Version: 1.1.0Documentation Index
Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt
Use this file to discover all available pages before exploring further.
Last Updated: 2026-05-15
Owner: Product / Compliance / CL / PM / PF
Purpose: Decision-grade matrix for choosing ONC pathway (Full certification, modular certification, or alignment-only), with criterion-level coverage and implementation gaps.
1) Executive Summary and Decision Framework
Encore Health OS already has meaningful ONC-oriented groundwork in specs and partial implementation, especially around FHIR, patient access, C-CDA, information blocking, and prior authorization. Strongest existing anchors:CL-16andCL-16-EN-02for FHIR/USCDI and SMART-aligned patient access.PM-55for ONC HTI-1 patient access + information blocking workflow.CL-48for C-CDA generation and transition workflows.PM-52andPM-10for Da Vinci CRD/DTR/PAS trajectory.- Existing compliance baseline in
ONC_CERTIFICATION_ROADMAP.md,REGULATORY_COMPLIANCE_TRACKER.md, andAUTHORITATIVE_REFERENCES.md.
- Conditions and Maintenance of Certification artifacts (Real World Testing, Insights condition, attestations cadence, CHPL documentation artifacts).
- Public health reporting criteria (f-family) and transport criteria (h-family) at certification depth.
- Design/process criteria (g(3) Safety-Enhanced Design, g(4) QMS, g(5) Accessibility-centered design) as ONC evidence artifacts.
- Predictive DSI transparency and HTI-2 additions (
j(20),j(21)).
1.1 Path Comparison
| Path | What it means | Approx effort | Ongoing burden | Best fit |
|---|---|---|---|---|
| Full ONC Certification (broad module scope) | Certify broad criterion set with ONC-ACB/ATL and full Conditions/Maintenance obligations | 12-24+ months | High | If commercial strategy depends on certified module breadth and formal CHPL posture |
| Modular ONC Certification (targeted) | Certify a constrained criterion package (typically API-centric and selected supporting criteria) | 6-12 months | Medium-High | If payer/customer contracts need certified capability but not full criterion surface |
| ONC Alignment-Only (no certification filing) | Implement standards and compliance posture without formal ONC testing/certification artifacts | 3-9 months | Medium | If near-term value is interop/compliance readiness without CHPL listing |
1.2 Required Artifacts by Path
| Artifact | Full | Modular | Alignment-only |
|---|---|---|---|
| ONC-ACB engagement | Required | Required | Not required |
| ONC-ATL test execution | Required | Required (for in-scope criteria) | Not required |
| CHPL listing | Required | Required (for certified module) | No |
| Real World Testing plan/results | Required | Required (for certified scope) | Optional internal |
| Insights Condition reporting | Required | Required | Optional internal |
| Mandatory disclosures URL | Required | Required | Optional |
| Hosted documentation URL | Required | Required | Optional |
| Annual attestation package | Required | Required | Internal governance only |
| Inferno/SITE/Cypress conformance evidence | Required | Required for selected criteria | Strongly recommended internal |
1.3 Decision Triggers
| Trigger | Recommendation |
|---|---|
| Contract explicitly requires CHPL-listed module | Choose modular or full certification |
| Strategic product positioning requires “certified” market claim | Choose modular now, full later if needed |
| Priority is interoperability delivery speed with lower overhead | Choose alignment-only with certification-grade internal evidence |
| Multi-state payer expansion requires auditable API posture quickly | Choose modular certification focused on API and information blocking evidence |
2) 45 CFR §170.315 Criteria Gap Matrix (Criterion Families)
Coverage Status Legend:NoneSpec-onlySpec + partial implSpec + impl-completeCertified-ready
2.1 (a) Clinical Criteria
| Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
a(1) | CPOE - medications | Yes | CL | CL-05, CL-06 | Partial eRx workflow and medication structures | Spec + partial impl | SITE + certification method | NCPDP/RxNorm ecosystem | HTI-4 impacts med standards timelines | Split into cert-oriented enhancement with testable CPOE acceptance |
a(2) | CPOE - laboratory | Yes | CL | CL-09 | HL7/FHIR lab ingestion exists; full certification flow not complete | Spec + partial impl | NIST/public health suites + cert method | HL7 v2/Lab standards | HTI alignment via USCDI | Add explicit certification test matrix for lab order entry and result linkage |
a(3) | CPOE - diagnostic imaging | Usually limited for BH | CL | No dedicated cert-ready spec | No dedicated evidence surfaced | None | Certification method | Imaging standards as applicable | N/A or limited by service line | Confirm N/A policy by product scope and document rationale |
a(4) | Drug-drug / drug-allergy checks | Yes | CL | CL-06, CL-45 | Allergy tracking implemented, interaction logic partial | Spec + partial impl | Certification method | RxNorm/SNOMED ecosystems | HTI-4 adjacent | Add required interaction logic evidence package and override logging |
a(5) | Demographics | Yes | PM/CL | PM-01, PM-55 | Demographics tables + APIs partially mapped | Spec + partial impl | Inferno + cert method | USCDI v3 baseline | HTI-1 | Normalize to USCDI v3 required fields and value sets |
a(6) | Problem list | Yes | CL | CL-46 | Problem list features present; FHIR cert mapping incomplete | Spec + partial impl | Inferno + cert method | USCDI + terminology | HTI-1 | Add profile-conformant export + terminology conformance tests |
a(7) | Medication list | Yes | CL | CL-05 | Medication data exists; full cert test evidence not assembled | Spec + partial impl | Inferno + cert method | USCDI + RxNorm | HTI-1/4 | Add gap closure on code-set fidelity and API outputs |
a(8) | Medication allergy list | Yes | CL | CL-45 | Implemented allergy workflows + partial FHIR mapping | Spec + partial impl | Inferno + cert method | USCDI + terminology | HTI-1 | Add inferno-oriented conformance test assets |
a(9) | Clinical decision support | Yes | CL | CL-08 | Internal CDS exists; not ONC cert evidence packaged | Spec + partial impl | Certification method | CDS evidence requirements | HTI-1/HTI-2 interplay | Add cert-specific CDS intervention, source, and audit artifacts |
a(10) | Drug-formulary and preferred drug list checks | Yes | CL/PM | No dedicated ONC cert spec found | No dedicated cert evidence | None | eRx suite + cert method | NCPDP/RxNorm ecosystem | HTI-4 adjacent | Create dedicated spec or enhancement for formulary checking |
a(11) | Smoking status | Yes | CL | Covered indirectly in assessments and USCDI mapping specs | Partial via assessments; not explicitly certified | Spec + partial impl | Inferno + cert method | USCDI v3 | HTI-1 | Add explicit smoking-status criterion acceptance and FHIR mapping |
a(12) | Family health history | Possibly in-scope | CL | No clear dedicated criterion spec | No evidence confirmed | None | Certification method | USCDI profile scope dependent | HTI-1 | Decide in-scope status and either implement or document exclusion |
a(13) | Patient-specific education resources | Usually yes | PM/CL | Portal and engagement specs (PM-12, CL-26) | Patient education workflows not mapped to criterion artifacts | Spec-only | Certification method | Patient engagement standards | HTI-1 adjacent | Add criterion-specific educational resource mapping and audit trail |
a(14) | Implantable device list | Typically not BH core | CL | Explicitly treated as N/A in roadmap | No implementation expected | None | Certification method | Device UDI standards | N/A for BH scope | Keep N/A with formal scope memo |
a(15) | Social, psychological, behavioral data support | Yes | CL | CL-18, CL-40 | SDOH/intake features exist | Spec + partial impl | Inferno + cert method | USCDI+ BH relevance | HTI-1/HTI-2 trajectory | Align value sets and criterion-specific export/reporting evidence |
2.2 (b) Care Coordination Criteria
| Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
b(1) | Transitions of Care | Yes | CL | CL-48, CL-12 | C-CDA tooling in progress, not fully cert-ready | Spec + partial impl | SITE C-CDA tools | C-CDA companion guide versions changing | HTI-1 baseline updates | Finish validation harness and transmission evidence |
b(2) | Clinical information reconciliation/incorporation | Yes | CL | CL-12, CL-05 | Partial reconciliation functions | Spec + partial impl | SITE/C-CDA tooling | C-CDA + USCDI | HTI-1 | Build cert test cases for reconciliation workflows |
b(3) | Electronic prescribing | Yes | CL | CL-06 | Current eRx path exists; production-grade NCPDP transition pending | Spec + partial impl | eRx Testing Suite | NCPDP SCRIPT 2023011 deadline | HTI-4 | Execute HTI-4 upgrade program and test suite readiness |
b(4) | Real-time prescription benefit | Often in-scope if eRx scope includes it | CL | Mentioned in CL-06 enhancement planning | No cert-ready implementation confirmed | Spec-only | eRx Testing Suite | RTPB standard v13 | HTI-4 | Add dedicated implementation spec and go/no-go decision |
b(5) | Incorporate laboratory tests/results | Yes | CL | CL-09 | Lab ingestion partially present | Spec + partial impl | Public health + cert method | HL7 v2/FHIR mapping | HTI-1 | Expand to criterion-specific reconciliation and provenance checks |
b(6) | Data export | Yes | PF/CL | PF-44, CL-20 | Export capabilities implemented in parts | Spec + partial impl | Certification method | EHI export requirements | HTI-1 | Consolidate EHI export criterion evidence packet |
b(7) | Security tags - summary of care (send) | Yes | CL/PF | No dedicated DS4P send spec | No criterion-level evidence | None | SITE/C-CDA tools | DS4P required | HTI-1 | Create DS4P send spec and labeling pipeline |
b(8) | Security tags - summary of care (receive) | Yes | CL/PF | No dedicated DS4P receive spec | No criterion-level evidence | None | SITE/C-CDA tools | DS4P required | HTI-1 | Create DS4P receive/processing policy + tests |
b(9) | Care plan | Yes | CL | CL-03, CL-16 mappings | Care plan data exists; cert conformance incomplete | Spec + partial impl | C-CDA + Inferno as applicable | USCDI/C-CDA | HTI-1 | Add canonical care-plan export and validation evidence |
b(10) | EHI export | Yes | PF/CL/PM | PF-44, PM-55 | Partial implementation across modules | Spec + partial impl | Certification method | EHI export + Cures posture | HTI-1 | Single governed EHI export control plane and tests |
b(11) | Decision support interventions / predictive DSI transparency | Yes | PM/CL/GR | PM-64, CL-08 | Mentioned but no dedicated ONC transparency package | Spec-only | Certification method | ONC DSI source attributes | HTI-1 | Author dedicated criterion spec with full source attribute disclosures |
2.3 (c) Clinical Quality Measure Criteria
| Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
c(1) | CQM - record and export | Yes | CL | CL-51 | Spec present, implementation not complete | Spec-only | Cypress | QRDA ecosystem | HTI roadmap dependent | Build QRDA generation and certification test pipeline |
c(2) | CQM - import and calculate | Yes | CL | CL-51 | Partial quality calculations in product; not cert packaged | Spec + partial impl | Cypress | QRDA + measure logic | HTI roadmap dependent | Add ONC cert method coverage and validation data |
c(3) | CQM - report | Yes | CL | CL-51, CL-35 | Reporting exists operationally but not ONC cert-targeted | Spec + partial impl | Cypress | CMS quality reporting guides | HTI-1 adjacent | Formalize ONC reporting output conformance |
c(4) | CQM - filter | Yes | CL | CL-51 | No cert-oriented evidence bundle identified | Spec-only | Cypress | Taxonomy/value-set versions matter | HTI-1 adjacent | Implement filter conformance + replayable test fixtures |
2.4 (d) Privacy and Security Criteria
| Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
d(1) | Authentication, access control, authorization | Yes | PF | PF-01, PF-30 | Mature auth/RBAC foundations | Spec + impl-complete | Certification method | HIPAA + ONC controls | HTI-1 | Add criterion-specific traceability matrix |
d(2) | Auditable events and tamper resistance | Yes | PF/PM | PF-40, PM-55 | Audit logs exist, PM info-blocking log exists | Spec + partial impl | Certification method | HIPAA audit controls | HTI-1 | Add immutable FHIR-specific audit stream and cert evidence |
d(3) | Audit report(s) | Yes | PF | PF-91 | Dashboard spec exists, not fully implemented | Spec-only | Certification method | Reporting evidence | HTI-1 | Deliver audit report artifact generator for certification |
d(4) | Amendments | Yes | CL/PM | Scattered in clinical documentation specs | Not mapped as ONC criterion | Spec-only | Certification method | HIPAA overlap | HTI-1 | Add explicit criterion ownership and tests |
d(5) | Automatic log-off | Yes | PF | No dedicated ONC criterion spec | Platform behavior likely present but undocumented for cert | None | Certification method | Security UX policy | HTI-1 | Create criterion-level evidence and timeout policy tests |
d(6) | Emergency access | Yes | PF/CL | Break-glass references in compliance tracker | Partial references, no criterion package | Spec-only | Certification method | Emergency access controls | HTI-1 | Define and test emergency access workflow formally |
d(7) | End-user device encryption | Yes | PF/IT | IT compliance tracker references | No explicit criterion implementation package | None | Certification method | HIPAA device controls | HTI-1 | Add policy/evidence package for endpoint encryption controls |
d(8) | Integrity | Yes | PF | Core platform safeguards exist | Not mapped in ONC cert format | Spec-only | Certification method | Data integrity checks | HTI-1 | Add signed evidence for integrity controls |
d(9) | Accounting of disclosures | Yes | CL | CL-11, CL-11 enhancements | Implemented for Part 2 disclosures | Spec + impl-complete | Certification method | Part 2 + HIPAA overlap | HTI-1 | Extend to full ONC accounting criterion mapping |
d(10) | Authentication credential management | Yes | PF | PF auth/RBAC specs | Core exists, cert evidence package not assembled | Spec + partial impl | Certification method | Credential lifecycle controls | HTI-1 | Produce criterion-level credential management controls documentation |
d(11) | Encryption and hashing of authenticated credentials | Yes | PF/IT | IT tracker notes deferred credential-at-rest hardening | Partial | Spec + partial impl | Certification method | HIPAA + crypto controls | HTI-1 | Prioritize vault migration and certify traceability |
d(12) | Encrypt authentication assertions | Yes | PF | No dedicated cert spec | No direct evidence bundle | None | Certification method | SAML/SMART assertion encryption | HTI-1 | Author dedicated criterion spec |
d(13) | Multi-factor authentication | Yes | PF | Mentioned in trackers/specs; no standalone criterion spec | Partial/Deferred operationally | Spec-only | Certification method | MFA requirements | HTI-1 | Add dedicated MFA criterion implementation and evidence |
2.5 (e) Patient Engagement Criteria
| Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
e(1) | View, Download, and Transmit (VDT) | Yes | PM/CL | PM-12, PM-55, CL-16 | Portal exists; API scope incomplete for certification posture | Spec + partial impl | Inferno + cert method | USCDI/FHIR + patient rights | HTI-1 | Complete patient-driven SMART access and evidence |
e(2) | Secure messaging | Yes | PM/CL | PM-14, CL-48 | In-app messaging and C-CDA transmission efforts exist | Spec-only | SITE/Direct tools | Direct/transport requirements | HTI-1 | Differentiate in-app messaging from ONC Direct-compliant messaging and close gap |
e(3) | Patient health information capture | Yes | PM/CL | No dedicated ONC criterion spec identified | No evidence package found | None | Certification method | Patient-submitted data standards | HTI-1 | Add dedicated spec for capture, provenance, and reconciliation |
2.6 (f) Public Health Criteria
| Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
f(1) | Immunization registry reporting | Sometimes | CL/PM | No dedicated ONC criterion spec | No VXU-style cert evidence | None | NIST Immunization Test Suite | HL7 v2 immunization guides | HTI-1 | Decide scope by contracts; if in-scope, author full spec |
f(2) | Syndromic surveillance reporting | Usually limited for BH, but contract-dependent | CL/PM | No dedicated criterion spec | No evidence found | None | NIST Syndromic Suite | HL7 v2 syndromic guides | HTI-1 | Keep as conditional scope item with documented decision |
f(3) | Electronic lab reporting (ELR) | Potentially relevant | CL | Lab ingestion exists, but no ELR outbound certification spec | No cert evidence found | None | NIST ELR Suite | HL7 v2 ELR | HTI-1 | Add outbound/reporting scope decision and implementation plan |
f(4) | Cancer registry reporting | Often N/A for BH | CL/PM | No dedicated spec | No evidence | None | Public health tooling | Registry standards | HTI-1 | Document N/A unless oncology service lines added |
f(5) | Reportable lab tests/conditions | Contract-dependent | CL/PM | No dedicated spec | No evidence | None | Public health tooling | Public health condition reporting | HTI-1 | Evaluate by state/public-health mandates |
f(6) | Antimicrobial use and resistance reporting | Usually N/A for BH | CL | No dedicated spec | No evidence | None | AU/AR CDA validator | CDA AU/AR guides | HTI-1 | Document N/A unless service scope expands |
f(7) | Health care surveys reporting | Usually limited for BH | CL/PM | No dedicated spec | No evidence | None | NHCS validator | CDA NHCS guides | HTI-1 | Document N/A or add if payer/contract requires |
2.7 (g) Design and Performance Criteria
| Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
g(3) | Safety-enhanced design | Yes | PF/CL/PM | No ONC-specific SED spec | No NIST 7741 evidence package | None | Certification method | NIST IR 7741 usability process | HTI-1 | Create SED spec and study artifact template |
g(4) | Quality management system | Yes | PF/GR | No dedicated QMS criterion spec | No ONC-ready QMS artifact set | None | Certification method | QMS attestation expectations | HTI-1 | Create QMS governance/evidence spec |
g(5) | Accessibility-centered design | Yes | PF/CL/PM | PF-93, CL portal enhancements | Accessibility work in progress, not mapped to ONC criterion artifacts | Spec + partial impl | Certification method | WCAG 2.1 AA + Section 504 | HTI-1 | Add ONC-centered accessibility evidence matrix |
g(6) | C-CDA creation performance | Yes | CL | CL-48 | C-CDA generation path in progress | Spec + partial impl | SITE/C-CDA tools | C-CDA performance and validity | HTI-1 | Finish benchmarking + validation artifact set |
g(7) | Application access - patient selection | Yes | CL/PM | CL-16, PM-55 | Partial API surfaces | Spec + partial impl | Inferno | FHIR/SMART | HTI-1 | Finalize patient-level access semantics and tests |
g(8) | Application access - data category request | Yes | CL/PM | CL-16 + PM-55 | Partial | Spec + partial impl | Inferno | FHIR/USCDI mappings | HTI-1 | Complete category-level filtering and conformance tests |
g(9) | Application access - all data request | Yes | CL/PM | CL-16 + PM-55 | Partial ($everything path not fully cert-ready) | Spec + partial impl | Inferno | FHIR all-data semantics | HTI-1 | Add production-ready all-data request behavior and evidence |
g(10) | Standardized API for patient and population services | Yes | CL/PM | CL-16, CL-16-EN-02, PM-55 | FHIR edge facade exists but SMART/CapabilityStatement/cert harness incomplete | Spec + partial impl | Inferno | US Core, SMART, USCDI v3 | HTI-1 | Build inferno CI harness + complete SMART and metadata endpoints |
2.8 (h) Transport Criteria
| Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
h(1) | Direct Project | Yes (for transition workflows) | CL/PM | CL-48, PM-14 | HISP adapter patterns exist; not full cert-ready direct stack | Spec + partial impl | SITE Direct Testing | Direct transport standards | HTI-1 | Implement full Direct flow, delivery notifications, and certification tests |
h(2) | Direct edge protocols, XDR/XDM | Yes if Direct scope chosen | CL/PM | No dedicated h(2) cert spec | No certified-ready evidence found | None | SITE Direct + edge tools | XDR/XDM requirements | HTI-1 | Add explicit h(2) implementation spec if cert path selected |
2.9 (j) HTI-2 Additions
| Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action |
|---|---|---|---|---|---|---|---|---|---|---|
j(15) | Prior auth API - coverage requirements discovery | Yes (payer operations) | PM | PM-52, PM-10 | Spec track exists, implementation incomplete | Spec-only | Inferno/Da Vinci conformance | CRD | HTI-2 | Execute phased implementation with payer pilots |
j(16) | Prior auth API - documentation templates/rules | Yes | PM | PM-52 + PM-10 | Spec exists | Spec-only | Inferno/Da Vinci conformance | DTR | HTI-2 | Add DTR rule engine and endpoint-level conformance tests |
j(19) | Prior auth API - prior auth support | Yes | PM | PM-52 + PM-10 | Spec exists, not complete | Spec-only | Inferno/Da Vinci conformance | PAS | HTI-2 | Implement PAS transaction lifecycle + evidence |
j(20) | DSI workflow triggers (client) | Yes | PM/CL | Mentioned in standards references only | No dedicated implementation | None | ONC tooling as released | CDS Hooks STU2 | HTI-2 | Create dedicated spec and client integration plan |
j(21) | Subscriptions (client) | Yes | PM/CL | Mentioned in standards references only | No dedicated implementation | None | ONC tooling as released | FHIR subscriptions backport | HTI-2 | Create dedicated spec and phased event subscription strategy |
2.10 SVAP / Version Cutover Flags (Cross-Criterion)
| Standard area | Legacy baseline | New baseline | Operational impact |
|---|---|---|---|
| USCDI | v1 | v3 (required by late 2025 cutover windows in ONC tooling references) | Update mappings in CL-16/PM-55 and all certification test fixtures |
| US Core | STU3.1.1 | STU6.1.0 | Resource profile conformance changes for Inferno |
| SMART App Launch | 1.0 | 2.0 | Update OAuth flows, scopes, and app registration expectations |
| NCPDP SCRIPT | 2017071 | 2023011 | eRx/billing ecosystem upgrade with HTI-4 timing |
| C-CDA companion guide | R2 | R4.1 | Document generation/validation updates in CL-48 |
3) Conditions and Maintenance of Certification Matrix
| Condition/Maintenance Area | Current repo coverage | Status | Primary anchors | Gap summary | Recommended action |
|---|---|---|---|---|---|
| Information Blocking governance | Present in PM-55 and compliance tracker | Spec + partial impl | PM-55, REGULATORY_COMPLIANCE_TRACKER.md | Need full denial taxonomy, workflows, and annual governance packet | Build criterion-to-exception control matrix and reporting automation |
| API Conditions of Certification (terms, fees, transparency, maintenance) | Partial conceptual coverage | Spec-only | PM-55, CL-16 family | Missing formal policy/doc artifacts expected in certification workflows | Add API condition governance spec + publishable artifacts |
| Real World Testing (RWT) | No dedicated spec/doc found | None | N/A | Missing annual plan/results framework | Create RWT spec and evidence template |
| Insights Condition metrics | No dedicated spec/doc found | None | N/A | Missing data capture + submission process | Create Insights metrics pipeline spec |
| Communications condition | Not explicitly documented | None | N/A | Missing formal communications guardrail artifact | Add policy spec tied to legal/compliance workflows |
| Annual attestation process | Not explicitly documented | None | N/A | Missing attestation calendar and artifact assembly | Add attestation operations spec |
| Assurances | Not explicitly documented | None | N/A | Missing signed assurance framework and controls mapping | Add assurances package spec |
| Mandatory disclosures URL | Not explicitly documented | None | N/A | Missing customer-facing disclosures publication workflow | Add disclosures publication spec |
| Hosted docs URL | Not explicitly documented | None | N/A | Missing certification-oriented hosted docs surface | Add docs publication and versioning policy |
| Trusted Exchange / TEFCA evolution | Scoped in enhancement | Spec + partial impl | CL-16-EN-01 | Needs operational partner onboarding and cert interplay decisions | Keep as phased item with go/no-go contract trigger |
4) ONC Tooling Readiness Matrix
| Tool | URL | Main criterion coverage | Current readiness | Evidence today | What is required to pass |
|---|---|---|---|---|---|
| Inferno Framework | inferno.healthit.gov | g(10), API-centric criteria, related HTI updates | Partial | CL-16/PM-55 specs, partial FHIR facade | CapabilityStatement, SMART full flow, profile-conformant resources, CI harness |
| SITE / Edge Testing Tool | site.healthit.gov | C-CDA, Direct, related certification tooling | Partial | CL-48 and direct adapter concepts | Complete Direct/XDR/XDM implementations and validation workflows |
| ONC Conformance Test Tools index | ONC Conformance Test Tools | Cross-criterion test resources | Partial | Resource inventory known | Build test execution program tied to each selected criterion |
| C-CDA Testing | C-CDA testing entry | b(1), b(2), g(6) and related | Partial | CL-48 generation work | Full schema/content validation and regression tests |
| Direct Testing | Direct testing entry | h(1), h(2), transition transport | Partial | HISP adapter pattern exists | Production Direct stack, delivery notification, edge protocol coverage |
| Cypress | healthit.gov/cypress | c(1)-c(4) CQM | Low | CL-51 spec only | Implement QRDA/CQM engine with Cypress-ready fixtures |
| eRx Testing Suite | erx.healthit.gov | b(3), b(4) | Low-Partial | CL-06 path exists but HTI-4 transition pending | Upgrade standards and execute full eRx conformance tests |
| NIST Immunization Suite | NIST Immunization Suite | f(1) | Low | No dedicated criterion implementation | Build/report immunization messaging if in-scope |
| NIST Syndromic Suite | NIST Syndromic Suite | f(2) | Low | No dedicated criterion implementation | Build/report syndromic feeds if in-scope |
| NIST ELR Suite | NIST ELR Suite | f(3) | Low | No dedicated ELR certification flow | Build/report ELR transport and validations if in-scope |
| AU/AR CDA validator | AU/AR validator | f(6) | Low | None | Implement and validate AU/AR submissions if in-scope |
| NHCS validator | NHCS validator | f(7) | Low | None | Implement and validate NHCS submissions if in-scope |
| CPOE Evaluation Tool | Leapfrog CPOE tool | CPOE quality and safety corroboration | Low | None | Add pilot validation workflow if pursuing broader quality evidence |
| IHE Testing Tools | IHE tools | Interoperability profile validation | Low | None | Map relevant IHE profiles to cert scope and execute tests |
5) ONC Resource Adoption Assessment (Non-Certification Resources)
| Resource | URL | Current use in repo | Coverage status | Recommendation |
|---|---|---|---|---|
| Health IT Playbook | playbook.healthit.gov | Mentioned as resource category; no dedicated adoption spec | None | Create cross-core adoption guide tied to CL/PM/PF implementation patterns |
| ONC Implementation Resources hub | Implementation Resources | Referenced in ONC pages; not operationalized in compliance docs | None | Add periodic review cadence and artifact intake process |
| SITE hub | site.healthit.gov | Known as test hub; no internal runbook in compliance docs | Spec-only | Add certification test-ops runbook and ownership model |
| ONC Certification overview | Certification of Health IT | Mapped in roadmap/tracker | Spec-only | Keep updated with HTI release changes and ACB process updates |
| ONC Conformance tools page | Conformance tools | Partially reflected in docs | Spec-only | Convert to criterion-to-tool matrix (this document is first pass) |
| SAFER Guides (2025 updates) | Resources hub entry | Not explicitly mapped to specs | None | Add safety assessment program and annual review requirement |
| Security Risk Assessment Tool | SRA Tool | Mentioned in ONC ecosystem references only | None | Create customer operational workflow and internal readiness checklist |
| Patient Engagement Playbook | Health IT Playbook ecosystem | No direct operational mapping | None | Create PM-12/CL-26 adoption enhancement and content governance |
| Get It, Check It, Use It guide | Resources hub | Not integrated into patient guidance workflows | None | Add patient education/copy strategy for portal engagement |
6) Recommended Next-Step Batches (Post-Decision)
These are not implemented in this document. They are recommended work packages after path selection.Batch A: Decision Lock
- Choose one path: Full, Modular, or Alignment-only.
- Set scope statement by criterion family and target deadlines.
- Name accountable owners and evidence calendar.
Batch B: Critical Safety and Conditions
- New specs for Real World Testing, Insights condition, and attestation packaging.
- Dedicated predictive DSI transparency spec (
b(11)). - SAFER Guides adoption and governance spec.
Batch C: Modular Certification Core
- Production conformance for
g(10)(Inferno-ready API package). - Direct transport criterion hardening (
h(1)/h(2)). - Patient engagement criterion completion (
e(1)/e(2)/e(3)as selected). - d-family criterion evidence bundle finalization.
Batch D: Public Health Decision and Execution
- Formal in-scope/N/A determinations for
f(1)-f(7). - Implement only contract-required public health criteria.
- Build corresponding NIST validation workflows.
Batch E: HTI-2 Extensions
- Implement and certify
j(15)/j(16)/j(19)to production level. - Add new specs for
j(20)CDS Hooks client andj(21)subscriptions client.
Batch F: ONC Resource Adoption
- Health IT Playbook operational adoption guide.
- Patient engagement playbook integration plan.
- SRA tool integration and annual safety review process.
Batch G: Governance and Process Updates
- Refresh
ONC_CERTIFICATION_ROADMAP.md. - Refresh
REGULATORY_COMPLIANCE_TRACKER.mdONC rows. - Update compliance-review workflows to enforce criterion checks in future spec authoring.
7) Cross-References and Sources
7.1 External ONC/HHS Sources
- Certification of Health IT
- ONC Conformance Test Tools
- SITE
- Health IT Playbook
- Implementation Resources
7.2 Internal Compliance and Spec Sources
docs/compliance/ONC_CERTIFICATION_ROADMAP.mddocs/compliance/REGULATORY_COMPLIANCE_TRACKER.mddocs/compliance/AUTHORITATIVE_REFERENCES.mdspecs/SPEC_STATUS_REGISTRY.mdspecs/cl/specs/CL-16-fhir-interoperability-data-exchange.mdspecs/cl/specs/CL-16-EN-02-uscdi-v3-patient-access-api.mdspecs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.mdspecs/cl/specs/CL-48-clinical-document-architecture-cda.mdspecs/pm/specs/PM-52-davinci-fhir-prior-authorization-api.mdspecs/pf/specs/PF-96-medicaid-state-compliance-configuration.md
7.3 Known Internal Consistency Notes
PF-96file header indicates complete status while registry/tracker entries may lag in some contexts.ONC_CERTIFICATION_ROADMAP.mdis intentionally high-level and should be refreshed after path selection.
Appendix A: Current ONC Readiness Scorecard (Snapshot)
| Area | Score (0-5) | Rationale |
|---|---|---|
API foundation (g(10) track) | 2.5 | Strong specs and partial implementation, missing certification harness and full SMART readiness |
| Information blocking operations | 2.0 | Governance direction present, still missing full annual artifact machinery |
| C-CDA and transitions | 2.0 | Strong CL-48 scope, not yet complete and validated end-to-end for certification |
| eRx track | 2.0 | Core direction present, HTI-4 standard transition pending |
| Public health criteria | 0.5 | Mostly unscoped/unimplemented for certification |
| Conditions/Maintenance of Certification | 1.0 | Major artifacts missing (RWT, Insights, attestation operations) |
| Tooling operationalization (SITE/Inferno/Cypress) | 1.5 | Inventory known, execution program not formalized |
Appendix B: Immediate No-Regret Actions (Regardless of Path)
- Finalize and run Inferno-aligned test harness for current FHIR API scope.
- Normalize USCDI v3 mapping inventory and close known terminology gaps.
- Formalize information blocking denial taxonomy and review queue disposition standards.
- Add explicit criterion ownership tags to each ONC-relevant spec.
- Create one annual ONC compliance calendar (deadlines, attestations, test windows).
- Create DS4P send/receive spec (CL-63) for §170.315(b)(7)/(b)(8) — critical for Part 2 SUD data exchange.
- Create DEA EPCS spec (CL-64) for 21 CFR 1311 — required for MAT prescribing.
- Create Contexture HIE integration spec (PF-108) — highest-ROI Arizona move for DAP/TI 2.0.
- Create EKRA compliance spec (PF-107) — P0 legal priority due to NorthSight relationship.
- Create DSI transparency spec (CL-65) for §170.315(b)(11) — required before AI features ship.
docs/compliance/ONC_REGULATORY_READINESS_IMPLEMENTATION_PLAN.md for the full implementation plan with 12 new skills and 12 new specs.