The Department of Health and Human Services finalized a rule on October 26 that removes 14 of the 60 certification criteria in its health information technology program, revises 7 others, and leaves 39 unchanged. The rule, called HTI-5, was published in the Federal Register on October 28. It is the largest deregulation of the program since the certification criteria were created.
The certification program is the government's seal of approval for electronic health record software. A vendor that wants to sell to hospitals participating in federal programs generally needs its product certified against the criteria in 45 CFR Part 170. The criteria are not a product specification in the ordinary sense. They are a common language that lets a hospital compare vendors and lets the government know what a certified product can do. The program grew out of the 2009 HITECH Act and was reshaped by the 21st Century Cures Act in 2016.
The headline number is the savings. HHS projects $1.55 billion in present value and $108.1 million in annualized net savings, measured in 2024 dollars at a 7 percent discount rate. The department also says the rule eliminates the AI model card requirement, narrows real-world testing, and reduces the reporting burden for the Insights Condition.
Those changes are real. They also leave a question that the rule does not answer. If the government stops checking for certain capabilities, who checks? The answer, increasingly, will be the hospitals and clinics that buy the software.
The final cuts are narrower than the proposal
ONC proposed removing 34 criteria. It finalized 14. The difference is the result of comment pressure, mostly from patient groups, clinicians, and vendors who argued that some criteria were doing work the market would not replace.
The agency kept the privacy and security criteria. It kept the quality management system requirements. It kept the accessibility-centered design requirements. Those decisions matter because they define the floor. A certified product still has to protect data, follow a quality process, and meet accessibility standards. The rule cuts the reporting and documentation around those duties, not the duties themselves.
The criteria that were removed tend to be the ones that describe a specific workflow or a specific document format. The criteria that were kept tend to be the ones that describe a safety or security property. That is a coherent theory of deregulation: keep the guardrails, cut the checklists.
The AI model card is gone
The most consequential removal is the AI model card requirement in the decision support interventions criterion. The rule drops the source-attribute support and access and modification requirements in section 170.315(b)(11)(iv) and (v). Those provisions required developers to document how an AI model was trained, what data it used, and how its performance could be checked.
A model card typically records the training data, the intended use, the performance metrics, and the known limitations of a model. It is not a guarantee that the model works. It is a disclosure that lets a buyer ask better questions. The certification requirement made that disclosure a condition of selling to hospitals in federal programs.
The model card was never a perfect transparency tool. It was a standardized disclosure, not an audit. But it gave buyers a common document to compare, and it gave regulators a hook to ask whether a vendor had tested its model. Without it, the information may still be available in contracts and sales materials, but it is no longer a certification condition.
That shift puts the burden on procurement. A hospital that wants to know how an AI triage tool was trained will have to ask for the evidence and write the requirement into its contract. Large systems have the staff to do that. Small rural hospitals may not. The rule does not create a new obligation to replace the old one, so the practical effect depends on how buyers behave.
Real-world testing loses its paperwork
The rule also narrows the real-world testing condition. It eliminates the requirement to submit annual testing plans and results, and it removes the use of the standards version advancement process for that condition. The testing itself does not disappear from the program, but the reporting around it does.
Real-world testing was introduced to answer a simple question: does the software work outside the lab? The answer was supposed to come from live deployments, not from a vendor's own test suite. Removing the plan and results submission reduces the paperwork, but it also reduces the public record of what was tested and what failed.
The rule does not say that real-world testing is no longer expected. It says the government will not collect the plans and results. The testing may still happen inside vendors, and buyers may still ask for it. The difference is that the public record will depend on what vendors choose to publish.
The Insights Condition gets a similar treatment. Most of its measures are removed or descoped. The condition was designed to give the government a view of how certified products performed in the field. The remaining measures are a smaller sample. The agency says the change reduces burden. The tradeoff is less visibility into how the products work in practice.
What the rule leaves standing
The rule does not touch the information blocking provisions, at least not yet. ONC proposed changes to those rules, but the final rule leaves them out. The agency says comments are still under review and may be addressed in a future rulemaking.
The rule keeps the FHIR-based API requirements and resets the certification program's scope around them. That is a bet that the next generation of interoperability will run through standardized APIs rather than through document-based exchanges. The rule delays the removal of the document-based transitions of care criteria until January 1, 2030, which gives the industry time to move.
If the FHIR API becomes the primary route, the criteria that remain are mostly about the API's conformance and security. Vendors that built their interoperability story around documents will have to rebuild it around the API. That is the intended direction of the rule, and it is the part of the deregulation with the clearest technical logic.
The effective dates are staggered. Most provisions take effect December 28, 2026. Three amendatory instructions take effect January 1, 2027. One criterion, the document-based transitions of care removal, is pushed to January 1, 2030. That schedule gives vendors a short window to update their products and a longer window to retire the older exchange methods.
Information blocking is deferred
The decision to leave information blocking out of the final rule is the most important thing the rule does not do. Information blocking is the set of practices that prevent patients and providers from accessing health data. It is the enforcement side of interoperability, and it is where the government can act most directly on vendors.
ONC's proposal would have changed the definition of information blocking and the exceptions. The final rule does not adopt those changes. The agency says it is still considering the comments. That leaves the current rules in place, which is a relief for vendors who feared a broader definition and a disappointment for patient advocates who wanted a tighter one.
The deferral also means the deregulatory story is incomplete. The certification criteria are a small part of the interoperability problem. The larger part is whether data moves when a patient asks for it. The rule cuts the paperwork on the certification side without changing the enforcement on the information blocking side.
The savings and the dates
The $1.55 billion present value estimate is based on the paperwork the rule removes. The agency says implementation costs are zero and reviewer costs are about $1.3 million for 616 reviewers. Those numbers are projections, not audited results. They depend on how many vendors and providers change their behavior.
The comment record is likely to be the main evidence of what the agency heard. ONC received a large number of comments on the proposal, and the difference between 34 proposed removals and 14 final ones shows that some of them changed the outcome. The final rule does not explain each decision in detail, so buyers who want to know why a criterion survived will have to read the preamble and the response to comments.
The savings will be real for vendors that no longer have to produce model cards, testing plans, and Insights reports. The savings for providers are less direct. A hospital does not file certification paperwork. It buys products that do. The provider's cost is in the procurement and verification work that the rule now leaves to the buyer.
That is the trade the rule makes. The government certifies fewer things and asks fewer questions. The market is expected to fill the gap. For large buyers with market power, that may work. For small buyers with limited staff, the gap may become an unverified assumption.
The rural hospital problem is the clearest example. A small hospital may have one IT director and no procurement lawyer. It buys the software its vendor recommends, and it relies on certification as evidence that the product meets a federal standard. If the standard no longer covers a capability the hospital needs, the hospital may not know until the product fails in practice. The rule does not require the vendor to volunteer that information.
The rule takes effect at the end of December, which means the first certification cycle under the new criteria will begin in 2027. The vendors that already have products in the pipeline will have to decide which criteria they still want to meet. The buyers will have to decide what they still want to require. The rule does not settle that question. It moves it.
Vendors also face a marketing problem. A product that once advertised its certified status against a full checklist will now have fewer badges to display. Certification still matters, but it covers less. Vendors that want to differentiate on safety or transparency will have to do it outside the certification mark, with their own documentation and their own contracts.
Primary sources
- HHS, press release on the HTI-5 final rule, October 26, 2026. healthit.gov
- ONC, HTI-5 final rule page and summary. healthit.gov
- Federal Register, Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, 91 FR 67916, October 28, 2026. govinfo.gov
- AHA News, summary of the final rule and the criteria changes. ahadata.com