---
title: "HTI-5 Final Rule: Less Regulation, but What Does It Mean for Healthcare Stakeholders?"
description: ONC's HTI-5 final rule reduces health IT certification requirements, easing developer burdens while preserving essential safeguards for patient safety and interoperability.
---

[POCP Blog](https://blog.pocp.com/blog)

# [HTI-5 Final Rule: Less Regulation, but What Does It Mean for Healthcare Stakeholders?](https://blog.pocp.com/blog/hti-5-final-rule-less-regulation-but-what-does-it-mean-for-healthcare-stakeholders)

 Written by [Mary Griskewicz](https://blog.pocp.com/blog/author/mary-griskewicz) | Nov 6, 2026, 1:23:01 PM

co-authored by [Vanessa Candelora](https://www.linkedin.com/in/vcandelora/),  PP&T Management & Operations Lead 

##### Industry feedback narrowed ONC's deregulatory agenda, preserving key safeguards while changing expectations for developers and the organizations that rely on their technology.

On October 26, 2026, the Office of the National Coordinator for Health Information Technology (ONC) released the [Health Data, Technology, and Interoperability (HTI-5) final rule](https://www.hhs.gov/press-room/hhs-finalizes-hti-5-deregulatory-rule.html), reducing requirements for certified health IT. ONC’s goal is to “lower the administrative and compliance burden on developers so that they can spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans,” National Coordinator for Health IT Tom Keane, MD, said in the news release.

The final rule removes 14 certification criteria and revises seven, rather than eliminating the 34 originally proposed. The Department of Health and Human Services (HHS) estimates industry regulatory savings of more than $1.5 billion.

Most provisions take effect 60 days after publication, while certain changes take effect Jan. 1, 2027. The removal of certain document-based exchange and Direct messaging requirements from the transitions-of-care criterion takes effect Jan. 1, 2030.

But the more interesting story may be what *didn't* make it into the final rule. ONC deferred all proposed changes to the information blocking regulations, including clarifying that automated tools and AI agents can be legitimate users of health data and removing the Trusted Exchange Framework and Common Agreement (TEFCA) Manner Exception.

Comments from providers, hospitals, developers, and industry associations, including the EHR Association, helped narrow the proposal and balance regulatory relief and innovation with safeguards for patient safety, security, and trust.

Developers bear the direct certification obligations, but the changes affect every organization that purchases, integrates with, or relies on certified health IT.

## Understanding the HTI Rule Series: The Bigger Regulatory Picture

Introduced in 2023, ONC's HTI naming convention organizes federal health IT and interoperability updates, including implementation of the 21st Century Cures Act. The rules address three interconnected priorities:

- **Updating health IT certification:** Refining standards and capabilities for EHRs and other health IT modules, including the United States Core Data for Interoperability (USCDI) and Fast Healthcare Interoperability Resources (FHIR).
- **Advancing interoperability:** Supporting secure, efficient information exchange and the shift from documents toward standards-based APIs.
- **Addressing information blocking:** Preventing unnecessary interference with electronic health information access, exchange, or use. These regulations apply to providers, certified health IT developers, and health information networks and exchanges.

The rules have addressed different priorities over time, from algorithm transparency and information sharing in HTI-1 to electronic prescribing and prior authorization capabilities in HTI-4.

HTI-5 shifts the emphasis to narrowing the existing certification program while laying groundwork for future interoperability requirements.

## What Changed Between the Proposed and Final Rule?

The original proposal sought to eliminate requirements which ONC considered duplicative, outdated, or burdensome. Industry feedback challenged which requirements fit those descriptions.

### Privacy, Security, and Accessibility: Industry Pushback Makes a Difference

ONC retained privacy, security, quality management, and accessibility certification requirements after healthcare organizations and professional associations warned that removing them could weaken safeguards and shift responsibility to purchasers.

The American Hospital Association (AHA) and other provider organizations emphasized certification's role in protecting patient information and supporting reliable care. Without that baseline, purchasers could bear more responsibility for evaluating and maintaining essential capabilities.

By preserving these safeguards, industry feedback helped maintain a common baseline of expectations across healthcare technology products.

### AI Transparency: Federal Requirements Removed, but the Need Remains

ONC eliminated AI model card requirements under the Decision Support Interventions (DSI) certification criteria despite concerns from the AHA and other provider organizations. The requirements were intended to help purchasers evaluate predictive algorithms and AI-enabled clinical decision support.

Developers lose a federal documentation obligation, but health systems still need to assess how AI tools work, their data, performance, and workflow risks. Procurement, contracts, vendor assessments, and AI governance may need to fill that gap, potentially creating different documentation expectations across customers and jurisdictions.

Developers and their customers will need to work together to establish appropriate oversight and trust. Removing AI transparency requirements from certification does not diminish transparency's importance. Perhaps collaboration to adopt a common standard is the next best step?

### Legacy Requirements: Reducing Burden While Preserving a Transition Path

The rule eliminates criteria for legacy clinical decision support, Direct secure messaging and email, security tags for summary-of-care documents, and care plans. Family health history and certain application access criteria sunset on January 1, 2027, reducing developers' maintenance costs and complexity.

To avoid disrupting workflows that rely on Consolidated Clinical Document Architecture (C-CDA) documents, ONC set January 1, 2030, as the effective date for changes to the document-based transitions-of-care criterion. This provides time to plan API-based exchange as FHIR standard adoption progresses at different speeds.

Stakeholders can use the extended timeline to coordinate modernization and avoid unnecessary disruption to current operations as the shift toward FHIR-enabled interoperability continues.

Importantly, removal of a standalone certification criterion does not automatically prohibit continued use of the underlying technology or eliminate every other requirement that may apply to it.

## What Does HTI-5 Mean for Different Healthcare Stakeholders?

HTI-5 directly affects certified health IT developers, but its implications extend to organizations that rely on their products:

### Health Technology Vendors

Reduced certification, testing, and documentation requirements can free resources for innovation. Before retiring capabilities, developers should assess customer workflows, contracts, and integrations, coordinate modernization plans around the extended C-CDA timeline and consider voluntary AI documentation to support customer trust and procurement.

### Health Systems and Providers

Retained privacy, security, accessibility, and quality management criteria preserve baseline safeguards. Providers may need stronger vendor assessments and AI governance for capabilities no longer covered by certification. The extended C-CDA timeline offers time to coordinate FHIR adoption with vendors and exchange partners, especially for smaller, rural, and under-resourced organizations.

### Health Plans and PBMs

Health plans and PBMs depend on certified systems for data exchange. Aligning FHIR investments, including those supporting CMS-0057-F, with provider modernization can improve prior authorization and other workflows. The January 2030 C-CDA date applies to the relevant ONC certification criterion, not a universal payer or PBM deadline. Future information blocking policies on automated access also warrant monitoring, as does the deferred proposal to remove the TEFCA Manner Exception. For payers participating in TEFCA, the outcome could affect whether provider data requests are routed through TEFCA or fulfilled through direct FHIR API connections.

### Life Sciences Manufacturers

Certification changes may affect EHR-enabled prescribing, prior authorization, clinical decision support, and patient support initiatives, even though manufacturers generally are not directly responsible for certification compliance. Work with technology partners on scalable FHIR integrations and AI transparency, but do not assume fewer certification requirements will immediately produce new capabilities; vendor roadmaps, implementation choices, and use-case requirements still matter.

## Looking Ahead: What to Expect from HTI-6

The federal Unified Agenda identifies the next anticipated rule, *Health Data, Technology, and Interoperability: Application Programming Interfaces and Information Blocking (HTI-6)*, as addressing standards adoption, expanded APIs, information blocking, and targeted Conditions of Certification. Areas to watch include:

- **Automated access:** ONC deferred HTI-5 proposals on robotic process automation (RPA) and agentic AI. Future rulemaking may clarify how information blocking requirements, which can already apply to automated access, balance legitimate access with security and system performance.
- **Expanded APIs:** Potential uses beyond patient access include payer-provider exchange, clinical and administrative workflow integration, and AI-enabled access. Specific standards, criteria, and timelines remain to be proposed.
- **Information blocking:** Updates could clarify how exceptions apply to evolving technologies and data-sharing practices, with implications for providers, developers, and health information networks and exchanges. ONC also deferred its proposal to remove the TEFCA Manner Exception, which lets a data holder fulfill a request through TEFCA instead of a direct FHIR API connection when both parties participate in TEFCA. The exception remains in effect unless a future final rule removes it.
- **Conditions of Certification:** Targeted updates could affect developers' ongoing responsibilities for API access, interoperability, and real-world product support.

Details will remain uncertain until a proposed rule is published. Organizations should monitor HTI-6 and comment on proposals affecting workflows, technology investments, and information-sharing relationships.

## The Bigger Picture: Certification Is Changing, but Accountability Remains

HTI-5 reduces certification requirements, not the operational responsibilities of using healthcare technology. Industry comments preserved foundational safeguards, while other changes leave more decisions to developers and purchasers.

Developers must decide which capabilities to maintain; purchasers must scrutinize products and safeguards; and partners must assess effects on shared workflows. With HTI-6 expected to address APIs, information blocking, and automated access, organizations should ask:

- Which capabilities and integrations depend on changing certification requirements, and do our vendor assessments and contracts address the gaps?
- How will we evaluate and govern AI without federal certification documentation and government-mandated guardrails?
- How can we use transition timelines and coordinate with partners to modernize interoperability while preparing for future API and information blocking requirements?

The greatest opportunity is to turn compliance relief into stronger technology strategies, vendor and partner relationships, and readiness for the next phase of interoperability.

## How Point-of-Care Partners Can Help

Point-of-Care Partners helps developers, health plans, providers, and life sciences organizations translate evolving policy and standards into practical strategies.

Our team has the expertise to assess HTI-5's implications for certification, interoperability dependencies, FHIR adoption, and technology roadmaps, and to help organizations prepare for HTI-6 and contribute informed public comments.

[Connect with Point-of-Care Partners](https://www.pocp.com/contact/) to assess how HTI-5 and other policies affect your interoperability and technology roadmap. We can help you identify overlapping requirements and dependencies, prioritize investments, and determine which initiatives to tackle first.

 

[View full post](https://blog.pocp.com/blog/hti-5-final-rule-less-regulation-but-what-does-it-mean-for-healthcare-stakeholders)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Mary Griskewicz"
  },
  "dateModified" : "2026-11-06T13:23:01.716Z",
  "datePublished" : "2026-11-06T13:23:01Z",
  "headline" : "HTI-5 Final Rule: Less Regulation, but What Does It Mean for Healthcare Stakeholders?",
  "image" : {
    "@type" : "ImageObject",
    "height" : 1024,
    "url" : "https://6890714.fs1.hubspotusercontent-na1.net/hubfs/6890714/ONC%20as%20gardener%20Trimming%20a%20Lush%20Hedge.png",
    "width" : 1536
  },
  "mainEntityOfPage" : "https://blog.pocp.com/blog/hti-5-final-rule-less-regulation-but-what-does-it-mean-for-healthcare-stakeholders",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "POCP Blog"
  }
}
```