HHS trims health IT certification rules while leaving information blocking for later
The Health and Human Services Department has finalized a health IT certification rule that pares back long-standing documentation and functional requirements for developers, a move ONC says will cut regulatory costs by more than $1.5 billion. The final action, called HTI-5, is framed as a deregulatory step aimed at reducing the burden on vendors that build electronic health record modules and related digital tools.
One immediate effect is straightforward: fewer certification hurdles for developers.
ONC removed 14 of 60 certification criteria and revised seven others, while retaining 39 criteria with no changes. The agency had proposed a far more aggressive overhaul in December, when it floated eliminating 34 of 60 requirements and revising seven, a plan that would have altered nearly 70% of the existing framework. The final version keeps the basic certification structure intact but still narrows the compliance load in a meaningful way.
HHS estimates the rule will save $1.55 billion in present-value regulatory costs and deliver $108.1 million in annualized net savings beginning in 2027. Those savings are not abstract in a sector where product teams can spend enormous time building evidence packages, updating documentation, and defending legacy certification features. For smaller vendors in particular, the rule may free resources for product development rather than paperwork, especially in a market where interoperability work often competes with short-term commercial pressure.
Tom Keane, the national coordinator for health IT, described the change as a way to redirect developer time toward interoperability, automation, and better patient and clinician experiences. The practical logic is clear: when certification criteria become largely document-based or depend on functions that already exist broadly in the market, the regulatory value of keeping them can erode while the compliance cost persists. ONC’s position is that some of those criteria were no longer necessary because the capabilities are already mature in health IT products or because they may slow innovation rather than improve safety or usability.
FHIR APIs move closer to center stage
HTI-5 also signals a continued shift toward FHIR-based application programming interfaces and related successor technologies. That direction matters because the API path is now central to how modern systems exchange data across settings, vendors, and care teams. Instead of leaning on older, document-heavy certification expectations, ONC is moving toward a model in which interoperability is built around more flexible data access and exchange tools.
In clinical terms, the appeal is obvious. Better APIs can reduce the friction that still surrounds medication histories, prior authorization workflows, laboratory data exchange, and care coordination across systems that do not speak the same technical language. A more API-centered certification program also creates room for AI-enabled tools that depend on structured, machine-readable data rather than static documents or manually assembled files.
The rule also makes conforming edits to several Conditions and Maintenance of Certification requirements, including Assurances, Application Programming Interfaces, and Attestations. ONC further scaled back the Real World Testing requirements by easing obligations around testing plans, testing results, and the Standards Version Advancement Process. The Insights reporting requirements were reduced in line with earlier enforcement discretion, although the use of FHIR bulk data access remained in place.
A separate change removes the AI model-card transparency requirements for decision support interventions that were established under HTI-1. ONC’s direction here is consistent with the broader thrust of the rule: trim documentation overhead where the agency believes the burden outweighs the regulatory benefit.
Information blocking waits for another round
The most politically sensitive part of ONC’s December proposal did not make it into the final rule. The agency had proposed changes to information blocking regulations, including revised definitions of “access” and “use” that would have allowed autonomous AI systems to retrieve and share health data. It also proposed removing or revising a range of information blocking exceptions.
Those proposals remain unresolved for now.
HHS said comments on the information blocking sections are still under consideration, and ONC officials laid out two possible paths forward. The agency could finalize the existing proposals in a separate rule using the original proposal and comment record, or it could start a new rulemaking process with revised language and another public comment period. Either route would keep the issue alive, but it also means providers, developers, and compliance teams will have to wait before they know whether the original AI-related and exception-related ideas will return in their current form.
Keane said the department’s enforcement posture on information blocking has not changed. ONC and the Office of Inspector General are still aligned on holding entities accountable when patient data is improperly withheld, and the agency continues to present interoperability not as a technical luxury but as a core requirement for a functioning digital health system.
Compliance costs fall as the agency narrows its target
The final rule is less sweeping than the December proposal, and that restraint may make it easier to operationalize. A full reset of the certification program would have created more uncertainty for vendors and downstream customers, including health systems that have built purchasing, integration, and training workflows around existing criteria. By scaling back the number of removed requirements, ONC preserved the core architecture of certification while still stripping out parts it considers outdated or redundant.
That balance matters for implementation. Developers still face a certification program, real world testing expectations, and a set of maintenance requirements that continue to shape product design. Yet the reduced burden could improve the economics of building interoperable tools, especially for vendors that have struggled to maintain compliance with criteria that no longer correspond closely to clinical need or market reality.
The rule is scheduled for publication in the Federal Register on Oct. 28. Many provisions take effect 60 days after publication, while others will not begin until Jan. 1, 2027. ONC has also signaled that HTI-6 is already in development and will likely address standards adoption, expanded API use, successor technologies, and additional updates to information blocking regulations.
The next round of rulemaking will determine whether the agency follows this narrower deregulatory path or reopens the most contentious data-access questions with a fresh proposal.