HTI-5 certification criteria cuts shift EHR proof burden to providers
ASTP/ONC's deregulatory package would retire roughly half the Health IT Certification Program's criteria while narrowing information blocking exceptions, leaving hospital IT, informatics and compliance teams to absorb validation work vendors once attested to.
For a decade, the Health IT Certification Program functioned as unpaid due diligence for hospitals: if a module was certified, somebody at a federally recognized testing body had already checked that it did what it claimed. The proposed cuts to HTI-5 certification criteria would retire a large share of that scaffolding. What does not go away is the underlying need for proof, and in the current draft that work lands squarely on provider organizations.
Pacific AI analysis of the HTI-5 proposed rule; Dynamic Health IT separately describes the proposal as cutting about 50% of criteria.
| Value (criteria) | Health IT Certification Program criteria |
|---|---|
| Current criteria | 60 criteria |
| Proposed for removal | 34 criteria |
| Remaining if finalized | 26 criteria |
What ASTP/ONC put on the table in HTI-5
ASTP/ONC published the proposed rule, formally titled "Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity," in the Federal Register on Dec. 29, 2025. The framing is explicitly deregulatory: strip criteria that the agency considers redundant, obsolete or better handled by market forces, and reduce the compliance overhead carried by certified health IT developers.
The scale is what has drawn attention. Dynamic Health IT characterized the proposal as cutting 50% of certification criteria. A Pacific AI breakdown put a firmer number on it, counting 34 of 60 criteria slated for removal. Either way, the shift is structural rather than cosmetic, and it reaches areas that provider organizations have treated as settled for years.
Parts of the shift are already operational. ASTP/ONC maintains an active enforcement discretion notices page and exercised discretion for developers on certain criteria in late November 2025, before any final rule exists. Health systems that are waiting for a Federal Register final notice before adjusting their assumptions are already behind the practical state of the market.
When a certification criterion disappears, the proof burden does not. It just moves to a hospital team that did not get new headcount to carry it.
The asymmetry: vendor duties loosen, provider exposure does not
McDermott Will & Emery flagged the central imbalance plainly: certification criteria relax while information blocking exceptions tighten. That pairing matters more than either change on its own. Developers shed attestation and testing obligations. Providers, who sit on the other side of the information blocking rules, get narrower safe harbors for the judgment calls they make every day about data release, privacy and infeasibility.
In practice, a compliance officer loses on both ends of the same transaction. The vendor can no longer be pointed to as the party that certified a capability, and the exception the organization might have relied on to justify a withholding decision gets harder to claim. Nelson Mullins and Covington Digital Health analysts have also read HTI-5 as more than pure deregulation, tying the certification changes to an interoperability and AI transparency agenda that raises expectations on how decision support behaves in the field.
The American Hospital Association filed formal comments on the interoperability proposed rule on Feb. 27, 2026. Health Affairs Forefront ran a patient safety counterargument urging ASTP/ONC to preserve core certification protections. This is an open fight, not a settled rule, which is exactly why contract and governance work should start now rather than after the comment docket closes.
Certification was free due diligence, and the bill is coming due
When a criterion sunsets, the testing, documentation and attestation work does not evaporate. It relocates to hospital IT, informatics and compliance teams, almost always without added headcount. The organizations that feel this first are mid-size systems that leaned on certification status as a procurement filter because they lacked an internal software assurance function.
Three consequences follow directly. First, contract language has to carry assurances that certification used to supply, including functional warranties, interoperability performance commitments and audit rights. Second, AI and clinical decision support validation becomes a local governance job with local liability, since the federal testing floor no longer backstops the claim. Third, information blocking risk rises for providers even as developer duties fall.
None of that is theoretical in a renewal negotiation. A vendor that no longer attests to a capability has no regulatory reason to accept contractual responsibility for it unless the buyer insists during the window when leverage exists.
Where AI and decision support validation lands
The most consequential piece for clinical leaders is the treatment of predictive and AI-enabled decision support. Industry analysis of HTI-5 describes the rule as pushing AI and predictive model testing onto buyers. That means a health system deploying a sepsis model, a deterioration score or an ambient documentation tool owns the evaluation question: does it perform on our population, with our data, under our workflows.
Healthcare IT News and Health Affairs Forefront have both covered the validation gap left when criteria sunset. The gap is not just technical. It is a governance and documentation gap, because a hospital that cannot show how it evaluated a model will struggle to defend that decision to a board, a plaintiff's attorney or a state regulator filling the federal vacuum.
Systems with a functioning AI governance committee, a model inventory and a post-deployment monitoring cadence are positioned to absorb this. Systems that treated vendor certification as evidence of safety now need to build that capability on a compressed timeline.
What CIOs should pressure-test before the final rule lands
Start with a renewal calendar. Identify every certified health IT contract coming up for renewal in the next 18 months and map which of its capabilities depend on criteria proposed for removal. Those are the agreements where assurances need to migrate from the certification program into the contract itself.
Then build the local evidence layer: a model and module inventory, a defined validation protocol, documented monitoring, and a named owner for each. Pair that with a refreshed information blocking review, since narrower exceptions change the analysis behind standing release practices and patient portal configurations.
Finally, track the docket. Comment letters from the AHA and others, plus the safety arguments running through Health Affairs Forefront, could reshape the final scope. Planning for the proposal as written is prudent. Assuming it is final is not.
