On December 29, 2025, the U.S. Department of Health and Human Services (“HHS”), through the Assistant Secretary for Technology Policy (“ASTP”)/Office of the National Coordinator for Health Information Technology (“ONC”) (collectively, “ASTP/ONC”), issued a proposed rule to update its Health Data, Technology, and Interoperability (“HTI”) regulations, as well as a notice to withdraw prior proposals issued as part of the HTI-2 proposed rule.   

HTI-5 Proposed Rule

The proposed rule, Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity (“HTI-5”), proposes (1) changing the certification criteria for the ONC Health IT Certification Program, (2) prioritizing the use of Fast Healthcare Interoperability Resources (“FHIR”) application programming interfaces (“APIs”), and (3) updating certain information blocking requirements.  The HTI-5 proposed rule is open for comment until February 27, 2026. 

Key topics in the HTI-5 proposed rule include:

  • Elimination or Revision of Several ONC Health IT Certification Program Criteria:  For background, as part of the ONC Health IT Certification Program, developers must certify that their health IT modules conform to certain functional requirements, known as “certification criteria.”  As part of the HTI-5 proposed rule, ASTP/ONC proposes to eliminate or revise more than half of the existing current certification criteria.  Specifically, the HTI-5 proposed rule would eliminate 34 and revise seven of the existing 60 certification criteria, as shown here. 

Among the certification criteria that ASTP/ONC proposes to revise is the requirement applicable to decision support interventions (“DSIs”).  Currently, health IT developers must provide detailed source attribute information for “predictive DSIs”—including AI‑based systems—when such tools are supplied as part of certified health IT.  These source attributes, referred to by ASTP/ONC as the “AI model card” requirements, include information such as the intervention’s intended use, the target patient population and end users, known risks, the nature of the training data and inputs, and the processes used for external validation, among other specified details.  The HTI‑5 proposed rule would amend this criterion by eliminating both the requirement for developers to supply this source attribute information and the requirement to implement certain risk management practices for predictive DSIs.

ASTP/ONC also proposes to remove the privacy and security certification criteria in 45 C.F.R. § 170.315(d), which include, among others, authentication, access control, and authorization requirements.  ASTP/ONC states in the proposed rule that there is a disconnect between these existing criteria and the requirements that most purchasers and users of certified health IT are subject to under the HIPAA Privacy and Security Rules, which has led to unnecessary regulatory burden.

  • Prioritization of a FHIR-Based API Ecosystem for Information Exchange:  In the proposed rule, ASTP/ONC states that its proposals to revise the ONC Health IT Certification, as discussed above, aim to “reset” the program to prioritize FHIR-based APIs over “functionality-oriented criteria.”  In particular, ASTP/ONC states that it intends to “sharpen the [program’s] future focus to prioritize FHIR-based APIs that: (1) enhance automation and API performance; (2) move beyond read-only interactions; and (3) expand the scope of data available to support clinical efficiency, patient-centered care, and timely reporting (e.g., public health, quality, government programs) use cases.”  ASTP/ONC states that this movement toward the prioritization of FHIR-based APIs will also support the development of “creative [AI]-enabled interoperability solutions.”
  • Revisions to Information Blocking Requirements:  For background, the 21st Century Cures Act and ONC’s implementing regulations prohibit “information blocking,” which is a practice that is likely to interfere with access, exchange, or use of electronic health information (“EHI”), unless an exception applies.  The HTI-5 proposed rule proposes to update the definitions of “access” and “use” to emphasize that these definitions include automated means of access, exchange, or use of electronic health information (“EHI”), including autonomous AI systems. 

ASTP/ONC also proposes to revise its exceptions for practices that are not information blocking to: (1) remove or revise certain conditions from the Infeasibility Exception, (2) remove the TEFCA Manner Exception, and (3) revise the “manner requested” condition in the Manner Exception.  As it relates to the proposal to remove the TEFCA Manner Exception, ASTP/ONC states that the exception was intended to incentivize participation in TEFCA, but ASTP/ONC believes the exception is sometimes applied in a manner that demonstrates a misunderstanding of the exception and harms information exchange.  ASTP/ONC states that it is no longer necessary to retain this exception to incentivize participation in TEFCA, as there has been significant maturation and advancement of TEFCA in recent years.

In addition to the HTI-5 proposed rule, ASTP/ONC also recently issued several new information blocking FAQs, which relate to several of the proposals discussed above, including access to EHI by automated technologies and the information blocking exceptions noted above.

The HTI-5 proposed rule may be one of multiple HTI proposals issued in the coming months, as ASTP/ONC has signaled that a HTI-6 proposed rule may be issued this spring or summer and could require electronic health records to support data exchange with wearables.

Withdrawal Notice

The notice, the Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability; Withdrawal formally withdraws the proposals in the HTI-2 proposed rule that were not finalized in the HTI-2 and HTI-4 final rules.  

ASTP/ONC states that its decision to formally withdraw the remaining proposals is based on several reasons, including comments received in response to the HTI-2 proposed rule and the administration’s recent request for information related to deregulation, the Trump administration’s broader deregulatory focus, and changes in technology, such as newer standards, updated API interfaces, and emerging AI technologies.

Tags: Health data, Health IT, HHS, information blocking
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Anna D. Kraus Anna D. Kraus

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into…

Anna Durand Kraus advises on issues relating to the complex array of laws governing the health care industry. Her background as Deputy General Counsel to the U.S. Department of Health and Human Services (“HHS”) gives her broad experience with, and valuable insight into, the programs and issues within the purview of HHS, including Medicare, Medicaid, fraud and abuse, and HIPAA privacy and security. Anna is co-chair of the firm’s Health Care Industry practice group.

Anna regularly advises clients on Medicare reimbursement matters, particularly those arising under Part B and the Part D prescription drug benefit. She also has extensive experience with the Medicaid Drug Rebate program. She assists numerous pharmaceutical and device manufacturers, health care providers, pharmacy benefit managers, and other health care industry stakeholders to navigate the challenges and opportunities presented by the Affordable Care Act.

Anna is a trusted adviser on health information privacy, security and breach notification issues, including those arising under the Health Insurance Portability and Accountability Act (“HIPAA”) and the Health Information Technology for Economic and Clinical Health (“HITECH”) Act. Her background in this area dates back to the issuance of the original HIPAA privacy regulations.

Anna’s clients depend on her to guide them through compliance with the Anti-Kickback statute, the Stark regulations, and other laws preventing fraud and abuse in the health care industry. Her deep knowledge of these laws has made her an important component of the firm’s representation of pharmaceutical companies and health care organizations under federal investigation or facing allegations under the False Claims Act. In addition, clients contemplating acquisitions in the health care sector rely on her to guide due diligence efforts.

Read more about Anna D. KrausEmail
Show more Show less
Photo of Elizabeth Brim Elizabeth Brim

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and…

Elizabeth Brim is an associate in the firm’s Washington, DC office, where she is a member of the Data Privacy and Cybersecurity and Health Care Practice Groups and advises clients on a broad range of regulatory and compliance issues related to privacy and health care.

Elizabeth’s practice includes counseling clients on compliance with the complex web of health information privacy laws and regulations, such as HIPAA, the FTC’s Health Breach Notification Rule, and state medical and consumer health privacy laws as well as state consumer privacy and genetic privacy laws. She also advises clients on health care compliance issues, such as fraud and abuse, market access, and pricing and reimbursement activities.

Elizabeth routinely advises on regulatory compliance as part of transactions, clinical trial programs, collaborations and other activities that involve genetic data, and the development and operation of digital health products. As part of her practice, Elizabeth routinely counsels clients on drafting and negotiating privacy and health care terms with vendors and third parties and developing privacy notices and consent forms. In addition, Elizabeth maintains an active pro bono practice.

Elizabeth is an author of the American Health Law Association treatise, Pricing, Market Access, and Reimbursement Principles: Drugs, Biologicals and Medical Devices and the U.S. chapter of the Global Legal Insights treatise, Pricing & Reimbursement Laws and Regulations.

Read more about Elizabeth BrimEmail
Show more Show less