The U.S. Department of Health and Human Services (HHS) is rolling back several health IT certification requirements, including certain AI transparency regulations, with a final rule announced last week. While those changes could reduce certification costs for technology developers, they may leave hospitals and health systems holding more responsibility for evaluating the safety and performance of the AI tools they purchase.
The HTI-5 final rule, which was issued by the Office of the National Coordinator for Health Information Technology (ONC) last week, approved the removal of 14 of the certification criteria for health IT technology, of the 60 that are currently in effect, and revised an additional seven. The original proposal had called for the removal of 34 of the 60 criteria. Most changes take effect on December 28, 2026, with a few exceptions taking effect on January 1, 2027. According to the ONC, the changes are expected to save more than $1.5 billion in regulatory costs.
One consequential change involves decision support interventions, including predictive tools a healthcare provider might use to assist in clinical decision making. The rule removes requirements for health IT developers to provide source attributions for AI recommendations, which may help users understand the data underlying a tool’s recommendation. According to documents released by the Government Publishing Office “we have finalized removal of source attribute information transparency for evidence-based and predictive decision support interventions … as well as removal of source attribute access and modification requirements and intervention risk management requirements.”
This means that hospitals will lose a standardized way to evaluate AI products, according to Mel Soliz, an attorney focused on health data privacy, interoperability, and technology law.
“Certification no longer guarantees access to information about a predictive tool’s intended use, training data, performance, or limitations. In practice, the responsibility for doing this evaluation is going to fall on the users of these tools; that is, the hospitals and health care providers,” said Soliz in an email.
This leaves hospitals, health systems, and providers to establish their own evaluation processes, she added. Soliz recommends that health leaders build their own disclosure, validation, and bias-testing requirements into AI procurement contracts rather than relying on federal certification.
The rule also eliminates the voluntary certification criteria for security tags which are used to shield sensitive health information, such as behavioral health or substance use disorder records. Though HIPAA requirements remain unchanged, Soliz calls this shift one of the most disappointing changes for healthcare providers.
“This tagging enables providers to create a summary record that is tagged as restricted and subject to restrictions on redisclosure to support compliance with sensitive data laws and patient privacy preferences,” Soliz explains. “Without this tagging, it becomes exceedingly challenging to apply the appropriate consent rules to the appropriate records at the level of granularity desired.”
Will reduced certification requirements translate into better technology and costs saved as the ONC is claiming, or create more risk and validation burden for healthcare buyers? It appears that while it is good news for developers of technology, hospitals will now face the task of ensuring their own procurement and technology screening processes fill the gaps created by the federal certification changes.
Photo: illustration, Getty Images
