State of EHR 2026: Adoption, Costs, Rules and What's Next

Nearly every office-based physician and hospital in the U.S. already uses an electronic health record (EHR), the software that holds patient charts. So the useful questions in this state of EHR 2026 report are different: who sells it, which rules apply, what it costs and what can go wrong. It gathers the latest EHR adoption statistics, with dated numbers linked to their sources. One limit up front: the newest official counts for office-based physicians and hospitals are from 2024. The federal agency behind them says its June 2026 reports are its last formal ones.

Quick Answer

Nearly every office-based physician and hospital has an EHR. In 2024, 95% of office-based physicians used one, per ONC, the federal Office of the National Coordinator for Health IT (ONC, 2024). That year, 99.4% of non-federal acute care hospitals had a certified EHR, meaning a legal agreement with a certified developer, which ONC says is not the same as adopting it (ONC, 2024). These are general, children's and cancer hospitals that the federal government does not run. A certified EHR is one that meets federal technical rules.

So the choices that matter now are which system, at what full price, under which rules and with what risk. The CDC, the federal public health agency, has ended its physician survey. ONC says its June 2026 briefs are its last formal reports, so no newer official count is planned. Any 2026 rate elsewhere is an estimate.

Key numbers

• 95% of office-based physicians used an EHR in 2024 and 91% a certified one, up from 42% using any EHR in 2008 (ONC, 2024).
• 86.1% of solo physicians had any EHR in 2024, against 99.1% in practices of 51 or more physicians (ONC, 2024).
• The biggest vendor, Epic, is the main EHR for 27.7% of physicians (2024). The top five vendors together reach 59.1% (our sum of the five published shares: 27.7 + 11.1 + 7.5 + 7.3 + 5.5). In hospitals, Epic serves 50.8% in 2024 (ONC, physicians, 2024; ONC, hospitals, 2024).
• 34 of 60 EHR certification criteria, the technical tests an EHR must pass to be federally certified, would be removed under HTI-5. HTI-5 is a 2025 ONC proposal to cut those rules. Its final version was under White House review on October 6, 2026 (ONC, 2025; federal review list, 2026).
• 41%: only 44 of the 107 full EHRs in our cost calculator show a price on their own site. Full EHRs are complete systems, not one-job tools. Prices were read on September 26, 2026 (EHR cost calculator, 2026).
• $398 a month is the median for one primary care practice: 2 clinicians who prescribe, 600 visits a month, and only e-prescribing, insurance claims and a patient portal. The median is the middle price, with half of the vendors costing less and half costing more. It covers the 7 of 11 other vendors with published prices whose pages list and price e-prescribing, claims and a portal, in our calculator, without ClinikEHR. With ClinikEHR, the median is $376 across 8, and ClinikEHR's own $354 is one of the two middle values (September 2026) (EHR cost calculator, 2026).
• OCR, the Office for Civil Rights at the U.S. Department of Health and Human Services (HHS), enforces HIPAA, the federal health privacy law. It says hacking and ransomware are the most frequent type of large breach, meaning a breach of 500 or more people (HHS OCR, 2026). Ransomware is software that locks a system until the victim pays. About four in five large 2025 breaches in our tally were hacking or IT incidents (HHS breach portal, 2025).

At a glance

Nearly every physician has an EHR; the open questions are price, rules and risk

Six numbers from 2024 to 2026. Each detail line gives the data year.

• 95%

  Office-based physicians with any EHR

  91% used a certified one (2024)

• 86.1%

  Solo physicians with any EHR

  Against 99.1% in practices of 51 or more physicians (2024)

• 41%

  Full EHRs that show a price

  44 of the 107 full EHRs in our calculator (September 2026)

• $398

  Median monthly price, primary care

  The middle price for one practice: 2 prescribing clinicians, 600 visits a month, e-prescribing, claims and portal only. 7 of the 11 other priced vendors list and price all three features, without ClinikEHR; $376 across 8 with it, where ClinikEHR's own $354 is one of the two middle values (September 2026)

• 6 hours

  In the EHR per 8 patient hours

  One 2025 study of 195 primary care doctors at one academic health system

• 34 of 60

  Federal EHR tests proposed for removal

  Certification criteria in HTI-5, a 2025 ONC proposal; not final on October 6, 2026

How We Gathered This Data

We read government data briefs and surveys, agency pages and the Federal Register, the government's daily record of new rules. We also read peer-reviewed studies, which outside experts check before publication, and surveys from professional groups and industry firms. For facts about one company, we read its own pages. We read everything in September and October 2026, and every number carries its data year, the year it describes. We left out pages we could not open, secondhand figures where an original existed, and figures whose definitions conflict.

This report covers the United States, because that is where the public data we found come from. Hospitals appear only where they give context for a clinic, because you run a clinic.

Our EHR cost calculator holds 123 products: 114 full EHRs and 9 one-job tools such as telehealth, AI-note and booking tools. Seven of the 114 are free software a practice installs itself, so we leave them out of price statistics. That leaves 107 full EHRs.

We read each price on the vendor's own page on September 26, 2026. "Published" means the page gives a price for at least one plan. Vendors that give a price only on request, called quote-only vendors, sit outside every median.

A median is the middle price: half of the vendors cost less and half cost more. In tables, "n" means the number of vendors behind a figure. We quote a median only when 5 or more vendors remain without ClinikEHR.

We build ClinikEHR, and it is one of the 107, so where it changes an answer we show results with and without it. Its figures include features our team confirmed that its pricing page does not list.

We count one note and one reminder per session, or per client where the vendor's file says so. We count one claim, a bill sent to an insurance company, per billed session. So 110 sessions with 70% billed to insurance give 77 claims (110 times 0.70).

"Monthly" is the steady price after first-year discounts and before card fees. "First year" adds one-time set-up fees and uses first-year rates, so it is not simply 12 times the monthly price. SimplePractice claim rates are those effective October 1, 2026.

How many doctors' offices, hospitals and other settings use an EHR?

Nearly all office-based physicians and hospitals do, and fewer behavioral health and long-term care settings do. The newest official counts are 2024 data. The CDC, the federal public health agency, ended its physician survey with the 2024 round. ONC then said its June 2026 briefs on physicians and hospitals are its final formal reports, so any 2026 rate is an estimate. The CDC's survey page says:

The final NEHRS data collection was completed in 2024.

CDC, National Electronic Health Records Survey (NEHRS), page dated May 20, 2026.

What do the newest EHR adoption statistics show for doctors' offices?

In 2024, 95% of office-based physicians used any EHR, and 91% used a certified one, which meets technical rules set under a federal program. In 2008, only 42% used any EHR. The survey ran July to December 2024 (CDC, 2024) and reached 1,725 physicians (ONC, 2024). Physicians answered for themselves, so these are self-reports, not audits.

The table shows how use grew from 2004 to 2024. The source gives no reason for the 2022 dip (to 88%, from 90% in 2018 and 2020) or the 2024 jump (from 88% to 95%).

Source: ONC, 2004 to 2024. The survey method changed in 2012.

Practice size matters, as the chart below shows.

The data

The smaller the practice, the lower the share with any EHR

Share of office-based physicians with any EHR, by practice size, 2024

• Solo practice (1 physician)Certified EHR: 79.9%86.1%
• 2 to 3 physiciansCertified EHR: 90.2%94.2%
• 4 to 10 physiciansCertified EHR: 92.9%97.9%
• 11 to 50 physiciansCertified EHR: 95.1%98.4%
• 51 or more physiciansCertified EHR: 98.5%99.1%

The solo rate is 13.0 percentage points below the rate for practices of 51 or more (99.1 minus 86.1). The certified rate is 18.6 points below (98.5 minus 79.9). About one in ten physicians (9.8%) answered don't know when asked if their EHR was certified (CDC, 2024).

So ONC counted a physician as using a certified EHR if they named one of ten certified EHR makers, even if they had answered no or don't know. ONC says the true rate may still be higher than 91%. Ask any vendor: is this product certified?

How many hospitals and other care settings use an EHR?

Almost every hospital has one: 99.4% of non-federal acute care hospitals had a certified EHR in 2024, up from 99.0% in 2018 (ONC, 2024). In 2010, hospitals differed by size, ownership and location. By 2024 those gaps had almost closed: for-profit hospitals were at 98%, and non-profit, government, small, rural and independent hospitals at 99% or higher. The table shows other settings. Do not rank the rows, because each survey counts something different.

Near-total use does not mean one system: 43.11% of community health centers run more than one EHR or data system. The remaining gaps sit in smaller outpatient, behavioral health and long-term care settings, not hospitals. Why it matters: nearly all hospitals and health centers have an EHR. If you refer patients to them, the question is whether your system can exchange records with theirs. What to do: before you choose an EHR, ask your main referral partners which systems they use.

Does having an EHR mean records move easily?

Using an EHR is not the same as sharing records. The tables show answers from the 2024 survey of 1,725 office-based physicians (CDC, 2024). In 2024, about one in three physicians often sent records electronically to outside providers (31.6%) or often received them (34.7%). About one in two often searched outside sources for a new patient's records (50.4%). Only 42.1% said their EHR brings in outside data without retyping or scanning.

The don't know answers run from 1.6% to 38.3%, so the true shares may differ. Satisfaction with the EHR itself looked better than the sharing results. In 2024, 67.0% were satisfied (25.5% very plus 41.5% somewhat), and 19.7% were dissatisfied (12.7% plus 7.0%). These are our sums of published rows. Shares are of all physicians; the 5% with no EHR were not asked.

Records move only if your referral partners can exchange them too. About half of physicians (50.6%) said providers in their referral network cannot. So ask any vendor how it brings in outside records without retyping.

Who sells EHRs, and what changed in the EHR market in 2025 and 2026?

Doctors' offices are spread across a long list of vendors, while three vendors serve over four in five hospitals (ONC, 2024). The market also changed in 2025 and 2026. Hospitals bought fewer systems, two vendors saw ownership changes, one retired a product and one fell behind on its public financial reports. A large market share does not tell a clinic whether a vendor will keep supporting its product or let you take your data out. So this section also lists ownership and exit events.

Who has the biggest share of the EHR market?

The table shows the main EHR that office-based physicians named in 2024, as a share of all physicians, including the 5% with no EHR (ONC, 2024).

Small practices pick from a wide mix of vendors: 32% of solo physicians use a top-five vendor, against 90% in practices of more than 50 (ONC, 2024). A second federal data set looks different: in 2024, 62.8% of 268,652 clinicians reporting to a Medicare quality program named Epic (ONC, 2024). These are two different counts, not a contradiction.

The first counts physicians, one main EHR each. The second counts clinicians who chose to report, lets each name several products, and misses practices that skip the program. Why it matters: a high share tells you what big groups and hospitals chose, not what fits a clinic your size. What to do: ask vendors for references from clinics of your size and specialty.

In hospitals, Epic served 50.8% in 2024 (ONC, 2024). KLAS, a health IT research firm, counts signed contracts instead. Fierce Healthcare reported from KLAS data that Epic had 43.7% of U.S. acute care hospitals and 56.9% of hospital beds in 2025 (Fierce Healthcare, 2025). The two sources count different things, so the shares do not match.

What changed in 2025 and 2026, and why should a clinic care?

The table lists seven events in date order and names each source type, because a company's own release gives only its own account.

Satisfaction awards are not market share, and the ModMed release comes from the company that gains the customers. The lesson: a vendor can change owners, retire a product or fall behind on filings. None of these events proves a product is bad, but each is a fact a clinic can check. Ask who owns the vendor, how long it will support the product and how you get your data out.

Which rules changed or are changing, and where does each one stand in October 2026?

Rules fall into three groups, based on who must follow them: EHR vendors, clinics or health plans. Three final rules were waiting at the White House on October 6, 2026. The White House office that reviews major rules is the Office of Information and Regulatory Affairs (OIRA). A final rule under its review is not yet in effect. The timeline shows status, and the table says who must act.

Timeline

Three EHR rules are still waiting on White House review as of October 2026

Eight rules and dates, from in force to proposed, with status as of October 6, 2026.

1. July 31, 2024In force

   Clinicians can lose Medicare points for blocking information

   The HHS Inspector General finds that a Medicare clinician blocked information and refers the case to CMS, the Medicare agency. If the clinician must report on the Promoting Interoperability category, that category scores zero. It is typically a quarter of the total Medicare score.

2. January 1, 2026In force

   Health plans must explain prior authorization denials

   Medicare Advantage, Medicaid, children's health insurance (CHIP) and federal marketplace plans must give a specific reason when they deny a prior authorization request. Prior authorization is the plan's approval before it pays for a service. Except marketplace plans, which are outside the time limits, they must decide in 72 hours for urgent requests and 7 calendar days for standard ones. This binds plans, not clinics.

3. February 16, 2026In force

   Part 2 compliance date

   Programs covered by Part 2, the federal rule on substance use disorder records, must follow the updated rules. HHS began taking complaints and breach notices.

4. April 2, 2026Proposed

   HIPAA Privacy Rule update: final rule at White House review

   Not final. The final rule was received April 2, 2026 and was still pending review on October 6, 2026. Its text is not public.

5. July 28, 2026Proposed

   HTI-5: final rule at White House review, agency target date passed

   Not final. HTI-5 is ONC's proposed rule to cut certification requirements. The final rule was received July 28, 2026 and was pending on October 6, 2026. The agency's own August 2026 target has passed.

6. September 29, 2026Proposed

   CMS 2027 physician fee schedule: final rule at White House review

   Not final. The physician fee schedule is Medicare's yearly payment rule for clinicians. The final rule reached White House review on September 29, 2026 and was pending on October 6, 2026. The July 2026 proposal would drop the Security Risk Analysis measure for the 2027 performance year. That measure is a yes-or-no statement that the clinic reviewed the risks to its patient data.

7. January 1, 2027Coming

   Health plans' data-sharing connections due

   The Patient Access, Provider Access, Payer-to-Payer and Prior Authorization connections are generally due from this date.

8. July 2027Proposed

   Target for the final HIPAA Security Rule update

   HHS lists it as a long-term action. Agency targets often slip.

Certification rules: what must your EHR vendor build?

Certification is a federal program that sets technical rules an EHR product must meet. Those rules bind vendors, not clinics. Under a rule called HTI-1, certified EHRs had to support version 3 of USCDI, a federal list of patient data types, by December 31, 2025 (ONC, 2025).

A second rule, HTI-5, is only a proposal. It would remove 34 of the 60 certification criteria, the individual technical tests, and revise 7 more (ONC, 2025). A clinic files nothing, but certified features may become optional, so ask which ones your vendor will keep. The table above gives the review status.

Information blocking: can a clinic be penalized?

Information blocking means stopping or slowing access to health information without a legitimate reason. The law's base figure is $1 million per violation, and HHS's January 2026 table lists the maximum as $1,327,209. The fines apply to developers of certified health IT, exchanges and networks, not clinics (HHS, 2026). A September 4, 2025 alert from the HHS Inspector General (OIG) and ONC said enforcement is active and listed no cases (OIG and ONC, 2025).

A clinic faces a disincentive only if OIG finds information blocking and refers it to CMS, the Medicare agency. For a MIPS clinician, a disincentive means lost Medicare scoring points rather than a fine. MIPS is the Medicare program that adjusts payments by a yearly score. For a MIPS clinician who must report on the Promoting Interoperability category, the rule says the clinician faces:

not earning a score in the performance category (a zero score), which is typically a quarter of the total final composite performance score

HHS, Federal Register, July 1, 2024, rule effective July 31, 2024.

The chart below follows one claim.

How it works

A claim of information blocking can end very differently depending on who is accused

What happens after someone files a claim on ONC's public portal

1. Step 1

   A claim is filed

   The public can file on ONC's portal

   ONC forwards
2. Step 2

   ONC shares it with OIG

   Every claim goes to the HHS Inspector General

   OIG decides
3. Step 3

   OIG may investigate

   No investigation count is published

   if found
4. Step 4

   The outcome depends on who was accused

   A clinic: a disincentive through CMS after an OIG finding and referral. Developers, networks and exchanges: a fine of up to $1,327,209 per violation. Certified developers: ONC can require corrective action and could suspend or end certification.

ONC's monthly file lists 2,453 named parties across all claims. ONC analysts classed 1,938 of them as health care providers, which is about 79% (1,938 divided by 2,453 is 0.79). That 79% is our sum, not an ONC total. A claim is only an allegation, and OIG's information-blocking page lists no penalties, which is evidence, not proof. A separate rule, covered in the next section, also requires clinics to answer record requests on time, and OCR does enforce it.

Data sharing and patient access: what must a clinic do?

TEFCA, the national record-sharing network run under ONC, is voluntary, so ask your vendor whether it connects. Patients use portals too. A patient portal is a secure website or app where patients see their records.

In 2024, 65% of U.S. adults were offered an online record and used it at least once in the past year, up from 25% in 2014. Among adults who were offered access, 87% of those whose provider encouraged use logged in, against 57% of those who were not encouraged. This shows the two go together; it does not prove that encouragement caused the gap (ONC, 2024).

Patients must get their records within 30 days of asking, with one 30-day extension (Code of Federal Regulations, 45 CFR 164.524). On August 27, 2026, OCR announced a $50,000 settlement with an eye-care provider that took almost two years to give a patient her records. It was OCR's 55th Right of Access action, the rule that lets patients get copies of their records (HHS OCR, 2026). So answer record requests within 30 days, and remind patients about the portal.

Privacy and Medicare reporting: what applies now?

Programs covered by Part 2, the federal rule on substance use disorder records, had to follow the updated rules by February 16, 2026 (HHS OCR, 2026). A federal court cancelled most of the 2024 reproductive health privacy rule in June 2025, so only the changes to the notice of privacy practices remain, and those concern Part 2 substance use disorder records (HHS OCR).

For Medicare scoring, CMS added a second yes answer to the Security Risk Analysis measure for 2026 (CMS, 2025) and proposed dropping the measure for 2027 (CMS, 2026). A security risk analysis is a written review of the risks to patient data. HIPAA requires one whatever the Medicare measure does.

How much does an EHR cost in 2026?

How much does an EHR cost? Among the three practice types in the tables below, the cheapest entry plan for one clinician costs $31 a month and the most expensive $499. ClinikEHR and Halaxy charge $0 for one clinician, so they are not in that range. The real bill adds features, card fees and one-time fees. Unless a table says otherwise, every calculator number below is for vendors with published prices, read September 26, 2026; the vendor fee tables were read October 6, 2026.

Do EHR vendors publish their prices?

Of the 107 full EHRs in our calculator, 44 publish a price on their own page, which is 41% (44 divided by 107 is 0.41). Without ClinikEHR it is 43 of 106, also 41%.

Practice types overlap, so the rows do not add to 107. On October 6, 2026, athenahealth, DrChrono and NextGen showed no price on their own pages (EHR cost calculator, 2026). Quote-only vendors sit outside every median, so the medians below describe only vendors that publish prices. To compare vendors that do not publish a price, ask each for an itemized quote. The chart below shows the shares.

The data

Only 44 of the 107 full EHRs in our calculator (41%) show a price; the share runs from 18% to 73% by practice type

Share of full EHRs in our calculator that publish a price, by practice type

• All full EHRs44 of 10741%
• Therapy and mental health24 of 3373%
• Physical therapy and chiropractic13 of 2259%
• Med spa and aesthetics8 of 1553%
• Medical and primary care12 of 3238%
• Hospital and inpatient2 of 1118%

What do published base plans cost for one, five and ten clinicians?

Each vendor's entry plan is its cheapest published plan. The middle half is the range that holds the middle 50% of vendors: a quarter cost less and a quarter cost more. Entry plans include different things. We left out ClinikEHR and Halaxy, which cost $0 at one clinician, and WriteUpp and ECLIPSE, which publish no price at one or more of these team sizes. Each added clinician brings 40 clients and 100 visits.

The chart below shows the spread for one clinician. The table after it adds five and ten clinicians.

The data

For one clinician, entry plans run from $31 to $499 a month, and the spread differs by practice type

Entry plan per month for one clinician. The thin line runs lowest to highest, the box is the middle half and the tick is the median.

• Therapy and mental health21 products · Middle half $45 to $69
  $55 middle$31 to $249
• Medical and primary care10 products · Middle half $50 to $300
  $245 middle$39 to $499
• Physical therapy and chiropractic9 products · Middle half $39 to $65
  $49 middle$33 to $158

$0$200$400

lowest to highestthe middle halfthe median (half cost less, half cost more)

In therapy, the one-clinician median is $55 across 21 vendors, and 17 of the 21 plans cost $39 to $85. In medical, the $245 median describes no real plan: four plans cost $39 to $50, six cost $199 to $499, and none falls between. With 10 prices, the median is the average of the fifth and sixth, $199 and $290, which is $244.50. AdvancedMD's page lists $429 to $1,070 per provider a month for medical specialties. So the $429 in the vendor table is the low end of its range (AdvancedMD, 2026).

Do not multiply a one-clinician price by your headcount, because 6 of the 21 therapy vendors lower the rate as the team grows. Five times the therapy median is $275 (5 times 55), but the five-clinician median is $225. What to do: ask each vendor for a quote at your real team size.

Three vendors have a $0 plan for a very small practice that does not bill insurance, and each is capped. The test practice has 1 clinician, 20 clients and 40 visits a month. The third column raises it to 40 clients and 60 visits, and the fourth adds 28 insurance claims a month, sent electronically.

How do vendors charge?

In therapy, 13 of 21 charge the same extra amount for each added clinician and 8 change the rate as the team grows. In medical it is 7 of 10, and in physical therapy and chiropractic only 4 of 9. None charges a flat price for a growing team.

Why it matters: the price for 5 clinicians is usually not 5 times the price for 1. What to do: ask for the price at your own team size and what each added clinician costs. A third model is a percentage of collections, the money a clinic is actually paid. It costs more as the clinic collects more, so ask for the rate and monthly minimum in writing.

What does a whole practice pay once the features it needs are added?

We priced practices with the features they need (definitions in the table). For primary care, the median is $398 a month without ClinikEHR (7 vendors) and $376 with it (8 vendors). ClinikEHR's own price for this practice is $354, below $398. So adding it makes the median the average of $354 and $398, which is $376, a drop of $22.

For the solo therapist the medians are $86 and $87. An AI note-taker lifts the therapy median to $120 without ClinikEHR, up $34 (120 minus 86), and to $125 with it.

Each median uses only vendors whose pricing page lists and prices every feature we chose. That is 8 of 24 priced therapy EHRs and 8 of 12 priced primary care EHRs. A vendor left out may have the feature, but its page is silent. Bigger practices have fewer such vendors, so the next table names them and gives no median.

ClinikEHR's AI price assumes the notes stay within its pooled allowance of 300 audio minutes a month on Essential. The calculator output does not show that cap being applied.

Which fees are easy to miss?

Card fees can cost more than the software. We show a card fee as the percent of a $100 payment, including the fixed fee per payment. Of 24 priced therapy EHRs, 8 have no card rate on file, and so do 6 of 12 medical EHRs. Osmind passes Stripe's fee to the patient, so we leave it out of the median. Without ClinikEHR and Osmind, the therapy median is 3.35% (14 vendors), and with ClinikEHR added and Osmind counted at 0% it is 3.35% (16 vendors).

ClinikEHR has the highest online card fee in our calculator data. Its rate is 5.10%: a 1.9% platform fee plus Stripe's 2.9% plus $0.30 gives $5.10 on a $100 payment. Work it out: on $10,000 a month in 100 payments of $100, 3.35% costs $335. That is about six times the $55 median monthly price of a one-clinician therapy plan (335 divided by 55 is 6.09). At 5.10% it costs $510.

Per-use and add-on fees sit on vendors' own pages, read October 6, 2026. DrChrono, for one, publishes no plan price but lists per-text, per-fax and per-call fees.

One-time fees are another place where costs hide. Free migration usually means you import the data yourself, and a missing price does not mean free. For onboarding (training and help getting started), 22 of 24 therapy vendors have nothing recorded, which is not free onboarding. Ask each vendor for a written list of every extra fee.

The next table shows how vendors handle AI note-taking on their pricing pages. Of 24 priced therapy EHRs, 3 include it at no extra cost and 2 include a capped allowance. Another 13 sell it as an add-on, with a median of $35 a month and a range of $15 to $175. Four offer it without a published price, and 2 do not list it. Included means no extra charge on the plan; check each page for limits, such as Halaxy's video visits only.

What should you check in the contract before you sign?

ONC's 2016 guide to EHR contracts warns that cloud contracts often renew automatically. It suggests that a contract renew only if the buyer says it wants to renew, and that buyers negotiate caps on future price increases upfront (ONC, 2016). ONC's chapter on switching EHRs lists transition costs but gives no dollar figure. It says:

Unfortunately, very few EHR vendors include any transition provisions in their standard form contracts.

ONC, EHR Contracts Untangled, Chapter 9, 2016.

Federal rules require makers of certified EHRs to describe the extra costs and fees a user may pay, in plain language. The rule is 45 CFR 170.523, in the Code of Federal Regulations (eCFR, current to October 1, 2026). This covers certified products only, and the description may list fees without prices. So get renewal notice, price caps, data export and transition help in writing, and ask how long a vendor will support its product, as UroChartEHR shows.

How much time do clinicians spend in the EHR, and what is changing?

Two measures put EHR time at about 6 hours for every 8 hours of scheduled patient time. The newest survey says after-hours documentation is easing while prior authorization work grows. The log studies come from academic systems and Epic users; the family physician figures are self-reported.

How many hours are clinicians in the EHR?

A study used computer logs of EHR use from February to July 2025 to measure 195 primary care physicians at one academic health system. They spent 6.0 hours in the EHR for every 8 hours of scheduled patient time, and 2.9 hours of that fell outside scheduled hours (Applied Clinical Informatics, 2025). The authors write:

Almost half of study physicians' EHR use occurred outside patient scheduled hours.

Applied Clinical Informatics, Variation in Measures of Electronic Health Record Use Outside Scheduled Hours, May 13, 2026.

The table adds two older studies of EHR time. Active time means the mouse or keyboard was in use.

In the Boston study, clinics with a pharmacy technician had 7.87 fewer EHR minutes per visit. That shows the two go together; it does not prove the technician caused the difference (JAMA Network Open, 2021).

Is the workload getting lighter or heavier?

On September 30, 2026, ONC posted an analysis of what family physicians reported about their workload each year from 2024 to 2026. After-hours charting is easing, and prior authorization work is growing. These are self-reports, and the post gives no sample size for 2025 or 2026 (ONC, 2024 to 2026). The 2024 study behind it covered 8,419 family physicians who answered American Board of Family Medicine certification questions (Journal of General Internal Medicine, 2024). ONC's post says three or more hours per day, while the study counts hours per evening.

Averages hide who carries the load. A Health Affairs study counted patient portal messages. At UCSF Health, the University of California San Francisco health system, the top 5% of patients sent 52.8% of the medical advice messages that patients start. Across 224,068 US ambulatory (outpatient) physicians, primary care physicians received a median of 9.6 messages a week. Half got fewer and half got more (Health Affairs, published 2026).

The abstract also reports 53.3 messages a week for the top quartile. It does not say whether that is of all physicians or of primary care physicians, or whether it is an average, a middle value or a cutoff, so 5.6 times the primary care median (53.3 divided by 9.6) is only a rough comparison. The abstract does not state the data period.

Family physicians who said their home EHR time was appropriate were less likely to report burnout. Their odds were 0.58 times those of other doctors, or 42% lower (1 minus 0.58). The study shows the two go together, not that one causes the other (JAMA Network Open, 2017 to 2023).

In a 2020 to 2021 study of 18,265 physicians, sharing note-writing cut documentation time only in one case. That was when the helper wrote more than 40% of the note (JAMA Internal Medicine, 2020 to 2021). So the load is uneven, and staffing, message routing and shared note-writing may matter more than the averages suggest.

Do AI note-taking tools change the picture?

An AI scribe listens to a visit and drafts the note. The table lists the evidence. Savings are small and uneven: 13.4 fewer EHR minutes per 8 scheduled patient hours is under 3% of those 8 hours (13.4 divided by 480 is 0.028). Notes can also contain errors, so review every note. Our report on AI in EHRs goes deeper.

What are the security and downtime risks for a clinic?

OCR says hacking and ransomware are the most frequent type of large breach. Ransomware is software that locks a system until the victim pays. The Sophos survey covers organizations with 100 to 5,000 employees, Kettering is a hospital system, and the HHS breach list does not show practice size. No source we found gives a breach or outage cost for a clinic of 1 to 10 clinicians.

How often are practices breached, and how?

On April 23, 2026, OCR announced four HIPAA settlements, agreements in which an organization pays money and agrees to fix problems, after ransomware attacks. The total was $1,165,000. In every case, OCR found the organization had not done a proper security risk analysis. The four were a women's health network, a medical imaging provider, a benefits administrator and an employer's health plan (HHS OCR, 2026).

The table is our count of rows on HHS's public breach portal, which lists breaches of 500 or more people. It is our tally, not an HHS total, and recent weeks are undercounted.

Source: HHS breach portal, our tally of rows in its Under Investigation and Archive lists.

How to read it: breaches at healthcare providers were usually modest, with a middle value of about 4,800 people in 2025. Business associates, the vendors that handle data for clinics, reported breaches covering about 63% of the people affected that year. The locations listed most often were network servers and email, not the electronic medical record.

Change Healthcare is a vendor whose systems clinics across the country relied on. It told OCR in July 2025 that about 192.7 million people were affected by the 2024 attack on it. That count is not in the 2025 tally (HHS OCR, 2025). One vendor failure can reach clinics across the country at once. So ask your vendor about its security duties and how fast it must tell you about a breach.

How long does downtime last, and what makes it worse?

On May 20, 2025, Kettering Health, a multi-hospital system, had a system-wide outage. It believes the ransomware group Interlock caused it. Its core record system, Epic, came back on June 2, after 13 days (May 20 to June 2). On June 10, after 21 days, it said key services, including physician office visits, were back to normal. The system wrote that page during the event, so it is the system's own account (Kettering Health, 2025).

ONC's SAFER guide, a federal self-assessment on EHR safety, says:

Occasional temporary unavailability of EHRs is inevitable, due to failures of software and hardware infrastructure, as well as power outages and natural and man-made disasters.

ONC, SAFER Guides: Contingency Planning, 2025 edition.

A clinic cannot stop every attack, but it can control four things: a tested backup, a paper fallback, current software patches and secure logins.

The table below gives wider figures from a survey commissioned by the security firm Sophos. It covers organizations of 100 to 5,000 employees in 17 countries, so small clinics are outside the sample (Sophos, 2025). Recovery was slower when attackers locked the data (encrypted it). Only 9% were back to normal within a day, against 35% when the attack was stopped before the data was locked. About four in ten victims took longer than a week (100 minus 58 is 42; our subtraction, not a number Sophos prints).

What does the law expect today, and what may change?

Today, the HIPAA Security Rule, the part of HIPAA that protects electronic patient data, requires three plans. They are a data backup plan, a disaster recovery plan and an emergency-mode operation plan (Code of Federal Regulations, 2024 edition). A disaster recovery plan says how to restore lost data, and an emergency-mode plan says how to keep protecting data while systems are down.

HHS issued a proposal on December 27, 2024, published in the Federal Register on January 6, 2025. It would add a 72-hour restore rule and a 24-hour notice from vendors when they activate their own contingency plan (HHS OCR, 2024 proposal). It is not final: HHS's agenda targets July 2027, and targets often slip (federal agenda, 2026).

If an attack or outage may have led to patient data being accessed or disclosed in a way HIPAA does not allow, HHS presumes a breach. The clinic can overturn that only by showing a low chance that the data was compromised. Whether ransomware alone counts as a breach depends on the facts (HHS OCR, 2025). The table lists each duty and its status.

What This Means for Your Clinic: What Should You Do Now?

The main EHR trends for 2026 are unfinished rules, more doctors using AI note tools, and hacking as the most frequent type of large breach. Prices are also missing: 63 of the 107 full EHRs in our calculator do not show one. These eight steps answer them.

1. Ask your vendor in writing if its product is certified, who owns it and how long it will support it. Why: solo physicians had the lowest certified share of any practice size, 79.9% in 2024 (ONC, 2024), and vendors change owners or retire products.
2. Get every fee in writing before you sign, including card rate, migration, renewal cap and data export. Why: only 44 of the 107 full EHRs in our calculator (41%) show a price. The therapy median card fee, 3.35% without ClinikEHR and Osmind, costs $335 a month on $10,000 in card payments (EHR cost calculator, 2026).
3. Confirm your privacy notice (your notice of privacy practices) was updated by February 16, 2026, the due date for the remaining changes (HHS OCR).
4. Answer record requests within 30 days, and remind patients about the portal. Why: OCR settled with an eye-care provider for $50,000 after it took almost two years to give a patient her records (HHS OCR, 2026). Among adults offered portal access in 2024, 87% of those whose provider encouraged use logged in, against 57% of the rest (ONC, 2024).
5. Keep a written, current security risk analysis, and close the doors attackers use: patches, email protection and logins. Why: in all four of its April 2026 ransomware settlements, OCR found the organization had not done a proper risk analysis (HHS OCR, 2026).
6. Build a downtime kit of paper forms, a tested backup restore and a way to reach staff without the EHR. Why: only 51% of Sophos survey victims whose data was locked restored from backups, in a survey fielded in early 2025 (Sophos, 2025).
7. Cut documentation time by sharing note-writing or trying an AI note tool, and review every note. Why: documentation time fell only when the helper wrote more than 40% of the note. That was in a 2020 to 2021 study of 18,265 physicians (JAMA Internal Medicine, 2020 to 2021). AI scribe adoption was linked to 13.4 fewer EHR minutes per 8 scheduled patient hours, but after-hours EHR time did not change clearly (JAMA, 2023 to 2025). In a 2024 pilot at one health system, 5.3% of the reviewed AI notes had an error rated serious or imminent risk (JMIR Medical Informatics, 2024).
8. Watch four rules that are not final: the HTI-5 rule, the CMS 2027 fee schedule, the HIPAA Privacy Rule update and the HIPAA Security Rule update. On October 6, 2026, none of the four was final. Three were at White House review (federal review list, 2026), and the Security Rule update was on HHS's long-term list (federal agenda, 2026).

What We Still Do Not Know

• Adoption in 2026. There is no official 2026 count, and ONC says its certified share may be underestimated.
• Final rules. The final text and timing of HTI-5, the CMS 2027 fee schedule, the Privacy Rule update and the Security Rule overhaul.
• Information-blocking penalties. We found none on OIG or ONC pages on October 6, 2026, but a missing posting is not proof.
• Small-practice market share. The official table puts smaller vendors in "Other," which is 21.5%.
• Prices. Our calculator is a sample read on one day, quote-only vendors sit outside every median, and we found no independent survey of what small practices pay in total.
• Effects and costs. The EHR time and AI studies come from academic health systems or from users of one EHR, Epic, not from small clinics. No source gives a breach or outage cost for a clinic of 1 to 10 clinicians.

Frequently Asked Questions

How many doctors use an EHR in 2026?

There is no official 2026 count. The newest official figure is for 2024: 95% of office-based physicians used an EHR and 91% used a certified one. That comes from the CDC's National Electronic Health Records Survey, conducted July to December 2024 and reported by ONC. The survey ended with its 2024 round, and ONC says its June 2026 briefs are its last formal reports. So any 2026 rate is an estimate.

What share of small practices and hospitals use an EHR?

In 2024, 86.1% of solo physicians had any EHR and 79.9% a certified one. For practices of 2 to 3 physicians the figures were 94.2% and 90.2%. For 11 to 50 physicians they were 98.4% and 95.1%, and for 51 or more 99.1% and 98.5%. Among non-federal acute care hospitals, 99.4% had a certified EHR. The smaller the practice, the lower the share.

Who has the biggest EHR market share?

It depends on who is counted. Among office-based physicians in 2024, Epic is the main EHR for 27.7% and the top five vendors for 59.1%. In hospitals, Epic served 50.8% in 2024, according to ONC. KLAS data reported by Fierce Healthcare put Epic at 43.7% of U.S. acute care hospitals for 2025. Among clinicians reporting to a Medicare quality program, 62.8% named Epic, which is a different group.

How much does an EHR cost in 2026?

Only 41% of the 107 full EHRs in our calculator publish a price. Among vendors with published prices in our calculator (read September 26, 2026), the median entry plan for one clinician is $55 a month for therapy (21 vendors). It is $245 for medical (10 vendors) and $49 for physical therapy and chiropractic (9 vendors). The median is the middle price: half cost less and half cost more. No medical plan costs between $50 and $199, so $245 describes no real plan. These medians leave out ClinikEHR and Halaxy, which cost $0 at one clinician; with them, the medians are $51 (23 vendors), $125 (12 vendors) and $45 (11 vendors). Card fees, add-ons and one-time fees come on top.

Can a clinic be fined for information blocking?

Fines, up to $1,327,209 per violation in HHS's January 2026 table, apply to developers, networks and exchanges. A clinic faces a disincentive only after the HHS Inspector General finds information blocking and refers it to CMS, the Medicare agency. For a Medicare clinician in MIPS (Medicare's yearly scoring program) who must report on the Promoting Interoperability category, that is a score of 0 in that category. As of October 6, 2026, we found no penalty listed on the Inspector General's pages.

Is the HIPAA Security Rule update final?

No. HHS issued the proposal on December 27, 2024, and it was published in the Federal Register on January 6, 2025. Its agenda lists it as a long-term action with final action targeted for July 2027, and targets often slip. The current rule stays in force, including backup, disaster recovery and emergency-mode operation plans. The proposal would add written procedures to restore lost systems and data within 72 hours.

How much time do doctors spend in the EHR?

In a 2025 study of 195 academic primary care physicians, EHR time was 6.0 hours for every 8 scheduled patient hours, with 2.9 hours outside scheduled hours. A 2021 to 2022 national study of Epic users found 5.8 hours, and 7.3 for primary care. The share of family physicians reporting 3 or more after-hours documentation hours fell from 41% in 2024 to 34% in 2026.

What should a clinic do if its EHR goes down?

ONC's SAFER guide says occasional temporary EHR downtime is inevitable. Keep paper forms for key tasks, tested backups, trained staff, a communication plan that does not depend on the EHR, and written downtime policies. HIPAA already requires an emergency-mode operation plan. If patient data may have been accessed or disclosed in a way HIPAA does not allow, HHS presumes a breach. The clinic can overturn that only by showing a low chance that the data was compromised, and HHS sets 60-day reporting clocks.

Conclusion

The state of EHR in 2026 is near-universal use, prices that 63 of the 107 full EHRs in our calculator do not show, and rules still being finished. Nearly every office-based physician has an EHR, so choose on fit, price and exit terms, not on whether to have one. Three duties to keep up with today are answering record requests within 30 days, updating the privacy notice and keeping a written security risk analysis current. The full price is more than the sticker price, so get every fee in writing and plan for downtime. Clinics that ask vendors specific questions and keep a short list of simple habits will be better prepared for these trends in 2026.

ClinikEHR is the EHR we build. Its public pricing page lists a Free plan at $0 for up to 50 clients and 2 staff, with no card needed. It also lists Essential at $99.90 a month and Team at $250 a month. Plans are month to month, with no long-term contract. You can compare it with other products in the EHR cost calculator.

Related Articles

• State of Agentic AI EHR 2026
• State of Small Clinics 2026
• State of Behavioral Health Practice 2026
• EHR Cost Calculator
• ClinikEHR billing and payments features
• How Much Does an EHR Cost in 2027? Real Prices, Hidden Fees & Pricing Models Compared
• EHR Implementation Cost 2027: Timeline, Contracts & What to Expect
• How to Switch EHRs Without Losing Patient Data (2027 Guide)
• Best EHR for Small Practices in 2027: Billing, Notes, and Telehealth Made Simple
• How to Reduce Documentation Time Without Cutting Corners in 2026
• How Small Clinics Can Simplify Compliance Without Losing Their Mind (or Their Weekends)

Statistics are as of the dates shown. Check the linked sources for updates. This is general information, not legal or medical advice.