Home → Blog

Compliance

Do you need an ONC-certified EHR if you don't take insurance?

Short answer: no. Here is what ONC certification actually is, when it matters, and what a cash-pay practice should look for instead.

August 04, 2026 · 4 min read

If you have shopped for practice software in the last year, you have seen the badge: ONC Certified Health IT. It appears on pricing pages next to a number two or three times higher than the competition, and it is very good at making a practice owner feel that choosing anything else is reckless.

So let us be precise about what it is.

What ONC certification actually is

The ONC Health IT Certification Program is a voluntary federal program run by the Assistant Secretary for Technology Policy. A vendor pays an authorized testing body to verify that its software meets a defined set of criteria, data export, interoperability, clinical decision support, security, and so on.

Voluntary is the operative word. There is no law that says a physician, therapist or clinic must use certified software to keep a medical record. What certification does is make a practice eligible for specific federal programs.

When it genuinely matters

Certification stops being optional the moment your revenue depends on one of these:

• Medicare Promoting Interoperability / MIPS. If you report under MIPS and want to avoid a payment adjustment, you need certified technology. This is the big one.
• Medicaid incentive and state programs that reference certified health IT in their requirements.
• Hospital or health-system contracts that list certification as a procurement requirement, regardless of whether the law requires it.

If none of those describe your practice, certification is a feature you are paying for and will never use.

What "cash-pay" changes

A practice that is paid directly by the patient, private-pay therapy, aesthetics, direct primary care, acupuncture, a walk-in clinic charging a flat fee, has no MIPS exposure, no payer contracts and no clearinghouse. The entire apparatus that certification exists to standardize is machinery you never switch on.

What you still need is real, and often gets lost in the noise:

• HIPAA compliance and a signed BAA with your software vendor. This one is not optional. If a vendor stores protected health information for you, they are your Business Associate, and you should have the agreement signed before your first patient record exists.
• A complete, defensible clinical record. Your state board and your malpractice carrier care about documentation, not certification.
• Your data, exportable. You should be able to get your patients, appointments and invoices out without begging.
• An audit trail. Who opened which chart, when, and what they changed.

Notice that none of those four require a certification badge. They require a vendor who does the work and will put it in writing.

The information blocking wrinkle

One nuance worth knowing: the information blocking rules apply more broadly than certification does. In practice, for a small cash-pay practice, that means you should not be preventing a patient from getting their own health information. Any decent system lets you share documents and records with a patient through a portal, and that is the behaviour the rules are aimed at.

What to ask a vendor instead

Skip the badge and ask these five, in writing:

1. Will you sign a BAA, and can I see it before I subscribe? If the answer is anything other than a plain yes with a document attached, stop there.
2. Is data encrypted in transit and at rest, and is there a full audit log I can download myself?
3. What exactly can I export, in what format, and what does it cost? "Contact support" is not an answer.
4. **What do you not do?** A vendor who cannot name a limitation is either new or not being straight with you.
5. If I later start billing insurance, what happens? Better to know now that you would have to migrate than to find out in year three.

The honest counter-argument

There is one scenario where paying for certified software as a cash-pay practice is rational: you are fairly sure you will start billing payers within a year or two, and you would rather not migrate twice. Migration is genuinely painful, and choosing the heavier system up front can be the cheaper decision over five years.

But that is a deliberate bet on your own future, not a compliance requirement. Make it with your eyes open, and do not let a badge on a pricing page make it for you.

Full disclosure, since this is our blog: we are not ONC certified, and for a cash-pay practice you do not need us to be. We sign a BAA with every practice, encrypt data in transit and at rest, keep a downloadable audit log, and let you export your data yourself. If you bill payers directly, we will tell you we are the wrong tool, see what we deliberately do not do.

← All articles