HTI-5 Final Rule: What Changes for Health IT Developers

On 26 October, HHS released the HTI-5 final rule. HTI-5 changes the ONC Health IT Certification Program, the program behind the "certified EHR" label that hospitals and clinics rely on. It removes 14 of the program's 60 certification criteria and revises 7 more. HHS estimates the savings at more than $1.5 billion over time, or about $108 million a year, mostly in lower compliance costs for developers.

The final rule cuts far less than the proposal. The December 2025 draft wanted to remove 34 criteria. Several of the changes developers were watching most closely, including everything about information blocking, were left out for now.

This post explains what changed, what stayed and what to do next, whether you build health software or buy it.

Facts checked on 3 November 2026. Confirm the dates against the Federal Register before acting on them.

The rule in one paragraph

ONC certification is voluntary, but many programs require it. For example, hospitals and clinicians in Medicare's Promoting Interoperability Program must use certified technology. HTI-5 makes certification cheaper to keep. It removes some criteria, drops the annual Real World Testing plans and trims most Insights reporting. It also removes the AI "model card" transparency requirements. Privacy and security criteria stay. ONC describes the rule as a reset that clears the ground for new requirements built on FHIR APIs.

Key dates

• 26 October 2026: final rule released.
• 28 October 2026: published in the Federal Register.
• 28 December 2026: 13 changes take effect, 60 days after publication.
• 1 January 2027: 7 more changes take effect.
• 1 January 2030: C-CDA and Direct messaging are no longer required by the transitions of care criterion.

The 2030 date is the one to plan around. C-CDA documents sent over Direct have been the default way to exchange care summaries for over a decade. Removing them from certification is a clear sign that ONC expects that exchange to move to FHIR.

What changes, and what stays

Cut back

• 14 criteria removed and 7 revised. ONC has published the full list. Check it against every certified module you maintain.
• Real World Testing is lighter. Developers no longer submit an annual testing plan.
• Most Insights measures are gone. These were the reporting measures on how certified products are used.
• AI model cards are gone. The decision support interventions criterion no longer requires source attributes or risk management practices for predictive AI tools. Developers no longer have to publish details of how their models were trained, validated and tested.

Kept

• Privacy and security criteria, including multi-factor authentication, audit reports and the capability that helps users comply with HIPAA. The proposal to remove some of them was not finalised.
• The HTI-4 criteria for electronic prior authorisation and real-time prescription benefit checks.
• Public health reporting criteria.

Not decided yet

• Information blocking. All the proposed changes were deferred, including new definitions of "access" and "use" that would cover autonomous AI systems. The current rules and penalties still apply. HHS says the comments "remain under consideration", so these proposals may come back in a later rule.

What it means if you build health software

• Less paperwork, not less work. Fewer criteria and no annual testing plans free up time. Your customers still expect the features they have today, and many contracts require them.
• FHIR is where the next requirements will come from. ONC has said future rules will build on FHIR APIs, including APIs that write data, not only read it. If your product still depends on C-CDA files and Direct messages, start planning the move now. You have until 2030, and the move takes longer than most teams expect.
• AI transparency is now a sales question. Certification no longer requires model cards, but hospitals still have to manage the risks of the tools they use. In the US, 45 CFR 92.210 requires providers to identify and reduce discrimination in patient care decision tools. Expect buyers to ask for the same information through contracts and security questionnaires. Keeping your model documentation up to date makes those deals faster.
• Information blocking hasn't changed. If your product holds back, delays or makes it hard to export patient data, the existing rules still apply to you.

What it means if you buy health software

• Read your EHR renewal carefully. Commenters warned that features no longer required for certification could come back as paid add-ons. Ask your vendor in writing to keep the current functionality.
• Ask for AI information directly. Vendors no longer have to publish model cards, so add questions about training data, validation and known limits to your procurement process.
• Check your incentive program requirements. If you take part in Medicare Promoting Interoperability or another program that requires certified technology, confirm which version of the criteria it expects.

Next steps

1. Map each certified module against ONC's removal list and the three effective dates.
2. Update your certification listing, product pages and sales material.
3. Plan the move from C-CDA and Direct to FHIR-based exchange before 2030.
4. Keep your AI model documentation, even though certification no longer asks for it.
5. Providers: review EHR contracts for features that may turn into paid add-ons.
6. Everyone: keep information blocking compliance exactly as it is today.

Getting data out of separate systems was already hard, and HTI-5 pushes the industry further towards APIs. We wrote more about that in .

How Develenza can help

We build FHIR APIs and integrations for health software companies and providers, and we help teams move off older exchange formats. If you want help working out what HTI-5 means for your product or your systems contact, 

Sources