What You Ought to Know. The Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) Final Rule has been released by the Office of the National Coordinator for Health Information Technology (ONC) at the U.S. Department of Health and Human Services (HHS).
This rule directly enacts the administration’s deregulation directives under Executive Order 143 (Unleashing Prosperity through Deregulation) and Executive Order 14267 (Reducing Anti-Competitive Regulatory Barriers). It achieves a net present value of $1.55 billion in cost savings ($108.1 million annualized net savings discounted at 7% starting in 2027 in perpetuity) by reducing compliance and testing overhead for health IT developers.
The rule also forecasts $0 in new ongoing compliance implementation costs for developers of certified health IT. In the end, ONC finalized the removal of 14 certification criteria and revised seven others, leaving 39 criteria unchanged. By taking these actions, federal authorities maintained key privacy and security standards, kept usability and quality management guidelines intact, provided a multi-year support period for legacy Consolidated CDA (C-CDA) transitions of care, and separated federal artificial intelligence “model card” obligations from certified EHR technology.
The main focus of policy changes in HTI-5 involves Decision Support Interventions (DSI) as per 170.3153 CFR § 170.315(b)(11). In the prior HTI-1 Final Rule, ONC imposed strict algorithmic transparency regulations, compelling health IT developers to exhibit standardized ‘source attributes’, akin to nutrition labels or ‘model cards’, for predictive decision support interventions (PDSIs).
These attributes were to include information on training datasets, demographic validation benchmarks, and algorithmic funding sources. Conversely, under HTI-5, ONC has finalized the complete elimination of these predictive model card and intervention risk management requirements. Removal of Source Attribute Display (§ 170.315(b)(11)(iv) & (v)): Certified EHR module developers do not need to create and update user interfaces that display algorithmic training data, model provenance, or source attributes for clinicians at the point of care anymore..
Elimination of Developer Maintenance of Certification (§ 170.402(b)(4)): Health IT vendors’ obligation to consistently review and update risk management practices and source attribute metadata is eliminated.. Revoking Intervention Risk Management (§ 170.315(b)(23)(vi)): Federal certification audits for model drift monitoring and risk mitigation protocols are no longer required for developers..
Concentrating on Core Clinical Data: The data classes that trigger predictive DSIs are limited to Clinical Notes and the Assessment and Plan of Treatment, removing the need to configure predictive algorithms against non-clinical fields (e.g. Patient phone numbers are included. The formal deletion of expired CDS (§ 170.315(a)(9)) was carried out by regulators, as the legacy clinical decision support criterion expired on January 1, 2025.
In explaining the reversal, ONC mentioned that clinicians in high-pressure clinical settings seldom use technical model cards, and the regulatory burden of maintaining compliance was discouraging investment in cutting-edge artificial intelligence by developers. The organization stressed that monitoring of clinical algorithmic safety should be based on the Food and Drug Administration (FDA) and non-discrimination rules in civil rights (45 CFR § 92.210), instead of regular EHR certification.
Although developers received significant relief regarding AI compliance, provider associations, patient advocates, and safety-net organizations were able to resist proposals that endangered clinical safety and software integrity. The decision to eliminate all 13 privacy and security certification criteria, which was initially a point of contention, has been dropped by ONC.
Instead, they have decided to maintain the Privacy & Security Framework, as stated in § 170.315(d) and § 170.550(h).
