For more than a decade, the ONC Health IT Certification Program has grown by accretion. Each rulemaking cycle added criteria, conditions and attestations, and the certified EHR became a product defined as much by regulatory checklists as by what it did for clinicians. The HTI-5 proposed rule is the first serious attempt to run that process in reverse.

The Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT (ASTP/ONC) released HTI-5 on December 22, 2025, and it was published in the Federal Register on December 29, 2025 under the title “Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity.” The comment period closed February 27, 2026. As of this writing, no final rule has appeared in the Federal Register, even though the 2026 Unified Agenda listed an August 2026 target. Everything below describes a proposal, not settled law.

What HTI-5 proposes to cut

The headline number is large. ASTP/ONC proposes to remove 34 of the program’s 60 certification criteria and revise seven more. According to the agency’s own HTI-5 proposed rule chart, most of those changes would take effect on the final rule’s effective date, with a smaller group, including the revised transitions of care criterion, deferred to January 1, 2027.

Privacy and security criteria

The most consequential removal is the entire set of 13 privacy and security criteria at 45 CFR 170.315(d). That set covers authentication and access control, audit logging, automatic access time-out, emergency access, end-user device encryption, integrity, trusted connections, accounting of disclosures, encrypted credentials and multi-factor authentication. The two security-tagging criteria at (b)(7) and (b)(8) would also go.

ASTP/ONC’s reasoning is that these criteria duplicate obligations HIPAA covered entities already carry under the Security Rule, so certifying them separately adds testing cost without adding protection. That argument has a logic to it, but it shifts the burden of verification. Today a hospital can point to a product’s certification as evidence that audit logging and MFA exist in a defined form. Without the criteria, that assurance has to come from contracts, security questionnaires and the buyer’s own testing.

Decision support and AI transparency

The proposal removes the older clinical decision support criterion at (a)(9) and revises the decision support interventions criterion at (b)(11). The revision drops the source attribute requirements for predictive DSIs, often described as the “model card” provisions that HTI-1 finalized in 2024, along with the required risk management practices for predictive tools. Developers would no longer have to expose that transparency information as a condition of certification.

Other removals

The chart lists a long tail of other removals: family health history, implantable device list, care plan, clinical information reconciliation, the CQM filter criterion, cancer registry transmission, health care surveys, automated numerator recording and measure calculation, safety-enhanced design, quality management system, accessibility-centered design, two application access criteria and the Direct Project criteria.

The stated rationale: burden, savings and FHIR

HHS framed HTI-5 as deregulation tied to Executive Orders 14192 and 14267. The ASTP/ONC press release estimates $1.53 billion in total savings, including $650 million over five years, and says certified developers would save more than 1.4 million compliance hours in the first year, an average of up to 4,000 hours per developer.

The forward-looking half of the argument is about where certification effort should go. ASTP/ONC wants the program focused on FHIR-based APIs that do more than read-only access: APIs that automate workflows, write data back and support uses such as public health and quality reporting. The agency’s framing ties that shift to AI-enabled interoperability, where software agents rather than humans are increasingly the ones requesting data.

Information blocking changes ride along

HTI-5 is not only a certification rule. It also proposes several information blocking changes:

  • Access and use definitions. The definitions of “access” and “use” would be revised to state explicitly that they include automated means, including autonomous AI systems. In practice, that makes it harder to refuse an API request simply because a machine, not a person, is on the other end.
  • TEFCA Manner Exception. The exception would be removed. ASTP/ONC’s view is that TEFCA no longer needs the incentive and that the exception was being misapplied.
  • Manner and Infeasibility Exceptions. Conditions in both would be revised or narrowed.

Alongside HTI-5, ASTP/ONC formally withdrew the HTI-2 proposals it never finalized. That leaves HTI-5 as the operative statement of the agency’s direction.

The pushback

Comment letters filed by the February deadline show where the resistance sits. The American Hospital Association’s February 27 letter supported the move toward FHIR but opposed removing all 13 privacy and security criteria, citing rising breach totals and the 2024 Change Healthcare attack. The AHA warned that if certification no longer guarantees those capabilities, vendors may start charging for them as add-ons.

The AHA also asked ASTP/ONC to keep the transitions of care criterion, including its “create” requirements, and to keep C-CDA-based criteria, because many rural and under-resourced providers still depend on document-based exchange where FHIR is not yet practical. It called the proposed January 1, 2027 date infeasible and asked for at least 24 months after a final rule, coordinated with CMS Promoting Interoperability. It wanted the DSI transparency information retained because hospitals use it to evaluate AI tools.

These are not fringe positions. They come from the organizations that buy and run certified technology, and ASTP/ONC will have to answer them in the final rule’s preamble.

What health IT teams should do while the rule is pending

A final rule could still change the scope of the removals, the effective dates or both. That uncertainty argues for a few low-regret steps now.

Re-anchor security requirements in contracts

If certification stops guaranteeing audit logs, MFA, encryption and emergency access, those capabilities need to be named in vendor agreements and in procurement security questionnaires. Hospitals that have relied on “it’s certified” as shorthand should inventory which of their security controls actually trace back to a (d) criterion, and write them into contract language at the next renewal.

Decide how you will evaluate AI tools without model cards

If the DSI source attribute requirement goes away, the information it produced, such as intended use, training data description and known limitations, does not stop mattering. Clinical informatics and AI governance committees should decide what they will require from vendors on their own terms rather than waiting for a regulation to require it.

Map Promoting Interoperability dependencies

CMS Promoting Interoperability measures reference certified functionality. Any criterion removal has to be reconciled with what CMS still requires hospitals and clinicians to attest to. Watch for CMS rulemaking that follows a final HTI-5, and do not decommission functionality simply because a criterion disappears.

Keep C-CDA pathways alive where you need them

Organizations that still exchange documents with post-acute providers, rural partners or public health agencies should confirm with their vendors that those capabilities will remain supported, and at what price, regardless of certification status.

HTI-5 is a bet that a smaller certification program focused on modern APIs will produce more interoperability than a large one focused on feature checklists. Whether that bet pays off depends on how much of today’s baseline the market keeps on its own. Health systems can shape that outcome by writing the baseline into their own requirements before the certification floor moves.