HHS backs away from scrapping EHR security and privacy certification requirements

What happened

• Industry stakeholders raised concerns about patient safety and data protection.
• HHS announced it will retain the core certification rules while continuing to consider other cost‑reduction measures.
• No new obligations were introduced.

Why it matters

EHR vendors and health‑care providers can continue to rely on existing certification standards, but should monitor upcoming proposals that may alter other certification aspects.

Business impact

Organizations should maintain current compliance programs for HIPAA‑related EHR certification and allocate resources to assess any future regulatory tweaks.