and 170.523(f)(6), respectively); and
  2. To ensure that you convey this information on your website and in all marketing materials, communications statements, and other assertions related to your EHR technology’s certification (45 CFR 170.423(k)(1)(ii)) and 170.523(k)(1)(ii), respectively).

DISCLAIMER: The contents of this database lack the force and effect of law, except as authorized by law (including Medicare Advantage Rate Announcements and Advance Notices) or as specifically incorporated into a contract. The Department may not cite, use, or rely on any guidance that is not posted on the guidance repository, except to establish historical facts.