The ONC Health IT Certification Program is the US voluntary-but-effectively-mandatory program under which health IT is certified against federal criteria. Its Cures Act Final Rule 'Standardized API for patient and population services' criterion — commonly cited as (g)(10) — requires certified systems to expose HL7 FHIR (US Core), SMART App Launch, SMART Backend Services, and Bulk Data, with published service base URLs and transparent, non-discriminatory business terms. It defines what a compliant healthcare API must technically contain.
ONC Health IT Certification Program
Regulator guidance United States
The ONC Health IT Certification Program is where the Cures Act’s ‘standardized API’ promise becomes a concrete checklist. Certification is nominally voluntary, but because it gates participation in federal programs it is effectively mandatory — and its (g)(10) criterion is the precise definition of what a compliant EHR FHIR API has to be.
- The (g)(10) ‘Standardized API’ criterion - Certified systems must expose HL7 FHIR with US Core profiles, SMART App Launch, SMART Backend Services, and Bulk Data.
- Transparency conditions - Published service base URLs and transparent, non-discriminatory business and technical terms — an attempt to stop malicious compliance.
- The USCDI data floor - The API must carry the current USCDI data classes.
I catalogue the certification program because it is the rare mandate that reached past ‘have an API’ toward ‘have a specified one’ — it names the standards, which is more than most regulators do. And yet my scoring shows the limit of even a well-specified rule: a certified (g)(10) endpoint at an incumbent is real and gated, a compliance interface rather than a developer product. Specifying the standard is necessary and not sufficient; the examples, discovery documents, consent surface, and self-serve access that make it usable are still left to the vendor’s discretion, and mostly left unbuilt.
Implemented by these standards
A regulation is the law; a standard is the machine-readable contract that makes it real. These are the technical standards that implement this regulation, catalogued at standards.apievangelist.com.
SMART on FHIR
The (g)(10) criterion requires SMART App Launch and SMART Backend Services.
US Core
Certified APIs must expose US Core profiles.
USCDI
The data classes certified health IT must support.
Reaches these HTTP headers
Where a regulation actually touches the wire. Mandated means the law, or a technical standard it makes binding, names this header. Evidentiary means no law names it, but it is the deployed control for an obligation the law does impose. Inferred means it would be good evidence and nothing requires it — interesting to read, never to score.
