Automated FHIR Compliance Tools You Own and Operate

info@yourdata.health

HTI-1 / USCDI Provider Checklist

ONC certification readiness for health systems, EHR vendors, and CHPL-certified Health IT modules. Covers HTI-1 (and HTI-2 through HTI-4 where finalized), USCDI v3 and v4, (b)(11) Decision Support Intervention, (g)(10) FHIR APIs, information blocking, Real-World Testing, Inferno conformance, and CHPL surveillance recovery. Self-assess before TAP scoring.

Section 1

ONC HTI-1 Certification Criteria

HTI-1 effective 2024-01-01 · ongoing maintenance and surveillance

Certified Health IT Module Status

Module currently listed on the ONC CHPL (Certified Health IT Product List) with active certification status (45 CFR 170.523)

Certification scope and criteria mapped per § 170.315 against current product capabilities

ONC-ACB relationship active and up to date

No open non-conformities or open surveillance findings on the CHPL public listing

Section 2

USCDI v3 / v4 Data Class Conformance

USCDI v3 baseline currently required · v4 phase-in per ONC schedule

USCDI Data Class Mapping

All USCDI v3 required data classes mapped to internal data model with completeness evidence (§ 170.213)

US Core 6.1.0 (or current required) profiles supported for each USCDI data class

USCDI v4 gap analysis complete; migration plan documented with owners and dates

Sexual Orientation, Gender Identity, and disability/functional-status data classes captured per USCDI v3+ requirements

Social Determinants of Health (SDOH) data class supported (assessments, goals, interventions)

Encoded vocabularies validated: LOINC, SNOMED CT, RxNorm, ICD-10-CM, CPT/HCPCS, NDC, CVX, UCUM

Section 3

(b)(11) Decision Support Intervention and Predictive DSI

Effective 2025-01-01 for evidence-based DSI; predictive DSI by 2025-01-01

DSI Transparency and Source Attributes

Inventory of all evidence-based DSIs included in the certified product, each with intervention purpose documented (§ 170.315(b)(11)(iv))

For each DSI: source attribute information made available to end users (developer, funding source, bibliographic citation, intervention type)

Predictive DSI inventory captured separately with the additional source attributes required by HTI-1

For each predictive DSI: training data description, fairness assessment, validation methodology, intended use, and warnings disclosed

Intervention Risk Management (IRM) practices documented per § 170.315(b)(11)(vi): risk analysis, risk mitigation, governance

Feedback mechanism implemented allowing end users to flag DSI concerns

DSI source attributes accessible to a wide range of end users (not buried in admin screens)

Section 4

(g)(10) Standardized FHIR API for Patient and Population Services

Effective 2022-12-31 baseline · USCDI v3 endpoints required · v4 phase-in ongoing

FHIR R4 Endpoint Conformance

FHIR R4 API endpoint live and conformant to US Core 6.1.0 (or current) (§ 170.315(g)(10))

CapabilityStatement returned at /metadata; advertises supported resources and operations

SMART on FHIR 1.0 launch + 2.0 scopes both supported for ecosystem compatibility

OAuth 2.0 authorization server live; /.well-known/smart-configuration discoverable

Patient Access (single-patient) and Population Services (multi-patient via Bulk FHIR) both implemented

Bulk FHIR $export (system, group, patient) functional with async-job pattern

All USCDI v3 data classes returnable via the FHIR API

Section 5

Information Blocking

Effective since 2021-04-05 · disincentive rule effective 2024-07-31

Anti-Information-Blocking Posture

Documented practices for sharing electronic health information (EHI) on request (45 CFR Part 171)

App developer onboarding non-discriminatory; reasonable cost and timeline

Exception assessment documented for each exception relied upon (privacy, security, infeasibility, content/manner, fees, licensing, etc.)

No undocumented response-time delays, format restrictions, or fee-gating that could trigger an information-blocking claim

For health-system actors: disincentive policy understood (CMS programs withhold payment for information-blocking actors)

Section 6

Real-World Testing (RWT)

Annual plan due 2025-12-15 · annual results due 2026-03-15 (typical ONC cadence)

RWT Plans and Results

Current RWT Plan submitted to ONC-ACB and published on the CHPL (§ 170.405)

RWT Plan covers every Care Setting in which the Health IT is used in production

Measurement methodologies documented and reproducible

Prior RWT Results published; any anomalies have a remediation owner and date

Interoperability standards updates tracked (US Core, USCDI, FHIR base) and incorporated into plan

Section 7

Inferno Conformance + Touchstone

Continuous · Inferno is the ONC reference test kit · Touchstone is HL7's certification harness

Automated Test Pass Rates

ONC Inferno Framework test suite passing for current required modules (Patient Access, Bulk Data, Single Patient API)

HL7 Touchstone runs for FHIR R4 base + US Core conformance pass

Test cadence integrated into CI/CD or scheduled monthly (not only ad hoc before audits)

Edge-case behavior tested: missing optional fields, mixed terminology, pagination, async timeouts

Test outputs archived and traceable for ONC oversight requests

Section 8

CHPL Surveillance Recovery (if applicable)

Per ONC-ACB surveillance findings · CHPL list of products with non-conformities is public

If You Have an Open Non-Conformity

Full text of the surveillance finding(s) read and root cause identified

Corrective Action Plan (CAP) submitted to ONC-ACB within the response window

CAP includes specific evidence the issue is fixed (test logs, conformance pass output, regression test in place)

Re-test scheduled with ONC-ACB and verification deliverable prepared

CHPL public listing updated upon successful re-test; non-conformity entry resolved

Not sure where you stand? TAP audits your live FHIR endpoints against HTI-1, USCDI v3/v4, (b)(11) DSI, (g)(10) APIs, Inferno conformance, and CHPL surveillance evidence. Starter Audit Guarantee: refund if zero critical or high findings.

Book a Call