{"id":4743,"date":"2026-07-01T08:39:36","date_gmt":"2026-07-01T08:39:36","guid":{"rendered":"https:\/\/www.kayawell.com\/blog\/?p=4743"},"modified":"2026-07-01T08:39:44","modified_gmt":"2026-07-01T08:39:44","slug":"onc-certification-audit-readiness-checklist","status":"publish","type":"post","link":"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist","title":{"rendered":"ONC Certification Under HTI-1 and HTI-2: A Readiness Checklist for HIT Vendors Facing Their First Audit\u00a0"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The first time a health IT product goes through ONC certification, most teams discover that the difficult part was never the software they had spent years building. It was&nbsp;the evidence. A certification body will not take your word that an API returns the correct resources or that your decision support tools disclose what drives them, so it asks you to prove each claim against a published criterion, inside a controlled test environment, with documentation that a reviewer can still follow months after the fact. For a company used to shipping features on its own schedule, that move from building something to&nbsp;demonstrating&nbsp;it under scrutiny is exactly where first audits tend to come apart, and preparing for it well begins long before anyone schedules a test.&nbsp;<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_73 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\r\n<div class=\"ez-toc-title-container\">\r\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\r\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\r\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist\/#Where_the_rules_that_bind_you_live_today\" title=\"Where the rules that&nbsp;bind&nbsp;you live today&nbsp;\">Where the rules that&nbsp;bind&nbsp;you live today&nbsp;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist\/#What_a_certification_body_looks_at_before_and_after_it_issues_the_badge\" title=\"What a certification body looks at before and after it issues the badge&nbsp;\">What a certification body looks at before and after it issues the badge&nbsp;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist\/#Why_FHIR_conformance_should_get_the_largest_share_of_your_preparation_time\" title=\"Why FHIR conformance should get the largest share of your preparation time&nbsp;\">Why FHIR conformance should get the largest share of your preparation time&nbsp;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist\/#How_to_prepare_for_a_program_that_is_being_rewritten_while_you_certify\" title=\"How to prepare for a program that is being rewritten while you certify&nbsp;\">How to prepare for a program that is being rewritten while you certify&nbsp;<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.kayawell.com\/blog\/onc-certification-audit-readiness-checklist\/#A_practical_readiness_checklist_before_you_book_the_audit\" title=\"A practical readiness checklist before you book the audit&nbsp;\">A practical readiness checklist before you book the audit&nbsp;<\/a><\/li><\/ul><\/nav><\/div>\r\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Where_the_rules_that_bind_you_live_today\"><\/span><strong>Where the rules that&nbsp;bind&nbsp;you live today<\/strong>&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The certification program rests on a stack of federal rules, and they do not all carry equal weight for a vendor about to certify. The Health Data, Technology, and Interoperability rule known as HTI-1 is the one that set the requirements currently in force, including a baseline move to USCDI version 3 for the data your product must support, the US Core FHIR implementation guide at version 6.1.0, an updated SMART App Launch framework, and a Decision Support Intervention criterion that replaced the older clinical decision support criterion while adding transparency obligations for the inputs and logic behind those interventions. Those updates were set to take effect at the start of 2026, and a late-2025 enforcement discretion notice extended the window for developers to bring certified modules into line until the first of March 2026, which is the floor you are now measured against.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">HTI-2 is where a surprising number of&nbsp;first-timers&nbsp;lose the thread. It began as a sweeping proposed rule in 2024 that would have expanded data exchange, public health reporting, and encryption standards, yet only portions of it were ever&nbsp;finalized, most visibly the provisions tied to the Trusted Exchange Framework. At the&nbsp;close of 2025&nbsp;the agency formally withdrew the remaining certification proposals, including a planned move to a newer USCDI version, so a team preparing for audit should not be engineering toward requirements that no longer sit on the table. Reading HTI-2 as a checklist of mandatory work is a common and costly error, while reading it as a record of what was proposed,&nbsp;finalized, and later dropped is the&nbsp;accurate&nbsp;way to use it.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_a_certification_body_looks_at_before_and_after_it_issues_the_badge\"><\/span><strong>What a certification body looks at before and after it issues the badge<\/strong>&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Certification is granted by an ONC-Authorized Certification Body, with conformance testing performed through accredited laboratories and, for the FHIR-based criteria, the Inferno test kit. The certificate is not the end of the relationship, because the program attaches Conditions and Maintenance of Certification that&nbsp;keep&nbsp;you accountable well after launch. Those obligations include semiannual attestations filed within defined windows in April and October, real-world testing plans along with the results that must follow them, assurances that your product genuinely behaves as its certification claims, and an information-blocking posture that can withstand a closer look. Vendors who treat certification as a single gate are routinely caught off guard when an attestation window opens or a surveillance review asks for real-world testing evidence they never set up to collect, and building the calendar for those duties before you certify costs far less than reconstructing it under pressure later.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Why_FHIR_conformance_should_get_the_largest_share_of_your_preparation_time\"><\/span><strong>Why FHIR conformance should get the largest share of your preparation time<\/strong>&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Standardized API criterion, usually referenced as (g)(10), is where the heaviest concentration of first-audit findings shows up, because it asks a product to behave correctly across authorization, patient, and population-level access, and a long list of US Core profiles, every part of it validated against a public test suite. An endpoint that performs cleanly in a sales demo can still fail conformance on token scopes, on a profile missing a required element, or on a bulk export that buckles under volume. What teams new to this consistently underestimate is how much of the effort is mapping an existing data model onto US Core rather than writing fresh API code, and that mapping is precisely where experienced&nbsp;FHIR integration services&nbsp;prove their value by surfacing the gaps a testing tool would otherwise expose at the worst possible moment. Running Inferno early and often, as a series of rehearsals rather than a final exam taken once, is the habit that most reliably separates a calm first audit from a frantic one.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_to_prepare_for_a_program_that_is_being_rewritten_while_you_certify\"><\/span><strong>How to prepare for a program that is being rewritten while you certify<\/strong>&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The certification landscape is unusually fluid now.\u00a0The agency has signalled a deliberate shift toward a leaner program built around FHIR-based APIs, and a deregulatory proposal published at the end of 2025 would remove a sizable share of existing criteria and scale back some testing and attestation requirements. However, that proposal was still moving through its comment period and should be read as direction rather than as settled law. For anyone facing a first audit, the practical response is not to chase every announcement but to confirm in writing which criteria and which standards versions your certification body intends to test against on the date you certify. Standards versions change, enforcement discretion quietly moves deadlines, and criteria are added or retired, so readiness has less to do with memorising a rulebook and more to do with\u00a0maintaining\u00a0a current, sourced map of what genuinely applies to your product. Keeping that map\u00a0accurate\u00a0across several overlapping rules is closer to a standing discipline than a one-week project, which is one of the clearest reasons vendors bring in\u00a0<a href=\"https:\/\/nalashaahealth.com\/healthcare-compliance-consulting-services\/\">healthcare compliance consulting services<\/a>\u00a0rather than absorb the tracking burden internally.\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"A_practical_readiness_checklist_before_you_book_the_audit\"><\/span><strong>A practical readiness checklist before you book the audit<\/strong>&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Confirm with your certification body, on paper, the exact criteria, edition, and standards versions you will be tested against, since assuming last year&#8217;s list still applies is how avoidable findings happen. Map every data element your product handles against the current USCDI baseline and US Core&nbsp;profiles and&nbsp;treat any unmapped element as a finding waiting to surface. Run the relevant Inferno tests against your own endpoints repeatedly, fixing failures as a development task rather than a last-minute scramble. Stand up the calendar for attestations, real-world testing, and information blocking responsibilities before certification, so the post-launch obligations are scheduled rather than discovered. Finally, assign someone to watch active rulemaking and standards updates continuously, because in a program being rewritten this openly, the cost of working from an outdated requirement is measured in failed tests and lost time.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certification rewards the teams that prepare to prove their work rather than simply perform it, and the first audit becomes far less daunting once the evidence has been built alongside the product instead of assembled in a panic at the end.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The first time a health IT product goes through ONC certification, most teams discover that the difficult part was never the software they had spent years building. It was&nbsp;the evidence. A certification body will not take your word that an API returns the correct resources or that your decision support tools disclose what drives them, [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-4743","post","type-post","status-publish","format-standard","hentry","category-healthcare"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/posts\/4743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/comments?post=4743"}],"version-history":[{"count":0,"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/posts\/4743\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/media?parent=4743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/categories?post=4743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kayawell.com\/blog\/wp-json\/wp\/v2\/tags?post=4743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}