The federal government is loosening the rulebook for the software that holds Americans’ medical records. The Department of Health and Human Services on Monday finalized a rule that removes 14 of the 60 criteria health record vendors must meet to get their products certified, and revises seven others.
The rule, known as HTI-5, comes from HHS’s Office of the National Coordinator for Health Information Technology (ONC). HHS said in its announcement that the changes will save more than $1.5 billion in regulatory costs and free developers to spend more time building better tools.
The final version is much narrower than what ONC floated in December, when it proposed scrapping 34 criteria and revising seven, a plan that would have touched nearly 70% of the program’s requirements. The rule is scheduled to be published in the Federal Register on Oct. 28.
What does the HTI-5 final rule change?
Companies that sell electronic health record systems, such as Epic and Oracle Health, put their products through ONC’s Health IT Certification Program. Hospitals and doctors rely on that certified software to take part in Medicare programs and to share records with each other and with patients.
Under HTI-5, ONC is dropping requirements it considers outdated or already standard in the market. According to ONC’s list of removed and revised criteria, the cuts include the older clinical decision support criterion, family health history, care plans, security tags for summary-of-care documents, two Direct Project messaging criteria, and several criteria tied to automatically calculating quality measures.
Two application access criteria, covering patient selection and all-data requests, also go away on Jan. 1, 2027. ONC is steering the industry toward newer FHIR-based application programming interfaces, the standard behind many patient health apps.
The rule also ends annual real world testing plan submissions for developers and trims the data vendors report under the program’s Insights condition, though ONC kept a measure on the use of FHIR bulk data access. HHS estimates the package will save $1.55 billion in present-value costs and about $108.1 million a year starting in 2027, Fierce Healthcare reported.
Why are critics concerned about AI and privacy?
One of the most debated changes removes the so-called model card requirements for decision support tools, including those that use artificial intelligence. Those rules, adopted in 2024 under HTI-1, required developers to disclose details about how algorithms were built and how risks were managed.
ONC went ahead with the removal even though a large majority of commenters opposed it, according to a summary of the rule by the health law firm Hooper, Lundy & Bookman. Commenters warned it could shift evaluation and liability burdens onto providers and health systems and make it harder to judge bias and performance. STAT reported that ONC eliminated or revised several requirements over objections that the changes could weaken the security and privacy of health data.
ONC did make concessions. It kept the program’s privacy and security certification criteria and its quality management and accessibility requirements. It also pushed the deadline for phasing out document-based transitions of care exchange to Jan. 1, 2030, to give the industry time to move to FHIR.
What did HHS officials say?
“American doctors and patients need better technology, not more Washington paperwork,” HHS Secretary Robert F. Kennedy Jr. said in a statement. “We are freeing America’s health technology innovators to build better tools, lower costs, and help doctors spend more time caring for patients.”
Dr. Tom Keane, the National Coordinator for Health IT, said the rule would “significantly lower the administrative compliance burden for developers so that they can spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans.”
Keane told reporters Monday that HTI-5 is not the end of ONC’s deregulatory work and that a proposed HTI-6 rule will look at standards adoption, expanded use of APIs and more targeted conditions of certification.
What happened to the information blocking proposals?
The December proposal also would have rewritten parts of the information blocking rules, the regulations meant to stop providers and vendors from unreasonably withholding patient data. Among other things, it would have clarified that “access” and “use” of health data include automated means, such as autonomous AI tools.
None of those changes made it into the final rule. HHS said the comments it received on them “remain under consideration.” Michael Lipinski, an ONC regulatory affairs director, told reporters the agency could finalize them in a separate rule or start over with a new proposal. Keane said HHS’s commitment to enforcement “has not changed” and that it is working with the HHS Office of Inspector General to hold violators accountable.
When do the changes take effect, and what does it mean for patients?
Many provisions take effect 60 days after the rule is published, while others, including several of the removals, start Jan. 1, 2027. ONC plans an information session on the final rule on Oct. 29.
For patients, little should change right away. Certified systems still have to support patient access to records through APIs, and HIPAA privacy protections are not affected by this rule. The bigger question is how hospitals will vet AI tools without vendor disclosures, at a time when health data security is under strain, as the recent Quest Diagnostics lab ordering system breach showed.
Key Takeaways
- HHS finalized HTI-5 on Oct. 26, removing 14 of 60 health IT certification criteria and revising seven, far fewer than the 34 removals proposed in December.
- HHS projects more than $1.5 billion in savings, including about $108.1 million a year starting in 2027.
- AI model card disclosure requirements for decision support tools were removed even though most commenters opposed the change. Privacy and security criteria were kept.
- Information blocking changes were left out and could return in a future rule, likely HTI-6.
Frequently Asked Questions
What is the HTI-5 final rule?
HTI-5 is a final rule from HHS’s Office of the National Coordinator for Health IT, released Oct. 26, 2026. It removes 14 of the 60 criteria used to certify electronic health record software and revises seven others to reduce compliance costs for developers.
Which certification criteria did HTI-5 remove?
Removed criteria include clinical decision support, family health history, care plan, security tags for summary-of-care documents, Direct Project messaging, automated measure calculation and two application access criteria. Some removals take effect when the rule does and others on Jan. 1, 2027.
Does HTI-5 change patient privacy protections?
ONC kept its privacy and security certification criteria, and HIPAA is not changed by this rule. Critics, however, objected to dropping AI transparency requirements and some other criteria they said support privacy and safety.
When does HTI-5 take effect?
The rule is set to publish in the Federal Register on Oct. 28, 2026. Many provisions take effect 60 days later, and some changes take effect Jan. 1, 2027. The deadline for retiring document-based transitions of care exchange is Jan. 1, 2030.
