HTI-5 final rule drops 14 of 60 EHR certification criteria
The HTI-5 final rule, issued by HHS on October 26, 2026, removes 14 of the 60 criteria used to certify electronic health record software sold by companies such as Epic and Oracle, and substantially revises seven more. The cut covers security, privacy and transparency requirements. For health IT vendors it means less compliance work; for hospitals, more of their own checks on the software they buy.
Why HHS set out to cut certification rules
HHS says its certification rules had become a burden on the companies that build health record software. When it proposed HTI-5 on December 22, 2025, the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT, known as ASTP/ONC, framed the rule as part of President Trump's Executive Order 14192 on deregulation and of the administration's goal of leading in artificial intelligence.
The proposal had three goals: remove redundant requirements from the voluntary ONC Health IT Certification Program, update the information blocking rules so patients' access to their data is not blocked, and lay a new foundation of FHIR-based application programming interfaces for AI-enabled data exchange.
What the final rule changes
The final rule, issued on Monday, October 26, 2026, eliminated 14 of the 60 criteria used to certify electronic health record systems sold by companies such as Epic and Oracle, STAT reported. Seven other criteria were substantially revised. The 14 removed requirements cover security, privacy and transparency.
The final cut is smaller than the plan. In December 2025 the agency had proposed removing over 50% of the program's certification criteria, revising several others and permanently adopting earlier enforcement discretion notices.
How the certification program works for vendors
Certification is how health IT developers show that their software meets federal criteria, and HHS describes the program as voluntary. Each criterion is a requirement a product must meet to be certified. Fewer criteria mean fewer features a vendor must build, test and document to keep its certification.
HHS wants the program's future to rest on standards-based APIs such as FHIR, which let one system request and receive health data from another in a common format. The agency says that focus is meant to support AI-enabled interoperability tools, the software that moves and reads patient records across systems.
"These proposals reflect a commonsense approach that removes redundant requirements on health IT developers, that better ensures seamless patient access to their information and that sets a foundation for AI-based data exchange." — Tom Keane, MD, National Coordinator for Health IT, on the HTI-5 proposal
What HHS expects the HTI-5 final rule to save
The savings figures come from the December 2025 proposal and are estimates, not measured results. HHS expected the proposed rule to save $1.53 billion in total, including $650 million over the next five years for health IT developers, providers and others. It estimated that certified developers would save more than 1.4 million compliance hours in the first year, an average of up to 4,000 hours per developer.
Those estimates were made for a proposal that would have removed over 50% of the criteria. The final rule removes 14 of 60, so the savings the agency projected for the proposal should not be read as the savings of the final rule.
What it changes for health IT vendors and hospitals
For EHR vendors, the rule means fewer certification requirements to maintain and engineering time that can move to new products, which is what HHS says it intends. For hospitals and clinics that buy that software, it shifts some checking onto the buyer. STAT reports that many commenters objected that the changes would weaken the security and privacy of sensitive health information and efforts to ensure the safety of products that rely on artificial intelligence.
A hospital that relied on certification as proof of a security or transparency feature now has to ask the vendor directly whether that feature remains in the product.
Questions and answers
How many EHR certification criteria did HTI-5 remove?
The final rule eliminated 14 of the 60 criteria used to certify electronic health record systems and substantially revised seven others, according to STAT.
What did HHS say HTI-5 would save?
For the proposed rule, HHS estimated savings of $1.53 billion in total, including $650 million over five years, and more than 1.4 million compliance hours for developers in the first year. These are the agency's estimates for the proposal.
MOZGII view
How we would build it
When a regulator removes a requirement, the risk it covered does not disappear. It moves to whoever buys the software. If we were a hospital buying health record software after this rule, we would keep our own list of the security, privacy and transparency features we need, and test each vendor against it instead of relying on a certification label.
On the vendor side, we would treat the removed criteria as a product decision, not a free pass. Some of those features protect patient data, and customers will ask for them in contracts. We would keep the ones customers rely on, document them in plain terms, and drop only what no one uses. The part that needs the most care is any tool that reads or writes patient records with AI. We would log every record it touches and have clinicians review a sample of its outputs each week.
The one metric we would watch is the number of security and privacy questions in customer contracts that the product cannot answer with evidence. If that number grows, the vendor has cut something buyers still need.
Next, we would build FHIR-based data access with an audit trail from the start, since that is where the agency says the program is heading and where most AI tools will connect.
Sources
Where the facts in this story come from.
- 01HHS relaxes security, transparency rules for electronic health records | STATstatnews.com
- 02HHS Proposes HTI-5 Rule to Streamline Certification Program, Further Protect Patients from Information Blocking, and Foster an Artificial Intelligence-enabled Future - ONC - Office of the National Coohealthit.gov