Dive Brief:
- The government has finalized a rule that aims to make it easier for health IT developers to earn a federal certification indicating that their technology is secure and functional.
- Released by the Office of the National Coordinator for Health Information Technology on Monday, the HTI-5 final rule will cut 14 requirements from the ONC Health IT Certification Program's 60 criteria. The rule will revise another seven certification criteria.
- Health IT developers will no longer have to provide training data about tools that use AI or have to show their technology complies with certain standards for tasks like recording patients’ family histories. According to regulators, the changes will cut $1.5 billion in regulatory costs.
Dive Insight:
Regulators say that reducing the certification program’s criteria will allow health IT developers to dedicate resources to other aspects of technology development, such as improving user experience.
The final rule advances the Trump administration’s deregulatory agenda. Since 2025, the administration has slashed regulations across the healthcare industry, including rescinding Biden-era directives on health AI and previously mandatory processes for agency rulemaking. Previously, HTI-4 added and updated health IT certification criteria for electronic prior authorization, electronic prescribing and real-time prescription benefit checks, also in an effort to ease administrative burdens.
But the HTI-5 final rule does not go as far as the ONC's proposed HTI-5 rule released in December 2025 indicated.The proposed rule suggested removing 34 criteria from the ONC Health IT Certification Program, but the final rule only cut 14. The final rule also pares down the real-world testing requirement for developers, a condition for maintaining certification. Health IT developers will no longer have to submit annual plans for testing their tools in clinical settings.
The final rule also punts the ONC's decision on information-blocking proposals to a future date. Information blocking refers to actions that obstruct the exchange of health information, which is prohibited except in certain cases. While the agency proposed clarifying certain definitions and exceptions related to the information blocking rule — including revising the definitions of “access” and “use” to include autonomous AI systems — the proposals and comments submitted by the industry remain under consideration.
The ONC also did not finalize proposals to remove privacy and security certification criteria, such as ensuring certified health IT includes at least one capability that helps users comply with HIPAA.
Still, the final rule takes aim at the ONC Health IT Certification Program. The program provides a voluntary certification showing that health IT technology meets data accuracy, security and interoperability standards.
Though the certification itself is voluntary, participation in some federal, state and private programs requires it. For instance, technology used as part of the Medicare Promoting Interoperability Program, previously the Medicare and Medicaid EHR Incentive Programs, must be ONC-certified.
Among the changes in the final rule is the decision to drop the requirement for artificial intelligence model cards. Previously, health IT tools that incorporate AI, machine learning and other predictive algorithms had to provide source information for training, performance and validation data. Now, the ONC has removed this requirement to ease administrative burdens.
“Through HTI-5, we have taken decisive action to significantly lower the administrative compliance burden for developers so that they can spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans,” Dr. Tom Keane, national coordinator for health IT, said in the press release.
Many of the certification criteria changes will take effect 60 days after the rule is published in the Federal Register, while others will occur on Jan. 1.
