HHS Finalizes HTI-5 Rule, Projecting $1.5 Billion in Health IT Regulatory Savings

The U.S. Department of Health and Human Services (HHS) finalized the Health Data, Technology, and Interoperability (HTI-5) Final Rule on October 26, 2026, eliminating certain health IT certification requirements and reducing regulatory burdens for technology developers.

The rule, formally titled ONC Deregulatory Actions to Unleash Prosperity, is projected to save approximately $1.55 billion in regulatory costs while giving health IT developers greater flexibility to innovate and improve technologies used by clinicians and patients.

According to Becker’s Hospital Review, the final rule also scales back artificial intelligence (AI) transparency requirements and modifies standards affecting care coordination, patient engagement, and electronic health information exchange.

What’s Changing Under the HTI-5 Final Rule?

HHS initially proposed eliminating 34 of the program’s 60 certification criteria in December 2025. However, the final rule takes a more limited approach.

As reported by Becker’s Hospital Review and outlined in ONC’s final rule materials, the rule:

• Eliminates 14 certification criteria, reducing administrative and compliance requirements for health IT developers.
• Revises seven certification criteria, including requirements related to care coordination, patient engagement, and health information exchange.
• Retains 39 existing criteria, maintaining much of the certification program’s current framework.
• Reduces AI transparency requirements, including eliminating certain model-card requirements for predictive decision-support interventions.

The AI changes are particularly significant. Requirements introduced under the earlier HTI-1 rule were intended to provide healthcare organizations with information about predictive algorithms and decision-support tools incorporated into certified health IT.

While HTI-5 eliminates certain federal certification-related AI transparency requirements, it does not eliminate healthcare organizations’ responsibility to evaluate the safety, reliability, and security of AI-enabled technologies. Organizations may need to rely more heavily on vendor documentation and their own risk assessments when evaluating these tools.

Projected Savings and Greater Flexibility

HHS estimates the rule will generate approximately $1.55 billion in present-value regulatory savings, equivalent to $108.1 million in annualized net savings beginning in 2027, according to Becker’s Hospital Review.

These figures represent projected reductions in regulatory compliance costs, primarily benefiting health IT developers, rather than direct savings for healthcare providers or patients.

The administration maintains that reducing regulatory requirements will allow developers to redirect resources toward improving technologies used by clinicians and patients.

The changes also lay the groundwork for ONC’s future efforts to advance interoperability through Fast Healthcare Interoperability Resources (FHIR)-based application programming interfaces (APIs), which support the electronic exchange of health information.

Information Blocking Requirements Remain Under Review

The HTI-5 Final Rule does not resolve proposed changes to federal information blocking regulations.

HHS indicated that public comments on those proposals remain under consideration as the agency continues efforts to address practices that interfere with the access, exchange, or use of electronic health information.

ONC also updated its enforcement discretion notices to align with the final rule. Most existing notices will no longer apply and will be archived when the rule takes effect.

Healthcare organizations should continue complying with applicable information blocking requirements while monitoring future regulatory developments.

When Does the HTI-5 Rule Take Effect?

The rule is scheduled for publication in the Federal Register on October 28, 2026, with implementation occurring in stages:

• December 27, 2026: Most provisions take effect, 60 days after publication.
• January 1, 2027: Certain additional changes become effective.
• January 1, 2030: Changes to the transitions-of-care certification criterion take effect, removing certain document-based exchange and Direct messaging requirements associated with that criterion.

What Healthcare Organizations Should Do

Although HTI-5 primarily affects certified health IT developers, healthcare organizations should understand how the changes may affect their systems, vendors, and compliance programs.

Consider these actions:

1. Contact technology vendors. Ask EHR and other certified health IT vendors how the changes affect their products, certifications, and planned updates.
2. Evaluate AI transparency. Review vendor documentation and oversight practices for AI-powered clinical decision-support tools, particularly where certification-related disclosures are being eliminated.
3. Monitor interoperability changes. Understand how evolving certification requirements may affect patient access, care coordination, and electronic information exchange.
4. Maintain HIPAA safeguards. Continue protecting electronic protected health information (ePHI) and meeting applicable privacy and security requirements.
5. Track implementation deadlines. Review the final rule and upcoming ONC guidance to identify changes relevant to your organization.

Reduced Certification Requirements Do Not Change HIPAA Obligations

Importantly, ONC certification requirements and HIPAA regulations serve different purposes.

ONC certification establishes technical standards and capabilities for certain health IT products, while HIPAA establishes privacy and security obligations for covered entities and business associates.

Removing a certification criterion does not automatically eliminate a healthcare organization’s responsibility to safeguard electronic protected health information (ePHI).

Healthcare organizations should continue assessing vendor security practices, managing technology risks, and maintaining appropriate safeguards, regardless of changes to federal certification requirements.

The Bottom Line

The HTI-5 Final Rule marks a significant shift toward reducing federal health IT certification requirements while giving developers greater flexibility to innovate.

However, fewer certification requirements do not eliminate healthcare organizations’ responsibilities to safeguard patient information, evaluate technology risks, and comply with HIPAA and other applicable regulations.

As health IT certification requirements evolve, healthcare organizations should remain engaged with their technology vendors and ensure that innovation does not come at the expense of privacy, security, or patient trust.