What does the HTI-5 final rule change for my EHR?

The HTI-5 final rule removes 14 of the 60 certification criteria in the ONC Health IT Certification Program, revises seven, and leaves 39 unchanged. It takes effect 28 December 2026, with several removals delayed to 1 January 2027. ONC had proposed removing 34. The information blocking proposals in the same rule were not finalized.

Most of the HTI-5 guidance circulating right now was written against the proposed rule, so it describes changes that never happened.

What did the HTI-5 final rule actually do?

On 26 October 2026, ONC released Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, or HTI-5. It was published in the Federal Register on 28 October 2026.

The rule narrows what the ONC Health IT Certification Program requires of health IT developers. It removes certification criteria, revises others, removes the standards those criteria referenced, and makes conforming edits to several Conditions and Maintenance of Certification requirements, including Assurances (§ 170.402), Application Programming Interfaces (§ 170.404) and Attestations (§ 170.406). HHS projects the rule will save over $1.5 billion in regulatory costs.

ONC’s own framing is that the rule resets the Certification Program’s regulatory scope to establish a new foundation for FHIR-based API requirements. It is a clearing operation, with the building still to come.

ONC proposed removing 34 criteria. It removed 14.

The proposed rule identified 34 of the 60 criteria then in effect for removal, plus seven for revision. The final rule removes 14 and revises seven. Thirty-nine criteria are retained with no changes, including everything finalized in HTI-4: three electronic prior authorization API criteria, a real-time prescription benefit criterion, a revised e-prescribing criterion, and two criteria supporting modular API capabilities.

So 20 criteria that the proposed rule put forward for removal were left standing. ONC says comments on proposals not addressed in this final rule remain under review and may appear in later rulemaking, which leaves those 20 undecided rather than settled.

If a vendor or a consultant told you in the spring that a capability was being deregulated, check the list below before you act on it.

Which 14 certification criteria were removed?

From ONC’s own removals and revisions fact sheet.

A removal means the criterion is no longer part of the ONC Health IT Certification Program. It does not mean the capability stops working in any particular product, and it does not reduce a product’s existing certification. What goes away is the obligation to build, test and maintain that capability to a federal certification standard. Whether it survives in a given system becomes a vendor decision rather than a regulatory one.

Which seven criteria were revised?

The transitions of care revision is the outlier. It does not take effect until 1 January 2030, a three-year runway for the criterion that governs how clinical summaries move between systems at referral and discharge.

When does any of this take effect?

The final rule is effective 28 December 2026, except for amendatory instructions 7, 10 and 12, which are effective 1 January 2027. The per-criterion dates are in the tables above. One revision, transitions of care, is set for 1 January 2030.

Sixty days is a short window for a rule that touches a third of some products’ certification scope. It is long enough to put a set of questions to your vendor, and there is a list of those further down.

What happened to the AI “model card” requirement?

The decision support interventions criterion, § 170.315(b)(11), carried source attribute requirements. Paragraph (iv) required support for source attributes and paragraph (v) required access to and modification of them. Those are the elements usually called the “model card,” the structured disclosure of what a predictive or decision-support model was trained on, how it performs, and who is accountable for it.

HTI-5 removes both paragraphs. The ONC preamble calls this one of the more substantial revisions in the rule, and that is a fair description. It is also the change with the longest reach and the least coverage so far.

Transparency about where a decision-support or predictive model came from is no longer something certification guarantees. It is a vendor choice now.

That lands on any practice running a model that shapes a clinical decision: ambient documentation in a primary care visit, a drug interaction or sepsis alert, a coding suggestion, a risk score in a behavioral health intake. The job of asking where a model came from and who stands behind it moves from the certification program to the buyer. Our AI scribe compliance guide covers the questions worth asking about any model touching the record.

Is Direct messaging still required for a certified EHR?

No. Both Direct Project criteria are removed, § 170.315(h)(1) and § 170.315(h)(2), the latter covering the Edge Protocol and XDR/XDM, effective 28 December 2026.

Direct secure messaging is still widely used for referrals, care transitions and sending summaries to other providers, and nothing in HTI-5 switches it off. It is simply no longer a capability the Certification Program obliges a developer to carry. If your referral workflow runs on Direct, ask your vendor rather than assume.

Did HTI-5 change the information blocking rules?

Not yet. The proposed rule included information blocking proposals, and the final rule does not finalize them. HHS says comments on those proposals remain under consideration.

Anything you read describing HTI-5 as having changed the information blocking exceptions is describing the proposal. The information blocking regulations stand as they were.

What changed in the definition of “Base EHR”?

The term “Base EHR” at § 170.102 is revised to drop references to criteria the rule removes. The term “Common Clinical Data Set” is deleted along with its definition, because Part 170 no longer refers to it.

Mostly this is housekeeping. The reason it is worth noting is that “Base EHR” is the definition other federal programs point at when they describe what counts as certified EHR technology, so a change to its contents is a change to a shared reference. It is worth watching where that surfaces downstream.

What this changes for Medi-EHR’s certification

Medi-EHR 2.1 is certified to 41 criteria under CHPL listing 15.02.05.2979.MEDI.02.02.1.260225, certified 25 February 2026, with SLI Compliance as our ONC-ACB.

Fourteen of those 41 criteria are touched by HTI-5: eight removed, six revised. Roughly a third of our certification scope.

Criteria we hold that HTI-5 leaves untouched include (b)(10) Electronic Health Information Export, (g)(10) Standardized API for Patient and Population Services, and the security criteria covering multi-factor authentication and encrypted credentials. Our FHIR API work sits in that retained group, which fits ONC describing the rule as clearing ground for FHIR-based API requirements rather than stepping back from them.

Our certification status is unchanged by the rule itself. How and when removals are reflected on a CHPL listing is handled by each ONC-ACB. Our current listing details and mandatory disclosures and our Real World Testing plans and results are published and will be kept current.

What ONC certification still tells a buyer

Certification is a floor, and HTI-5 lowers it. After 28 December, a product carrying ONC certification is demonstrating conformance to 46 criteria rather than 60. The floor still covers a great deal: authentication and access control, audit logging, encryption, electronic prescribing, electronic health information export, the standardized patient and population API, clinical quality measure recording, and public health transmission.

What it no longer verifies on its own includes several things buyers have been treating as certified by default: the model-card transparency described above, Direct messaging, the older application access APIs, C-CDA creation performance, and automated measure calculation.

Certification has not become meaningless. It has become narrower. The useful response is to keep reading the badge for what it still covers and to do the rest of the diligence yourself.

Five questions to ask your EHR vendor before 28 December

1. Which of the 14 removed criteria are in your current certification scope? The answer is public on CHPL, so compare what you are told against the listing.
2. For each one you are dropping, are you keeping the functionality anyway? Removal from the program is not removal from the product, but the two are separable now. Ask which it is.
3. Do you still support Direct messaging, and under what commitment? This matters most if your referral workflow depends on it.
4. What source attribute information will you publish for any predictive or decision-support model in the product? Certification no longer requires an answer, which is why the question is worth asking.
5. Does your Real World Testing plan change? Plans are built around certified criteria, and those criteria are moving.

There is a sixth question that depends on what you practice, and it makes the same point either way.

A medical or multi-specialty practice should ask how the vendor handles e-prescribing of controlled substances, payer-specific prior authorization, and the quality reporting its payer mix requires. A behavioral health or residential organization should ask how the system handles 42 CFR Part 2 restrictions on substance use disorder records, which are stricter than HIPAA and carry their own consent machinery.

None of those has ever been a certification criterion. HTI-5 does not touch any of them, because the program never covered them in the first place. The requirements most likely to decide whether a system works for your practice have always lived outside the certification program, and this rule widens that gap rather than creating it.

Key takeaways

• HTI-5 removes 14 certification criteria, revises seven, and retains 39 of the 60 in effect.
• ONC had proposed removing 34, so most guidance written before 26 October 2026 overstates the change.
• The rule is effective 28 December 2026, with several removals delayed to 1 January 2027 and the transitions of care revision to 1 January 2030.
• The source attribute, or “model card,” requirements in § 170.315(b)(11) are fully removed, making AI transparency a vendor choice rather than a certification requirement.
• Both Direct Project criteria are removed.
• The information blocking proposals were not finalized and remain under consideration.
• Fourteen of Medi-EHR’s 41 certified criteria are affected: eight removed, six revised.

Frequently asked questions

What does the HTI-5 final rule change for my EHR?

HTI-5 removes 14 ONC certification criteria and revises seven. It does not automatically remove features from your EHR; check your product’s CHPL listing and ask your vendor which affected capabilities it will continue to support.

Does HTI-5 mean my EHR loses its certification?

No. Removing a criterion from the Certification Program does not withdraw a product’s certification or create a non-conformity. The product remains certified. The program it is certified against is narrower after the effective date.

Do I need to do anything before 28 December 2026?

The rule itself requires nothing of a provider organization. What is worth doing is asking your vendor which removed criteria were in their scope and whether they are keeping the functionality. That conversation is easier before the date than after.

Does this affect CMS programs that require certified EHR technology?

HTI-5 revises the definition of “Base EHR” to drop references to removed criteria. CMS programs that point at certified EHR technology reference definitions in Part 170, so changes there can surface in those programs. Check current CMS guidance for the program you participate in rather than assuming either way.

Does removing automated measure calculation affect my quality reporting?

Not your reporting obligations, which come from the payer or the program rather than from certification. What changes is that § 170.315(g)(1) and § 170.315(g)(2), the criteria requiring certified systems to record numerators and calculate measures automatically, leave the program on 1 January 2027. If you rely on your EHR to produce those numbers, confirm the capability is being kept, because it is no longer federally required.

Is Direct secure messaging going away?

Not as a technology or a service. The two Direct Project certification criteria are removed, which means developers are no longer required to certify that capability. Many will continue to offer it.

Where can I read the rule itself?

The final rule is in the Federal Register, and ONC maintains an HTI-5 resource page with an overview fact sheet and the criteria table.

Talk to us about what changed

Medi-EHR is an ONC-Certified, cloud-based EHR platform for medical and clinical practices and for behavioral health organizations. If you are evaluating an EHR and want a straight answer about what our certification covers after 28 December, we will give you the criteria list rather than a badge. Request a demo, or read our ONC certification details first.

Reviewed against the HTI-5 final rule, ONC fact sheets and CHPL listing data, 29 October 2026. Certification criteria and effective dates change with rulemaking, so verify against the Federal Register and CHPL before relying on them for a procurement or compliance decision.