The United States Department of Health and Human Services has finalized a rule that removes AI transparency requirements from the federal certification program for health software. Under the HTI-5 final rule, released on October 26, health IT products will no longer have to supply model cards describing how their predictive algorithms work. The change is part of a broader cut to certification rules that the department says will save more than 1.5 billion dollars in regulatory costs.
What the rule changes
The rule, formally titled Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity, removes 14 of the 60 criteria in the certification program run by the Office of the National Coordinator for Health Information Technology. It revises seven more criteria and leaves 39 unchanged.
The final version is narrower than the proposal issued in December 2025, which would have eliminated 34 criteria. That narrower scope is the result of months of feedback from hospitals, vendors, and patient groups. The department says it listened to that feedback.
The AI change sits inside the decision support interventions criterion. Model-card requirements, introduced under the earlier HTI-1 rule, were meant to give hospitals information about predictive tools built into certified software, including their training sources, performance, and validation. Those disclosures were the transparency layer for clinical AI.
Those mandates are now gone, along with annual Real World Testing plan submissions and some Insights Condition reporting metrics. The rule also removes or revises requirements covering care coordination, patient engagement, and health data exchange. Those revisions show how broad the rule is, reaching well beyond AI disclosure.
What stays, and what critics said
Not everything was cut. The department kept all privacy and security certification criteria, along with quality management system standards and accessibility-centered design requirements, after public feedback. It also extended the deadline for retiring document-based transitions of care requirements to January 1, 2030, giving the industry a longer path toward data exchange through Fast Healthcare Interoperability Resources, or FHIR, programming interfaces.
The transparency removal went ahead even though a large majority of commenters opposed it, according to the department’s own account of the feedback. Those commenters warned that dropping the requirements would shift evaluation, governance, and liability burdens onto providers and health systems, and would undermine patient safety, clinician trust, and the ability to judge bias, performance, and appropriateness.
The department’s answer is that developers will redirect saved compliance resources toward better tools for patients and clinicians. That answer has not satisfied critics, who say the burden shift is the problem. Hospitals, they argue, lack the staff and leverage to vet every vendor tool.
The rule is scheduled for publication in the Federal Register on October 28. Most provisions take effect 60 days after publication, while some changes take effect on January 1, 2027. Proposed changes to information blocking rules, which target practices that interfere with access to electronic health information, were left out entirely and remain under consideration for a future rule.
Why It Matters
Model cards were one of the few places where a hospital buying certified software could see, in a standard form, what an AI tool was trained on and how it had been tested. Hospitals cannot pause AI adoption while they wait for new rules.
Removing them does not remove AI from health care; it removes a disclosure layer around it, at a moment when hospitals are being asked to adopt AI tools quickly. The department itself is already a major AI buyer, with a plan to put Anthropic’s Claude across its workforce.
The department frames the rule as deregulation that frees innovators, and its savings estimate of 1.55 billion dollars in present value, or about 108 million dollars a year from 2027, is its headline case. The open question is who now does the vetting work that the cards supported, and whether hospitals, rather than vendors, end up carrying it.
Background
The certification program sets the bar for electronic health record systems sold in the United States, and its criteria have long shaped what vendors build. The HTI-5 rule continues a deregulatory push that began with the December proposal, but the final version shows where pushback changed the outcome: privacy and security survived, while AI transparency did not.
States, meanwhile, are writing their own AI rules, including New York’s chatbot law protecting minors. The department says it will keep working on interoperability standards, expanded programming interfaces, and targeted conditions of certification in future proposals. Future proposals will test whether transparency returns in another form.
Source: HHS announcement, Becker’s report
0 Comments