ONC Finalizes HTI-5 Deregulatory Rule to Cut $1.55B in Health IT Compliance and Accelerate FHIR APIs

What You Should Know

• The Office of the National Coordinator for Health Information Technology (ONC) at the U.S. Department of Health and Human Services (HHS) officially released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) Final Rule.
• Directly implements the administration’s regulatory reform directives under Executive Order 14192 (Unleashing Prosperity through Deregulation) and Executive Order 14267 (Reducing Anti-Competitive Regulatory Barriers).
• Delivers a net present value of $1.55B in cost savings ($108.1 million annualized net savings discounted at 7% beginning in 2027 in perpetuity) by cutting compliance and testing overhead for health IT developers.
• Projects $0 in new ongoing compliance implementation costs for developers of certified health IT.

Dismantling the AI “Model Card” Mandate: Rewiring Decision Support Interventions

ONC ultimately finalized the removal of 14 certification criteria and the revision of seven others, retaining 39 criteria completely intact. In doing so, federal regulators preserved foundational privacy and security requirements, held the line on usability and quality management baselines, extended a multi-year lifeline to legacy Consolidated CDA (C-CDA) transitions of care, and decoupled federal artificial intelligence “model card” mandates from certified EHR technology.

The most closely watched policy pivot in HTI-5 centers on Decision Support Interventions (DSI) under 45 CFR § 170.315(b)(11). In the previous HTI-1 Final Rule, ONC established stringent algorithmic transparency rules requiring health IT developers to display standardized “source attributes”—effectively nutrition labels or “model cards”—for predictive decision support interventions (PDSIs), detailing training datasets, demographic validation benchmarks, and algorithmic funding sources.

Under HTI-5, ONC finalized a complete removal of these predictive model card and intervention risk management requirements:

• Elimination of Source Attribute Display (§ 170.315(b)(11)(iv) & (v)): Developers of certified EHR modules are no longer required to build and maintain user interfaces that display underlying algorithmic training data, model provenance, or source attributes to clinicians at the point of care.
• Removal of Developer Maintenance of Certification (§ 170.402(b)(4)): Conforming edits remove the ongoing maintenance mandate requiring health IT vendors to routinely review and update risk management practices and source attribute metadata.
• Rescinding Intervention Risk Management (§ 170.315(b)(11)(vi)): Developers are relieved of federal certification audits regarding ongoing model drift monitoring and risk mitigation protocols.
• Focusing Scope on Core Clinical Data: The data classes required to trigger predictive DSIs are narrowed to data expressed in Clinical Notes and the Assessment and Plan of Treatment, eliminating burdensome mandates to configure predictive algorithms against non-clinical fields (e.g., patient phone numbers).
• Formal Deletion of Expired CDS (§ 170.315(a)(9)): Regulators formally struck and reserved the legacy clinical decision support criterion that expired on January 1, 2025.

In justifying the reversal, ONC noted that clinicians operating in high-pressure clinical workflows rarely access technical model cards, while the regulatory overhead of maintaining compliance was depressing developer investment in frontier artificial intelligence. The agency emphasized that oversight of clinical algorithmic safety is more properly anchored within the Food and Drug Administration (FDA) and civil rights non-discrimination rules (45 CFR § 92.210) rather than standard EHR certification.

The Great Compromise: Preserving Usability, Quality, and Security Floors

While developers secured substantial relief around AI compliance, provider associations, patient advocates, and safety-net organizations successfully pushed back against proposals that threatened clinical safety and software integrity:

• Privacy & Security Framework Retained (§ 170.315(d) and § 170.550(h)): ONC completely abandoned its controversial proposal to eliminate all 13 privacy and security certification criteria. The agency acknowledged overwhelming feedback from health systems and small practices warning that eliminating certified encryption, user authentication, and audit logs would strip providers of baseline verification tools required for HIPAA Security Rule compliance.
• Safety-Enhanced Design (SED) Streamlined to Attestation (§ 170.315(g)(3)): Rejecting total elimination, ONC preserved the usability mandate but converted it from a heavy summative laboratory testing regime into an attestation-based standard. This maintains the user-centered design baseline while stripping out cumbersome post-development usability reporting.
• Quality Management Systems (QMS) Preserved (§ 170.315(g)(4)): ONC retained the mandatory QMS criterion across all certified modules, affirming that baseline adherence to federal or ISO quality development frameworks remains an essential filter against substandard market entrants.
• Accessibility-Centered Design (ACD) Retained (§ 170.315(g)(5)): The agency kept the requirement that developers identify and apply accessibility standards during development, ensuring digital equity protections remain visible in certified products.
• Implantable Device List (IDL) Saved for CMS Alignment (§ 170.315(a)(14)): Proposed removal of the IDL criterion was scrapped after CMS finalized its new “Unique Device Identifiers for Implantable Medical Devices” measure in the FY 2027 IPPS final rule, maintaining UDI capture within the Base EHR definition.

The C-CDA Glidepath: A 2030 Sunset for Legacy Document Exchange

Recognizing that small clinics, long-term post-acute care (LTPAC) facilities, and behavioral health providers remain heavily reliant on document-based workflows, ONC restructured its transitions-of-care policies to establish an orderly runway toward an all-FHIR ecosystem:

• Transitions of Care Extension to 2030 (§ 170.315(b)(1)): Rather than stripping C-CDA creation and Direct secure messaging edge protocols by 2027, ONC extended the compliance sunset to January 1, 2030. This gives the healthcare ecosystem a four-year bridge to deploy mature, bidirectional FHIR-based exchange without risking patient referral drop-offs.
• CIRI Converted to a Functional Mandate (§ 170.315(b)(2)): The “clinical information reconciliation and incorporation” criterion was not eliminated. Instead, ONC stripped out rigid C-CDA document-format constraints and removed the outdated requirement to display data sources simultaneously side-by-side, converting CIRI into a flexible, functional criterion that accommodates automated and FHIR-native reconciliation workflows.
• Elimination of Redundant CDA Testing (§ 170.315(g)(6)): The secondary “Consolidated CDA creation performance” criterion was eliminated immediately, removing duplicative conformance testing for developers already certifying primary clinical exchange capabilities.

Real World Testing, SVAP, and ASTP Reversal

Beyond individual criteria, HTI-5 implements significant structural changes to the maintenance conditions governing certified developers:

• Delineating Real World Testing (RWT) (§ 170.405): Conforming to the enforcement discretion issued in June 2025, ONC eliminated the requirement for health IT developers to submit formal annual Real World Testing plans. Full RWT results reporting is now strictly confined to core API criteria (§ 170.315(g)(10) and provider prior authorization APIs § 170.315(g)(31)–(33)). For non-API criteria remaining within RWT scope (including retained cancer and survey reporting), developers need only document voluntary standards updates adopted via the Standards Version Advancement Process (SVAP).
• Preserving Public API Endpoint Transparency (§ 170.404(b)(2)): Regulators formally rejected vendor requests to eliminate the public publication of service base URLs. ONC affirmed that maintaining public directories of active FHIR endpoints is essential for third-party application onboarding and patient data access.
• Retiring ASTP Branding and Restoring ONC Authority: Conforming to administrative reorganizations, HTI-5 systematically strips all references to the “Assistant Secretary for Technology Policy (ASTP)” from 45 CFR Part 170 and the TEFCA regulations under Part 172, legally restoring the primacy and title of the Office of the National Coordinator for Health Information Technology (ONC).
• Status of Information Blocking: ONC confirmed that deregulatory proposals modifying federal information blocking disincentives and exceptions remain under active agency review and were not finalized in this release.

Clearing the Deck for the Super-Intelligence FHIR Era

The finalization of HTI-5 clarifies the federal government’s broader digital health trajectory:

• Lowering Market Entry Barriers: By stripping out 14 obsolete, duplicative, or overly prescriptive criteria, ONC directly reduces testing costs and legal overhead for emerging digital health vendors. Startups building modular tools no longer need to spend six-figure testing budgets proving compliance with legacy numerator reporting or dead-end C-CDA formatting benchmarks.
• Preparing for the Model Context Protocol (MCP) and Agentic AI: In its preamble, ONC noted that modernizing the Certification Program around FHIR APIs is a necessary prerequisite to support super-intelligence (SI) applications. The agency highlighted emerging standards like the Model Context Protocol (MCP)—which standardizes how external clinical applications feed structured context to Large Language Models—indicating that future rulemaking will prioritize dynamic, read/write FHIR APIs over static data-entry criteria.
• The Victory of Administrative Federalism: The substantial divergence between the proposed and final rules illustrates the influence of interagency coordination. ONC’s decisions to preserve the UDI implantable device list, retain cancer registries, and extend C-CDA transitions of care to 2030 were dictated by real-world alignment with CMS payment rules, CDC surveillance operations, and hospital operational realities.

National Coordinator for Health IT Tom Keane, M.D., summarized the operational pivot during Monday’s rollout: “Through HTI-5, we have taken decisive action to significantly lower the administrative compliance burden for developers so that they can spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans. A successful certification program should establish the floor healthcare needs without becoming the ceiling innovation keeps hitting.”

Operational Verification Checklist for Health IT Developers & Provider CIOs

• Audit Active DSI Model Card Roadmaps: Halt engineering allocations dedicated to building outward-facing model card UIs under § 170.315(b)(11)(iv)–(v); redirect clinical informatics teams toward internal algorithm bias monitoring aligned with Section 1557 requirements.
• Adjust SED Usability Compliance Protocols: Transition development documentation for Safety-Enhanced Design (§ 170.315(g)(3)) from external summative lab testing reports to standardized internal user-centered design attestation packages.
• Update 2027 CEHRT Certification Bundles: Verify that hospital and ambulatory EHR software configurations maintain compliance with CMS Promoting Interoperability measures by confirming continued support for the retained IDL criterion (§ 170.315(a)(14)) and functional CIRI workflows (§ 170.315(b)(2)).
• Recalibrate C-CDA to FHIR Roadmap: Re-anchor enterprise clinical data exchange strategies around the new January 1, 2030 sunset date for C-CDA transition-of-care creation and Direct edge protocols (§ 170.315(b)(1)).
• Streamline Real World Testing Submissions: Remove RWT plan generation from upcoming developer compliance cycles; restrict annual real-world performance metric tracking strictly to certified FHIR API endpoints (§ 170.315(g)(10) and prior authorization APIs).