The U.S. Department of Health and Human Services (HHS) on Oct. 26 finalized a deregulatory rule that removes 14 of the 60 criteria used to certify electronic health record (EHR) software and revises seven others, a scaled-back version of a proposal that would have cut 34. Regulators put the savings for health IT developers at $1.55 billion in net present value and said the changes clear the way for a certification program built around FHIR-based application programming interfaces (APIs).
The rule, titled “Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity” and known as HTI-5, was issued by the Office of the National Coordinator for Health Information Technology (ONC), according to the agency’s rule page. ONC says it reduces burden on developers by streamlining the ONC Health IT Certification Program, in line with Executive Order 14192 on deregulation.
What was cut and what was kept
According to an ONC fact sheet, 39 criteria remain unchanged, including the electronic prior authorization and real-time prescription benefit criteria adopted in the earlier HTI-4 rule. The removed and revised criteria are described as “long-standing, functionality-oriented and document-based,” covering capabilities ONC says are already well established in the market or impede innovation.
A second fact sheet lists the removals: the legacy clinical decision support criterion, family health history, two security-tag criteria for summary-of-care documents, care plan, a clinical quality measure filter, patient health information capture, automated numerator recording and automated measure calculation, a C-CDA creation performance criterion, two older application-access criteria, and two Direct Project messaging criteria. Some removals take effect on the rule’s effective date and others on Jan. 1, 2027. Among the seven revised criteria, the transitions-of-care change takes effect Jan. 1, 2030, which HIT Consultant reported extends a sunset previously set for 2027.
The rule also drops requirements that EHR developers display “model cards” or source attributes for predictive decision support tools and carry out intervention risk management, according to HIT Consultant and Healthcare Dive. Developers will no longer have to supply training, performance and validation information for AI, machine learning and predictive tools, Healthcare Dive reported. Real-world testing requirements were scaled back, including an end to annual testing-plan submissions, and reporting under the Insights condition was reduced, although a measure on use of FHIR bulk data access was retained, per the ONC fact sheet.
Several proposals did not survive. The 13 privacy and security certification criteria that ONC had proposed to eliminate, including the requirement that certified software offer at least one capability supporting HIPAA compliance, were kept, as was the implantable device list criterion, HIT Consultant reported. Proposed changes to the information blocking rules, including revising the definitions of “access” and “use” to cover autonomous AI systems, were not finalized and remain under consideration, according to Healthcare Dive.
“Through HTI-5, we have taken decisive action to significantly lower the administrative compliance burden for developers,” Tom Keane, the national coordinator for health IT, said in the HHS announcement, as quoted by both outlets.
Why it matters
Certification criteria define what an EHR must be able to do before it can be sold to providers who take part in federal programs, so removing 14 of them changes the baseline that hospitals and practices can expect from their software. ONC’s argument is that the dropped criteria describe functions the market already delivers and that effort is better spent on API-based interoperability; HIT Consultant reported that ONC described modernizing certification around FHIR APIs as a prerequisite for what it called “super-intelligence applications,” and cited the Model Context Protocol used by AI agents.
The AI changes cut the other way for anyone relying on federal transparency rules. The model card requirement had obliged EHR vendors to disclose how predictive tools were trained and validated; its removal takes that disclosure out of the certification program. Privacy and security criteria, all 13 of which the proposal would have eliminated, stay in place, according to HIT Consultant.
What to watch
Many provisions take effect 60 days after publication in the Federal Register, with others on Jan. 1, Healthcare Dive reported. ONC scheduled an information session on the rule for Oct. 29. The information blocking proposals and any FHIR-first API requirements would need separate rulemaking.
The caveats
The $1.55 billion figure is ONC’s own estimate, calculated as $108.1 million in annualized net savings discounted at 7 percent from 2027 in perpetuity, according to figures reported by HIT Consultant; it is a projection of developer compliance costs, not a measured saving, and Healthcare Dive rounds it to $1.5 billion. The ONC pages cited here are fact sheets that the agency says are not legal documents, and the effective date for several criteria is given only as “the final rule’s effective date.” Keane’s remarks are as reported by Healthcare Dive and HIT Consultant.
This article is for general information and does not replace advice from a qualified clinician. Corrections: email the editor using the address on the Contact page.
