HTI-5 Promotes Deregulatory Certification Actions, Leaves Information Blocking Rules Untouched

The U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) on October 26, 2026, published the Health Data, Technology, and Interoperability: Deregulatory Actions to Unleash Prosperity (HTI-5) final rule. HHS estimates that the rule will generate more than $1.5 billion in regulatory cost savings.

The final rule:

• reduces the number of certification criteria for health information technology (IT) to drive future certification toward the HL7 Fast Healthcare Interoperability Resources (FHIR) standard
• eliminates certain artificial intelligence (AI) transparency requirements established under HTI-1, including model card requirements for predictive decision support interventions
• revises the Conditions and Maintenance of Certification Requirements for health IT developers

The most notable aspect of the final rule is what ONC left out. ONC did not finalize its proposed changes to the information blocking definitions or exceptions. The proposed rule would have tightened restrictions on how data requests could be handled by changing the manner exception, removing or limiting the infeasibility exception, and removing the Trusted Exchange Framework and Common Agreement manner exception. The final rule leaves these provisions unchanged.

ONC also declined to finalize proposed changes clarifying that automated processes, including autonomous AI systems, fall within the definitions of access and use of electronic health information (EHI). Although these proposals were not adopted, existing information blocking requirements continue to apply, including when automated technologies are involved.

However, ONC has made clear that additional reforms may come in future rulemaking. ONC has already started work on its next rulemaking, HTI-6, which may include more substantial regulatory changes.

For more information about information blocking, see Holland & Knight's previous alert, "The Wait Is Over: Information Blocking Enforcement Is Officially Here," February 13, 2026.

Changes to Certification Criteria

The final rule reflects a decisive shift toward a leaner certification program centered on FHIR-based application programming interfaces (APIs) but scales back its initial proposal. To reduce administrative burden, ONC initially proposed removing 34 of the program's 60 certification criteria. However, the final rule removes only 14 and revises seven.

One of the more substantial changes is the narrowing of the "decision support interventions" criterion to fully remove the model card requirements for source attribute support as well as access and modification. This change is particularly significant for developers of AI-enabled health IT as it eliminates transparency, documentation and annual review requirements established under HTI-1. Though the revision reduces regulatory burdens, hospital and clinician commenters objected that removing standardized disclosures shifts the burden of vetting AI onto healthcare providers. ONC noted that it may revisit aspects of AI oversight in future rulemaking, including HTI-6, although it remains unclear whether the agency will pursue new transparency requirements.

In contrast, the final rule does not change the new criteria adopted in the Health Data, Technology and Interoperability: Electronic Prior Authorization and Real-Time Prescription Benefit (HTI-4) final rule. It also keeps privacy and security certification safeguards, as well as public health-related reporting requirements.

Implementation dates for the certification changes vary: Some take effect 60 days after publication, others on January 1, 2027, and one on January 1, 2030. Developers should review the applicable implementation timelines before adjusting their certification and compliance activities.

View the list of certification criteria removals and revisions, with their timing, based on the final rule.

By retiring certification criteria tied to legacy technologies, ONC is preparing the health IT ecosystem for what comes next, including a more FHIR-forward approach. The agency also acknowledged that extensive certification criteria can quickly become outdated and that compliance places a real burden on developers. Removing some of these requirements is intended to let developers spend more time developing solutions that improve interoperability, automation and innovation.

At the same time, ONC's decision to retain certain certification requirements demonstrates that the agency is pursuing a more targeted deregulatory approach than initially proposed, balancing reduced compliance concerns against continued expectations for interoperability, privacy and security.

ONC will make conforming changes to related certification standards and implementation specifications, as well as various terms and definitions.

Impact on Information Blocking and Future Enforcement

Under the current regulations, information blocking means a practice by a developer of certified health IT (certified health IT developer), a health information network or health information exchange (HIN/HIE), or a healthcare provider (collectively, actors), that is likely to interfere with access, exchange or use of EHI unless the practice is required by law or meets one of the outlined regulatory exceptions.

The final rule does not amend the information blocking definitions or exceptions that could have clarified how the regulations are enforced. Among the proposals not finalized are changes affecting the manner and infeasibility exceptions, as well as the treatment of automated access to EHI, including access involving autonomous AI systems. Despite the lack of change, the final rule and ONC statements signal future rulemaking and enforcement activities are on the horizon. HHS announced its intent to begin actively enforcing the information blocking regulations in a September 3, 2025, press release and a September 4, 2025, enforcement alert issued jointly by the HHS Office of Inspector General (OIG) and ONC.

Holland & Knight's health IT team is aware the OIG is actively pursuing a number of information blocking investigations.

Actors subject to the information blocking regulations should consider:

• conducting targeted information blocking assessments to confirm compliance with current regulations
• reviewing current information sharing practices to make sure none relies on proposed revisions that were not finalized
• evaluating changes to transparency requirements for predictive decision support interventions
• continuing to monitor the policy landscape for additional reforms, including HTI-6

The decision not to finalize changes to the information blocking requirements should not be interpreted as a retreat from enforcement. Rather, organizations should continue operating under the existing regulatory framework while preparing for potential future changes.

Looking Ahead: HTI-6 and Future Regulations

As mentioned above, ONC is also working on HTI-6, its next proposed rule. Future rulemaking is expected to focus on advancing interoperability standards, expanding the capabilities of application programming interfaces and supporting emerging technologies, including AI-enabled interoperability solutions. These efforts may also build on initiatives outlined in the Centers for Medicare & Medicaid Services Health Technology Ecosystem pledge. HHS is still considering comments submitted in response to the HTI-5 proposed rule's information blocking proposals. As a result, proposals deferred from HTI-5 could resurface in HTI-6 or subsequent rulemaking. HHS could release the HTI-6 proposed rule before the end of 2026.

In addition, expect the HHS Office for Civil Rights to issue care coordination regulations that will address changes to the HIPAA Privacy Rule, which may intersect with the HTI-5 and HTI-6 efforts.

If you have questions about how ONC's regulatory changes would affect your organization, please contact the authors.

Information contained in this alert is for the general education and knowledge of our readers. It is not designed to be, and should not be used as, the sole source of information when analyzing and resolving a legal problem, and it should not be substituted for legal advice, which relies on a specific factual analysis. Moreover, the laws of each jurisdiction are different and are constantly changing. This information is not intended to create, and receipt of it does not constitute, an attorney-client relationship. If you have specific questions regarding a particular fact situation, we urge you to consult the authors of this publication, your Holland & Knight representative or other competent legal counsel.