The Office of the National Coordinator for Health IT (ONC) finalized the HTI-5 rule on October 26, removing 14 of the 60 criteria in its health IT certification program and revising seven others. HHS projects the changes will save more than $1.5 billion in regulatory costs.

 

What happened

The HHS released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) final rule on October 26, 2026. The rule trims the list of capabilities health IT developers must demonstrate to earn certification under the ONC Health IT Certification Program.

The ONC kept the remaining 39 criteria unchanged, including the electronic prior authorization and real-time prescription benefit criteria added under HTI-4. The final rule is also narrower than the December 2025 proposal, which called for removing 34 criteria.

 

Going deeper

According to ONC's HTI-5 criteria chart, the removed criteria are:

  • Clinical decision support
  • Family health history
  • Security tags for sending and receiving summary of care documents
  • Care plan
  • Clinical quality measures filtering
  • Patient health information capture
  • Automated numerator recording and automated measure calculation
  • Consolidated CDA creation performance
  • Application access for patient selection and all data requests
  • Both Direct Project criteria, covering Direct secure messaging transport

Some removals apply on the rule's effective date, which Healthcare Dive reports falls 60 days after Federal Register publication. Others take effect on January 1, 2027. The seven revised criteria include transitions of care, decision support interventions, safety-enhanced design, and view, download, and transmit to a third party. The transitions of care revision does not take effect until January 1, 2030.

Developers of tools using AI and predictive algorithms will no longer have to supply source information about training, performance, and validation data. ONC also scaled back real-world testing, so developers no longer submit annual testing plans.

ONC did not finalize its proposal to remove the dedicated privacy and security certification criteria, and the HTI-5 information blocking proposals remain under consideration.

 

What was said

HHS Secretary Robert F. Kennedy Jr. said in the announcement, "American doctors and patients need better technology, not more Washington paperwork." National Coordinator for Health IT Tom Keane, M.D., said the rule lowers compliance burdens so developers can spend more time building tools for interoperability and automation.

Not everyone agreed with the approach. STAT reported ONC eliminated or revised several requirements over objections from commenters concerned about the security and privacy of health information and the safety of AI-enabled products. In a Health Affairs Forefront commentary on the proposed rule, the authors argued that HIPAA sets legal obligations, while certification ensures EHR design meets them in practice.

 

Why it matters

Certification is voluntary, but some federal programs depend on it. Technology used for the Medicare Promoting Interoperability Program, for example, must be ONC-certified. With fewer criteria, a certified label now confirms less about what an EHR does.

Two removals bear directly on how records move between organizations. Security tags let systems label sensitive data within a summary of care document, and the Direct Project criteria covered the encrypted, email-like transport many providers use for referrals and care transitions. Products may keep offering these features, but certification no longer verifies them.

The change shifts more verification work to buyers. During procurement and renewals, compliance and IT teams should confirm which exchange and security capabilities a product supports, rather than relying on certification status alone.

HIPAA obligations stay the same. Covered entities still need to assess transmission risks under the Security Rule and protect PHI wherever it travels, including email. Many organizations already send referrals, records requests, and patient updates by email, so a HIPAA compliant email platform with encryption and a signed business associate agreement (BAA) remains part of a sound exchange strategy, alongside the organization's own policies and risk analysis.

Paubox's 2026 Healthcare Email Security Report shows how wide the gap between sending PHI by email and securing it can be. Of the 170 email-related healthcare breaches reported to HHS OCR in 2025, 74% of the breached organizations had no DMARC policy or ran it in monitor-only mode, and none enforced MTA-STS, which encrypts connections between mail servers. A separate Paubox analysis, Healthcare's email security certificate crisis, found about 4.5% of outbound healthcare email connections went to servers with expired or self-signed certificates. With certification now checking fewer exchange capabilities, an organization's own email configuration carries more of the load.

See also: HIPAA Compliant Email: The Definitive Guide (2026 Update)

 

FAQs

What is the ONC Health IT Certification Program?

It is a voluntary federal program confirming health IT products meet set standards for functionality, security, and interoperability.

 

Does HTI-5 change HIPAA requirements for providers?

No, the HIPAA Privacy, Security, and Breach Notification Rules apply to covered entities and business associates exactly as before.

 

When do the HTI-5 certification changes take effect?

Most removals apply on the rule's effective date, January 1, 2027, while the revised transitions of care criterion takes effect on January 1, 2030.