Written and maintained by CASRAI Editorial Board
Last updated
The Certified Health IT Product List (CHPL) (chpl.healthit.gov) is the authoritative public registry maintained by the Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC) under Section 3001(c)(5) of the HITECH Act (42 U.S.C. § 300jj-11). The CHPL catalogs every electronic health record (EHR) system and health IT module that has been formally tested and certified under the ONC Health IT Certification Program (45 CFR Part 170).
For health systems, clinical trial networks, and health informatics engineers, the CHPL serves two operational roles: it generates the mandatory 15-character CMS EHR Certification ID required for federal payment program attestation, and it publishes machine-readable API documentation, clinical quality measure mappings, and Real World Testing (RWT) reports for every certified health IT deployment.
What Is the ONC Certified Health IT Product List (CHPL)?
Rather than certifying monolithic software packages alone, the ONC Health IT Certification Program allows vendors (such as Epic and Oracle Health, specialty EHR developers, and middleware API providers) to certify modular software components against discrete functional criteria in 45 CFR § 170.315. Each CHPL listing exposes standardized regulatory metadata:
- Unique CHPL Product Number: A structured identifier encoding the edition/certification schema, the ONC-Authorized Certification Body (ONC-ACB), the ONC-Authorized Testing Laboratory (ONC-ATL), the developer code, product code, version code, certified criteria count, additional software flag, and certification date.
- 15-Character CMS EHR Certification ID Generator: Hospitals attesting to the CMS Medicare Promoting Interoperability Program and clinicians reporting under the Merit-based Incentive Payment System (MIPS) select their exact combination of deployed CHPL products in the registry cart. Once the combined selection satisfies the required base EHR definition under 45 CFR § 170.315, CHPL generates a unique 15-character alphanumeric CMS EHR Certification ID for submission to CMS.
- Attested 45 CFR § 170.315 Criteria & Clinical Quality Measures (CQMs): Complete itemization of which clinical, privacy/security, care coordination, public health, and electronic Clinical Quality Measure (eCQM) criteria a specific software version satisfies, along with required HTI-1 predictive DSI source attributes under § 170.315(b)(11).
- Mandatory Disclosures & Service Base URLs: Links to the developer’s mandatory cost/fee disclosures (§ 170.523(k)(1)) and publicly accessible FHIR service base URLs required for production clinical endpoints.
What Are the § 170.315(g)(10) Standardized API Certification Requirements?
Enacted under the ONC 21st Century Cures Act Final Rule, 45 CFR § 170.315(g)(10) (Standardized API for patient and population services) is the foundational interoperability criterion listed on the CHPL for clinical informatics and multi-site research data extraction. To maintain active CHPL certification under § 170.315(g)(10), a health IT module must implement four core technical standards:
| Technical Component | Required Standard / Implementation Guide | Clinical & Research Informatics Function |
|---|---|---|
| Core Data Model & REST API | HL7 FHIR Release 4.0.1 & HL7 FHIR US Core Implementation Guide | Exposes structured patient demographics, problems, medications, allergies, laboratory results, vital signs, clinical notes, and provenance mapped to United States Core Data for Interoperability (USCDI). |
| App Authorization & Authentication | HL7 SMART App Launch Framework (OAuth 2.0 & OpenID Connect Core 1.0) | Supports both standalone patient/clinician app launch and EHR launch workflows, issuing refresh tokens and granular resource scopes without requiring custom vendor integration contracts. |
| Population-Level Bulk Extraction | HL7 FHIR Bulk Data Access ($export) Implementation Guide |
Enables asynchronous NDJSON batch export of multi-patient cohorts (Group or Patient level) using Backend Services authorization for population health analytics and clinical registry ingestion. |
| Public Endpoint Publication | Service Base URL Directory List | Requires developers to publish machine-readable FHIR endpoint bundle URLs for all production customer hospitals and clinics directly on the CHPL. |
How Do ONC-ACBs and ONC-ATLs Test and Certify EHR Systems?
Under Subpart E of 45 CFR Part 170, ASTP/ONC separates technical laboratory testing from certification governance and ongoing surveillance:
- ONC-Authorized Testing Laboratories (ONC-ATLs): Accredited under ISO/IEC 17025 (via NVLAP), ONC-ATLs execute the official ONC test procedures against candidate software versions. For § 170.315(g)(10) FHIR APIs, ONC-ATLs run the open-source Inferno Framework (inferno.healthit.gov) to validate SMART App Launch handshakes, US Core resource profiles, search parameters, and Bulk Data
$exportoperations. For eCQM criteria (§ 170.315(c)(1)–(3)), ONC-ATLs use the open-source Cypress test suite to verify QRDA Category I and Category III import, calculation, and export accuracy. - ONC-Authorized Certification Bodies (ONC-ACBs): Accredited under ISO/IEC 17065 (such as Drummond Group, ICSA Labs, and SLI Compliance), ONC-ACBs audit the ONC-ATL test reports, verify compliance with Conditions and Maintenance of Certification (Subpart D), issue the certificate, and upload the official product listing to the CHPL.
- Real World Testing (45 CFR § 170.405) & Surveillance: Certification does not end at laboratory testing. Under 45 CFR § 170.405, developers with modules certified to interoperability criteria must submit annual Real World Testing (RWT) Plans (by December 15 prior to the test year) and RWT Results (by March 15 following the test year) to their ONC-ACB for public posting on the CHPL. ONC-ACBs also conduct randomized and complaint-driven in-the-field surveillance; uncorrected non-conformities result in a CHPL status change to Suspended by ONC-ACB/ONC or Terminated/Withdrawn.
Frequently Asked Questions
What is the ONC Certified Health IT Product List (CHPL)?
The Certified Health IT Product List (CHPL) is the authoritative federal public registry maintained by the Assistant Secretary for Technology Policy / Office of the National Coordinator for Health Information Technology (ASTP/ONC) under HITECH Act § 3001(c)(5). It lists every electronic health record (EHR) and health IT module tested and certified to 45 CFR Part 170 criteria and generates the 15-character CMS EHR Certification ID required for Medicare Promoting Interoperability and MIPS attestation.
What are the § 170.315(g)(10) standardized API certification requirements?
Under 45 CFR § 170.315(g)(10), certified health IT modules must provide a standardized API for patient and population services built on HL7 FHIR Release 4.0.1, the HL7 FHIR US Core Implementation Guide, the HL7 SMART App Launch Framework (using OAuth 2.0 and OpenID Connect), and the HL7 FHIR Bulk Data Access ($export) Implementation Guide to exchange United States Core Data for Interoperability (USCDI) data elements.
How do ONC-Authorized Certification Bodies (ONC-ACBs) test EHR systems?
ONC splits testing and certification into two accredited roles: ONC-Authorized Testing Laboratories (ONC-ATLs) evaluate health IT modules against federal test procedures using tools such as the Inferno Framework for FHIR APIs and Cypress for electronic Clinical Quality Measures (eCQMs), while ONC-Authorized Certification Bodies (ONC-ACBs) review test reports, issue formal certifications, publish listings and mandatory disclosures to the CHPL, and conduct ongoing field surveillance.
