US ONC HTI-5 Deregulatory Rule

Overview

Published on October 28, 2026, by the Office of the National Coordinator for Health Information Technology (ONC) and the Assistant Secretary for Technology Policy (ASTP) within the U.S. Department of Health and Human Services (HHS), the final rule titled 'Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity' changes federal certification oversight of healthcare technology and artificial intelligence. Known as the HTI-5 Final Rule, it is identified as 91 FR 67916, Federal Register Document 2026-21943, and RIN 0955-AA09. Executive Orders 14192, 'Unleashing Prosperity through Deregulation,' and 14267, 'Reducing Anti-Competitive Regulatory Barriers,' are key policy drivers. The rule projects more than $1.5 billion in compliance cost savings across the healthcare IT industry by eliminating redundant, underutilized, or excessively burdensome certification criteria.

A central component is revision of the Decision Support Interventions (DSI) certification criterion under 45 CFR 170.315(b)(11). The rule rescinds transparency and risk management obligations adopted under the HTI-1 Final Rule. It repeals mandatory model card disclosures covering algorithmic training data provenance, target populations, performance metrics across demographic groups, and funding sources, together with formal intervention risk management requirements for predictive decision support interventions (PDSIs). It also removes the legacy clinical decision support criterion in 45 CFR 170.315(a)(9) and narrows the standard data required to support predictive interventions.

Definitions

Decision Support Intervention (DSI): Software technology intended to support clinical decision-making by providing evidence-based or predictive recommendations, alerts, or insights directly within clinical workflows. The certification framework addresses both evidence-based interventions and predictive tools.

Predictive Decision Support Intervention (PDSI): An automated tool or algorithmic model that uses mathematical formulas, machine learning, deep learning, statistical modeling, or artificial intelligence to calculate probabilities, risk scores, or predicted clinical outcomes from patient data.

Source Attributes and Model Cards: Standardized information about an algorithm, including intended clinical use, technical limitations, demographic composition of training data, validation methods, performance metrics, and funding sources. The rule removes certification requirements for capabilities enabling users to access, review, or modify these disclosures.

Health IT Module: A health software component or electronic health record system submitted for certification under the ONC Health IT Certification Program.

USCDI Data Classes: Standardized health data elements defined in the United States Core Data for Interoperability under 45 CFR 170.213 and used for interoperable health information exchange. The revised predictive DSI criterion draws on a narrower selection of clinical data rather than requiring selection capabilities across the entire USCDI standard.

Governance and Institutional Framework

ONC, operating under ASTP within HHS, governs the certification framework pursuant to authority under the Health Information Technology for Economic and Clinical Health (HITECH) Act and the 21st Century Cures Act. ONC establishes the voluntary certification criteria that electronic health record developers must meet to obtain Health IT Module certification. ONC-Authorized Testing Laboratories (ONC-ATLs) conduct technical software evaluations. ONC-Authorized Certification Bodies (ONC-ACBs) issue product certifications and conduct post-certification surveillance.

Removing model card and intervention risk management requirements from the certification program reduces the obligations assessed through that program. It does not eliminate the roles of other federal authorities responsible for clinical software. The Food and Drug Administration (FDA) retains medical device software oversight under the Federal Food, Drug, and Cosmetic Act, including oversight of high-risk clinical software within its jurisdiction.

The HHS Office for Civil Rights (OCR) enforces nondiscrimination requirements under Section 1557 of the Affordable Care Act and 45 CFR 92.210. Those requirements address discriminatory use of clinical algorithms in healthcare delivery. Certification changes therefore operate alongside medical device oversight and civil rights obligations rather than replacing those separate legal frameworks.

Key Focus Areas

Elimination of model cards and source attribute disclosures: The rule removes 45 CFR 170.315(b)(11)(iv) and (v). Certified health IT developers no longer need to build capabilities enabling clinical users to access, review, or modify source attribute disclosures for evidence-based or predictive decision support interventions. Removed disclosures include information about training data, intended populations, validation, demographic performance, limitations, and funding.

Elimination of intervention risk management: The rule revokes 45 CFR 170.315(b)(11)(vi), which required formal ongoing risk management for supplied PDSIs. The removed certification obligations encompassed drift monitoring, performance auditing, bias mitigation, and safety controls. These activities are no longer required through that DSI certification paragraph.

Narrowing predictive DSI data inputs: Revisions to 45 CFR 170.315(b)(11)(iii)(B) limit the standard data types required to enable selection of predictive DSIs. Instead of covering any data element across the entire USCDI standard, including nonclinical attributes such as telephone numbers, the criterion is limited to the core clinical data elements in paragraph (b)(11)(iii)(A), together with the Clinical Notes and Assessment and Plan of Treatment data classes.

Streamlining intervention triggers and contraindication checking: Paragraph 170.315(b)(11)(ii)(B), which required interventions triggered specifically when transition-of-care or referral summaries were incorporated, is removed and subsequent paragraphs are redesignated. Explicit references to drug-drug and drug-allergy contraindication checking in paragraph (b)(11)(iii) are also removed. Underlying functionality remains addressed through medication and allergy data elements in paragraphs (b)(11)(iii)(A)(2) and (3).

Repeal of the legacy clinical decision support criterion: The rule removes and reserves 45 CFR 170.315(a)(9). This eliminates the legacy CDS certification criterion while retaining the revised DSI framework under paragraph (b)(11).

Implementation Framework

Participating health IT developers must align software engineering, certification submissions, and documentation workflows with the reduced criterion set. Developers seeking certification or updating certifications under 45 CFR 170.315(b)(11) are no longer assessed by ONC-ATLs or ONC-ACBs on their ability to display model cards, present training details to clinicians at the point of care, or maintain formal intervention risk management plans under the removed certification provisions.

The rule retains core user-activation capabilities. Health IT Modules must enable authorized administrative or clinical users to select and activate specific evidence-based and predictive DSIs using the applicable data specified in 170.315(b)(11)(iii). For predictive interventions, the required selection capabilities use the narrowed clinical dataset, including Clinical Notes and Assessment and Plan of Treatment.

Feedback tools remain part of the revised framework. Redesignated 45 CFR 170.315(b)(11)(ii)(B) preserves mechanisms allowing healthcare organizations to electronically capture, export, and report feedback on real-world DSI performance and quality. Developers may remove mandatory source attribute display workflows if desired, but the removal of disclosure requirements does not remove retained activation or feedback functionality. Updated privacy and security cross-certification requirements under 170.315(h)(3)(ii) also apply to modules certified to paragraph (b)(11) on the specified compliance date.

Monitoring and Evaluation

ONC considered public comments and trade research in finalizing the rule. The agency identified limited clinician time and technical expertise for reviewing detailed source attributes or model cards during busy clinical encounters. It concluded that mandatory federal model card requirements imposed disproportionate compliance overhead on developers without demonstrating a measurable positive impact on clinical outcomes.

The revised approach shifts monitoring and evaluation of AI performance away from standardized federal certification requirements for model disclosures and intervention risk management toward market interactions and localized governance. ONC encourages users of certified health IT to ask their developers for information on the quality and performance of the DSIs they supply.

ONC states that industry-led efforts to provide transparency have promise, and other authorities, such as the FDA, keep their own oversight of clinical software. Healthcare organizations can retain local review processes for clinical accuracy, safety, bias, and performance even where those activities are no longer mandated by the removed ONC certification paragraphs. The preserved electronic feedback capabilities support continued collection and reporting of real-world intervention performance and quality information.

Penalties, Liability, and Appeals

Nonconformity with certification criteria that remain applicable can lead to ONC-ACB findings, mandatory corrective action plans, or potential revocation of Health IT Module certification. For example, failure to support required user selection or activation capabilities involving clinical note data classes remains relevant to certification compliance. Removing model card and intervention risk management provisions does not eliminate enforcement of the remaining criteria.

Certification enforcement operates through established administrative procedures under 45 CFR Part 170, Subpart E, including notice and opportunities to appeal certification actions. Developers must distinguish removed requirements from obligations retained or newly cross-referenced by the amended framework when planning corrective actions and certification maintenance.

Public commenters raised concerns about the allocation of legal liability and governance responsibilities. Opponents argued that eliminating mandatory model card disclosures shifts the burden of evaluating algorithmic safety, bias, and clinical accuracy onto hospitals and healthcare providers. ONC acknowledged those concerns while emphasizing that providers remain subject to applicable legal obligations, including civil rights requirements under 45 CFR 92.210. Healthcare providers' obligations regarding unlawful discrimination and patient harm remain independent of whether transparency is required by health IT certification standards.

Relationship to Other Instruments

The HTI-5 Final Rule directly amends regulations established through earlier ONC rulemakings and supersedes key DSI provisions adopted under the HTI-1 Final Rule, published at 89 FR 1192. The relevant regulatory foundation is 45 CFR Part 170, which contains health information technology standards, implementation specifications, certification criteria, and certification program procedures.

Section 170.213 supplies references to the United States Core Data for Interoperability. HTI-5 changes how the DSI criterion draws on standardized data by narrowing the required inputs for predictive intervention selection rather than requiring the full range of USCDI elements. Section 170.315 contains the revised DSI criterion and the removed legacy CDS criterion.

Section 1557 regulations at 45 CFR 92.210 provide a separate civil rights framework addressing discrimination associated with clinical decision tools. FDA software-as-a-medical-device oversight under the Federal Food, Drug, and Cosmetic Act provides complementary regulation of software function safety for products within medical device jurisdiction. Executive Orders 14192 and 14267 supply the rule's broader deregulatory and competition policy context.

International Alignment

The rule reflects a U.S. approach emphasizing federal deregulation and administrative burden reduction for healthcare software certification. It removes specified mandatory documentation and risk management requirements from the ONC program while leaving roles for voluntary transparency practices, local clinical governance, procurement arrangements, and other legal authorities.

This approach contrasts with the European Union Artificial Intelligence Act, which establishes mandatory transparency, technical documentation, human oversight, and premarket risk management requirements for high-risk AI systems, including medical AI tools within its scope. Whereas that framework uses standardized regulatory documentation and oversight requirements for covered high-risk applications, the revised ONC framework leaves model card disclosure and intervention risk management outside the specified certification requirements. The distinction concerns the design of regulatory oversight rather than the elimination of all U.S. obligations affecting clinical AI.

Implementation Timeline

Sources and References