Certified EHRs must support USCDI v3 from January 1, 2026, and SMART on FHIR lets an app launch inside the EHR with the clinician's context. The standards are the easy part. The integration types, what each can and cannot do, and why the calendar is set by your customer's IT team rather than your code.
ONC's HTI-1 rule made USCDI version 3 the baseline for certified health IT as of January 1, 2026, which widens the data available through certified EHRs' FHIR APIs. That makes integration more feasible than it was. It does not make it fast.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Getting listed with or approved by the EHR vendor's developer program, where one is required.
The customer's security review: questionnaires, a BAA, sometimes penetration test reports and SOC 2.
The customer's analyst and interface team scheduling the build, testing and go-live, often months out.
Mapping: the same FHIR resource carries different codes and extensions at different sites.
Normalize all inbound data (FHIR, HL7 v2, CSV) into one internal model early, so each new site is a mapping, not a code change.
Keep per-site configuration (endpoints, scopes, code mappings) as data, not branches.
Run each site's integration in its own isolated queue so one hospital's outage does not stall the rest.
Have SOC 2 and a HIPAA-ready AWS environment before the first enterprise security review, not during it.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
CMS-0057-F: The Payer APIs Due January 1, 2027, and a Build Plan for the Last Months
Medicare Advantage plans, Medicaid and CHIP programs and their managed care plans, and QHP issuers on the federal exchanges must have Patient Access, Provider Access, Payer-to-Payer and Prior Authorization APIs live by January 1, 2027. The 2026 operational requirements are already in force. What each API does, the standards behind them, and how we would build on AWS.
Read
EKS for HIPAA in 2026: What the BAA Covers and What You Still Have to Configure
EKS, ECR, Fargate, EBS, EFS and GuardDuty are on AWS's HIPAA eligible services list, so you can run workloads with PHI on Kubernetes under a BAA. Eligibility is not compliance: encryption, access, isolation, audit logs and what lands in your logs are yours. A control-by-control checklist, with a diagram.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.