> ## Documentation Index > Fetch the complete documentation index at: https://docs.encoreos.io/llms.txt > Use this file to discover all available pages before exploring further. # ONC Health IT Certification Gap Matrix > **Version:** 1.1.0\ **Last Updated:** 2026-05-15\ **Owner:** Product / Compliance / CL / PM / PF\ **Purpose:** Decision-grade matrix for choosing ONC pathway (**Full certification**, **modular certification**, or **alignment-only**), with criterion-level coverage and implementation gaps. *** ## 1) Executive Summary and Decision Framework Encore Health OS already has meaningful ONC-oriented groundwork in specs and partial implementation, especially around FHIR, patient access, C-CDA, information blocking, and prior authorization. Strongest existing anchors: * [`CL-16`](../../specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md) and [`CL-16-EN-02`](../../specs/cl/specs/CL-16-EN-02-uscdi-v3-patient-access-api.md) for FHIR/USCDI and SMART-aligned patient access. * [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) for ONC HTI-1 patient access + information blocking workflow. * [`CL-48`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md) for C-CDA generation and transition workflows. * [`PM-52`](../../specs/pm/specs/PM-52-davinci-fhir-prior-authorization-api.md) and [`PM-10`](../../specs/pm/specs/PM-10-prior-authorization-management.md) for Da Vinci CRD/DTR/PAS trajectory. * Existing compliance baseline in [`ONC_CERTIFICATION_ROADMAP.md`](./ONC_CERTIFICATION_ROADMAP.md), [`REGULATORY_COMPLIANCE_TRACKER.md`](./REGULATORY_COMPLIANCE_TRACKER.md), and [`AUTHORITATIVE_REFERENCES.md`](./AUTHORITATIVE_REFERENCES.md). Most important missing areas for certification readiness: * Conditions and Maintenance of Certification artifacts (Real World Testing, Insights condition, attestations cadence, CHPL documentation artifacts). * Public health reporting criteria (f-family) and transport criteria (h-family) at certification depth. * Design/process criteria (g(3) Safety-Enhanced Design, g(4) QMS, g(5) Accessibility-centered design) as ONC evidence artifacts. * Predictive DSI transparency and HTI-2 additions (`j(20)`, `j(21)`). ### 1.1 Path Comparison | Path | What it means | Approx effort | Ongoing burden | Best fit | | -------------------------------------------- | ------------------------------------------------------------------------------------------------ | ------------: | -------------: | ------------------------------------------------------------------------------------ | | Full ONC Certification (broad module scope) | Certify broad criterion set with ONC-ACB/ATL and full Conditions/Maintenance obligations | 12-24+ months | High | If commercial strategy depends on certified module breadth and formal CHPL posture | | Modular ONC Certification (targeted) | Certify a constrained criterion package (typically API-centric and selected supporting criteria) | 6-12 months | Medium-High | If payer/customer contracts need certified capability but not full criterion surface | | ONC Alignment-Only (no certification filing) | Implement standards and compliance posture without formal ONC testing/certification artifacts | 3-9 months | Medium | If near-term value is interop/compliance readiness without CHPL listing | ### 1.2 Required Artifacts by Path | Artifact | Full | Modular | Alignment-only | | ----------------------------------------- | -------- | -------------------------------- | ----------------------------- | | ONC-ACB engagement | Required | Required | Not required | | ONC-ATL test execution | Required | Required (for in-scope criteria) | Not required | | CHPL listing | Required | Required (for certified module) | No | | Real World Testing plan/results | Required | Required (for certified scope) | Optional internal | | Insights Condition reporting | Required | Required | Optional internal | | Mandatory disclosures URL | Required | Required | Optional | | Hosted documentation URL | Required | Required | Optional | | Annual attestation package | Required | Required | Internal governance only | | Inferno/SITE/Cypress conformance evidence | Required | Required for selected criteria | Strongly recommended internal | ### 1.3 Decision Triggers | Trigger | Recommendation | | ------------------------------------------------------------------ | ----------------------------------------------------------------------------- | | Contract explicitly requires CHPL-listed module | Choose modular or full certification | | Strategic product positioning requires "certified" market claim | Choose modular now, full later if needed | | Priority is interoperability delivery speed with lower overhead | Choose alignment-only with certification-grade internal evidence | | Multi-state payer expansion requires auditable API posture quickly | Choose modular certification focused on API and information blocking evidence | *** ## 2) 45 CFR §170.315 Criteria Gap Matrix (Criterion Families) Coverage Status Legend: * `None` * `Spec-only` * `Spec + partial impl` * `Spec + impl-complete` * `Certified-ready` ### 2.1 (a) Clinical Criteria | Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action | | --------- | ---------------------------------------------- | ---------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------- | ------------------- | --------------------------------------- | ------------------------------- | ------------------------------------- | ----------------------------------------------------------------------------- | | `a(1)` | CPOE - medications | Yes | CL | [`CL-05`](../../specs/cl/specs/CL-05-medication-management-reconciliation.md), [`CL-06`](../../specs/cl/specs/CL-06-e-prescribing-epcs.md) | Partial eRx workflow and medication structures | Spec + partial impl | SITE + certification method | NCPDP/RxNorm ecosystem | HTI-4 impacts med standards timelines | Split into cert-oriented enhancement with testable CPOE acceptance | | `a(2)` | CPOE - laboratory | Yes | CL | [`CL-09`](../../specs/cl/specs/CL-09-lab-diagnostic-orders-results.md) | HL7/FHIR lab ingestion exists; full certification flow not complete | Spec + partial impl | NIST/public health suites + cert method | HL7 v2/Lab standards | HTI alignment via USCDI | Add explicit certification test matrix for lab order entry and result linkage | | `a(3)` | CPOE - diagnostic imaging | Usually limited for BH | CL | No dedicated cert-ready spec | No dedicated evidence surfaced | None | Certification method | Imaging standards as applicable | N/A or limited by service line | Confirm N/A policy by product scope and document rationale | | `a(4)` | Drug-drug / drug-allergy checks | Yes | CL | [`CL-06`](../../specs/cl/specs/CL-06-e-prescribing-epcs.md), [`CL-45`](../../specs/cl/specs/CL-45-allergy-adverse-reaction-tracking.md) | Allergy tracking implemented, interaction logic partial | Spec + partial impl | Certification method | RxNorm/SNOMED ecosystems | HTI-4 adjacent | Add required interaction logic evidence package and override logging | | `a(5)` | Demographics | Yes | PM/CL | [`PM-01`](../../specs/pm/specs/PM-01-patient-registration-demographics.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) | Demographics tables + APIs partially mapped | Spec + partial impl | Inferno + cert method | USCDI v3 baseline | HTI-1 | Normalize to USCDI v3 required fields and value sets | | `a(6)` | Problem list | Yes | CL | [`CL-46`](../../specs/cl/specs/CL-46-problem-list-management-icd10.md) | Problem list features present; FHIR cert mapping incomplete | Spec + partial impl | Inferno + cert method | USCDI + terminology | HTI-1 | Add profile-conformant export + terminology conformance tests | | `a(7)` | Medication list | Yes | CL | [`CL-05`](../../specs/cl/specs/CL-05-medication-management-reconciliation.md) | Medication data exists; full cert test evidence not assembled | Spec + partial impl | Inferno + cert method | USCDI + RxNorm | HTI-1/4 | Add gap closure on code-set fidelity and API outputs | | `a(8)` | Medication allergy list | Yes | CL | [`CL-45`](../../specs/cl/specs/CL-45-allergy-adverse-reaction-tracking.md) | Implemented allergy workflows + partial FHIR mapping | Spec + partial impl | Inferno + cert method | USCDI + terminology | HTI-1 | Add inferno-oriented conformance test assets | | `a(9)` | Clinical decision support | Yes | CL | [`CL-08`](../../specs/cl/specs/CL-08-clinical-decision-support.md) | Internal CDS exists; not ONC cert evidence packaged | Spec + partial impl | Certification method | CDS evidence requirements | HTI-1/HTI-2 interplay | Add cert-specific CDS intervention, source, and audit artifacts | | `a(10)` | Drug-formulary and preferred drug list checks | Yes | CL/PM | No dedicated ONC cert spec found | No dedicated cert evidence | None | eRx suite + cert method | NCPDP/RxNorm ecosystem | HTI-4 adjacent | Create dedicated spec or enhancement for formulary checking | | `a(11)` | Smoking status | Yes | CL | Covered indirectly in assessments and USCDI mapping specs | Partial via assessments; not explicitly certified | Spec + partial impl | Inferno + cert method | USCDI v3 | HTI-1 | Add explicit smoking-status criterion acceptance and FHIR mapping | | `a(12)` | Family health history | Possibly in-scope | CL | No clear dedicated criterion spec | No evidence confirmed | None | Certification method | USCDI profile scope dependent | HTI-1 | Decide in-scope status and either implement or document exclusion | | `a(13)` | Patient-specific education resources | Usually yes | PM/CL | Portal and engagement specs (`PM-12`, `CL-26`) | Patient education workflows not mapped to criterion artifacts | Spec-only | Certification method | Patient engagement standards | HTI-1 adjacent | Add criterion-specific educational resource mapping and audit trail | | `a(14)` | Implantable device list | Typically not BH core | CL | Explicitly treated as N/A in roadmap | No implementation expected | None | Certification method | Device UDI standards | N/A for BH scope | Keep N/A with formal scope memo | | `a(15)` | Social, psychological, behavioral data support | Yes | CL | [`CL-18`](../../specs/cl/specs/CL-18-sdoh-screening-social-needs.md), [`CL-40`](../../specs/cl/specs/CL-40-clinical-intake-documentation-sdoh-assessment.md) | SDOH/intake features exist | Spec + partial impl | Inferno + cert method | USCDI+ BH relevance | HTI-1/HTI-2 trajectory | Align value sets and criterion-specific export/reporting evidence | ### 2.2 (b) Care Coordination Criteria | Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action | | --------- | ------------------------------------------------------------ | --------------------------------------- | ----------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------ | ------------------- | ----------------------------- | --------------------------------------- | ---------------------- | ---------------------------------------------------------------------- | | `b(1)` | Transitions of Care | Yes | CL | [`CL-48`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md), [`CL-12`](../../specs/cl/specs/CL-12-care-coordination-transitions.md) | C-CDA tooling in progress, not fully cert-ready | Spec + partial impl | SITE C-CDA tools | C-CDA companion guide versions changing | HTI-1 baseline updates | Finish validation harness and transmission evidence | | `b(2)` | Clinical information reconciliation/incorporation | Yes | CL | [`CL-12`](../../specs/cl/specs/CL-12-care-coordination-transitions.md), [`CL-05`](../../specs/cl/specs/CL-05-medication-management-reconciliation.md) | Partial reconciliation functions | Spec + partial impl | SITE/C-CDA tooling | C-CDA + USCDI | HTI-1 | Build cert test cases for reconciliation workflows | | `b(3)` | Electronic prescribing | Yes | CL | [`CL-06`](../../specs/cl/specs/CL-06-e-prescribing-epcs.md) | Current eRx path exists; production-grade NCPDP transition pending | Spec + partial impl | eRx Testing Suite | NCPDP SCRIPT 2023011 deadline | HTI-4 | Execute HTI-4 upgrade program and test suite readiness | | `b(4)` | Real-time prescription benefit | Often in-scope if eRx scope includes it | CL | Mentioned in CL-06 enhancement planning | No cert-ready implementation confirmed | Spec-only | eRx Testing Suite | RTPB standard v13 | HTI-4 | Add dedicated implementation spec and go/no-go decision | | `b(5)` | Incorporate laboratory tests/results | Yes | CL | [`CL-09`](../../specs/cl/specs/CL-09-lab-diagnostic-orders-results.md) | Lab ingestion partially present | Spec + partial impl | Public health + cert method | HL7 v2/FHIR mapping | HTI-1 | Expand to criterion-specific reconciliation and provenance checks | | `b(6)` | Data export | Yes | PF/CL | [`PF-44`](../../specs/pf/specs/PF-44-data-export-compliance.md), [`CL-20`](../../specs/cl/specs/CL-20-medical-record-export-document-generation.md) | Export capabilities implemented in parts | Spec + partial impl | Certification method | EHI export requirements | HTI-1 | Consolidate EHI export criterion evidence packet | | `b(7)` | Security tags - summary of care (send) | Yes | CL/PF | No dedicated DS4P send spec | No criterion-level evidence | None | SITE/C-CDA tools | DS4P required | HTI-1 | Create DS4P send spec and labeling pipeline | | `b(8)` | Security tags - summary of care (receive) | Yes | CL/PF | No dedicated DS4P receive spec | No criterion-level evidence | None | SITE/C-CDA tools | DS4P required | HTI-1 | Create DS4P receive/processing policy + tests | | `b(9)` | Care plan | Yes | CL | [`CL-03`](../../specs/cl/specs/CL-03-treatment-planning.md), CL-16 mappings | Care plan data exists; cert conformance incomplete | Spec + partial impl | C-CDA + Inferno as applicable | USCDI/C-CDA | HTI-1 | Add canonical care-plan export and validation evidence | | `b(10)` | EHI export | Yes | PF/CL/PM | [`PF-44`](../../specs/pf/specs/PF-44-data-export-compliance.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) | Partial implementation across modules | Spec + partial impl | Certification method | EHI export + Cures posture | HTI-1 | Single governed EHI export control plane and tests | | `b(11)` | Decision support interventions / predictive DSI transparency | Yes | PM/CL/GR | [`PM-64`](../../specs/pm/specs/PM-64-ai-coding-assistant.md), [`CL-08`](../../specs/cl/specs/CL-08-clinical-decision-support.md) | Mentioned but no dedicated ONC transparency package | Spec-only | Certification method | ONC DSI source attributes | HTI-1 | Author dedicated criterion spec with full source attribute disclosures | ### 2.3 (c) Clinical Quality Measure Criteria | Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / SVAP posture | HTI rule context | Recommended action | | --------- | -------------------------- | --------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------- | ------------- | ---------------------------------- | --------------------- | ------------------------------------------------------- | | `c(1)` | CQM - record and export | Yes | CL | [`CL-51`](../../specs/cl/specs/CL-51-clinical-quality-measures-reporting-engine.md) | Spec present, implementation not complete | Spec-only | Cypress | QRDA ecosystem | HTI roadmap dependent | Build QRDA generation and certification test pipeline | | `c(2)` | CQM - import and calculate | Yes | CL | [`CL-51`](../../specs/cl/specs/CL-51-clinical-quality-measures-reporting-engine.md) | Partial quality calculations in product; not cert packaged | Spec + partial impl | Cypress | QRDA + measure logic | HTI roadmap dependent | Add ONC cert method coverage and validation data | | `c(3)` | CQM - report | Yes | CL | [`CL-51`](../../specs/cl/specs/CL-51-clinical-quality-measures-reporting-engine.md), [`CL-35`](../../specs/cl/specs/CL-35-population-health-care-gap-management.md) | Reporting exists operationally but not ONC cert-targeted | Spec + partial impl | Cypress | CMS quality reporting guides | HTI-1 adjacent | Formalize ONC reporting output conformance | | `c(4)` | CQM - filter | Yes | CL | [`CL-51`](../../specs/cl/specs/CL-51-clinical-quality-measures-reporting-engine.md) | No cert-oriented evidence bundle identified | Spec-only | Cypress | Taxonomy/value-set versions matter | HTI-1 adjacent | Implement filter conformance + replayable test fixtures | ### 2.4 (d) Privacy and Security Criteria | Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | --------------------------------------------------- | -------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------- | -------------------- | -------------------- | ------------------------------- | ----------- | -------------------------------------------------------------------- | | `d(1)` | Authentication, access control, authorization | Yes | PF | [`PF-01`](../../specs/pf/specs/PF-01-organization-site-management.md), [`PF-30`](../../specs/pf/specs/PF-30-permissions-system-v2.md) | Mature auth/RBAC foundations | Spec + impl-complete | Certification method | HIPAA + ONC controls | HTI-1 | Add criterion-specific traceability matrix | | `d(2)` | Auditable events and tamper resistance | Yes | PF/PM | [`PF-40`](../../specs/pf/specs/PF-40-ux-enhancement-framework.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) | Audit logs exist, PM info-blocking log exists | Spec + partial impl | Certification method | HIPAA audit controls | HTI-1 | Add immutable FHIR-specific audit stream and cert evidence | | `d(3)` | Audit report(s) | Yes | PF | [`PF-91`](../../specs/pf/specs/PF-91-compliance-automation-regulatory-dashboard.md) | Dashboard spec exists, not fully implemented | Spec-only | Certification method | Reporting evidence | HTI-1 | Deliver audit report artifact generator for certification | | `d(4)` | Amendments | Yes | CL/PM | Scattered in clinical documentation specs | Not mapped as ONC criterion | Spec-only | Certification method | HIPAA overlap | HTI-1 | Add explicit criterion ownership and tests | | `d(5)` | Automatic log-off | Yes | PF | No dedicated ONC criterion spec | Platform behavior likely present but undocumented for cert | None | Certification method | Security UX policy | HTI-1 | Create criterion-level evidence and timeout policy tests | | `d(6)` | Emergency access | Yes | PF/CL | Break-glass references in compliance tracker | Partial references, no criterion package | Spec-only | Certification method | Emergency access controls | HTI-1 | Define and test emergency access workflow formally | | `d(7)` | End-user device encryption | Yes | PF/IT | IT compliance tracker references | No explicit criterion implementation package | None | Certification method | HIPAA device controls | HTI-1 | Add policy/evidence package for endpoint encryption controls | | `d(8)` | Integrity | Yes | PF | Core platform safeguards exist | Not mapped in ONC cert format | Spec-only | Certification method | Data integrity checks | HTI-1 | Add signed evidence for integrity controls | | `d(9)` | Accounting of disclosures | Yes | CL | [`CL-11`](../../specs/cl/specs/CL-11-consent-management-42cfr-part2.md), CL-11 enhancements | Implemented for Part 2 disclosures | Spec + impl-complete | Certification method | Part 2 + HIPAA overlap | HTI-1 | Extend to full ONC accounting criterion mapping | | `d(10)` | Authentication credential management | Yes | PF | PF auth/RBAC specs | Core exists, cert evidence package not assembled | Spec + partial impl | Certification method | Credential lifecycle controls | HTI-1 | Produce criterion-level credential management controls documentation | | `d(11)` | Encryption and hashing of authenticated credentials | Yes | PF/IT | IT tracker notes deferred credential-at-rest hardening | Partial | Spec + partial impl | Certification method | HIPAA + crypto controls | HTI-1 | Prioritize vault migration and certify traceability | | `d(12)` | Encrypt authentication assertions | Yes | PF | No dedicated cert spec | No direct evidence bundle | None | Certification method | SAML/SMART assertion encryption | HTI-1 | Author dedicated criterion spec | | `d(13)` | Multi-factor authentication | Yes | PF | Mentioned in trackers/specs; no standalone criterion spec | Partial/Deferred operationally | Spec-only | Certification method | MFA requirements | HTI-1 | Add dedicated MFA criterion implementation and evidence | ### 2.5 (e) Patient Engagement Criteria | Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | ---------------------------------- | --------------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------- | --------------------- | -------------------------------- | ----------- | -------------------------------------------------------------------------------- | | `e(1)` | View, Download, and Transmit (VDT) | Yes | PM/CL | [`PM-12`](../../specs/pm/specs/PM-12-patient-portal-self-service.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md), [`CL-16`](../../specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md) | Portal exists; API scope incomplete for certification posture | Spec + partial impl | Inferno + cert method | USCDI/FHIR + patient rights | HTI-1 | Complete patient-driven SMART access and evidence | | `e(2)` | Secure messaging | Yes | PM/CL | [`PM-14`](../../specs/pm/specs/PM-14-secure-messaging.md), [`CL-48`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md) | In-app messaging and C-CDA transmission efforts exist | Spec-only | SITE/Direct tools | Direct/transport requirements | HTI-1 | Differentiate in-app messaging from ONC Direct-compliant messaging and close gap | | `e(3)` | Patient health information capture | Yes | PM/CL | No dedicated ONC criterion spec identified | No evidence package found | None | Certification method | Patient-submitted data standards | HTI-1 | Add dedicated spec for capture, provenance, and reconciliation | ### 2.6 (f) Public Health Criteria | Criterion | Title | In-scope for BH | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | ------------------------------------------ | ---------------------------------------------- | ----------- | ------------------------------------------------------------ | -------------------------- | --------------- | ---------------------------- | --------------------------------- | ----------- | ------------------------------------------------------------- | | `f(1)` | Immunization registry reporting | Sometimes | CL/PM | No dedicated ONC criterion spec | No VXU-style cert evidence | None | NIST Immunization Test Suite | HL7 v2 immunization guides | HTI-1 | Decide scope by contracts; if in-scope, author full spec | | `f(2)` | Syndromic surveillance reporting | Usually limited for BH, but contract-dependent | CL/PM | No dedicated criterion spec | No evidence found | None | NIST Syndromic Suite | HL7 v2 syndromic guides | HTI-1 | Keep as conditional scope item with documented decision | | `f(3)` | Electronic lab reporting (ELR) | Potentially relevant | CL | Lab ingestion exists, but no ELR outbound certification spec | No cert evidence found | None | NIST ELR Suite | HL7 v2 ELR | HTI-1 | Add outbound/reporting scope decision and implementation plan | | `f(4)` | Cancer registry reporting | Often N/A for BH | CL/PM | No dedicated spec | No evidence | None | Public health tooling | Registry standards | HTI-1 | Document N/A unless oncology service lines added | | `f(5)` | Reportable lab tests/conditions | Contract-dependent | CL/PM | No dedicated spec | No evidence | None | Public health tooling | Public health condition reporting | HTI-1 | Evaluate by state/public-health mandates | | `f(6)` | Antimicrobial use and resistance reporting | Usually N/A for BH | CL | No dedicated spec | No evidence | None | AU/AR CDA validator | CDA AU/AR guides | HTI-1 | Document N/A unless service scope expands | | `f(7)` | Health care surveys reporting | Usually limited for BH | CL/PM | No dedicated spec | No evidence | None | NHCS validator | CDA NHCS guides | HTI-1 | Document N/A or add if payer/contract requires | ### 2.7 (g) Design and Performance Criteria | Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | ---------------------------------------------------- | -------- | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------- | -------------------- | ------------------------------ | ----------- | ---------------------------------------------------------------- | | `g(3)` | Safety-enhanced design | Yes | PF/CL/PM | No ONC-specific SED spec | No NIST 7741 evidence package | None | Certification method | NIST IR 7741 usability process | HTI-1 | Create SED spec and study artifact template | | `g(4)` | Quality management system | Yes | PF/GR | No dedicated QMS criterion spec | No ONC-ready QMS artifact set | None | Certification method | QMS attestation expectations | HTI-1 | Create QMS governance/evidence spec | | `g(5)` | Accessibility-centered design | Yes | PF/CL/PM | [`PF-93`](../../specs/pf/specs/PF-93-platform-accessibility-infrastructure.md), CL portal enhancements | Accessibility work in progress, not mapped to ONC criterion artifacts | Spec + partial impl | Certification method | WCAG 2.1 AA + Section 504 | HTI-1 | Add ONC-centered accessibility evidence matrix | | `g(6)` | C-CDA creation performance | Yes | CL | [`CL-48`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md) | C-CDA generation path in progress | Spec + partial impl | SITE/C-CDA tools | C-CDA performance and validity | HTI-1 | Finish benchmarking + validation artifact set | | `g(7)` | Application access - patient selection | Yes | CL/PM | [`CL-16`](../../specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) | Partial API surfaces | Spec + partial impl | Inferno | FHIR/SMART | HTI-1 | Finalize patient-level access semantics and tests | | `g(8)` | Application access - data category request | Yes | CL/PM | CL-16 + PM-55 | Partial | Spec + partial impl | Inferno | FHIR/USCDI mappings | HTI-1 | Complete category-level filtering and conformance tests | | `g(9)` | Application access - all data request | Yes | CL/PM | CL-16 + PM-55 | Partial (`$everything` path not fully cert-ready) | Spec + partial impl | Inferno | FHIR all-data semantics | HTI-1 | Add production-ready all-data request behavior and evidence | | `g(10)` | Standardized API for patient and population services | Yes | CL/PM | [`CL-16`](../../specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md), [`CL-16-EN-02`](../../specs/cl/specs/CL-16-EN-02-uscdi-v3-patient-access-api.md), [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) | FHIR edge facade exists but SMART/CapabilityStatement/cert harness incomplete | Spec + partial impl | Inferno | US Core, SMART, USCDI v3 | HTI-1 | Build inferno CI harness + complete SMART and metadata endpoints | ### 2.8 (h) Transport Criteria | Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | ------------------------------ | ------------------------------ | ----------- | -------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- | ------------------- | ------------------------ | -------------------------- | ----------- | --------------------------------------------------------------------------- | | `h(1)` | Direct Project | Yes (for transition workflows) | CL/PM | [`CL-48`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md), [`PM-14`](../../specs/pm/specs/PM-14-secure-messaging.md) | HISP adapter patterns exist; not full cert-ready direct stack | Spec + partial impl | SITE Direct Testing | Direct transport standards | HTI-1 | Implement full Direct flow, delivery notifications, and certification tests | | `h(2)` | Direct edge protocols, XDR/XDM | Yes if Direct scope chosen | CL/PM | No dedicated h(2) cert spec | No certified-ready evidence found | None | SITE Direct + edge tools | XDR/XDM requirements | HTI-1 | Add explicit h(2) implementation spec if cert path selected | ### 2.9 (j) HTI-2 Additions | Criterion | Title | In-scope | Owning core | Existing spec(s) | Implementation evidence | Coverage status | ONC test tool | Standards / posture | HTI context | Recommended action | | --------- | ------------------------------------------------ | ---------------------- | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------- | --------------- | ---------------------------- | --------------------------- | ----------- | ------------------------------------------------------------ | | `j(15)` | Prior auth API - coverage requirements discovery | Yes (payer operations) | PM | [`PM-52`](../../specs/pm/specs/PM-52-davinci-fhir-prior-authorization-api.md), [`PM-10`](../../specs/pm/specs/PM-10-prior-authorization-management.md) | Spec track exists, implementation incomplete | Spec-only | Inferno/Da Vinci conformance | CRD | HTI-2 | Execute phased implementation with payer pilots | | `j(16)` | Prior auth API - documentation templates/rules | Yes | PM | PM-52 + PM-10 | Spec exists | Spec-only | Inferno/Da Vinci conformance | DTR | HTI-2 | Add DTR rule engine and endpoint-level conformance tests | | `j(19)` | Prior auth API - prior auth support | Yes | PM | PM-52 + PM-10 | Spec exists, not complete | Spec-only | Inferno/Da Vinci conformance | PAS | HTI-2 | Implement PAS transaction lifecycle + evidence | | `j(20)` | DSI workflow triggers (client) | Yes | PM/CL | Mentioned in standards references only | No dedicated implementation | None | ONC tooling as released | CDS Hooks STU2 | HTI-2 | Create dedicated spec and client integration plan | | `j(21)` | Subscriptions (client) | Yes | PM/CL | Mentioned in standards references only | No dedicated implementation | None | ONC tooling as released | FHIR subscriptions backport | HTI-2 | Create dedicated spec and phased event subscription strategy | ### 2.10 SVAP / Version Cutover Flags (Cross-Criterion) | Standard area | Legacy baseline | New baseline | Operational impact | | --------------------- | --------------- | -------------------------------------------------------------------- | ------------------------------------------------------------------ | | USCDI | v1 | v3 (required by late 2025 cutover windows in ONC tooling references) | Update mappings in CL-16/PM-55 and all certification test fixtures | | US Core | STU3.1.1 | STU6.1.0 | Resource profile conformance changes for Inferno | | SMART App Launch | 1.0 | 2.0 | Update OAuth flows, scopes, and app registration expectations | | NCPDP SCRIPT | 2017071 | 2023011 | eRx/billing ecosystem upgrade with HTI-4 timing | | C-CDA companion guide | R2 | R4.1 | Document generation/validation updates in CL-48 | *** ## 3) Conditions and Maintenance of Certification Matrix | Condition/Maintenance Area | Current repo coverage | Status | Primary anchors | Gap summary | Recommended action | | ------------------------------------------------------------------------ | --------------------------------------- | ------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- | -------------------------------------------------------------------- | | Information Blocking governance | Present in PM-55 and compliance tracker | Spec + partial impl | [`PM-55`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md), [`REGULATORY_COMPLIANCE_TRACKER.md`](./REGULATORY_COMPLIANCE_TRACKER.md) | Need full denial taxonomy, workflows, and annual governance packet | Build criterion-to-exception control matrix and reporting automation | | API Conditions of Certification (terms, fees, transparency, maintenance) | Partial conceptual coverage | Spec-only | PM-55, CL-16 family | Missing formal policy/doc artifacts expected in certification workflows | Add API condition governance spec + publishable artifacts | | Real World Testing (RWT) | No dedicated spec/doc found | None | N/A | Missing annual plan/results framework | Create RWT spec and evidence template | | Insights Condition metrics | No dedicated spec/doc found | None | N/A | Missing data capture + submission process | Create Insights metrics pipeline spec | | Communications condition | Not explicitly documented | None | N/A | Missing formal communications guardrail artifact | Add policy spec tied to legal/compliance workflows | | Annual attestation process | Not explicitly documented | None | N/A | Missing attestation calendar and artifact assembly | Add attestation operations spec | | Assurances | Not explicitly documented | None | N/A | Missing signed assurance framework and controls mapping | Add assurances package spec | | Mandatory disclosures URL | Not explicitly documented | None | N/A | Missing customer-facing disclosures publication workflow | Add disclosures publication spec | | Hosted docs URL | Not explicitly documented | None | N/A | Missing certification-oriented hosted docs surface | Add docs publication and versioning policy | | Trusted Exchange / TEFCA evolution | Scoped in enhancement | Spec + partial impl | [`CL-16-EN-01`](../../specs/cl/specs/CL-16-EN-01-tefca-qhin-connectivity.md) | Needs operational partner onboarding and cert interplay decisions | Keep as phased item with go/no-go contract trigger | *** ## 4) ONC Tooling Readiness Matrix | Tool | URL | Main criterion coverage | Current readiness | Evidence today | What is required to pass | | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------------- | ---------------------------------------------- | ------------------------------------------------------------------------------ | | Inferno Framework | [inferno.healthit.gov](https://inferno.healthit.gov/) | `g(10)`, API-centric criteria, related HTI updates | Partial | CL-16/PM-55 specs, partial FHIR facade | CapabilityStatement, SMART full flow, profile-conformant resources, CI harness | | SITE / Edge Testing Tool | [site.healthit.gov](https://site.healthit.gov/) | C-CDA, Direct, related certification tooling | Partial | CL-48 and direct adapter concepts | Complete Direct/XDR/XDM implementations and validation workflows | | ONC Conformance Test Tools index | [ONC Conformance Test Tools](https://healthit.gov/certification-health-it/certification-process/onc-conformance-test-tools/) | Cross-criterion test resources | Partial | Resource inventory known | Build test execution program tied to each selected criterion | | C-CDA Testing | [C-CDA testing entry](https://site.healthit.gov/c-cda) | `b(1)`, `b(2)`, `g(6)` and related | Partial | CL-48 generation work | Full schema/content validation and regression tests | | Direct Testing | [Direct testing entry](https://ett.healthit.gov/ett/#/direct) | `h(1)`, `h(2)`, transition transport | Partial | HISP adapter pattern exists | Production Direct stack, delivery notification, edge protocol coverage | | Cypress | [healthit.gov/cypress](https://healthit.gov/cypress/) | `c(1)`-`c(4)` CQM | Low | CL-51 spec only | Implement QRDA/CQM engine with Cypress-ready fixtures | | eRx Testing Suite | [erx.healthit.gov](https://erx.healthit.gov/erx/#/home) | `b(3)`, `b(4)` | Low-Partial | CL-06 path exists but HTI-4 transition pending | Upgrade standards and execute full eRx conformance tests | | NIST Immunization Suite | [NIST Immunization Suite](https://hl7v2-iz-r1-5-testing.nist.gov/iztool/#/home) | `f(1)` | Low | No dedicated criterion implementation | Build/report immunization messaging if in-scope | | NIST Syndromic Suite | [NIST Syndromic Suite](https://hl7v2-ss-r2-testing.nist.gov/ss-r2/#/home) | `f(2)` | Low | No dedicated criterion implementation | Build/report syndromic feeds if in-scope | | NIST ELR Suite | [NIST ELR Suite](https://hl7v2-elr-testing.nist.gov/mu-elr/) | `f(3)` | Low | No dedicated ELR certification flow | Build/report ELR transport and validations if in-scope | | AU/AR CDA validator | [AU/AR validator](https://validator-legacy.lantanagroup.com/validator/) | `f(6)` | Low | None | Implement and validate AU/AR submissions if in-scope | | NHCS validator | [NHCS validator](https://cda-validation.nist.gov/cda-validation/muNHCS.html) | `f(7)` | Low | None | Implement and validate NHCS submissions if in-scope | | CPOE Evaluation Tool | [Leapfrog CPOE tool](https://www.leapfroggroup.org/survey-materials/prepare-cpoe-tool) | CPOE quality and safety corroboration | Low | None | Add pilot validation workflow if pursuing broader quality evidence | | IHE Testing Tools | [IHE tools](https://www.ihe.net/testing/testing_tools/) | Interoperability profile validation | Low | None | Map relevant IHE profiles to cert scope and execute tests | *** ## 5) ONC Resource Adoption Assessment (Non-Certification Resources) | Resource | URL | Current use in repo | Coverage status | Recommendation | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | --------------- | ------------------------------------------------------------------------- | | Health IT Playbook | [playbook.healthit.gov](https://playbook.healthit.gov/) | Mentioned as resource category; no dedicated adoption spec | None | Create cross-core adoption guide tied to CL/PM/PF implementation patterns | | ONC Implementation Resources hub | [Implementation Resources](https://healthit.gov/resources/?search-text=Implementation+Resources) | Referenced in ONC pages; not operationalized in compliance docs | None | Add periodic review cadence and artifact intake process | | SITE hub | [site.healthit.gov](https://site.healthit.gov/) | Known as test hub; no internal runbook in compliance docs | Spec-only | Add certification test-ops runbook and ownership model | | ONC Certification overview | [Certification of Health IT](https://healthit.gov/certification-health-it/) | Mapped in roadmap/tracker | Spec-only | Keep updated with HTI release changes and ACB process updates | | ONC Conformance tools page | [Conformance tools](https://healthit.gov/certification-health-it/certification-process/onc-conformance-test-tools/) | Partially reflected in docs | Spec-only | Convert to criterion-to-tool matrix (this document is first pass) | | SAFER Guides (2025 updates) | [Resources hub entry](https://healthit.gov/resources/?search-text=Implementation+Resources) | Not explicitly mapped to specs | None | Add safety assessment program and annual review requirement | | Security Risk Assessment Tool | [SRA Tool](https://healthit.gov/resources/?search-text=Implementation+Resources) | Mentioned in ONC ecosystem references only | None | Create customer operational workflow and internal readiness checklist | | Patient Engagement Playbook | [Health IT Playbook ecosystem](https://playbook.healthit.gov/) | No direct operational mapping | None | Create PM-12/CL-26 adoption enhancement and content governance | | Get It, Check It, Use It guide | [Resources hub](https://healthit.gov/resources/?search-text=Implementation+Resources) | Not integrated into patient guidance workflows | None | Add patient education/copy strategy for portal engagement | *** ## 6) Recommended Next-Step Batches (Post-Decision) These are not implemented in this document. They are recommended work packages after path selection. ### Batch A: Decision Lock * Choose one path: Full, Modular, or Alignment-only. * Set scope statement by criterion family and target deadlines. * Name accountable owners and evidence calendar. ### Batch B: Critical Safety and Conditions * New specs for Real World Testing, Insights condition, and attestation packaging. * Dedicated predictive DSI transparency spec (`b(11)`). * SAFER Guides adoption and governance spec. ### Batch C: Modular Certification Core * Production conformance for `g(10)` (Inferno-ready API package). * Direct transport criterion hardening (`h(1)` / `h(2)`). * Patient engagement criterion completion (`e(1)`/`e(2)`/`e(3)` as selected). * d-family criterion evidence bundle finalization. ### Batch D: Public Health Decision and Execution * Formal in-scope/N/A determinations for `f(1)`-`f(7)`. * Implement only contract-required public health criteria. * Build corresponding NIST validation workflows. ### Batch E: HTI-2 Extensions * Implement and certify `j(15)`/`j(16)`/`j(19)` to production level. * Add new specs for `j(20)` CDS Hooks client and `j(21)` subscriptions client. ### Batch F: ONC Resource Adoption * Health IT Playbook operational adoption guide. * Patient engagement playbook integration plan. * SRA tool integration and annual safety review process. ### Batch G: Governance and Process Updates * Refresh [`ONC_CERTIFICATION_ROADMAP.md`](./ONC_CERTIFICATION_ROADMAP.md). * Refresh [`REGULATORY_COMPLIANCE_TRACKER.md`](./REGULATORY_COMPLIANCE_TRACKER.md) ONC rows. * Update compliance-review workflows to enforce criterion checks in future spec authoring. *** ## 7) Cross-References and Sources ### 7.1 External ONC/HHS Sources * [Certification of Health IT](https://healthit.gov/certification-health-it/) * [ONC Conformance Test Tools](https://healthit.gov/certification-health-it/certification-process/onc-conformance-test-tools/) * [SITE](https://site.healthit.gov/) * [Health IT Playbook](https://playbook.healthit.gov/) * [Implementation Resources](https://healthit.gov/resources/?search-text=Implementation+Resources) ### 7.2 Internal Compliance and Spec Sources * [`docs/compliance/ONC_CERTIFICATION_ROADMAP.md`](./ONC_CERTIFICATION_ROADMAP.md) * [`docs/compliance/REGULATORY_COMPLIANCE_TRACKER.md`](./REGULATORY_COMPLIANCE_TRACKER.md) * [`docs/compliance/AUTHORITATIVE_REFERENCES.md`](./AUTHORITATIVE_REFERENCES.md) * [`specs/SPEC_STATUS_REGISTRY.md`](../../specs/SPEC_STATUS_REGISTRY.md) * [`specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md`](../../specs/cl/specs/CL-16-fhir-interoperability-data-exchange.md) * [`specs/cl/specs/CL-16-EN-02-uscdi-v3-patient-access-api.md`](../../specs/cl/specs/CL-16-EN-02-uscdi-v3-patient-access-api.md) * [`specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md`](../../specs/pm/specs/PM-55-onc-hti1-uscdi-v3-patient-access-api.md) * [`specs/cl/specs/CL-48-clinical-document-architecture-cda.md`](../../specs/cl/specs/CL-48-clinical-document-architecture-cda.md) * [`specs/pm/specs/PM-52-davinci-fhir-prior-authorization-api.md`](../../specs/pm/specs/PM-52-davinci-fhir-prior-authorization-api.md) * [`specs/pf/specs/PF-96-medicaid-state-compliance-configuration.md`](../../specs/pf/specs/PF-96-medicaid-state-compliance-configuration.md) ### 7.3 Known Internal Consistency Notes * [`PF-96`](../../specs/pf/specs/PF-96-medicaid-state-compliance-configuration.md) file header indicates complete status while registry/tracker entries may lag in some contexts. * [`ONC_CERTIFICATION_ROADMAP.md`](./ONC_CERTIFICATION_ROADMAP.md) is intentionally high-level and should be refreshed after path selection. *** ## Appendix A: Current ONC Readiness Scorecard (Snapshot) | Area | Score (0-5) | Rationale | | ------------------------------------------------- | ----------: | ----------------------------------------------------------------------------------------------- | | API foundation (`g(10)` track) | 2.5 | Strong specs and partial implementation, missing certification harness and full SMART readiness | | Information blocking operations | 2.0 | Governance direction present, still missing full annual artifact machinery | | C-CDA and transitions | 2.0 | Strong CL-48 scope, not yet complete and validated end-to-end for certification | | eRx track | 2.0 | Core direction present, HTI-4 standard transition pending | | Public health criteria | 0.5 | Mostly unscoped/unimplemented for certification | | Conditions/Maintenance of Certification | 1.0 | Major artifacts missing (RWT, Insights, attestation operations) | | Tooling operationalization (SITE/Inferno/Cypress) | 1.5 | Inventory known, execution program not formalized | Overall snapshot: **1.8 / 5.0** for certification readiness; **2.5 / 5.0** for alignment-only interoperability posture (revised down from 3.0 per May 2026 analysis — USCDI v3 is now the baseline and most BH competitors already meet that bar). *** ## Appendix B: Immediate No-Regret Actions (Regardless of Path) 1. Finalize and run Inferno-aligned test harness for current FHIR API scope. 2. Normalize USCDI v3 mapping inventory and close known terminology gaps. 3. Formalize information blocking denial taxonomy and review queue disposition standards. 4. Add explicit criterion ownership tags to each ONC-relevant spec. 5. Create one annual ONC compliance calendar (deadlines, attestations, test windows). 6. Create DS4P send/receive spec (CL-63) for §170.315(b)(7)/(b)(8) — critical for Part 2 SUD data exchange. 7. Create DEA EPCS spec (CL-64) for 21 CFR 1311 — required for MAT prescribing. 8. Create Contexture HIE integration spec (PF-108) — highest-ROI Arizona move for DAP/TI 2.0. 9. Create EKRA compliance spec (PF-107) — P0 legal priority due to NorthSight relationship. 10. Create DSI transparency spec (CL-65) for §170.315(b)(11) — required before AI features ship. **Note:** Alignment score revised from 3.0/5.0 to 2.5/5.0. USCDI v3 is now the baseline (Jan 1, 2026); most BH competitors already meet that bar. Target 4.0/5.0 within 6 months. See `docs/compliance/ONC_REGULATORY_READINESS_IMPLEMENTATION_PLAN.md` for the full implementation plan with 12 new skills and 12 new specs.