Ask the vendor for the CHPL Product Number of the exact product and version you would be running, then look it up yourself on the Certified Health IT Product List at chpl.healthit.gov. If they cannot give you an identifier that resolves to a listing matching the product, the developer, and the version in your quote, treat every certification claim in the sales deck as unverified marketing. This check is free, public, and takes about ten minutes.
Look it up yourself, in ten minutes
Certification is one of the very few claims in an EMR sales process that you can independently verify before you sit through a demo. Uptime, support quality, roadmap promises, and "most loved by physicians" are all things you have to take on faith or dig out of references. Certification status is a matter of public record. Use it: it is a cheap early filter, and how a vendor responds to being asked is itself informative.
What ONC certification actually means
Under the ONC Health IT Certification Program, health IT products are tested by accredited testing laboratories and certified by authorized certification bodies against specific federal criteria. A few things follow from that, and practice administrators routinely get all of them wrong:
- Certification is per module and per version. A developer's flagship product being certified tells you nothing about the version they are actually selling you, or about a separate module they are bundling in.
- Certification is per criterion. Products are certified to a set of criteria, such as e-prescribing, API access, or electronic export of data. "We're certified" is not an answer. "We hold criteria X, Y, and Z" is.
- It is a conformance test, not a quality rating. It confirms the product did specific things correctly in a test environment. It says nothing about usability, support, uptime, price, or fit for your specialty.
- It can matter to your money. Participation in CMS programs, including the Promoting Interoperability performance category, generally requires the use of certified electronic health record technology. If your reimbursement depends on it, the criteria you rely on belong in the contract.
How to search CHPL
- Get the exact product name, developer name, and version from the vendor, in writing.
- Search that product on the Certified Health IT Product List.
- Confirm the developer name matches. Resellers and private-label arrangements are common, and the certified developer may not be the company selling to you.
- Check the listing's status. Active is what you want. Suspended, withdrawn, or terminated listings are exactly what they sound like.
- Open the criteria list and confirm the criteria you actually need are present.
- Check for open surveillance activity, non-conformities, and corrective action plans. These are public.
- Note the CHPL Product Number and put it in your evaluation file. You will want it again at contract time.
Reading the listing
| What you see | What to do with it |
|---|---|
| Certification status | Anything other than active is a conversation stopper until explained. Ask when it changed and why. |
| Version | Must match the version in your quote and statement of work. If the certified version is older than the one being sold, ask which one you will actually be running. |
| Certified criteria | Check the specific ones you depend on, rather than accepting the general claim. Interoperability and data export are the ones buyers most often assume and least often verify. |
| Surveillance and non-conformities | An open non-conformity is not automatically disqualifying, but an unexplained one is. Read the corrective action plan and ask about status. |
| API documentation and service base URLs | Certified API criteria come with published documentation. If your future analytics vendor or specialist partner needs API access, this is where you check that it exists. |
| Real World Testing | Shows whether and how the developer tests interoperability in production, not just in a lab. |
Claims that should make you pause
- "We're certified" with no version, no developer name, and no CHPL number. The number exists. Ask for it.
- "HIPAA certified." HHS does not run a certification program for HIPAA compliance and does not endorse products or vendors as HIPAA compliant. A vendor can sign a business associate agreement and describe its safeguards. It cannot be federally certified as HIPAA compliant, because no such certification exists. Buying software will also never discharge your own obligations, including your risk analysis.
- Claims about the proposed 2026 HIPAA Security Rule updates. Those updates are proposed, not final. A vendor selling you something today on the basis that a proposed rule is already in effect is either confused or hoping you are. Verify the current status at HHS before letting it drive a purchase.
- "Fully interoperable" from a product with no certified API criteria.
- Certification for a module you are not buying. Bundles get described loosely. Check what the certified listing actually covers.
- Refusal to put certification status in the contract. If it is true, it is free to warrant.
Certification is a floor, not a ranking
The Certified Health IT Product List does not rank products, score them, or award tiers. There is no "top rated certified EHR" on it, because there is no rating on it. If a vendor claims certification as evidence of superiority, they are describing a bar that every serious competitor also cleared. What certification tells you is that the product met defined conformance requirements and that the developer is subject to ongoing surveillance. That is a floor. Usability, support responsiveness, note efficiency, and specialty fit all sit above it, and you have to evaluate those yourself.
Questions to ask the vendor
- What is the CHPL Product Number for the exact version we would be on at go-live?
- Which certification criteria does that listing hold, and which of them are you relying on to meet our requirements?
- Have you had any open non-conformities or corrective action plans in the past two years? What were they?
- Will you warrant in the contract that you will maintain certification for the criteria we rely on?
- Is API access to our own data included, or priced separately?
- What does electronic export of our data cost, in what format, and how long does it take?
- Where can we read your Real World Testing plan and results?
If something is wrong with a certified product
If a certified product does not do what its certification says it does, or if a developer is making it unreasonably hard to access, exchange, or use your electronic health information, there are formal channels. ONC operates a complaint process for certified health IT, and information blocking claims can be reported through HealthIT.gov. Knowing these exist changes the tone of the conversation about data export fees before you sign, which is when it is useful to know.
The takeaway
Certification will not tell you which EMR is best, and any vendor who implies otherwise is telling you they have nothing better to lead with. What it will tell you, quickly and for free, is which vendors describe their own product accurately. Get the CHPL Product Number, confirm the version and the criteria, read the surveillance history, and put the criteria you depend on into the contract. Then go evaluate the things certification does not cover, which is nearly everything that will determine whether your clinicians can stand the thing in eighteen months.
Common questions
Is ONC certification required for my practice?
You do not need certified software to run a practice, but participation in CMS programs such as the Promoting Interoperability performance category generally requires certified electronic health record technology. Check the current CMS program requirements for your situation.
Can an EMR be "HIPAA certified"?
No. HHS does not certify or endorse software as HIPAA compliant, and there is no federal HIPAA certification program for products. A vendor can sign a business associate agreement and document its safeguards, but that does not transfer your own compliance obligations to them.
What is a CHPL Product Number?
It is the unique identifier for a certified health IT module and version on the Certified Health IT Product List. Ask the vendor for it, then confirm the listing yourself at chpl.healthit.gov rather than taking the claim on faith.
Does certification mean the EMR is good?
No. It means the product passed conformance testing against specific federal criteria. Usability, support quality, uptime, and specialty fit are not part of certification and must be evaluated separately.