Meditech Trust Center

generated: '2026-08-14'
method: searched
source:
  - https://home.meditech.com/en/d/regulatoryresources/pages/certification.htm
  - https://home.meditech.com/en/d/regulatoryresources/otherfiles/ry2024meditechchplguideonchealthitcertificationcriteriaeh.pdf
  - https://chpl.healthit.gov/
description: >-
  MEDITECH publishes no SOC 2, HITRUST, PCI, or FedRAMP attestation page (searched; none
  found). It does publish a real, verifiable regulatory compliance program: ONC Health IT
  Certification under the Certified Health IT Product List (CHPL), which is the credential
  that actually governs its EHR/FHIR product line under 21st Century Cures Act interoperability
  rules. Recorded here as the trust-center equivalent for a healthcare EHR vendor.
soc2: {found: false}
hitrust: {found: false}
pci_dss: {found: false}
fedramp: {found: false}
certifications:
  - name: ONC Health IT Certification (2015 Edition Cures Update)
    authority: ONC-ACB (via the Certified Health IT Product List, chpl.healthit.gov)
    scope: >-
      Certifies specific MEDITECH product-version modules (Core HCIS, Ambulatory/MPM,
      Emergency Department Management, Oncology) against ONC's 2015 Edition certification
      criteria, including 170.315(c)(3) Clinical Quality Measures reporting under the 2025
      Standards Version Advancement Process (SVAP).
    sample_certificate_ids:
      - product: MEDITECH Expanse Core HCIS v2.2c
        certificate_id: 15.04.04.2931.MEDI.CO.02.1.220630
      - product: MEDITECH Expanse Ambulatory v2.2c
        certificate_id: 15.04.04.2931.2931.02.03.1.220630
    covered_versions: [Expanse 2.2, Expanse 2.1, '6.1', '6.0', 'Client/Server & MAGIC 5.67c']
    disclaimer: >-
      MEDITECH's own page states the certification "does not represent an endorsement by the
      U.S. Department of Health and Human Services," and directs verification to the
      authoritative CHPL listing rather than the vendor's own certificate numbers.
    authoritative_verification: https://chpl.healthit.gov/
note: >-
  This is not a SOC2/HITRUST-style security-controls attestation; it is a functional/
  interoperability certification specific to US health IT regulation. It is the correct
  analog for this industry and this vendor, and is included here rather than left absent,
  because it is real, sourced, and independently verifiable at chpl.healthit.gov.