On October 26, 2026, the U.S. Department of Health and Human Services (“HHS”), through the Office of the National Coordinator for Health Information Technology (“ONC”), released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (“HTI-5”) final rule. Among other changes, the final rule removes or revises numerous certification criteria and requirements applicable to developers of certified health IT under the ONC Health IT Certification Program.

As discussed in our prior post, the HTI-5 proposed rule contemplated changes both to the Health IT Certification Program and to ONC’s information blocking regulations. However, the HTI-5 final rule did not contain any of the proposed changes to the information blocking regulations, which HHS stated “remain under consideration as part of HHS’ ongoing efforts to ad dress and eliminate information blocking.” We discuss key aspects of the final rule below.

Changes to the ONC Health IT Certification Program

As previously discussed, the HTI-5 proposed rule would have eliminated 34 and revised seven of the Health IT Certification Program’s 60 certification criteria. The final rule is narrower than proposed; it removes 14 criteria and revises seven criteria, with 39 criteria left unchanged, including certain criteria revised as part of the HTI-4 final rule. ONC has published a table overviewing which criteria were removed and revised here.

ONC describes these changes as part of a broader effort to shift the Health IT Certification Program away from functionality-oriented certification criteria and toward future requirements centered on FHIR-based APIs. Changes to the Health IT Certification Program and its criteria include:

• Decision Support Interventions (“DSI”). The final rule revises the DSI certification criterion by eliminating requirements to provide certain “source attributes” for evidence-based and predictive DSIs. ONC has referred to these source-attribute requirements for predictive DSIs as AI “model card” requirements, which address matters such as intended use, intended users and patient populations, known risks, training data, and external validation. The revision also removes certain risk-management practice requirements applicable to predictive DSIs.

• Patient Access and Data Exchange. The final rule removes certain functionality-focused criteria, including criteria for patient health information capture, application access for patient selection and all-data requests, and Direct Project-based exchange. For example, in removing the patient health information capture criterion, ONC noted that the relevant capabilities are “widely implemented and used in health IT at this time,” “suggesting that these capabilities will remain in health IT products even if the corresponding criterion is removed.” The final rule also revises the criterion for patients to view, download, and transmit their health information to a third party by removing certain technical requirements, including conformance with specified web accessibility and network time protocol standards.

• Real World Testing. The final rule reduces Real World Testing requirements for developers of certified health IT, including by eliminating requirements to submit annual Real World Testing plans and narrowing the requirements for Real World Testing results. ONC had already exercised enforcement discretion with respect to certain Real World Testing requirements, including the requirement to submit an annual plan, pending completion of this rulemaking.

By contrast, among other criteria left unchanged, ONC did not finalize its proposal to remove the privacy and security certification criteria, which include requirements related to authentication, access control, and authorization.

The HTI-5 final rule generally takes effect on December 28, 2026, with later effective dates for certain changes to certification criteria.

Looking Ahead

ONC is also expected to issue the HTI-6 proposed rule, which, according to the 2026 Unified Agenda, is anticipated to address standards adoption, expanded uses of APIs and potential successor technologies, enhancements to the conditions of certification, and revisions to the information blocking regulations. The timing for the HTI-6 proposed rule is not yet clear.