What is ONC?
Office of National Coordinator

ONC was established by executive order in 2004 and codified into law by the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. Its role was significantly expanded by the 21st Century Cures Act of 2016, which gave ONC authority over interoperability standards, health IT certification, and information blocking enforcement.

ONC’s core functions include:

Setting health IT standards. ONC defines the technical standards that certified health IT must support — including FHIR for API-based data exchange, C-CDA for clinical document exchange, and vocabulary standards like SNOMED CT, LOINC, and ICD-10.

Managing the Health IT Certification Program. ONC establishes the criteria that EHR systems and other health IT modules must meet to be certified. Certification is required for participation in CMS incentive and quality programs.

Developing and maintaining USCDI. ONC manages the United States Core Data for Interoperability (USCDI) — the standardized data set that defines what information certified systems must exchange.

Enforcing information blocking rules. Under the Cures Act, ONC investigates potential information blocking by health IT developers, health information networks, and health information exchanges, and refers violations to the HHS Office of Inspector General for civil monetary penalties.

Advancing TEFCA. ONC established the Trusted Exchange Framework and Common Agreement (TEFCA) — the national governance framework for health information exchange (HIE) that aims to create a network of networks for nationwide interoperability.

In simple terms: ONC is the federal office that decides what health IT systems must do, how they must share data, and what happens when they don’t.

ONC influences healthcare IT through rulemaking, certification requirements, standards development, and enforcement actions.

EHR vendors must maintain certification as criteria evolve. When ONC advances to a new USCDI version or adds new certification requirements through rulemaking, vendors must update their products and re-certify within the specified compliance timeline.

Clinical documentation — Certified systems must support structured clinical documentation using standardized vocabularies (SNOMED CT for problems, LOINC for observations, RxNorm for medications).

Interoperability — Certified systems must expose FHIR R4 APIs conforming to the US Core Implementation Guide, support SMART on FHIR app launch, and implement Bulk FHIR export.

Clinical decision support — Certified systems must provide configurable clinical decision support capabilities.

Patient data access — Certified systems must enable patients to access their health data through FHIR-based APIs, supporting third-party app authorization via SMART on FHIR.

Electronic health information export — Certified systems must support single-patient and population-level export of all electronic health information (EHI).

HTI-2 (2024) — Further updated certification requirements, advanced USCDI, and addressed emerging areas including AI transparency in health IT.

Healthcare IT teams must track ONC requirements and build compliance into their development and operational processes.

HIPAA alignment. ONC certification requirements and HIPAA requirements overlap but are not identical. Organizations must satisfy both — ONC’s interoperability and data access mandates alongside HIPAA’s privacy and security rules. Conflicts between “share more data” (Cures Act) and “protect data” (HIPAA) require careful policy and consent design.

At Taction, our team helps EHR vendors, health IT developers, and healthcare organizations build systems that meet ONC certification requirements and stay compliant as regulations evolve.

What we do:

Whether you’re pursuing ONC certification for the first time, updating an existing certified product, or building compliance infrastructure across your organization, our healthcare technology team delivers the regulatory depth and technical precision ONC demands.