Key Takeaways
- Fewer cuts than proposed. ONC removed 14 of the 60 federal Health IT Certification Program criteria and revised seven, compared with the 34 removals proposed. Although the compliance relief is significant, it is more modest than many had expected.
- Lighter developer obligations. The rule scales back Real World Testing requirements, including eliminating annual plan submissions, and trims most Insights reporting measures. These recurring costs were thought to fall hardest on smaller developers, so their removal is likely to lower barriers to entry and free up resources.
- Information blocking deferred. Information blocking proposals contained in the proposed rule remain under consideration. Although ONC signaled future rulemaking, current information blocking rules and penalties still apply.
- AI “model cards” eliminated. The decision support interventions criterion no longer requires certified health IT to support source attributes or apply risk management to predictive AI tools. ONC will consider whether to restore the older transparency requirements for evidence-based, non-AI decision support, and did not signal anything similar for predictive AI.
- Privacy and security criteria retained. ONC did not finalize proposals to remove privacy and security certification criteria (such as multifactor authentication and audit reports) and will revisit them in future rulemaking, meaning security baselines for certified products remain intact for now.
- Fast Healthcare Interoperability Resources (FHIR) -forward direction. ONC describes the rule as a reset of the certification program to build future FHIR-based application programming interface (API) requirements, including APIs that move beyond read-only interactions, and to make room for AI-enabled interoperability using emerging standards such as Model Context Protocol.
On Oct. 26, 2026, the Office of the National Coordinator for Health Information Technology (ONC) released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) final rule. HHS estimates the rule will create more than $1.55 billion in present-value cost savings (about $108 million a year), mainly from reduced developer compliance burden.
The final rule, published in the Federal Register on Oct. 28, 2026, is significantly narrower than the December 2025 proposed rule. ONC did not finalize any of the proposed information blocking changes, and it left a number of certification proposals unaddressed; both could return in later rules.
Thirteen changes take effect on the rule’s effective date, Dec. 28, 2026; seven take effect on Jan. 1, 2027; and the removal of the C-CDA and Direct requirements from the transitions of care criterion takes effect on Jan. 1, 2030.
What the Rule Means for Healthcare Providers
Although the rule reduces developer — not provider — obligations, providers are likely to feel downstream effects. Commenters warned after publication of the proposed rule that functions no longer required for certification may reappear as paid add-ons; ONC acknowledged the concern but said it does not believe that users will see a significant increase in overall costs. Providers should review upcoming electronic health record (EHR) vendor contract renewals for unbundled pricing and consider seeking contractual commitments to maintain current functionality.
With model cards gone, providers using predictive AI tools should obtain transparency information directly from vendors through contracts and their own internal AI governance processes. ONC expressly reminds providers in the final rule of their obligation under 45 C.F.R. § 92.210 to identify and mitigate bias in predictive tools.
Providers also remain the principal target of information blocking enforcement — ONC data indicates they are the subject of nearly 80% of complaints — and the existing rules and disincentives continue to apply.
What the Rule Means for Health Technology Companies
Developers will gain some compliance relief beginning at the end of this year, with other changes phasing in through 2027 and 2030.
Vendors should map their certified modules against the removal and revision timeline, update certification and marketing materials, and prioritize FHIR-based API capabilities, for which ONC signaled future requirements.
AI developers will face fewer federal certification requirements but should expect provider customers to request bias and input-variable information, and related contract commitments, to support those customers’ Section 1557 obligations to avoid discrimination when they use clinical algorithms and AI tools.
Information blocking exposure is unchanged for now, though practices that rely on current exceptions — such as conditioning third-party app or portal access — could become vulnerable if the deferred proposals are finalized.
What the Rule Means for Private Equity Investors
For health IT portfolio companies, HTI-5 should improve margins and product development timelines, but lower entry barriers may erode the competitive differentiation that certification historically provided. The investment thesis continues to tilt toward companies with mature FHIR APIs and API-enabled AI. Businesses dependent on legacy document-based exchange face longer-term risk.
In diligence, deal teams should assess a target’s certification footprint against the removal timeline, any customer commitments tied to removed criteria and information blocking compliance as a live risk. Given the pending proposals and planned FHIR rulemaking, transaction documents should consider regulatory-change risk in representations, indemnities and valuation. Provider-platform portfolio companies should use EHR contract renewals to protect pricing and functionality.
What Comes Next
ONC signaled further rulemaking focused on FHIR-based exchange, and the information blocking proposals remain pending, with no announced timeline. Clients should monitor ONC guidance and evaluate contracts, product roadmaps and diligence checklists now. For more information, contact the author or a member of the Healthcare Compliance, Regulatory & Policy Practice Group.