HHS finalizes HTI-5 rule, removing 14 EHR certification requirements

On October 26, 2026, the Department of Health and Human Services and the Office of the National Coordinator for Health IT published the HTI-5 final rule, cutting 14 of the 60 criteria used to certify electronic health record software sold by vendors such as Epic and Oracle, and revising seven others. The final rule is significantly narrower than the version proposed in December 2025, which had called for eliminating 34 criteria; key privacy, security, and multi-factor authentication requirements were retained after commenters raised concerns about patient safety.

Among the changes that did make it through: annual Real World Testing plan submissions are eliminated, reporting metrics under the Insights Condition are reduced, and the so-called "model card" transparency mandates — which had required EHR vendors to disclose source attributes for AI-assisted clinical decision tools — are removed. HHS projects the rule will reduce regulatory costs by more than $1.5 billion. Most changes take effect 60 days after the rule's publication date, with some pushed to January 1, 2027.

Information blocking proposals that were included in the draft rule were dropped entirely from this final version and remain under consideration for a future HTI-6 rulemaking, which the 2026 Unified Agenda lists as expected in November. Health IT leaders at hospitals and health systems may want to review the ONC HTI-5 Criteria Removals and Revisions Fact Sheet to understand which certification requirements their EHR vendors will no longer need to meet, particularly those related to AI transparency, and to assess what that means for any internal governance policies built around those disclosures.