ONC Finalizes HTI-5, De-regulating Less than Anticipated and Punting on Information Blocking Changes

On October 28, 2026, the Office of the National Coordinator for Health Information Technology (ONC) released its final rule on “Deregulatory Actions to Unleash Prosperity”. The rule, known as HTI-5, contains substantial changes to ONC’s Health IT certification program and continues the push toward Fast Healthcare Interoperability Resources (FHIR)-based interoperability. However, the final rule’s impact is narrower than ONC’s initial proposal. ONC retained most of the Health IT certification criteria that it had proposed to remove and deferred every proposed change to the information blocking rule. 

We published an analysis of the proposed rule in January. With this post, we will explain the most important aspects of the final rule impacting the Health IT landscape next year. The rule becomes effective on December 28, although some aspects will not take effect until January 1, 2027.

Changes to Health IT Certification Program

The final rule removes 14 of the 60 existing criteria in the Health IT certification program, far fewer than the 34 ONC proposed, and revises the same 7 criteria identified in the proposal. As a result of ONC removing or revising the criteria, developers have fewer or modified requirements to become or remain Certified Health Information Technology under the ONC program. The remaining 39 criteria, including those added in 2025 through the HTI-4 rule, are unchanged. Notably, ONC retained all privacy and security certification criteria, the Quality Management System standards, and the accessibility-centered design requirements. 

The full HTI-5 criteria removal list includes:

• (a)(9) Clinical decision support
• (a)(12) Family health history
• (b)(7) Security tags – summary of care – send
• (b)(8) Security tags – summary of care – receive
• (b)(9) Care plan
• (c)(4) Clinical quality measures (CQMs) – filter
• (e)(3) Patient health information capture
• (g)(1) Automated numerator recording
• (g)(2) Automated measure calculation
• (g)(6) Consolidated CDA creation performance
• (g)(7) Application access – patient selection
• (g)(9) Application access – all data request
• (h)(1) Direct Project
• (h)(2) Direct Project, Edge Protocol and XDR/XDM

In keeping with the original focus of the proposed rule to steer the health care ecosystem toward FHIR‑based application programming interfaces (APIs) and away from Consolidated Clinical Document Architecture (C-CDA)-centered conformance, HTI-5 removes the requirement for C-CDA creation performance capability (§ 170.315(g)(6)) and other C‑CDA‑dependent capabilities.

Decision Support Interventions: AI Model Cards Removed

HTI-5 retires the legacy “clinical decision support” criterion at § 170.315(a)(9), consistent with its HTI‑1 sunset and replacement by the “decision support interventions” (DSI) criterion. Further, the final rule narrows the newer DSI criterion by removing the AI model-card source attribute transparency standards and risk management requirements. 

This is a consequential change in the final rule. HTI-1 required certified health IT with predictive DSIs to make available information about a tool’s training data, performance, and limitations, which gave health care organizations a way to evaluate predictive tools built into their electronic health records (EHRs). ONC finalized the removal even though a “large majority of commenters” opposed it, warning that it would shift “evaluation, governance, and liability burdens to providers and health systems” and away from developers that are better positioned to identify and communicate that information.

Without the model card requirements, certified EHRs no longer must meet a federal baseline of information about embedded predictive tools. Health systems will need to obtain that information by contract (which they are unlikely to successfully accomplish), including data provenance, performance across patient subgroups, update cadence, and monitoring responsibilities. Vendors that continue to publish model cards voluntarily may find it sets them apart in procurement.

Reductions to Conditions and Maintenance of Certification

HTI-5 pares down the Real-World Testing (RWT) requirements by eliminating the plan submission requirement and limiting full RWT results reporting to API-focused criteria, aligning RWT with the program’s API-first focus.

Consistent with ASTP/ONC’s April 2025 enforcement discretion notice, HTI-5 removes most Insights measures but retains required reporting on “use of FHIR bulk data access” as the reporting of that measure aligns with ONC’s FHIR-forward strategy. ONC is delaying the implementation of that measure until July 2029 to give Health IT developers more time to prepare for the reporting requirements.

ONC also finalized proposals to make conforming edits to ongoing requirement developers must meet to keep their certification: "Assurances" (§ 170.402), "Application Programming Interfaces" (§ 170.404), and "Attestations" (§ 170.406) Conditions and Maintenance of Certification requirements. These require developers to give assurances about appropriate access, exchange, and use of electronic health information, to meet requirements for their certified APIs, and to attest to their compliance. These edits do not add new obligations, though. 

Information Blocking

As discussed in our prior analysis, the proposed rule included targeted but impactful revisions to the information blocking rule at 45 CFR part 171. In proposing the changes, ONC was attempting to narrow exceptions that regulated entities rely on to support activities that would otherwise be information blocking. This narrowing effort would combat what ONC saw as misuse of the exceptions to the rule in an anti-competitive manner and to reflect the rising use of artificial intelligence and automation in health IT. These proposals included revising the definitions of “access” and “use”, removing the “third party seeking modification use” condition of the infeasibility exception, and narrowing the manner exception.

Definitions of “access” and “use”

ONC proposed to clarify that “access” and “use” of electronic health information (EHI) include automated means, “including, without limitation, autonomous AI system[s].” This change would have explicitly made interfering with requests made through APIs, automated services, or AI agents to potentially constitute information blocking. ONC did not explain why it did not finalize this proposal, and nothing in the final rule suggests that ONC has concluded the information blocking rule should not reach automated access. To the contrary, ONC’s information blocking FAQs explain that interfering with automation technologies could already implicate this rule. 

Third party seeking modification use condition

The infeasibility exception currently allows actors to deny requests from third parties seeking to modify EHI (e.g., writing data back to an EHR). ONC proposed to eliminate this option, citing concerns that it was being misused and that technology now supports secure two-way data exchange. If this condition had been removed, actors would no longer have been able to treat those requests as categorically infeasible and would need to consider alternative ways of fulfilling them.

Manner exception

If an actor could not agree with a requestor on terms for sharing data in the way requested, the actor could generally offer the data another way instead. ONC proposed that an actor could not rely on this flexibility if the terms it offered were not at market rate, were contracts of adhesion, or contained unconscionable terms. If this had been finalized, the ability of EHR developers and other actors would have been limited to use one-sided contract terms to restrict data access and could have given requestors more leverage in negotiating access agreements. 

While none of these proposals made it into the final rule, ONC has made clear that some of the proposals may be finalized in later rulemaking. Until then, the current information blocking exceptions remain in effect.

Bottom Line

HTI-5 does not go as far as the proposed rule in its deregulation efforts, but it still meaningfully reduces certification requirements and costs and reinforces ONC’s focus on FHIR APIs. Health IT developers and actors regulated by the information blocking rules should also keep an eye on future rulemakings as ONC will likely revisit one or more of these topics later.

Reed Smith will continue to track developments with regard to regulation of the Health IT ecosystem. If you have any questions or concerns about this rule, please do not hesitate to reach out to the authors of this post or to the health care attorneys at Reed Smith.