US Health IT Reset: HTI-5 Cuts Certification Burden and Recasts AI Governance

The US Department of Health and Human Services has finalised a major overhaul of its health IT certification programme. Fourteen criteria will be removed and seven revised, with the agency estimating US$1.55 billion in present-value compliance savings. The shift creates room for faster product development, but it also raises new questions about AI transparency, hospital procurement and the next phase of interoperability.

Published 1 November 2026 | Regulatory development: HTI-5 Final Rule, published in the Federal Register on 28 October 2026

The United States has taken a consequential step in reshaping the regulatory environment for electronic health records, clinical software and digital health infrastructure. On 28 October 2026, the Department of Health and Human Services (HHS), through the Office of the National Coordinator for Health Information Technology (ONC), published the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity final rule, commonly referred to as HTI-5.

HTI-5 removes 14 of the programme's 60 certification criteria, revises seven and retains 39 unchanged. HHS estimates US$1.55 billion in present-value savings for developers of certified health IT, equivalent to annualised net savings of US$108.1 million in 2024 dollars at a 7% discount rate. The rule takes effect on 28 December 2026, with selected changes on 1 January 2027 and a transitions-of-care change delayed until 1 January 2030.

For health technology companies, the immediate message is lower administrative burden and a stronger policy direction toward Fast Healthcare Interoperability Resources (FHIR)-based application programming interfaces (APIs). Hospitals face a more complex adjustment: some AI decision-support transparency disclosures are being retired from certification, making vendor evidence, contracts and internal governance more important.

HTI-5 is not a general deregulation of medical technology. It is a targeted reset of one US health IT certification framework—a distinction that matters to software developers, medical-device companies, hospital groups, investors and international suppliers.

What Changed

The ONC Certification Program sets technical and functional criteria for health IT modules that developers choose to certify. Although voluntary, certification has commercial relevance because certified products support participation in certain federal programmes and can influence procurement. Testing is conducted through ONC-authorised laboratories and certification bodies, and products are listed in the Certified Health IT Product List.

The final rule is narrower than the December 2025 proposal, which contemplated removing 34 criteria and revising seven. After public comments, HHS retained more requirements where stakeholders raised concerns about security, patient access, public health reporting and the readiness of replacement standards.

Where Burden Falls

The changes target functionality-oriented and document-based requirements that ONC considers widely established, less useful as certification drivers or better addressed through newer standards. Removed criteria cover clinical decision support, family health history, selected security tags for care summaries, care plans, some quality-measure functions, patient health information capture, automated measure recording and calculation, consolidated clinical document creation, selected application-access functions and legacy Direct Project exchange.

Seven criteria are revised: transitions of care; clinical information reconciliation; decision support interventions; clinical quality-measure reporting; patient view-download-transmit functionality; antimicrobial-use and resistance reporting; and safety-enhanced design. Vendors must map each certified module to the precise revised text and effective date rather than simply switching off legacy features.

Ongoing reporting is also narrowed. Real World Testing will focus on API-related certification criteria rather than the broader set of functions previously covered. Several measures under the Insights condition are removed, but FHIR bulk-data access reporting is retained and moved to July 2029 to give developers time to prepare.

The changes matter most to developers maintaining multiple certified modules, particularly smaller firms with lean regulatory teams. Reduced testing and reporting can free engineering capacity, although the benefit will vary by product portfolio, certification scope and existing compliance maturity.

FHIR Becomes Central

The final rule is also a directional statement about the architecture of US health data exchange. ONC intends to prioritise FHIR-based APIs that improve automation and performance, move beyond read-only interactions and expand the data available for clinical efficiency, patient-centred care and timely reporting. The agency describes HTI-5 as a reset of the certification programme's regulatory scope, creating a foundation for future API requirements.

FHIR is a standard for representing and exchanging healthcare information through modern web-based interfaces. It can support modular software and more flexible connections among electronic health records, payers, laboratories, pharmacies and care-management systems. Consistent APIs can reduce bespoke interfaces and help hospitals connect specialist applications without replacing core record systems.

Yet the transition is not instantaneous. The final rule delays the removal of selected Consolidated Clinical Document Architecture (C-CDA) and Direct exchange requirements for transitions of care until 1 January 2030. ONC acknowledged stakeholder concerns that FHIR-based replacements are not yet mature or widely adopted in every care setting. Smaller, rural, behavioural-health, long-term and post-acute care providers may be more dependent on existing document exchange workflows. The extension is therefore a recognition that standards migration requires operational readiness, not just a regulatory deadline.

Vendors must plan for hybrid environments: maintaining selected legacy pathways while investing in FHIR APIs, data mapping, terminology services, identity management, consent handling and conformance testing. Treating FHIR as a superficial connector rather than core architecture risks future competitiveness.

AI Transparency Debate

One of the most sensitive changes concerns predictive clinical decision-support interventions. The previous certification criterion included source-attribute disclosures often called AI model cards, covering intended use, training and source information, limitations and performance across patient groups. HTI-5 removes the source-attribute support, access and modification requirements and related intervention risk-management requirements under this specific ONC criterion.

ONC says it found limited evidence that clinicians used the mandated information in routine workflows or that certification disclosures had demonstrably improved care. It also cited developer concerns about burden. The agency encourages healthcare organisations to request intended use, provenance, training data, limitations, performance and known-risk information directly from vendors.

Many commenters opposed the change, arguing that it could shift evaluation and governance work to hospitals and make it harder to assess bias, subgroup performance, appropriateness and vendor influence. ONC records these concerns but concludes that the revised criterion provides sufficient assurance; it may reconsider similar transparency requirements in future rulemaking.

For buyers, the procurement conversation changes. A vendor may no longer need to meet the same ONC disclosure mechanism for affected predictive decision-support functionality, but transparency remains commercially important. Hospitals should request evidence on intended use, validation populations, subgroup performance, data drift, updates, human oversight, escalation and incident reporting.

Vendors can turn this into a product-assurance differentiator. Model documentation, clinical validation summaries, implementation guidance and post-deployment monitoring should be accessible to clinical, IT, legal, risk and procurement teams.

What Remains

HHS did not finalise its proposal to remove the programme's privacy and security certification criteria. These were retained after stakeholders argued they provide a useful baseline for audit controls and access management, particularly for providers with limited technical resources. Selected public-health reporting and patient-access capabilities were also retained where replacement standards were not ready.

ONC certification does not guarantee compliance with HIPAA's Privacy, Security or Breach Notification Rules. Certified capabilities do not replace the separate obligations of covered entities and business associates. Healthcare organisations must continue risk analysis, vendor oversight, system security and control testing.

HTI-5 also did not finalise proposed changes to information-blocking definitions and exceptions; HHS says those comments remain under consideration. Existing information-blocking rules remain in place. Vendors should not interpret HTI-5 as permission to restrict lawful access, exchange or use of electronic health information.

Market Implications

For software developers

Developers should map each certified module to criteria removed, revised or retained; confirm the applicable dates; and update testing, documentation and release plans. Redirect available capacity toward FHIR capability, API performance, workflow integration, cybersecurity and product improvements rather than assuming savings will automatically flow to margins.

Lower certification overhead may help specialist entrants, but it does not remove enterprise sales barriers. Hospitals will still assess integration, reliability, security, service levels, clinical value and vendor financial strength. New entrants need a credible implementation proposition alongside regulatory readiness.

For hospitals and health systems

Providers should review procurement templates and vendor contracts before the effective dates. Where certification criteria are removed, essential expectations can be preserved contractually. AI agreements should address intended use, validation, subgroup performance, limitations, model updates, monitoring and safety incidents, proportionate to clinical risk.

Hospitals should inventory C-CDA and Direct-dependent interfaces now. The 2030 date is time for a staged migration, not a reason to postpone FHIR planning. Prioritise high-volume pathways and clinically important workflows.

For medical-device companies

Medical-device manufacturers increasingly compete through connected software and AI-enabled workflows. HTI-5 may affect integration with certified health IT, but it does not confer FDA clearance or remove FDA obligations for software that qualifies as a device. Manufacturers must separate the device's regulatory pathway from the interoperability requirements of the hospital IT environment.

Imaging, monitoring, diagnostics and decision-support suppliers need an integration strategy combining appropriate FDA status, clinical evidence, secure exchange and clear deployment responsibilities. ONC certification is not a substitute for FDA classification or product-specific review.

For international suppliers

International suppliers may find opportunities in FHIR-enabled modules, workflow automation, data quality, patient engagement, analytics and integration services. US entry still requires buyer validation, channel partners, viable implementation economics and clarity on the certifications or approvals relevant to the product category.

For Indian health IT and medical-technology companies, the change may improve the economics of developing interoperable products for US customers, but local market validation remains essential. Mapping target buyers, incumbent platforms, procurement criteria, integration partners and pricing can distinguish technical feasibility from commercial viability. Market intelligence and market-entry research can support that assessment.

Implementation Timeline

Executive Action Plan

Executives should turn the rule into a controlled product and commercial workstream. Six actions are priorities:

1. Map the portfolio. Create a register of every certified module, its criteria, certification body, customer deployment and applicable transition date. Do not rely on a single corporate-level interpretation of the rule.
2. Reallocate engineering capacity. Quantify the testing and reporting work that can be retired, then prioritise FHIR APIs, interoperability performance, integration tooling and product usability. Avoid treating the HHS cost estimate as a guaranteed saving for an individual vendor.
3. Strengthen AI evidence. Maintain voluntary model documentation even where the ONC certification requirement is removed. Make intended use, validation, limitations, subgroup performance and monitoring practices available to customers in a consistent format.
4. Refresh procurement controls. Hospitals should update vendor questionnaires and contract schedules so that critical privacy, security, clinical safety and AI assurance expectations remain explicit.
5. Build a FHIR migration plan. Identify legacy C-CDA and Direct dependencies, map receiving-system readiness and prioritise interfaces by clinical criticality and volume.
6. Track future rulemaking. Monitor information-blocking proposals and subsequent ONC actions. HTI-5 is one step in a continuing regulatory transition, not the final state of US health data policy.

Strategic Outlook

Three outcomes are plausible. Lower certification overhead could free developers to invest in APIs, automation and specialist applications. Hospitals may respond to removed disclosures by imposing stronger contractual evidence requirements, shifting rather than eliminating assurance costs. And gaps in FHIR readiness may prolong a hybrid environment in which vendors support several exchange pathways.

These outcomes can occur together. Vendors may benefit from lower certification costs while facing higher customer expectations for cybersecurity, AI validation and implementation. Hospitals may gain choice but incur more evaluation work. Winners will convert flexibility into better workflows, data availability, usability and total cost of ownership.

US health IT policy is moving from a prescriptive catalogue of established functions toward a more API-centred framework. FHIR is the central interoperability direction, while AI-enabled systems are likely to become more integrated into clinical and administrative workflows. Product governance, data quality and implementation capability will therefore become more important differentiators.

For investors, the rule warrants a review of regulatory operating costs and competitive positioning, not an automatic re-rating of digital health companies. Diligence should test the FHIR roadmap, customer retention, implementation economics and AI assurance. International entrants must identify where ONC certification applies and where FDA or other requirements remain decisive.

HTI-5 recalibrates the US health IT market: selected certification obligations fall, important safeguards remain and API-based interoperability moves closer to the centre of policy. Lower compliance friction may accelerate innovation, but clinical credibility and dependable integration will determine adoption.

Sources and Method

This article is based primarily on the final rule published by the US Government Publishing Office and ONC's accompanying fact sheets. HHS cost estimates are presented as agency estimates, not independently measured savings or guaranteed reductions in healthcare spending. Commercial implications are analysis derived from the scope and timing of the rule.

1. US Government Publishing Office — Federal Register, 91 FR 67916: HTI-5 Final Rule, published 28 October 2026.
2. ONC — HTI-5 Final Rule Overview, 26 October 2026.
3. ONC — HTI-5 Final Rule Removals or Revisions of Certification Criteria, 26 October 2026.
4. ONC — Certification of Health IT: programme scope, certification process and resources.
5. US Food and Drug Administration — Clinical Decision Support Software: Guidance for Industry and FDA Staff, document issued 29 January 2026.
6. US Department of Health and Human Services — HTI-5 final rule announcement, 26 October 2026.

Prepared for executive information and strategic discussion. This article is not legal advice, a regulatory determination for any specific product, or investment advice. Companies should review the final rule and obtain product-specific regulatory counsel before changing certification or market-access plans.