ONC’s HTI-5 final rule trims health IT certification requirements, charts FHIR-forward course

On October 28, 2026, the US Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) published in the Federal Register the Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity (HTI-5) final rule. The final rule updates ONC Health IT Certification Program requirements at 45 CFR Part 170. It removes or revises certification criteria, standards, and Conditions and Maintenance of Certification requirements that apply to health IT developers of certified health IT (certified health IT developers). The final rule is effective December 28, 2026, except for certain provisions that take effect January 1, 2027.

The HTI-5 final rule finalizes a substantially narrowed set of policies that ONC proposed in the HTI-5 proposed rule. For more information about the proposed rule, see our previous client alert, “ASTP’s HTI-5 relaxes certification criteria while tightening information blocking exceptions.” Notably, ONC did not finalize any of its proposals to amend the information blocking regulations at 45 CFR Part 171. ONC states that comments on proposals not addressed in the final rule “remain under review and consideration” and may be included in future final rules or in revised proposals. During its October 29, 2026, information session, ONC said it may address the information blocking proposals in one of three ways:

• Issuing a separate final rule.
• Proposing the same or modified proposals in a new proposed rule.
• Finalizing the proposals in a different HHS rulemaking.

Of the 60 certification criteria now in effect, the proposed rule would have removed 34 and revised seven. The final rule removes 14 criteria, revises seven, and leaves 39 unchanged. The 39 unchanged criteria include the electronic prior authorization, real-time prescription benefit, e-prescribing, and modular application programming interface (API) criteria that ONC adopted in the HTI-4 final rule.

This client alert discusses the finalized changes and key implications for certified health IT developers and for health care providers that deploy and use certified health IT.

Purpose of the final rule: Burden reduction to facilitate innovation

ONC frames the final rule as a deregulatory action under Executive Order 14192 (Unleashing Prosperity Through Deregulation) and Executive Order 14267 (Reducing Anti-Competitive Regulatory Barriers). Its central premise is that many certification requirements no longer drive adoption or improvement of the functionality they cover. ONC concludes that maintaining them diverts developer resources from innovation. ONC explains:

By removing burdensome and unnecessary requirements of the Certification Program, this final rule supports providers in caring for their patients. Developers of certified health IT will have more time to support providers’ specific technological needs. Further, by increasing competition in the certified health IT market that will come from reduced barriers to entry for the certification of health IT, providers also will have more choices to meet their health IT needs. (91 Fed. Reg. at 67917)

ONC repeatedly relies on the concept of “widely adopted” or “widely implemented” functionality to justify removal. To judge whether a criterion meets that standard, ONC considers whether, and for how long, the criterion has been included in the base electronic health record (EHR) definition or CMS’s CEHRT definitions. ONC pairs that analysis with survey data showing that 99% of hospitals and 91% of physicians reported having a certified EHR in 2024. ONC reasons that functionality that is well established in the market will remain available without a certification requirement. On that basis, it removes criteria such as family health history, patient health information capture, application access, and the Direct Project transport criteria.

ONC also casts the rule as a reset of the Certification Program’s scope toward FHIR-based APIs:

America’s interoperability arc in healthcare has bent decisively toward Fast Healthcare Interoperability Resources (FHIR®)-based application programming interfaces (APIs). . . . [W]e aggressively reduce and remove long-standing functionality-oriented and non-FHIR-based certification criteria from the Certification Program. While this approach will directly and rapidly reduce compliance burdens for health IT developers that participate in the Certification Program, more broadly, it will enable ONC to reset the Certification Program’s regulatory scope and establish a new foundation on which to build FHIR-based API requirements in the future. (91 Fed. Reg. at 67917)

ONC states that it intends to focus future certification requirements on FHIR-based APIs that:

• Enhance automation and API performance.
• Move beyond read-only interactions.
• Expand the scope of data available for clinical efficiency, patient-centered care, and timely reporting use cases such as public health, quality, and government programs.

Allocation of burden between developers and providers

A recurring theme in the comments on the proposed rule was that deregulation does not eliminate burden but reallocates it from certified health IT developers to their health care provider customers. Commenters warned that providers would need to verify capabilities themselves and negotiate to preserve functionality. They also warned that removed capabilities could reappear as optional modules or premium features.

ONC addresses this concern directly. It states that the costs of removed functionalities “[a]re likely included in the costs that customers currently pay.” It adds that if developers continue to charge for specific functionalities, “customers may now be able to see the cost of a specific functionality independent of the certified Health IT Modules, providing further price transparency.”

ONC’s regulatory impact analysis assumes that developers “will use the cost savings to invest in innovation and emerging technology, rather than directly reduce costs on their end users.” In other words, providers should not expect price reductions from the final rule.

Certification criteria finalized for removal or revision

Table 1 of the final rule lists the certification criteria finalized for removal or revision:

Table 1. Certification criteria finalized for removal or revision

The clinical decision support criterion expired on January 1, 2025, under the HTI-1 final rule. Its removal from the Code of Federal Regulations is therefore a cleanup change. Where ONC removed a criterion, it generally also removed the standards that the criterion referenced.

Proposals not finalized because of FHIR readiness and maturity concerns

ONC’s FHIR-forward vision collided with extensive public comments that FHIR-based alternatives are not yet ready to replace C-CDA- and CDA-based exchange for several use cases. Many commenters stressed that long-term and post-acute care, behavioral health, small and rural providers, and public health agencies still depend on C-CDA- and CDA-based exchange. In response, ONC did not finalize the following proposals as proposed:

• Transitions of care (§ 170.315(b)(1)). ONC proposed to remove the “send and receive via edge protocol,” “create,” and “display” requirements effective January 1, 2027. It instead delayed those removals to January 1, 2030.
• Clinical information reconciliation and incorporation (§ 170.315(b)(2)). ONC proposed to remove this criterion. It instead revised the criterion into a functional, standards-agnostic requirement that can be demonstrated across a broader range of workflows.
• Transmission to cancer registries (§ 170.315(f)(4)). ONC did not finalize removal. It cited commenter concerns that FHIR-based cancer reporting resources are not yet operationally ready and that receiving public health systems are not prepared.
• Transmission to public health agencies – electronic case reporting (§ 170.315(f)(5)). ONC did not finalize its proposal to convert the criterion to a functional-only requirement. The existing standards-based requirements remain in place.
• Transmission to public health agencies – health care surveys (§ 170.315(f)(7)). ONC did not finalize removal. It cited concerns that FHIR-based standards are not mature enough and that receiving public health systems are not ready for FHIR-based reporting.

ONC did, however, remove several C-CDA-based criteria despite similar readiness concerns. These include the care plan criterion, which ONC noted has very low certification uptake (48 certified health IT modules), the security tags criteria, and the C-CDA creation performance criterion. ONC reasoned that retaining the C-CDA validation requirements beyond 2030, together with the extended transitions of care timeline, addresses concerns about removing C-CDA-based requirements.

The January 1, 2030, deadline is the clearest signal in the final rule of ONC’s expected pace for moving away from C-CDA. ONC describes the extension as providing “a clear and workable timeline for certified health IT to move from C-CDA-based standards to FHIR-based standards.” Developers and providers should treat it as the planning horizon for migrating document-based transitions of care workflows.

Decision support interventions

The most substantial revision in the final rule narrows the DSI criterion at § 170.315(b)(11), which ONC adopted in the HTI-1 final rule. Consistent with Executive Order 14434, the final rule refers to artificial intelligence (AI) as “super intelligence” (SI). ONC finalized, as proposed, the following changes:

• Source attribute requirements removed. ONC removed the source attribute support requirements and the source attribute access and modification requirements for evidence-based and predictive DSIs. Developers were required to give users information about the sources of evidence-based DSIs (such as the bibliographic citation and intervention developer) and about how a predictive DSI was trained, its intended use and limitations, and how it performs across patient groups.
• Intervention risk management removed. ONC removed the requirements for developers to apply risk management practices to predictive DSIs they supply.
• Narrower data scope for predictive DSIs. Developers no longer need to enable predictive DSIs that use any data expressed in the United States Core Data for Interoperability (USCDI) standard. The requirement is now limited to the data that evidence-based DSIs must be able to use (i.e., problems, medications, allergies and intolerances, at least one demographic data element, laboratory, vital signs, unique device identifiers for implantable devices, and procedures) plus the clinical notes and assessment and plan of treatment data classes. ONC noted that many USCDI data elements, such as phone number, are unlikely to be used as predictive DSI inputs.
• Reconciliation-triggered interventions removed. ONC removed the requirement to enable interventions when medications, allergies and intolerances, and problems are incorporated from a transition of care or referral summary.

According to ONC, a large majority of commenters opposed these changes. They argued that removing the transparency and risk management requirements would shift evaluation, governance, and liability burdens to providers, particularly small, rural, and safety-net organizations without data science capacity. ONC was not persuaded. Its reasoning reflects a deliberate decision to prioritize developer burden reduction and innovation over Certification Program-based risk management.

First, ONC relied on developer reports that “most clinical users lack the time or technical background to engage with source attribute information for DSIs.” ONC also stated that it found no evidence in peer-reviewed literature or trade press that users relied on the transparency requirements or that the requirements improved patient care. Some commenters countered that the real users of source attribute information are governance, procurement, compliance, and patient safety teams rather than point-of-care clinicians. ONC responded that it “remain[s] cognizant of the need to minimize burden on developers of certified health IT, especially when the required functionality is not widely used and may not be equally applied to other developers that do not participate in the Certification Program.”

Second, on risk management, ONC acknowledged the importance of monitoring predictive DSI performance. It then stated that “we also seek to minimize burden on developers of certified health IT and encourage innovation in this evolving area.” ONC also characterized the change as “reducing the Department’s regulatory footprint and concentrating requirements solely within other Department authorities, such as those exerted by the FDA.”

Third, ONC placed the onus on providers to obtain DSI information through the market. It stated that removing the requirements “does not mean that such information about intended use, provenance, training data, limitations, performance, and known risks is unknown or unavailable.” ONC encouraged users to ask their developers for this information. It also reminded users of their obligations under the regulations implementing Section 1557 of the Affordable Care Act to identify and mitigate the risk of discrimination from patient care decision support tools. Section 1557 prohibits discrimination on the basis of race, color, national origin, sex, age, or disability in health programs and activities that receive federal financial assistance or are administered by HHS.

For health care providers, the practical effect is that the Certification Program no longer guarantees access to source attribute information or developer risk management for AI tools embedded in certified health IT. Providers that rely on that information for AI governance programs, Section 1557 compliance, or state law obligations may need to proactively request it from their EHR developers or obtain it from other sources.

Automated numerator recording and automated measure calculation

ONC finalized, as proposed, the removal of two criteria effective January 1, 2027:

• Automated numerator recording (§ 170.315(g)(1)). This criterion requires the capability to identify the patients or actions in the numerator of percentage-based Promoting Interoperability measures.
• Automated measure calculation (§ 170.315(g)(2)). This criterion requires the capability to record numerators and denominators and generate measure reports.

Commenters raised concerns about the loss of assurance that measure calculations are accurate and about misalignment with CMS requirements. ONC responded that developers now have extensive experience with CMS measure requirements and will continue to support accurate calculation to keep their customers in good standing. Eligible hospitals, CAHs, and MIPS eligible clinicians will remain responsible for accurately calculating and attesting to Promoting Interoperability measures, regardless of whether the calculation tool is certified.

For developers, removal provides meaningful burden relief. They no longer must test and certify that their measure calculations conform to CMS specifications, and ONC’s regulatory impact analysis attributes $6 million to $9.6 million in annual savings to the automated measure calculation criterion alone.

Accessibility-related criteria

The final rule takes a split approach to accessibility.

ONC did not finalize removal of the accessibility-centered design criterion, which applies to all certified health IT modules. ONC explained that the widespread use of accessibility-centered design practices supports retaining, rather than removing, the attestation-based criterion. ONC also noted that retention helps reduce the risk of uneven accessibility practices among new market entrants.

ONC did finalize removal of the Web Content Accessibility Guidelines (WCAG) 2.0 conformance requirement from the view, download, and transmit to 3rd party criterion. ONC cited developer feedback that WCAG assessment tool licenses cost thousands of dollars annually and that the referenced standard is outdated.

ONC emphasized that the final rule does not alter any entity’s obligations under applicable civil rights laws, including the Americans with Disabilities Act, Section 504 of the Rehabilitation Act, Section 1557, and other applicable federal or state laws.

ONC acknowledged that removing the WCAG requirement could place greater responsibility on providers to evaluate the accessibility of the health IT they purchase.

Real world testing requirements

Consistent with ONC’s June 30, 2025, enforcement discretion notice, ONC finalized changes to the Real World Testing Condition and Maintenance of Certification requirements:

• Plans eliminated. Developers are no longer required to submit annual real world testing plans, and ONC removed the ONC-Authorized Certification Body review process for those plans.
• Results reporting narrowed. Full results reporting is limited to health IT modules certified to API-focused criteria. These are the standardized API for patient and population services criterion and the HTI-4 provider prior authorization API criteria.
• SVAP reporting streamlined. ONC finalized with modification its proposed revisions to the Standards Version Advancement Process (SVAP), a voluntary process that requires developers to adopt and certify their health IT to a newer version of a standard or implementation specification included in certification criteria subject to real world testing. The finalized revisions only require developers to report in their real world testing results SVAP updates to health IT certified to API-focused certification criteria. ONC concluded that developer attestations and Certified Health IT Product List (CHPL) listings provide sufficient transparency for other SVAP updates.

The underlying obligation to conduct real world testing has not been eliminated. Section 4002 of the 21st Century Cures Act requires developers to test the real world use of their technology for interoperability. Developers therefore remain obligated to conduct real world testing for health IT certified to the criteria identified in § 170.405(a), which include the retained clinical information reconciliation and incorporation, cancer registry, and health care survey criteria.

Insights Condition and Maintenance of Certification

The Insights Condition and Maintenance of Certification requires certified health IT developers to report data about how their certified health IT is used for interoperability, which ONC makes publicly available. ONC removed five of the seven measures. It retained the “use of FHIR in apps” measure and, contrary to its proposal, the “use of FHIR bulk data access” measure. ONC explained that retaining the bulk data measure aligns with its FHIR-forward strategy. ONC’s enforcement discretion notice for the Insights Condition anticipated this deregulatory action. Developers should review their reporting obligations for the retained measures.

Looking ahead to HTI-6

The final rule repeatedly signals that it is a foundation for future FHIR-focused rulemaking. ONC references “an upcoming planned regulatory action that will focus on HL7® FHIR® based exchange.” HHS’s regulatory agenda lists that rulemaking as HTI-6: Application Programming Interfaces and Information Blocking, with an expected date of November 2026.

HTI-6 may address several open items:

• The deferred HTI-5 information blocking proposals.
• New FHIR-based API certification criteria that move beyond read-only access.
• Replacement pathways for the C-CDA-based criteria that sunset on January 1, 2030.
• Revisions to the privacy and security criteria and the Privacy and Security Certification Framework.

ONC also expressed interest in SI-enabled interoperability solutions that combine FHIR with emerging standards such as the Model Context Protocol. Stakeholders should be prepared to comment on what may be a more significant rulemaking.

Practical next steps

Certified health IT developers should consider the following:

• Map the portfolio to the final rule’s timelines. Key dates are December 28, 2026; January 1, 2027; and January 1, 2030. Plan CHPL listing updates accordingly.
• Update customer-facing materials. Review marketing materials, contracts, and customer communications that reference certification to removed or revised criteria, and update representations to avoid overstating certified functionality.
• Decide on voluntary DSI transparency. Determine whether to continue providing model card information and conducting predictive DSI risk management voluntarily. Customers subject to Section 1557’s patient care decision support tool requirements and state laws governing AI use in health care may continue to request this information.
• Recalibrate real world testing and Insights compliance. Align software testing and compliance programs to the narrowed real world testing reporting obligations and the retained Insights measures. Remember that the obligation to conduct real world testing continues for criteria in § 170.405(a).
• Plan for the C-CDA-to-FHIR migration. Begin planning for the transition from C-CDA-based transitions of care exchange in advance of January 1, 2030.

Health care providers that deploy and use certified health IT should consider the following:

• Consider securing functionality by contract. Consider requesting contractual commitments to preserve functionality no longer assured by certification. Examples include family health history, patient health information capture, care plan, Direct messaging, AI model card information, and WCAG-conformant patient portals.
• Verify measure calculations. Validate Medicare Promoting Interoperability measure calculations after January 1, 2027, when certification no longer covers them.
• Strengthen AI governance and accessibility review. Build internal processes to obtain and evaluate information on AI-enabled DSIs, including for compliance with the Section 1557 requirements for patient care decision support tools. Assess the accessibility of patient-facing technology under applicable civil rights laws.
• Prepare for HTI-6. Engage in HTI-6 and future rulemaking, particularly regarding the timeline and readiness of FHIR-based replacements for document-based exchange.

If you have questions about how the final rule affects your organization, please contact either of the authors of this client alert or your regular McDermott Will & Schulte lawyer.