An ONC-Authorized Testing Laboratory (ONC-ATL) is a laboratory "accredited by NVLAP and authorized by ONC to test Health IT Modules under the ONC Health IT Certification Program" (HealthIT.gov, ONC-ATLs). This page is for testing laboratories seeking that authorization or renewing it under 45 CFR Part 170, Subpart E. Integral Healthcare Solutions (IHS) organizes the records and procedures behind your ONC-ATL application; your engineers own testing competence and methods, and your laboratory submits.

Last reviewed: October 2026.

What is an ONC-ATL?

An ONC-ATL tests Health IT Modules against certification criteria. It does not make certification decisions; that is the role of an ONC-Authorized Certification Body. Two layers govern the laboratory.

The first is federal. 45 CFR Part 170, Subpart E sets the authorization scope (section 170.511), the ONC-ATL application (section 170.520(b)), the "Principles of proper conduct for ONC-ATLs" (section 170.524), and submission, review and renewal (sections 170.525, 170.530 and 170.540). We read the current eCFR text on 2 October 2026 (eCFR). The application must include "Documentation that confirms that the applicant has been accredited by NVLAP to the ONC Health IT Certification Program, including to ISO/IEC 17025" (45 CFR 170.520(b)(3)).

The second is the NVLAP accreditation. NIST Handbook 150-31, 2021 Edition, "NVLAP Health Information Technology Testing," states: "This handbook specifies the technical requirements and provides guidance for the accreditation of laboratories under the NVLAP Health IT LAP. It supplements the NVLAP procedures and general requirements found in NIST Handbook 150 and ISO/IEC 17025" (NIST HB 150-31:2021, §1.1.1). The edition matters: "This November 2021 edition of the NIST Handbook 150-31 supersedes and replaces the July 2017 edition" (Foreword).

Who needs it and what triggers it

The buyer is a testing laboratory that wants to test Health IT Modules in the ONC program. The triggers:

• Initial authorization. An application "may be submitted to the National Coordinator at any time" (45 CFR 170.525(b)).
• A scope decision. "Applicants may seek authorization from the National Coordinator to perform the testing of Health IT Modules to a portion of a certification criterion, one certification criterion, or many or all certification criteria adopted by the Secretary under subpart C of this part" (45 CFR 170.511).
• Renewal. "An ONC-ACB or ONC-ATL is required to renew its status every three years" (45 CFR 170.540(c)).
• Coordinating two processes. The NVLAP accreditation must be in place to apply, and kept up afterward, so the laboratory runs the NVLAP and ONC timelines together.

How IHS helps

IHS works on the records and procedures side of the laboratory. The process:

1. Gap assessment. Your organizational records are read against 45 CFR 170.520(b) and the section 170.524 Principles of Proper Conduct, with each gap tied to its paragraph.
2. Responsibility and evidence maps. IHS builds maps that separate what NVLAP assesses under NIST Handbook 150-31 and ISO/IEC 17025 from what ONC authorization adds, and ties each requirement to the record that meets it.
3. Drafting. IHS drafts personnel, training and method record controls, the change-reporting procedure and the authorization application file, for your quality and technical leads to review and approve.
4. Mock document review. IHS reviews the file against the regulation and lists what is missing.
5. Readiness support. IHS drafts application text for your laboratory to submit to ONC.

What you supply: your quality manual, test methods, personnel records, and your laboratory engineers and quality experts.

The limit: testing competence and method validation are specialist-led and assessed by NVLAP. IHS covers records and procedures only. Your laboratory, not IHS, submits to and corresponds with ONC and NVLAP.

What to have ready

Each item comes from 45 CFR Part 170, Subpart E (eCFR current text read 2 October 2026) or NIST Handbook 150-31, 2021 Edition.

• NVLAP accreditation to the ONC Health IT Certification Program, "including to ISO/IEC 17025," with documentation that confirms it (45 CFR 170.520(b)(3)).
• A written scope: which certification criteria, or portions of criteria, you will ask to test (45 CFR 170.511).
• A procedure to "Maintain its NVLAP accreditation for the ONC Health IT Certification Program, including accreditation to ISO/IEC 17025" (45 CFR 170.524(a)).
• A training program "that includes documented procedures and training requirements to ensure its personnel are competent to test health IT" (45 CFR 170.524(c)).
• Confirmation that your quality documents work from the November 2021 edition of NIST Handbook 150-31, which "supersedes and replaces the July 2017 edition" (NIST HB 150-31:2021; confirmed as the edition NIST's handbook page lists, 2 October 2026).
• Preparation for proficiency testing, which "may include written examinations, oral examinations, and evaluation of artifacts" (NIST HB 150-31:2021, §3.4.1.2).
• A filing plan that allows for ONC's review, which may take "up to 30 days from receipt" for a first application (45 CFR 170.530(a)(2)). If ONC finds deficiencies it issues a deficiency notice and returns the application (170.530(b)(2)). A revised application must be received within 15 days of receipt of the notice unless ONC grants a good-cause extension (170.530(c)(2)). If the revised application still contains deficiencies, ONC issues a denial notice and the applicant cannot reapply for six months (170.530(c)(4)).
• A renewal calendar on the three-year cycle (45 CFR 170.540(c)).

The introductory call is the place to go through this list against your laboratory's records.

How it compares

The ONC-ATLs listed on the HealthIT.gov page when we read it were "Drummond Group" and "SLI Compliance, a Division of Gaming Laboratories International, LLC" (HealthIT.gov). Other federal approval routes for assurance bodies include CMS deeming authority for accrediting organizations and SAMHSA approval of OTP accrediting bodies.

What it costs

The cost has three parts: NVLAP accreditation, any ONC authorization fee, and your staff and engineering time. Neither ONC nor NVLAP publishes a fee schedule on the pages we reviewed. IHS's fee depends on scope. IHS scopes each engagement after a free introductory call.

What this is not

• IHS is not an accreditation body or a testing laboratory. It does not assess testing competence, validate methods, or grant, influence or predict ONC's or NVLAP's decisions.
• IHS does not submit to ONC or NVLAP or act for your laboratory before either. Your laboratory files and corresponds.
• This page is not legal advice.

Frequently asked questions

What is an ONC-Authorized Testing Laboratory (ONC-ATL)?

An ONC-ATL is a laboratory "accredited by NVLAP and authorized by ONC to test Health IT Modules under the ONC Health IT Certification Program" (HealthIT.gov). Authorization is governed by 45 CFR Part 170, Subpart E.

Do we need NVLAP accreditation before applying for ONC-ATL status?

Yes. The application must include "Documentation that confirms that the applicant has been accredited by NVLAP to the ONC Health IT Certification Program, including to ISO/IEC 17025" (45 CFR 170.520(b)(3)). After authorization, the laboratory must maintain that accreditation (170.524(a)).

What is NIST Handbook 150-31 and how does it relate to ISO/IEC 17025?

NIST Handbook 150-31, 2021 Edition, "NVLAP Health Information Technology Testing," sets the technical requirements for laboratories in the NVLAP Health IT program. It "supplements the NVLAP procedures and general requirements found in NIST Handbook 150 and ISO/IEC 17025" (NIST HB 150-31:2021, §1.1.1). The November 2021 edition replaced the July 2017 edition.

Can a lab seek ONC-ATL authorization for only some certification criteria?

Yes. Section 170.511 allows authorization "to a portion of a certification criterion, one certification criterion, or many or all certification criteria adopted by the Secretary under subpart C of this part."

What goes in an ONC-ATL application under 45 CFR 170.520(b)?

The required items include documentation of NVLAP accreditation to the ONC Health IT Certification Program, including ISO/IEC 17025 (45 CFR 170.520(b)(3)). Applications "may be submitted to the National Coordinator at any time" (170.525(b)).

How long does ONC take to review an ONC-ATL application, and how often must we renew?

"The National Coordinator is permitted up to 30 days from receipt to review an application that is submitted for the first time" (45 CFR 170.530(a)(2)). If ONC finds deficiencies it issues a deficiency notice and returns the application (170.530(b)(2)). A revised application must be received within 15 days of receipt of the notice unless ONC grants a good-cause extension (170.530(c)(2)). If the revised application still contains deficiencies, ONC issues a denial notice and the applicant cannot reapply for six months (170.530(c)(4)). Once authorized, "An ONC-ACB or ONC-ATL is required to renew its status every three years" (170.540(c)).

What are the Principles of Proper Conduct for ONC-ATLs?

They are the ongoing obligations in 45 CFR 170.524. They include the duty to "Maintain its NVLAP accreditation for the ONC Health IT Certification Program, including accreditation to ISO/IEC 17025" and to "Maintain a training program that includes documented procedures and training requirements to ensure its personnel are competent to test health IT."

What does NVLAP proficiency testing look like for health IT testing?

NIST Handbook 150-31 states: "Proficiency testing for this program may include written examinations, oral examinations, and evaluation of artifacts" (§3.4.1.2). The handbook sets the assessment requirements; your engineers prepare for the technical content.

ONC-ATL vs ONC-ACB: which authorization fits our organization?

An ONC-ATL tests Health IT Modules and applies with NVLAP accreditation including ISO/IEC 17025 (45 CFR 170.520(b)). An ONC-ACB makes certification decisions and applies with ISO/IEC 17065 accreditation (170.520(a)). The fit depends on whether your organization tests products or certifies them; see the ONC-ACB page.