ONC pares back health IT certification as HTI-5 rewrites federal compliance demands
Federal health IT rules are moving in a less prescriptive direction. The Office of the National Coordinator for Health Information Technology finalized HTI-5, a rule that removes 14 requirements from the ONC Health IT Certification Program and revises seven more, a sizable retreat from the broader proposal released late last year.
The practical effect is straightforward: fewer certification chores for developers, fewer required disclosures for some AI-enabled tools, and less mandated testing paperwork to keep federal certification in hand. Regulators estimate the changes will cut $1.5 billion in regulatory costs.
Certification rules lose requirements around AI, family history, and testing
The certification program remains voluntary on paper, but it has real force in the market because participation in several federal, state, and private programs depends on it. Technology used for the Medicare Promoting Interoperability Program must be ONC-certified, so any loosening of the program changes the baseline expectations for vendors serving hospitals and physician groups.
Among the most consequential changes is the removal of the requirement for artificial intelligence model cards. Until now, health IT tools that used AI, machine learning, or other predictive algorithms had to provide source information for training, performance, and validation data. Under HTI-5, that obligation falls away, easing disclosure requirements for developers building decision support, prediction, and automation features into clinical software.
The rule also eliminates standards tied to recording patients’ family histories. In clinical software, family history fields often support risk assessment for cardiovascular disease, cancer syndromes, hereditary conditions, and medication selection. Reducing the federal reporting burden around those data elements may speed development, but it also narrows the certification framework’s reach into how deeply vendors must document structured data capture.
One sentence captures the shift: ONC is asking less of software before it can be called certified.
Real-world testing requirements are stripped down
HTI-5 also pares back the real-world testing requirement that has been part of certification maintenance. Health IT developers will no longer have to submit annual plans for testing their tools in clinical settings. That change matters because real-world testing is one of the few mechanisms that tries to connect a vendor’s technical claims with how software behaves in actual workflows, where documentation burden, interoperability failures, and alert fatigue can expose weaknesses that never appear in a lab environment.
For developers, the relief is obvious. Annual plans and related compliance work require personnel, outside coordination, and ongoing documentation. For providers, the quieter question is whether fewer mandatory test submissions will make it harder to compare tools on safety, usability, and performance in day-to-day care settings. The final rule answers that question indirectly by shifting the balance toward development speed and away from structured federal oversight.
ONC stops short of the broader rollback first floated in 2025
The final rule is narrower than the version ONC proposed in December 2025. That earlier proposal suggested removing 34 criteria from the certification program; the final rule settles on 14 removals and seven revisions instead. In regulatory terms, that is still a major contraction, but it is also a visible retreat from the more sweeping deregulatory option initially placed on the table.
The agency also chose not to finalize proposed changes to privacy and security criteria. Certified health IT will still need at least one capability that helps users comply with HIPAA, and the final rule does not strip away those safeguards. For providers handling sensitive patient information, that decision preserves an important floor under the certification program even as other requirements are reduced.
The same selective approach appears in ONC’s handling of information blocking. Proposals to clarify definitions and exceptions tied to the information-blocking rule remain unresolved, including language that would have revised the meanings of “access” and “use” to include autonomous AI systems. Those proposals, along with public comments, are still under consideration.
Regulatory relief comes with a narrower federal safety net
Tom Keane, national coordinator for health IT, framed HTI-5 as a direct effort to reduce administrative burden so developers can focus on interoperability, automation, and better care delivery. That logic fits the administration’s broader deregulatory agenda, which has already moved to reverse Biden-era health AI directives and other rulemaking constraints.
Yet the health IT market depends on certification not just as a marketing signal, but as a gatekeeper for participation in programs that touch hospitals, payers, and public reporting. When federal criteria become easier to meet, more vendors may enter the certification pipeline or maintain it with fewer resources devoted to paperwork. When criteria are loosened too far, the tradeoff is a weaker federal picture of how software handles data accuracy, security, and interoperability in practice.
The result is not a simple deregulatory win or a safety setback. It is a redistribution of responsibility from the certification process toward the market and the buying organizations that must decide whether a vendor’s product actually performs as promised.
Timing for implementation will vary across the rule
Some of the certification changes will take effect 60 days after publication in the Federal Register. Others will begin on Jan. 1. Vendors, health systems, and integrators will have to track those dates carefully because compliance changes rarely land in a single clean wave. Different product lines may move on different schedules, and procurement teams will need to know which features are affected before renewal or implementation decisions are locked in.
What remains unresolved is how much of the clinical software ecosystem will translate this regulatory relaxation into better product design rather than simply lower compliance overhead. The rule does not measure downstream effects on workflow quality, data exchange, or patient-facing outcomes. It removes requirements first and leaves the operational consequences to unfold later, in the places where EHRs, AI tools, and interoperability standards meet actual bedside care.