HHS rolls back 14 security and privacy requirements for EHR certification

The U.S. Department of Health and Human Services issued a final rule that removes 14 of the 60 criteria used to certify electronic health record (EHR) systems.

The revisions affect security, privacy and transparency obligations for vendors such as Epic and Oracle, and substantially modify seven additional criteria.

The administration said the changes will lower regulatory burden and speed the development of new technologies, including those that use artificial intelligence.

Public commenters warned that weakening these standards could compromise patient data protection and the safety of AI‑driven health tools.