HHS Eliminates 14 Health IT Certification Criteria, Projects $1.5B Savings

HHS removes 14 certification criteria in HTI-5 final rule

The Office of the National Coordinator for Health IT issued its HTI-5 final rule on October 28, eliminating 14 federal health IT certification criteria and projecting more than $1.5 billion in regulatory cost savings. The rule retires legacy transport standards, removes the older clinical decision-support criterion, and reduces AI model-card and risk-management requirements under the Decision Support Interventions certification.

For enterprise buyers, this changes the economics of AI procurement and interoperability architecture. Lower certification costs should accelerate vendor roadmaps for AI-enabled clinical applications, but the removal of federal AI transparency requirements shifts governance responsibility to procurement teams and clinical-risk committees. Health systems can no longer assume that ONC certification provides evidence about an AI system's provenance, validation methodology, or bias controls.

What the rule changes for AI governance

ONC removed AI model-card source-attribute requirements and scaled back risk-management obligations. Vendors will spend less documenting model lineage and decision logic for certification, but buyers lose a federal baseline for transparency.

This means enterprise AI governance processes must tighten. Contracts should now explicitly require model validation documentation, bias testing results, audit logs, performance monitoring, and change notification protocols. The certification program will no longer enforce these controls, so buyers must build them into RFP criteria, vendor assessments, and ongoing governance checkpoints.

The cost savings are real — HHS projects $1.5 billion in reduced compliance burden — but the tradeoff is higher diligence costs for health systems that previously relied on certification as a proxy for technical rigor. Clinical-risk committees should reassess their AI approval frameworks before the next budget cycle.

FHIR APIs become the interoperability foundation

HTI-5 positions FHIR APIs as the future mechanism for clinical and administrative data exchange, including payer-provider transactions, drug formularies, provider directories, and electronic prior authorization. This benefits major EHR vendors like Epic, Oracle Health, and MEDITECH, as well as FHIR-native interoperability companies and cloud platforms like Microsoft Azure and Salesforce Health Cloud.

The rule reduces the compliance advantage held by vendors that invested heavily in legacy certification documentation. Smaller, API-first vendors can now compete on technical merit rather than certification overhead. This should expand the competitive field for interoperability middleware, identity-matching services, and data-exchange platforms.

For buyers, the shift to FHIR creates planning leverage but demands technical diligence. Health systems should reassess expensive proprietary integration layers before renewal and verify that vendors support specific USCDI and FHIR implementation guides. The rule creates regulatory flexibility, not automatic interoperability. Buyers still need to validate API conformance, data-quality performance, identity matching, uptime commitments, and support for the exact standards their workflows require.

What to do before the next budget cycle

Health systems should audit their current certification dependencies and interoperability architecture. If your organization budgeted for AI model-card documentation or legacy transport-standard upgrades, those line items may no longer be necessary. Redirect that capital toward private AI-governance tooling, contract controls, and FHIR API validation.

For AI procurement, add explicit transparency requirements to RFP templates. Require vendors to disclose training data sources, validation methodology, bias-testing protocols, performance benchmarks, monitoring dashboards, and change-notification processes. The federal certification program will no longer enforce these controls, so your contracts must.

For interoperability, verify that vendors commit to specific FHIR implementation guides, not just general FHIR compatibility. Test API conformance, uptime, and data-quality performance before signing multi-year agreements. The rule lowers certification costs but does not eliminate the need for technical validation.

The HTI-5 rule reduces compliance expense and expands vendor flexibility, but it also transfers risk from federal oversight to enterprise governance. Health systems that treat this as a cost-reduction opportunity without tightening internal controls will discover the gap when an AI model fails or an API integration delivers incomplete data.