HTI-5 final rule cuts 14 certification criteria, not the 34 proposed

The HTI-5 final rule cuts 14 certification criteria from the federal program that certifies electronic health records (EHRs), far short of the 34 that the Office of the National Coordinator for Health Information Technology (ONC) proposed to remove in December 2025. The final rule was published in the Federal Register on October 28, 2026. Most of it will take effect on December 28. ONC also revised 7 criteria and left 39 untouched, including every criterion that HTI-4 added for electronic prior authorization.

Much of the distance between the proposal and the final rule traces to public comments. ONC had proposed to drop all 13 privacy and security criteria, and it kept every one of them. It turned the safety-enhanced design requirement, which governs usability work, into an attestation instead of deleting it. Exchange of Consolidated Clinical Document Architecture (C-CDA) documents under the transitions of care criterion now has until January 1, 2030, instead of January 1, 2027, as ONC first proposed.

Where ONC held its ground, the changes are large. The decision support criterion loses the model card requirements that HTI-1 created for predictive AI tools, even though a large majority of commenters on that proposal opposed it. Developers will stop filing real world testing plans. ONC estimates annualized savings for developers of $108.1 million. For hospitals and physician practices, the near-term change is in what their vendors must prove to certifiers rather than in what the software does, since ONC expects vendors to keep most of the removed functions.

Key takeaways

• Fewer cuts than proposed. ONC removed 14 of the 34 criteria it proposed to drop. It revised 7 others and left 39 unchanged.
• Model cards are out. Predictive decision support tools no longer need certified source attributes or risk management practices. ONC said it found no evidence that the requirements helped patients.
• C-CDA exchange gets until 2030. The transitions of care criterion keeps most of its document exchange requirements until January 1, 2030.
• Privacy and security criteria stay. ONC dropped its plan to remove them but said a future rule may revisit them.
• Testing narrows to APIs. Real world testing plans end. Full results reporting now covers only the patient and population services API and the 3 prior authorization APIs.
• Information blocking waits. The proposal’s information blocking changes are not in this rule. ONC says comments on proposals it did not address remain under review.

The 14 criteria that leave the program

ONC split the removals across 2 dates. The rule removes 7 criteria when it takes effect on December 28. Another 7 remain until January 1, 2027. For 5 of those, the definitions of certified EHR technology (CEHRT) used by the Centers for Medicare & Medicaid Services (CMS) refer to the criteria, and the later date lines up with CMS’s own changes.

From Table 1 of the final rule and its amendatory instructions 11 and 12. Dates are when each criterion is removed and reserved in the regulation text.

Why ONC says the tests no longer pay

ONC’s case for most of these removals is that certification has stopped moving the market. In the rule’s words, certification is “likely no longer a primary factor driving improvements” in particular areas. ONC points to its own survey data from 2024, in which 99% of hospitals and 91% of physicians reported having a certified EHR. It treats a criterion as widely adopted when it has long been part of the Base EHR definition or the CEHRT definitions. The Base EHR definition sets the minimum capabilities a certified product must have. If a function is everywhere, the reasoning goes, a test proving that it exists adds cost without adding much assurance.

Removing a criterion ends the certification test. Whether the feature survives is up to the market.

Several removals reflect overlap with newer requirements. The clinical decision support criterion had already expired on January 1, 2025, replaced by the decision support interventions criterion that HTI-1 created. The patient selection criterion duplicates a function that the standardized application programming interface (API) criterion in § 170.315(g)(10) already requires through the SMART App Launch guide, and it has little use once its companion criterion for all data requests goes.

Family health history and care plans have moved into the data standard. Both are data elements in version 6 of the United States Core Data for Interoperability (USCDI), which ONC finalized in July 2026. Developers may adopt version 6 voluntarily, although version 3 remains the version the regulation names, as our January piece on the USCDI baseline explained. Few products were certified to the care plan criterion in any case. As of September 2026, 48 health IT modules were certified to it, out of 714 active certifications.

For hospitals, CMS has already moved. Its fiscal 2027 inpatient payment rule, published on August 4, 2026, finalized the removal of several of these criteria from its CEHRT definition, including the 2 automated measure criteria. CMS has proposed similar changes for clinicians in its 2027 physician fee schedule.

Security tags and Direct

The security tag criteria carry the clearest privacy stakes among the removals. They are the only criteria in the program that support tagging a summary of care as restricted from redisclosure, both when it is sent and when it is received. Most commenters opposed removing them, mainly because the alternatives built on Fast Healthcare Interoperability Resources (FHIR), the standard behind modern health data APIs, are not yet mature. ONC acknowledged that the criteria are the program’s only support for segmenting sensitive data but called them underadopted. It said it would rather focus on FHIR-based standards for data segmentation and consent.

The 2 Direct Project criteria leave on December 28, but Direct does not leave the program. ONC kept the Direct standard in § 170.202(a)(2), and the transitions of care criterion still requires Direct transport until 2030. ONC’s impact analysis notes that most hospitals often use Direct messaging with outside organizations, but that they now use network-based exchange more.

What ONC kept after the comments

Of the 34 criteria ONC proposed to remove, 20 remain in the program. Of those, 18 stay exactly as they were and 2 survive in reduced form.

Privacy and security criteria stay

The largest reversal involves the 13 privacy and security criteria in § 170.315(d), which cover functions from user authentication to encryption. ONC had proposed to remove all of them, along with the framework that ties them to the other criteria a product is certified to. Its argument was that certified EHR technology cannot by itself make an organization compliant with the HIPAA Security Rule. It also said developers had built security functions into their products to pass certification, which made it harder for providers to use better standalone tools, such as a third-party audit log. As a fallback, it offered to keep only the 3 auditing criteria, which it said could help detect fraud.

The vast majority of commenters objected. ONC noted that most of them did not answer its reasoning and instead explained why the criteria still mattered. Providers said certification is how they know a product has baseline security, and they worried that developers would strip out features to save money. ONC wrote that the concern was most acute for small and rural providers with limited resources to negotiate for those features.

ONC finalized no part of the proposal, not even the fallback. It said it will keep considering how to handle privacy and security in a future rule, which could remove or update some of the criteria. Commenters also pointed out that the audit standard behind the auditing criteria, ASTM E2147-18, is out of date. That matters to anyone relying on certified audit logs, the subject of our piece on tamper-evident access logs.

C-CDA exchange gets until 2030

The transitions of care criterion in § 170.315(b)(1) tests whether certified EHRs can create a C-CDA summary of care and send it by Direct messaging when a patient moves between settings. ONC proposed to strip it down by January 1, 2027, leaving only the ability to receive and validate C-CDA documents, as a step toward FHIR-based exchange.

Most commenters said that was too soon. They described long-term care and behavioral health settings as heavily dependent on C-CDA documents. They also said no mature FHIR replacement exists for transitions of care. ONC kept its direction but moved the date. Most of the document exchange requirements will now expire on January 1, 2030. The requirement to validate incoming C-CDA documents continues past that date. ONC also replaced references to an expired version of the C-CDA standards with the current one.

CMS is moving on a similar clock for hospitals. Its fiscal 2027 inpatient rule removes the 2 electronic referral loop measures from the Medicare Promoting Interoperability Program starting with the 2029 reporting period, according to the HTI-5 rule. As of the rule’s publication, CMS had not proposed the same change for clinicians in MIPS.

A related criterion survived in a different form. ONC had proposed to remove clinical information reconciliation and incorporation, § 170.315(b)(2), which lets a clinician reconcile incoming clinical lists, such as medications, with the patient’s chart. It now remains as a functional criterion. Developers must still show that the capability works in at least one workflow, but they no longer have to use the C-CDA standards to do it.

Safety-enhanced design becomes an attestation

The safety-enhanced design criterion, § 170.315(g)(3), requires developers to apply user-centered design to a defined set of functions, such as computerized order entry and decision support. ONC proposed to remove it. Commenters said the criterion was created after real patient safety incidents and that usability testing may matter more as AI features enter the EHR.

ONC agreed that the criterion serves a safety function and kept it as an attestation. Developers still have to apply user-centered design and name the process they used. They no longer have to recruit participants for usability testing or submit the results. ONC estimates net savings of $19.2 million to $27.8 million a year across 366 products.

Public health and design criteria stay

The public health criteria fared better than proposed. ONC kept the criterion for reporting to cancer registries. It also kept the criterion for national health care surveys. The electronic case reporting criterion stays as it was, with developers free to certify using either CDA or FHIR standards, after ONC dropped a plan to make it a functional requirement. Antimicrobial use and resistance reporting became functional, which ONC said better fits reporting to the National Healthcare Safety Network.

The quality management system criterion, § 170.315(g)(4), stays as a baseline quality expectation. The accessibility-centered design criterion, § 170.315(g)(5), stays as well. The implantable device list criterion stays because it supports a CMS measure on unique device identifiers.

Decision support loses its model cards

The decision support interventions criterion, § 170.315(b)(11), was HTI-1’s answer to AI in the EHR. The HTI-1 rule, issued in January 2024, required developers to make source attributes available for the decision support tools they supply, with the most detailed disclosures for predictive tools. These are model card facts, such as how a model was trained and how it performs across patient groups. ONC’s own description compares them to nutrition labels. Developers also had to apply risk management practices to their predictive tools.

HTI-5 removes the source attribute requirements in § 170.315(b)(11)(iv) and (v). It also drops the risk management requirement in § 170.315(b)(11)(vi), along with the duty in § 170.402(b)(4) to keep that information current. Support for predictive tools now covers a narrower set of data rather than any USCDI data element.

Some of the criterion survives. Developers must still let a limited set of users select which decision support tools to activate. They must also keep a feedback function for evidence-based tools, which lets providers export data on how the tools perform in practice.

ONC’s case rests on use. It said developers reported that most clinicians lack the time or technical background to engage with source attributes during care. It also said it found no evidence, in peer-reviewed publications or the trade press, that users relied on the requirements or that they improved patient care. ONC estimates the change saves between $7.4 million and $53.3 million a year across the 251 products certified to the criterion.

Opposition was broad. Many commenters said the requirements had been in effect for less than 2 years, too short a time to judge them. Others argued that the real readers of a model card are not clinicians at the bedside but the governance teams deciding whether to deploy a tool. Several warned that the work of vetting AI tools would shift to providers, and that smaller organizations without data science staff would struggle most. Over half of the commenters who raised transparency concerns wanted the requirements kept.

ONC was not persuaded. It encouraged providers to ask their developers for the same information before deploying a tool. It reminded them of 45 CFR § 92.210, the Section 1557 rule that requires covered entities to identify and reduce discrimination risks in patient care decision support tools, which our February piece covers. It also described the change as leaving oversight of these tools to other parts of HHS, such as the Food and Drug Administration, whose 2026 decision support guidance we reviewed in April.

ONC left one opening. It said it will consider reinstating source attribute requirements for evidence-based tools, which it acknowledged had been part of the program for years and may not burden developers much.

The rule’s language about AI is new as well. It refers to AI as super intelligence, or SI, citing an executive order issued on September 29, 2026. It names the Model Context Protocol, a standard for supplying context to large language models, as an example of newer standards that could be paired with FHIR. The change thins the federal side of health AI regulation, which our September review found was already the thinner of the 2 rulebooks.

Testing and reporting narrow to the APIs

Real world testing is the condition of certification, required by the 21st Century Cures Act, under which developers show that certified products work for interoperability in the settings where they are sold. Until now, developers filed a testing plan each year and then reported the results.

HTI-5 ends the plans. Full results reporting now applies only to the API criteria. Those are the standardized API for patient and population services in § 170.315(g)(10) and the 3 prior authorization API criteria that HTI-4 added in § 170.315(g)(31) through (33). The duty to test the other covered criteria remains, because the Cures Act requires real world testing. ONC said the changes follow an enforcement discretion notice it issued on June 30, 2025. It estimates the savings at $33.6 million a year.

Most commenters opposed the change. They argued that public testing plans and results help buyers judge whether a product works, especially smaller providers and public health agencies. ONC answered that test results are only one of many factors in purchasing decisions. It added that certification testing and ONC’s direct review of certified products still provide oversight.

The remaining reporting falls on criteria with near-term stakes. Payers regulated by CMS must have their prior authorization APIs running in January 2027, as our October 6 analysis described. The provider-side criteria that connect to those APIs are among the few that still require full testing reports.

The Insights condition, which HTI-1 created to collect data on how certified technology is used, loses 5 of its 7 measures. The removed measures include both immunization measures and the measure of individuals’ access to their records. ONC had proposed to cut 6. It kept the bulk FHIR measure after commenters argued that the apps measure could not substitute for it, and it cited published reports of poor bulk FHIR performance. Reporting on that measure will now start in July 2029 instead of July 2028. Reporting on the use of FHIR in apps will start in July 2027.

A smaller change reaches the certification bodies. They no longer have to report which version of test data a product was tested with, or whether the developer altered it. ONC said most developers use the test data it supplies, so the field told the public little. That finding bears on the case our October 27 piece made for shipping test data with every implementation guide.

What the rule leaves for later

The rule leaves all 7 HTI-4 criteria unchanged. Those include the 3 electronic prior authorization API criteria, which our June analysis found certify only the provider half of the exchange.

The proposal’s information blocking changes are absent. HTI-5 amends only parts 170 and 172 of title 45, and ONC says comments on proposals it did not address remain under review. Those proposals would make clear that automated access by AI systems counts as access under the information blocking rules. They would also remove the manner exception for the Trusted Exchange Framework and Common Agreement (TEFCA), as our September analysis described.

The only change to the TEFCA regulations is a name. An HHS reorganization published on April 1, 2026, removed the title of Assistant Secretary for Technology Policy (ASTP) and restored the Office of the National Coordinator as a singly titled office. The rule strips ASTP references from part 172 and from part 170. Earlier Rounds pieces used ASTP, the office’s name at the time.

ONC also points to a planned rulemaking on FHIR-based exchange, listed on the federal regulatory agenda under Regulation Identifier Number 0955-AA10. It says the next API criteria should move beyond read-only interactions. It also wants better API performance and more data for uses such as public health reporting.

What the savings estimate counts

ONC puts the present value of the rule’s savings at $1.55 billion in 2024 dollars, discounted at 7%. That works out to $108.1 million a year, counted from 2027 onward with no end date. The only cost ONC counts is $1.29 million for an estimated 616 people to read the rule.

The proposed rule had estimated $1.53 billion on the same basis, which HHS announced in December 2025. The final estimate is slightly higher even though the rule removes 20 fewer criteria. The impact analysis does not reconcile the 2 figures. It does say that most of the savings come from 3 requirements it revised rather than removed, which may explain why dropping fewer criteria barely moved the total.

Per developer, ONC projects savings of $300,000 to $400,000 a year on average, which it likens to the cost of 2 data engineers. As of April 1, 2026, 466 developers had certified 601 products. ONC estimates that about 86% of those developers are small businesses.

The estimate covers only developer compliance costs. The rule concedes that ONC has little data on how the revisions will affect the availability or function of certified products for the hospitals and practices that use them.

Commenters challenged the estimate from 2 directions. Some said it ignored costs that would shift to providers and health information exchanges once certification no longer guarantees a function. Others said the savings were overstated, because most certifications are routine maintenance of features already built. ONC agreed that most certifications are recertifications. It said it had modeled maintenance as a fraction of the original development cost, 15% on average for the removed criteria.

The concern with the most direct effect on providers is price. Commenters warned that functions dropped from certification could return as optional modules or premium features. ONC answered that customers were likely already paying for those functions inside their license fees, and that separate pricing would at least make the cost visible. It also said that states remain free to set their own requirements.

What to watch in the rest of 2026

• December 28. Most of the rule will take effect. Watch how certification bodies update product listings for the removed criteria.
• Vendor pricing. Watch whether developers start charging separately for functions that are no longer certified.
• CMS and clinicians. Watch whether the 2027 physician fee schedule final rule removes the same criteria from the MIPS definition of certified EHR technology.
• Information blocking. Watch for a separate final rule on the automated access proposals and the TEFCA manner exception.
• The FHIR rule. Watch for the proposed rule on FHIR-based exchange that ONC has placed on the regulatory agenda.
• AI transparency. Watch whether industry frameworks fill the gap left by model cards, and whether ONC proposes to bring back source attributes for evidence-based tools.

About this analysis

Method. We read the final rule as published in the Federal Register on October 28, 2026, from the preamble through the amended regulation text. We compared its decisions with the proposed rule published on December 29, 2025. Counts of criteria come from the final rule’s Table 1 and its amendatory instructions. Descriptions of public comments are ONC’s own summaries, because the comments themselves were not reviewed.

Data notes. Dollar figures are ONC’s estimates of what developers would have spent meeting the removed or revised requirements, in 2024 dollars. They are projections, not observed savings. They also leave out costs that may shift to providers. Ranges are ONC’s lower and upper bounds. Product and developer counts are as of April 1, 2026, from ONC’s certified product list.

Sources. ONC final rule in the Federal Register (October 2026). ONC proposed rule in the Federal Register (December 2025). HHS release on the proposed rule (December 2025).

Frequently asked questions

What is the HTI-5 final rule?

It is a deregulatory rule from the Office of the National Coordinator for Health Information Technology that changes the federal certification program for health IT. Published on October 28, 2026, it removes 14 certification criteria and revises 7. ONC had proposed to remove 34.

When do the HTI-5 changes take effect?

Most of the rule will take effect on December 28, 2026. The removal of 7 criteria waits until January 1, 2027. Most document exchange requirements in the transitions of care criterion will expire on January 1, 2030.

Does a removed criterion mean an EHR feature goes away?

Not necessarily. Removal ends the certification requirement, not the software. ONC expects developers to keep functions their customers use, though commenters warned that some could be priced separately.

What happened to AI model cards?

The decision support interventions criterion no longer requires developers to provide source attributes for predictive tools or to apply risk management practices to them. ONC said it found no evidence that the requirements improved care. Providers can still ask developers for the information.

Did HTI-5 change prior authorization certification?

No. The 3 electronic prior authorization API criteria added by HTI-4 are unchanged. They are among the few criteria that still require full real world testing reports.

Did the rule change information blocking?

No. The proposal’s information blocking changes are not in the final rule. ONC says comments on proposals it did not address remain under review.