An ONC-Authorized Certification Body (ONC-ACB) is a certification body, accredited to ISO/IEC 17065, that ONC has authorized to certify health IT under 45 CFR Part 170, Subpart E. This page is for certification bodies seeking that authorization, changing its scope or renewing it. Integral Healthcare Solutions (IHS) builds the impartiality, decision and surveillance procedures for your ONC-ACB operation; your specialists own product evaluations, and your body submits the application.

Last reviewed: October 2026.

What is an ONC-ACB?

ONC describes ONC-ACBs as bodies that "assess health IT and make certification decisions based on the health IT's conformity to Certification Program requirements" (HealthIT.gov, ONC-ACBs). The route in is accreditation first: "Certification bodies that have obtained accreditation to ISO/IEC 17065 may seek authorization from ONC to participate in the ONC Health IT Certification Program" (same page).

The governing text is 45 CFR Part 170, Subpart E, "ONC Health IT Certification Program." The sections that apply to a certification body are section 170.510 (scope of authorization), section 170.520(a) (application), section 170.523 ("Principles of proper conduct for ONC-ACBs"), section 170.525 (submission), section 170.530 (review) and section 170.540 (status and renewal). We read the current eCFR text on 2 October 2026 (eCFR). ISO/IEC 17065 is incorporated by reference at section 170.599.

The application must include "Documentation that confirms that the applicant has been accredited to ISO/IEC 17065 (for availability, see § 170.599), with an appropriate scope, by any accreditation body that is a signatory to the Multilateral Recognition Arrangement (MLA) with the International Accreditation Forum (IAF)," and "An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ACBs" (45 CFR 170.520(a)(3)-(4)).

Who needs it and what triggers it

The buyer is a certification body that holds, or is working toward, ISO/IEC 17065 accreditation and wants to certify health IT in the ONC program. The triggers:

• Initial authorization. "An application for ONC-ACB or ONC-ATL status may be submitted to the National Coordinator at any time" (45 CFR 170.525(b)).
• A scope decision. Section 170.510 lets a body seek authorization for "Health IT Module certification" and/or "Certification of other types of health IT for which the Secretary has adopted certification criteria."
• Renewal. "An ONC-ACB or ONC-ATL is required to renew its status every three years," with the renewal request submitted "60 days prior to the expiration of its status" (45 CFR 170.540(c)).
• Organizational change. An ONC-ACB must "Report to ONC within 15 days any changes that materially affect" its legal, organizational, personnel or policy status (45 CFR 170.523(d)).

How IHS helps

IHS works on the management-system side of the authorization: the procedures and records ONC's Principles of Proper Conduct call for, kept separate from what your ISO/IEC 17065 accreditation already covers. The process:

1. Gap assessment. Your management system is read against 45 CFR 170.520 and the section 170.523 Principles of Proper Conduct, with each gap tied to its paragraph.
2. Responsibility map. IHS keeps a map that separates what the ISO/IEC 17065 accreditation covers from what ONC authorization adds, so nothing is assumed covered twice or not at all.
3. Drafting. IHS drafts impartiality, certification-decision, complaint, surveillance and reporting procedures and the training-program documentation for your specialists to review and approve.
4. Evidence file. IHS assembles the authorization evidence file against each application item.
5. Mock review. IHS reviews the file against the regulation as a reviewer would and lists what is missing.
6. Readiness support. IHS drafts application text for your body to submit to ONC and helps you prepare for ongoing obligations such as observation visits and change reporting.

What you supply: your quality manual, certification scheme, evaluator files, and your certification, technical and legal specialists.

The limit: IHS holds no conformity-assessment accreditation and does not judge product conformity. The ISO/IEC 17065 assessment belongs to your accreditation body. Your certification body, not IHS, submits to and corresponds with ONC.

What to have ready

Each item comes from 45 CFR Part 170, Subpart E, current eCFR text read 2 October 2026, unless another source is named.

• ISO/IEC 17065 accreditation documentation "with an appropriate scope," from an accreditation body that is an IAF MLA signatory (45 CFR 170.520(a)(3)).
• An agreement, executed by your authorized representative, to adhere to the Principles of Proper Conduct for ONC-ACBs (170.520(a)(4)).
• A decision on scope under section 170.510: Health IT Module certification, other types of health IT with adopted criteria, or both.
• A procedure to "Maintain its accreditation in good standing to ISO/IEC 17065" (170.523(a)).
• A way to track attendance at "all mandatory ONC training and program update sessions" (170.523(b)).
• A procedure to report "within 15 days any changes that materially affect" legal, organizational, personnel or policy status (170.523(d)).
• Readiness to "Allow ONC, or its authorized agent(s), to periodically observe on site (unannounced or scheduled), during normal business hours, any certifications performed" (170.523(e)).
• Surveillance procedures, since ONC-ACBs must "ensure continued conformity of the certified health IT, which may include surveillance activities" (HealthIT.gov).
• A renewal calendar that puts the renewal request 60 days before status expires (170.540(c)).

The introductory call is the place to go through this list against your current management system.

How it compares

The ONC-ACBs listed on the HealthIT.gov page when we read it were "Drummond Group" and "SLI Compliance, a Division of Gaming Laboratories International, LLC" (HealthIT.gov). Other federal approval routes for assurance bodies include CMS deeming authority for accrediting organizations and SAMHSA approval of OTP accrediting bodies.

What it costs

The cost has three parts: your ISO/IEC 17065 accreditation, any ONC authorization fee, and your staff and specialist time. ONC does not publish a fee schedule on the pages we reviewed. IHS's fee depends on scope. Section 170.523(j) addresses refunds of the certification fees an ONC-ACB charges developers; it sets no amount. IHS scopes each engagement after a free introductory call.

What this is not

• IHS is not an accreditation body or a certification body. It does not grant, influence or predict ONC's authorization decision or your ISO/IEC 17065 accreditation decision.
• IHS does not submit to ONC or act for your body before it. Your body files and corresponds.
• This page is not legal advice.

Frequently asked questions

What is an ONC-Authorized Certification Body (ONC-ACB)?

An ONC-ACB is a certification body authorized by ONC to "assess health IT and make certification decisions based on the health IT's conformity to Certification Program requirements" (HealthIT.gov). Authorization is governed by 45 CFR Part 170, Subpart E.

What accreditation do we need before applying for ONC-ACB status?

ISO/IEC 17065. The application must include documentation that the applicant "has been accredited to ISO/IEC 17065 ... with an appropriate scope" (45 CFR 170.520(a)(3)).

Which accreditation bodies can grant the ISO/IEC 17065 accreditation ONC accepts?

Section 170.520(a)(3) accepts accreditation "by any accreditation body that is a signatory to the Multilateral Recognition Arrangement (MLA) with the International Accreditation Forum (IAF)." Check that your accreditation body is an IAF MLA signatory for the right scope before you rely on its accreditation.

What goes in an ONC-ACB application under 45 CFR 170.520?

The items include the ISO/IEC 17065 accreditation documentation and "An agreement, properly executed by the applicant's authorized representative, that it will adhere to the Principles of Proper Conduct for ONC-ACBs" (45 CFR 170.520(a)(3)-(4)). An application "may be submitted to the National Coordinator at any time" (170.525(b)).

How long does ONC take to review an ONC-ACB application?

"The National Coordinator is permitted up to 30 days from receipt to review an application that is submitted for the first time" (45 CFR 170.530(a)(2)). If ONC finds deficiencies it issues a deficiency notice and returns the application (170.530(b)(2)). A revised application must be received within 15 days of receipt of the notice unless ONC grants a good-cause extension (170.530(c)(2)). If the revised application still contains deficiencies, ONC issues a denial notice and the applicant cannot reapply for six months (170.530(c)(4)).

How often must an ONC-ACB renew its authorization?

Every three years. "An ONC-ACB or ONC-ATL is required to renew its status every three years," with the renewal request submitted "60 days prior to the expiration of its status" (45 CFR 170.540(c)).

What are the Principles of Proper Conduct for ONC-ACBs?

They are the ongoing obligations in 45 CFR 170.523. Among them, an ONC-ACB shall "Maintain its accreditation in good standing to ISO/IEC 17065," "Attend all mandatory ONC training and program update sessions," and allow ONC to "periodically observe on site (unannounced or scheduled), during normal business hours, any certifications performed."

What surveillance of certified health IT does an ONC-ACB have to run?

ONC states that ONC-ACBs "are required by its accreditation and other Certification Program requirements to ensure continued conformity of the certified health IT, which may include surveillance activities" (HealthIT.gov). The detailed surveillance requirements sit in the regulation and the program's own requirements; we have not summarized them here.

What changes must an ONC-ACB report to ONC within 15 days?

Section 170.523(d) requires an ONC-ACB to "Report to ONC within 15 days any changes that materially affect" its legal, organizational, personnel or policy status.

How is ONC-ACB status different from being an ONC-ATL?

An ONC-ACB makes certification decisions and applies with ISO/IEC 17065 accreditation under 45 CFR 170.520(a). An ONC-ATL tests Health IT Modules and applies with NVLAP accreditation, including ISO/IEC 17025, under 170.520(b). See the ONC-ATL authorization page.