The federal health technology certification programme is about to get smaller. On 26 October 2026, the Office of the National Coordinator for Health Information Technology (ONC) at the U.S. Department of Health and Human Services (HHS) released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) final rule. The rule revises the ONC Health IT Certification Program, the scheme under which developers certify that their health IT modules meet federal functional requirements known as certification criteria. HHS Secretary Robert F. Kennedy, Jr. said: “American doctors and patients need better technology, not more Washington paperwork.” The agency presents the rule as part of the administration's deregulation drive, citing Executive Orders 14192 and 14267, and projects that it will save more than $1.5 billion in regulatory costs.
What Changed in the Final Rule
The headline numbers show how far the final rule retreated from the draft. In December 2025 ONC proposed eliminating 34 of the programme's 60 certification criteria. The final rule instead removes 14 criteria and revises seven, leaving 39 untouched. The most consequential removal concerns decision support interventions: the rule drops the AI model-card requirements that HTI-1 had introduced, including source-attribute transparency and risk-management duties for predictive tools built into certified health IT. Those requirements were designed to give healthcare organisations information about the algorithms inside their systems. The rule also ends annual Real World Testing plan submissions, scales back reporting under the Insights condition, and removes or revises requirements covering care coordination, patient engagement and some health data exchange capabilities. A clinical decision support criterion that expired on 1 January 2025 is formally removed, and conforming edits are made to the Assurances, application programming interfaces (APIs) and Attestations conditions of certification.
What Was Kept
The final rule keeps the parts of the programme that drew the strongest defence in public comments. All privacy and security certification criteria are retained, along with quality management system standards and accessibility-centred design requirements. Criteria adopted in the earlier HTI-4 rule, covering electronic prior authorisation and real-time prescription benefit tools, are also unchanged. ONC describes the direction of travel as a shift toward Fast Healthcare Interoperability Resources (FHIR)-based APIs, the modern standard for exchanging electronic health information, and away from older document-based exchange. The deadline for removing document-based transitions-of-care requirements was extended to 1 January 2030 to give organisations a gradual transition to FHIR-based exchange, rather than an abrupt cutover.
When the Changes Take Effect
The rule is scheduled for publication in the Federal Register on 28 October 2026. Most provisions take effect 60 days after publication, while certain changes take effect on 1 January 2027. The removal of document-based exchange and Direct messaging requirements from the transitions-of-care criterion is the long tail, taking effect on 1 January 2030. Health IT developers will therefore face a staggered timetable rather than a single compliance date, and healthcare organisations should expect vendors to phase in product changes across 2027 rather than all at once.
What Was Not Decided
One major piece of the draft rule is missing from the final version. ONC's December 2025 proposal included changes to information blocking rules, including definitions of access and use that would have allowed autonomous AI systems to retrieve and share health data, and revisions to several information blocking exceptions. None of those proposals was finalised. HHS said comments on them remain under consideration, and ONC officials have pointed to a future HTI-6 rule covering standards adoption, expanded API uses and information blocking. National Coordinator for Health IT Tom Keane, M.D., told reporters that the agency's commitment to information blocking enforcement has not changed, and that it is working with the Office of Inspector General to hold organisations that block patient information accountable.
What This Means for Health IT Teams
For clinics and hospitals, HTI-5 matters less as a paperwork exercise than as a procurement signal. HHS argues that developers will redirect the money and staff time freed by lighter certification duties toward improving the technology clinicians and patients actually use. If that happens, organisations could see faster product improvements and lower vendor costs over time. The model-card removal cuts the other way: without a federal transparency requirement, a clinic evaluating a predictive scheduling, triage or documentation tool may no longer receive standardised information about the model's data sources, limitations and risks from the certification process itself. Procurement teams will need to ask vendors directly for that information and record what they receive, rather than assuming certification answers the question. Commenters who opposed the removal warned, as reported by law firm Hooper Lundy, that it could shift evaluation, governance and liability burdens onto providers and health systems, and could make it harder to assess bias and performance, a concern likely to weigh most heavily on smaller organisations without dedicated informatics staff.
Analysis: Less Paperwork, but a Transparency Trade-Off
HTI-5 reads as a compromise between two pressures that have pulled health IT policy in opposite directions: the push to cut compliance costs, and the push to make clinical AI explainable. The administration chose the first, but only part-way, keeping privacy, security and accessibility rules intact suggests ONC heard the argument that certification provides a baseline buyers rely on, even while it discarded the newer AI transparency layer. The durable signal for healthcare organisations is the FHIR direction: ONC is steering the programme toward API-based exchange and has flagged further standards and API proposals. For a clinic choosing a patient portal or EHR add-on today, the practical questions are therefore about interoperability and evidence, not certification badges alone: does the product exchange data through modern APIs, what does the vendor disclose about its AI features, and what happens to that disclosure when the federal requirement no longer compels it? Those questions will matter more, not less, after HTI-5.
Clinics reviewing their patient portal or health IT roadmap can explore MedClinicX's AI patient portal and related tools at https://medclinicx.com/solutions/ai-patient-portal, or request a demonstration via https://medclinicx.com/demo.
Sources and References
- U.S. Department of Health and Human Services, HHS Finalizes HTI-5 Deregulatory Rule to Encourage Innovation and Reduce Health IT Certification Program Compliance Costs, 26 October 2026: https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html
- Becker's Hospital Review, HHS finalizes health IT rule projected to save $1.5B, 26 October 2026: https://www.beckershospitalreview.com/healthcare-information-technology/digital-health/hhs-finalizes-health-it-rule-projected-to-save-1-5b/
- Fierce Healthcare, HHS finalizes health IT rule projected to slash $1.5B in costs, 26 October 2026: https://www.fiercehealthcare.com/regulatory/hhs-finalizes-hti-5-rule-streamline-onc-health-it-certification-and-cut-compliance-costs
- Hooper Lundy & Bookman, HHS Finalizes HTI-5 Deregulatory Rule, 26 October 2026: https://hooperlundy.com/hhs-finalizes-hti-5-deregulatory-rule/
Reporting based on the sources above, accessed 27 October 2026. The HHS announcement was read directly in full, and the Becker's, Fierce Healthcare and Hooper Lundy reports were read directly in full and cross-checked against it. MedClinicX did not conduct original reporting or interviews for this article. Corrections: contact us via https://medclinicx.com/contact