Section 170.402 - Assurances(a)Condition of Certification requirement.(1) A health IT developer must provide assurances satisfactory to the Secretary that the health IT developer will not take any action that constitutes information blocking as defined in 42 U.S.C. 300jj-52 and § 171.103 of this chapter on and after April 5, 2021, unless for legitimate purposes as specified by the Secretary; or any other action that may inhibit the appropriate exchange, access, and use of electronic health information.(2) A health IT developer must ensure that its health IT certified under the ONC Health IT Certification Program conforms to the full scope of the certification criteria.(3) A health IT developer must not take any action that could interfere with a user's ability to access or use certified capabilities for any purpose within the full scope of the technology's certification.(4) A health IT developer of a certified Health IT Module that is part of a health IT product which electronically stores EHI must certify to the certification criterion in § 170.315(b)(10) .(5) A health IT developer must not inhibit its customer's timely access to interoperable health IT certified under the Program.(b)Maintenance of Certification requirements.(1) A health IT developer must retain all records and information necessary to demonstrate initial and ongoing compliance with the requirements of the ONC Health IT Certification Program for: (i) A period of 10 years beginning from the date a developer's Health IT Module(s) is first certified under the Program; or(ii) If for a shorter period of time, a period of 3 years from the effective date that removes all of the certification criteria to which the developer's health IT is certified from the Code of Federal Regulations.(2)(i) By December 31, 2023, a health IT developer that must comply with the requirements of paragraph (a)(4) of this section must provide all of its customers of certified health IT with the health IT certified to the certification criterion in § 170.315(b)(10) .(ii) On and after December 31, 2023, a health IT developer that must comply with the requirements of paragraph (a)(4) of this section must provide all of its customers of certified health IT with the health IT certified to the certification criterion in § 170.315(b)(10) .(3)(i)Update. A health IT developer must update a Health IT Module, once certified to a certification criterion adopted in § 170.315 , to all applicable revised certification criteria, including the most recently adopted capabilities and standards included in the revised certification criterion.(ii)Provide. A health IT developer must provide all Health IT Modules certified to a revised certification criterion, including the most recently adopted capabilities and standards included in the revised certification criterion, to its customers of such certified health IT.(iii)Timeliness. A health IT developer must complete the actions specified in paragraphs (b)(3)(i) and (ii) of this section: (A) Consistent with the timeframes specified in part 170; or(B) If the developer obtains new customers of health IT certified to the revised criterion after the effective date of the final rule adopting the revised criterion or criteria, then the health IT developer must provide the health IT certified to the revised criterion to such customers within whichever of the following timeframes that expires last:(1) The timeframe provided in paragraph (b)(3)(iii)(A) of this section; or(2) No later than 12 months after the purchasing or licensing relationship has been established between the health IT developer and the new customer for the health IT certified to the revised criterion.(4) For developers of Health IT Modules certified to § 170.315(b)(11) , starting January 1, 2025, and on an ongoing basis thereafter, review and update as necessary source attribute information in § 170.315(b)(11)(iv)(A) and (B) , intervention risk management practices described in § 170.315(b)(11)(vi) , and summary information provided through § 170.523(f)(1)(xxi) .85 FR 25945, May 1, 2020, as amended at 85 FR 70084, Nov. 4, 2020; 85 FR 70084, Nov. 4, 2020 85 FR 25945, 6/30/2020; as amended at 85 FR 70084, 11/4/2020; 85 FR 70084, 12/4/2020; 89 FR 1433, 2/8/2024; 89 FR 8548, 3/11/2024