No single federal law requires every medical practice in the United States to use electronic medical records (EMRs). There is no blanket mandate that forces all doctors, clinics, or hospitals to go digital. However, a web of federal incentive programs, payment penalties, and state-level rules has made electronic records effectively unavoidable for most providers, especially those who treat Medicare or Medicaid patients.
What Federal Law Actually Says
The closest thing to a federal EHR mandate is the HITECH Act, signed into law on February 17, 2009, as part of the American Recovery and Reinvestment Act. HITECH was designed to promote the adoption and meaningful use of health information technology. It did not outright require providers to adopt electronic records. Instead, it created a carrot-and-stick system: billions of dollars in incentive payments for providers who adopted certified EHR systems, followed by financial penalties for those who didn’t.
HIPAA, the other major federal health law people think of, does not require electronic records either. HIPAA’s Security Rule only applies to health information that is already maintained or transmitted electronically. It sets standards for protecting that digital data but says nothing about paper records needing to go away. A practice that keeps entirely paper charts is not violating HIPAA by doing so.
How Medicare Penalties Changed the Equation
The real pressure comes through Medicare reimbursement. In 2015, the Medicare Access and CHIP Reauthorization Act (MACRA) folded the old EHR Incentive Program into a broader system called the Merit-based Incentive Payment System (MIPS). Under MIPS, clinicians who bill Medicare are scored across several performance categories, and one of them, called Promoting Interoperability, specifically requires the use of certified EHR technology. That category accounts for 30% of a clinician’s final MIPS score.
Clinicians who don’t participate or score poorly face negative payment adjustments on their Medicare reimbursements. Those penalties started at 4% in 2019 and have increased to 9% from 2022 onward. A 9% cut to Medicare payments is significant enough that most practices treat EHR adoption as functionally mandatory, even though no law explicitly says “you must use electronic records.”
The Medicaid side of the incentive program ended on December 31, 2021. Providers who participated received their final payments, and no further Medicaid-specific EHR incentives are available.
What Providers Must Do to Comply
For the 2025 performance year, clinicians reporting under MIPS must use EHR technology that meets federal health IT certification criteria. They need to submit data from required measures collected over at least 180 continuous days during the calendar year. On top of that, they must attest to several conditions: that they are not blocking the sharing of health information, that they have completed a security risk analysis, and that they have reviewed federal safety guides for EHR systems.
Accountable Care Organizations participating in the Medicare Shared Savings Program face even stricter expectations. Every ACO participant, provider, and professional who qualifies as a MIPS-eligible clinician must report Promoting Interoperability measures. Compliance is required regardless of which Shared Savings Program track the ACO is in, and ACOs that fail to meet the requirement are ineligible to share in any savings they generate.
Who Can Get an Exemption
CMS does allow hardship exceptions for hospitals and critical access hospitals, but the qualifying circumstances are narrow. You can apply for an exception if your EHR software lost its federal certification and the decertification happened during your reporting period, if your facility lacks sufficient internet connectivity, or if you experienced extreme and uncontrollable circumstances such as a natural disaster. Simply not having certified EHR technology is not enough to qualify. If you never bought the software, that alone won’t get you a pass.
Can You Still Run a Paper-Only Practice?
Technically, yes. No federal law will shut down a practice for using paper charts. CMS requires providers to maintain medical records for seven years from the date of service to keep their Medicare enrollment active, and those records can be “written and electronic documents.” The regulation at 42 CFR 424.516(f) does not specify that records must be in electronic form. Failure to maintain and provide access to records can result in revocation of Medicare enrollment, but the format itself is not the issue.
That said, a paper-only practice that bills Medicare will face those MIPS payment adjustments year after year, losing up to 9% of Medicare reimbursements indefinitely. For most providers, that financial hit makes paper-only operation unsustainable. Practices that don’t accept Medicare or Medicaid at all have the most freedom here, since the penalty structure only applies through those federal payment programs. A concierge practice or cash-only clinic could legally operate with paper records without facing federal financial consequences.
Electronic Prescribing Requirements
One area where electronic systems are more directly mandated is prescribing. Many states have passed laws requiring providers to transmit prescriptions electronically rather than on paper, particularly for controlled substances. New York was among the first to require electronic prescribing statewide, and numerous other states have followed with similar laws. These state-level mandates operate independently from the federal MIPS framework and apply regardless of whether a practice accepts Medicare.
The Bottom Line on Legal Requirements
The U.S. approach has been to make electronic records financially unavoidable rather than strictly illegal to avoid. If you are a provider who bills Medicare, refusing to use certified EHR technology will cost you up to 9% of your reimbursements every year. If you participate in an ACO, you are required to report EHR-related measures as a condition of sharing in savings. If you are in a state with electronic prescribing mandates, you must transmit prescriptions digitally. But if you run a small cash-only practice in a state without e-prescribing laws, there is no federal statute that forces you to buy an EHR system. The law doesn’t require it. The economics do.