ONC Finalizes a Significantly Narrower Rule for Health IT Certification

On October 28, 2026, the Office of the National Coordinator for Health Information Technology (ONC) published the fifth final rule under the Health Data, Technology, and Interoperability (HTI) heading, titled “ONC Deregulatory Actions To Unleash Prosperity.”[1]

The rule, known as “HTI-5,” finalizes a narrowed subset of the December 29, 2025, proposal that had sought to remove or revise a much larger number of certification criteria.[2] The HTI-5 final rule retires 14 certification criteria, revises several others, and reduces reporting obligations for developers of certified health information technology (“health IT”). It also removes references to the Assistant Secretary for Technology Policy (ASTP) from the certification and Trusted Exchange Framework and Common Agreement (TEFCA) regulations, restoring ONC as a singularly titled office.

What You Need to Know

• Scope and Timing: The final rule takes effect on December 28, 2026, with most criteria removals and revised reporting requirements phasing in on January 1, 2027. ONC retained 39 criteria, unchanged, including those governing electronic prior authorization and real-time prescription benefit; preserved the privacy and security criteria; and extended certain transitions-of-care deadlines to January 1, 2030.
• Decision Support and Testing: The final rule removes decision support source-attribute and risk management requirements, eliminates real world testing plan submissions, and limits testing results reporting to specified application programming interface (API) criteria. Developers of predictive tools should assess continuing obligations under customer contracts, Food and Drug Administration (FDA) requirements where applicable, and nondiscrimination laws.
• Information Blocking: Existing information blocking regulations remain fully in force because the final rule does not adopt the proposed 2023 or 2026 revisions. Oversight remains ongoing, investigations by the U.S. Department of Health and Human Services’ Office of Inspector General (OIG) are underway, and ONC has indicated that it is issuing notices of nonconformity to certified health IT developers. The deregulatory cuts in HTI-5 apply to select certification criteria rather than a rollback of data-sharing mandates.

This Insight summarizes what the HTI-5 final rule does, what it leaves in place, what it defers, and what developers and health care organizations should do now.

Background: From 34 Proposed Removals to 14

ONC’s Certification Program established the technical criteria that electronic health record (EHR) systems and other health IT products must meet to be certified. Certification matters beyond the program itself. Eligible providers that treat Medicare patients earn enhanced Medicare payments—and avoid payment reductions—by participating in the Medicare Promoting Interoperability Program, which for eligible clinicians is scored through the Promoting Interoperability performance category of the Merit-based Incentive Payment System (MIPS) that replaced the sustainable growth rate formula in 2015. Health care providers must use certified EHR technology (CEHRT) to participate in the Medicare Promoting Interoperability Program, and the Centers for Medicare & Medicaid Services’ (CMS’s) definitions of CEHRT reference specific certification criteria.[3] Changes to the criteria therefore affect both developers and the providers who buy their products.

The December 2025 proposal was broad. Of the 60 criteria then in effect, ONC proposed removing 34 and revising seven.[4] The HTI-5 final rule takes a narrower path by finalizing the removal of 14 criteria and the revision of seven. It also retains 39 criteria unchanged, including those adopted in the Electronic Prescribing, Real-Time Prescription Benefit, and Electronic Prior Authorization (HTI-4) final rule for electronic prior authorization and real-time prescription benefit.[5]

Many commenters objected to the proposed removals, and many of those removals were reconsidered after public comment. Commenters from rural, behavioral health, long-term care, and safety-net settings argued that the Consolidated Clinical Document Architecture (C-CDA)-based exchange remains foundational in their workflows and that Fast Healthcare Interoperability Resources (FHIR) alternatives are not yet mature. ONC responded by retaining or delaying several criteria, discussed below.

Criteria Removed

The final rule removes the following criteria. Most take effect January 1, 2027.

Separately from the decision support intervention revisions discussed in Part IV, the final rule removed the older clinical decision support criterion, § 170.315(a)(9), outright, even though it had already expired on January 1, 2025, under the Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) final rule; ONC declined to reinstate it or use it in place of the narrower decision support intervention requirements.[6]

ONC explains that removing a criterion does not require developers to remove the underlying functionality from their products. For example, the certification criteria for family health history and care plan were so widely implemented into EHRs that the functionality is even reflected in United States Core Data for Interoperability version 6. Removing those criteria from the certification program does not mean that developers of certified health IT would no longer support the functionality; rather, it would simply reduce the cost and burden of certification and maintenance.

Criteria Retained or Revised

Several proposed criteria slated for removal did not survive:

• Transitions of care. The proposal would have removed C-CDA send, receive, and create requirements by January 1, 2027. The final rule extends the deadline for removing edge protocol, create, and display requirements to January 1, 2030. The C-CDA validation requirement remains in place beyond that date.[7]
• Clinical information reconciliation and incorporation. ONC did not remove § 170.315(b)(2). The agency made the criterion functional by removing the standards references for exchanging health information, and it dropped the requirement to display data from two sources simultaneously. ONC explained that the criterion is used in CMS measures and that a functional version preserves the capability while allowing more flexible workflows.[8]
• Cancer registry, public health surveys, and electronic case reporting. ONC retained §§ 170.315(f)(4) and (f)(7) and kept electronic case reporting as a criterion that accepts either Clinical Document Architecture (CDA)-based or FHIR-based standards. ONC cited continued reliance on CDA-based reporting and public health systems that are not ready for FHIR at scale.[9]
• Antimicrobial use and resistance reporting. The rule revised § 170.315(f)(6) to a functional criterion, removing a standards reference that ONC found misaligned with the Centers for Disease Control and Prevention’s National Healthcare Safety Network requirements.[10]
• Privacy and security. ONC did not finalize the proposal to remove the privacy and security criteria in § 170.315(d) or the associated certification framework in § 170.550(h). The agency removed references to criteria previously dropped in earlier rulemakings. ONC stated that it will consider the approach to privacy and security certification in future rulemaking.[11]
• Safety-enhanced design and related criteria. ONC converted the safety-enhanced design criterion, § 170.315(g)(3), into an attestation-based requirement, removing summative testing and reporting provisions. The agency retained the quality management system criterion, § 170.315(g)(4), and the accessibility-centered design criterion, § 170.315(g)(5).[12]
• Implantable device list. The proposal to remove § 170.315(a)(14) was not finalized. ONC noted that CMS adopted the “Unique Device Identifiers for Implantable Medical Devices” measure in the fiscal year (FY) 2027 Hospital Inpatient Prospective Payment System (IPPS) rule, and that the measure depends on the criterion.[13]

Decision Support Interventions

The final rule makes its most substantive change to the decision support intervention criterion, § 170.315(b)(11). The final rule removes:

• the source-attribute support requirements in § 170.315(b)(11)(iv),
• the source-attribute access and modification requirements in § 170.315(b)(11)(v),
• the intervention risk management requirements in § 170.315(b)(11)(vi), and
• the corresponding Assurances maintenance requirement in § 170.402(b)(4).

The rule also removes the reference to drug-drug and drug-allergy contraindication checking in § 170.315(b)(11)(iii) while keeping medications and allergies as data types for evidence-based interventions, so interaction checking remains supported. The rule further narrows the data scope for predictive interventions, and it retains the feedback requirements for evidence-based interventions, redesignated as § 170.315(b)(11)(ii)(B).

ONC’s reasoning is that developers reported that most clinical users did not engage with source-attribute information at the point of care, that the record did not show the requirements had improved care, and that the requirements were burdensome to maintain. Commenters, including many clinicians, disagreed. They argued that the requirements had been in effect for less than two years, had not been evaluated, and provided information that governance, compliance, and safety teams rely on. ONC responded that FDA oversight and existing civil rights requirements, including 45 C.F.R. § 92.210 of the Section 1557 regulations, address those concerns, and ONC said it would consider whether source-attribute transparency should return in future rulemaking.[14]

For developers of predictive tools, the change does not end transparency expectations. Contracts, FDA requirements where applicable, and nondiscrimination obligations continue to apply. Developers should map what their customers may need from them now that the certification floor has moved.

Real World Testing, Insights, and API Requirements

• Real world testing. The final rule eliminates the requirement to submit real world testing plans. Results reporting is limited to the API criteria: § 170.315(g)(10) and the prior authorization API criteria in § 170.315(g)(31) through (g)(33). For non-API criteria, ONC replaces the Standards Version Advancement Process reporting requirement with attestation and listing on the Certified Health IT Product List. ONC declined commenters’ proposals for performance-based metrics, citing the scope of this rulemaking.
• The rule retains two measures, “Use of FHIR in apps” and “Use of FHIR bulk data access.” The bulk data measure was proposed for removal and then retained, with its reporting start moved to July 2029. The other six measures are removed. Developers must respond annually if they had an active certified module as of January 1 of the reporting period and still hold certified health IT at submission.[15]
• APIs and the path beyond FHIR. The rule removes the § 170.315(g)(7) and (g)(9) API-related criteria, and it conforms the definition of “Certified API technology” to the criteria that remain. It keeps the service base URL publication requirement in § 170.404(b)(2) over an objection that publication could reveal customer relationships. The preamble also refers to Model Context Protocol as a potential successor technology that could combine with FHIR in future API requirements, which signals that ONC does not regard FHIR as the ceiling for future certification.[16]

Information Blocking Changes Deferred

The 2023 HTI-1 proposal, which we discussed in a prior update, included changes to the information blocking regulations, among them a new “third party seeking modification use” condition, a “Manner Exception exhausted” condition, and a TEFCA manner condition.[17] The 2026 HTI-5 proposal included further revisions to the manner and infeasibility exceptions. None of the information blocking revisions appear in the final rule, and the preamble does not discuss them. Developers and providers should assume the current information blocking regulations remain in effect and monitor for a future proposal. At the October 2026 Sequoia Project and Carequality annual meeting, ONC’s National Coordinator for Health IT, Dr. Thomas Keane, reportedly said that information blocking remains important to ONC and that not blocking information remains the expectation. One industry observer expects further information blocking updates once ONC finalizes those details.

Conforming Changes and Regulatory Impact

The final rule makes conforming changes across 45 C.F.R. parts 170 and 172. For example, it removes “Complete EHR” terminology, revises the ONC-Authorized Certification Bodies (ONC-ACBs) principles of proper conduct to stop requiring reporting of test data versions and alterations, and removes ONC-ACB review of real world testing plans. The final rule also removes ASTP references throughout TEFCA (45 C.F.R. part 172) and related provisions.

ONC estimates that implementing and complying with the removal and revision of certification criteria will save developers a present value of $1.55 billion, discounted at 7 percent, with annualized net savings of $108.1 million in 2024 dollars. The agency states that the savings reflect developer time and effort, and that it did not quantify benefits to end users. For a developer that knows its customers well, those savings can be redirected to meet customers where they are and to support innovation. Estimated one-time review costs would total $1,293,508.[18]

Practical Considerations

For developers, the near-term work involves reducing test scope, dropping real world testing plan preparation, and deciding whether to continue supporting removed functions. Just because a certification criterion was removed does not mean that the functionality, or the ways that criterion is used, must be discontinued. Product development decisions will turn on customer contracts and competitive positioning. Developers should review customer agreements for warranties tied to certified functionality, since those may survive the regulatory change. For example, the Direct transport criterion is removed, but the Direct functionality remains supported by a transitions-of-care criterion through 2030, so a developer can drop separate Direct certification testing without withdrawing support from customers that still rely on it. The practical takeaway is that functionality that matured under a certification criterion need not lose its foundation when the criterion is removed, so developers should let customer needs drive product development decisions.

For providers, a criterion removed from certification may still be required by a CMS program, a contract, or state law. CMS has proposed conforming changes to CEHRT definitions on a parallel track. Providers relying on a specific certified capability for a CMS measure should confirm the current CEHRT definition before the relevant reporting period. For example, a provider that uses clinical information reconciliation for a CMS measure should expect that capability to remain available, because ONC kept the criterion in functional form, and CMS measures rely on it.

For developers that primarily serve providers who operate in outpatient clinics or ambulatory care settings, particularly providers who do not participate in MIPS or the Medicare Promoting Interoperability Program, the decision to keep certified functionality depends on whether those customers have other reasons to require certified technology, such as their patient mix, referral partners, participation in accountable care models, payer requirements, or contract terms. Certification remains voluntary for developers. For example, a developer whose therapy (physical therapy, occupational therapy, and speech-language pathology), behavioral health, or long-term care customers are outside MIPS may still keep its certified functionality if a referral partner or payer requires it, even though no CMS program does.

Key Dates and Open Items

Three dates anchor the planning horizon. The HTI-5 final rule takes effect on December 28, 2026; most criteria removals and reporting changes (Parts II and V) take effect on January 1, 2027; and the retained C-CDA transitions-of-care requirements expire on January 1, 2030.

ONC has indicated that future rulemaking may address privacy and security certification, the decision support transparency question, a forthcoming FHIR-based exchange action, and the deferred information blocking revisions. Developers and providers should monitor those proposals, because the retained criteria are the most likely to change again.

The final rule’s silence on the deferred information blocking revisions should not be read as a reprieve. The existing regulations remain fully in force, and they are already being tested. ONC has indicated that it is issuing notices of nonconformity to certified health IT developers, and OIG investigations are underway, although no timing for OIG enforcement actions has been disclosed. In October 2026, Fasten Health publicly disclosed that it had filed more than 200 information blocking complaints against health systems using MEDITECH that Fasten alleges never responded to Fasten’s requests to register its patient-facing application.[19] Registration is a technical prerequisite for a patient to authorize an app to retrieve records through certified patient access APIs, and the preamble of the 21st Century Cures Act final rule warned that refusing to register such an app would be “highly suspect and likely to implicate information blocking.” Providers in affected Medicare programs could face financial disincentives if OIG finds information blocking. Whatever ONC does with the deferred proposals, this is the practical test of the rules in force today.

As a practical matter, developers should confirm how certified EHR vendors handle app registration and review each vendor’s FHIR-based API workflows, transparency, and fee structures so that patient-facing app onboarding does not introduce prohibited interference or friction. Providers should review internal policies for responding to patient-facing and third-party app connection requests and map any conditions, security vetting, or delays to an active ONC information blocking exception, with documentation.

Looking ahead, this rule could shape innovation in several ways. With the certification criteria removed, developers can redirect the resources that they will save from not testing or maintenance and can invest in features their customers want or request. At the same time, slower movement away from C-CDA could delay advances in interoperability, while the preamble’s reference to Model Context Protocol suggests ONC is open to new API approaches that early adopters may be positioned to shape. Transparency may also become a point of competitive differentiation.

* * * *

For additional information about the issues discussed in this Insight, please contact the attorney(s) listed on this page or the Epstein Becker Green Health Care and Life Sciences attorney who regularly handles your legal matters.

ENDNOTES

[1] Dep’t of Health & Hum. Servs., Off. of the Nat’l Coordinator for Health Info. Tech., ONC Deregulatory Actions to Unleash Prosperity, 91 Fed. Reg. 67916 (Oct. 28, 2026) (to be codified at 45 C.F.R. pts. 170, 172).

[2] Dep’t of Health & Hum. Servs., Off. of the Nat’l Coordinator for Health Info. Tech., Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity, 90 Fed. Reg. 60970 (proposed Dec. 29, 2025).

[3] Dep’t of Health & Hum. Servs., Off. of the Nat’l Coordinator for Health Info. Tech., Medicare Program; ... Health Data, Technology, and Interoperability: Electronic Prescribing, Real-Time Prescription Benefit and Electronic Prior Authorization, 90 Fed. Reg. 36,536 (Aug. 4, 2025) (to be codified at 42 C.F.R. pts. 412, 495, 512 & 45 C.F.R. pt. 170).

[4] See 91 Fed. Reg. 67916 (Oct. 28, 2026).

[5] See 90 Fed. Reg. 36,536 (Aug. 4, 2025).

[6] 91 Fed. Reg. 67927–28 (Oct. 28, 2026) (final rule, pt. III.A.1.a).

[7] 90 Fed. Reg. 60984 (Dec. 29, 2025); Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, 91 Fed. Reg. 67930–33 (Oct. 28, 2026).

[8] 91 Fed. Reg. 67934–35 (Oct. 28, 2026) (final rule, pt. III.A.2.b); see also 45 C.F.R. § 170.315(b)(2) (as amended by the final rule).

[9] 91 Fed. Reg. 67951–52 (cancer registry, pt. III.A.6.a); id. at 67952–54 (electronic case reporting, pt. III.A.6.b); id. at 67955–56 (health care surveys, pt. III.A.6.d) (Oct. 28, 2026) (final rule); see also 45 C.F.R. § 170.315(f)(4), (f)(5), (f)(7).

[10] 91 Fed. Reg. 67954–55 (Oct. 28, 2026) (final rule, pt. III.A.6.c); see also 45 C.F.R. § 170.315(f)(6); 90 Fed. Reg. 60993 (Dec. 29, 2025) (proposed rule).

[11] 91 Fed. Reg. 67937 (Oct. 28, 2026) (final rule, pt. III.A.4) (retaining § 170.315(d)); id. at 67947 (future rulemaking); id. at 67968 (privacy and security criteria not removed); id. at 67975 (pt. III.E) (revising § 170.550(h)(3)); see also 45 C.F.R. §§ 170.315(d), 170.550(h).

[12] 91 Fed. Reg. 67958–61 (Oct. 28, 2026) (final rule, pts. III.A.7.c–e); see also 45 C.F.R. § 170.315(g)(3)–(5); 90 Fed. Reg. 60996–97 (Dec. 29, 2025) (proposed rule).

[13] 91 Fed. Reg. 67929–30 (Oct. 28, 2026) (final rule, pt. III.A.1.c); see also 91 Fed. Reg. 49570, 50055–60 (Aug. 4, 2026) (FY 2027 IPPS / Long-Term Care Hospital final rule).

[14] 91 Fed. Reg. 67941–43 (Oct. 28, 2026) (final rule, pt. III.A.2.e); id. at 67927 (pt. III.A.1.a) (future rulemaking); see also 45 C.F.R. § 92.210.

[15] 91 Fed. Reg. 67973 (Oct. 28, 2026) (final rule, pt. III.D.5) (removing six measures and moving the bulk data reporting start); id. at 67977 (retaining the bulk data access measure); see also 45 C.F.R. § 170.407(a)(3), (b)(1).

[16] 91 Fed. Reg. 67963–64 (Oct. 28, 2026) (final rule, pt. III.A.7.g–h) (removing (g)(7) and (g)(9)); id. at 67969 (conforming definition and service base URL publication); id. at 67917 (Model Context Protocol and successor technologies); see also 45 C.F.R. §§ 170.315(g)(7), (g)(9), 170.404(b)(2), (c).

[17] 88 Fed. Reg. 23746 (Apr. 18, 2023).

[18] 91 Fed. Reg. 67918 (Oct. 28, 2026) (final rule, pt. I.D); id. at 67980 (pt. VII, Regulatory Impact Analysis) (one-time review cost).

[19] See Kulatunga, J., Fasten just filed 200+ information blocking complaints against health systems using MEDITECH, published October 19, 2026, https://blog.fastenhealth.com/information-blocking-meditech-health-systems.