ONC’s HTI-5 Final Rule Removes 14 Health IT Certification Criteria From December 2026

ASTP/ONC released the HTI-5 final rule on 26 October 2026, and it was published in the Federal Register on 28 October 2026. The rule amends the ONC Health IT Certification Program, which sets the criteria that electronic health record systems and other health IT products must meet to be certified. The rule describes its approach as reducing and removing long-standing functionality-oriented and non-FHIR-based certification criteria.

According to law firm summaries of the final rule, ONC removed 14 of the programme’s 60 certification criteria, revised 7 and left 39 unchanged. This is considerably narrower than the proposal. The proposed rule, on which stakeholders submitted comments in early 2026, would have removed 34 criteria. Among the changes from proposal to final rule, commentators report that the safety-enhanced design criterion was revised rather than removed, and that ONC did not finalise its proposal to remove the privacy and security certification criteria. One summary reports that all 13 privacy and security criteria were kept, although sources were not entirely consistent on this point.

The rule also removes certain transparency, documentation and annual review requirements for predictive decision support interventions, including AI-enabled tools, that were introduced by the HTI-1 rule. Trade press reports ONC’s estimate that the rule will reduce health IT compliance costs by 1.55 billion US dollars.

The final rule keeps the programme centred on HL7 FHIR-based application programming interfaces. Law firm commentary describes it as a shift toward a leaner certification programme centred on FHIR APIs. One analysis states that older API criteria leave the programme on 1 January 2027, leaving the standardised FHIR API criterion at 45 CFR 170.315(g)(10) as the API on which the programme relies.

The 39 unchanged criteria include those adopted in the HTI-4 final rule for electronic prior authorisation, real-time prescription benefit, electronic prescribing and modular APIs. HTI-4 was finalised as part of the FY 2026 CMS Hospital Inpatient Prospective Payment System and Long-Term Care Hospital Prospective Payment System final rule.

The sources reviewed did not identify a change to the version of the United States Core Data for Interoperability (USCDI) used by the programme. Under the earlier HTI-1 rule, USCDI version 3 became the baseline for certification from 1 January 2026, with the HL7 FHIR US Core Implementation Guide STU 6.1.0 and the C-CDA Companion Guide Release 4.1 as the associated implementation specifications. Readers should check the final rule text for any USCDI-related amendments.

HTI-5 does not finalise the proposed changes to the information blocking rules. ONC confirmed that its deregulatory proposals modifying the information blocking exceptions and disincentives remain under active review. Developers, health information networks and providers should therefore continue to comply with the information blocking regulations as they stood before HTI-5.

Because the rule was published only shortly before this brief was prepared, detailed analysis of each removed and revised criterion is still emerging. The list of removed criteria was not confirmed in the sources reviewed, and readers should consult the Federal Register text for the definitive list.

The difference between the proposal and the final rule reflects the comment process. Hospital and provider organisations, among others, submitted comments on the proposal; the Federation of American Hospitals, for example, filed a comment letter dated 26 February 2026. The final rule retains the privacy and security criteria and removes far fewer criteria than proposed. The preamble to the final rule is the authoritative account of how ONC responded to the comments it received and of its reasons for each change from the proposal.

Certified health IT developers should map their certified modules against the 14 removed and 7 revised criteria, decide whether to maintain functionality that is no longer required for certification, and plan updates to product documentation and certification records before 28 December 2026 and 1 January 2027. Developers relying on older API criteria should ensure their FHIR API under (g)(10) meets current requirements.

For researchers, sponsors and real-world data teams, the rule reinforces FHIR APIs as the main route for standardised access to data from certified EHRs in the US. Teams building data pipelines from US healthcare systems should prioritise FHIR-based access and USCDI-aligned data elements, while recognising that some functionality outside the certification programme may become less consistent across vendors as certification requirements are reduced.