On December 29, 2025, the U.S. Department of Health and Human Services (“HHS”), through the Assistant Secretary for Technology Policy (“ASTP”)/Office of the National Coordinator for Health Information Technology (“ONC”) (collectively, “ASTP/ONC”), issued a proposed rule to update its Health Data, Technology, and Interoperability (“HTI”) regulations, as well as a notice to withdraw prior proposals issued as part of the HTI-2 proposed rule.
HTI-5 Proposed Rule
The proposed rule, Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity (“HTI-5”), proposes (1) changing the certification criteria for the ONC Health IT Certification Program, (2) prioritizing the use of Fast Healthcare Interoperability Resources (“FHIR”) application programming interfaces (“APIs”), and (3) updating certain information blocking requirements. The HTI-5 proposed rule is open for comment until February 27, 2026.
Key topics in the HTI-5 proposed rule include:
- Elimination or Revision of Several ONC Health IT Certification Program Criteria: For background, as part of the ONC Health IT Certification Program, developers must certify that their health IT modules conform to certain functional requirements, known as “certification criteria.” As part of the HTI-5 proposed rule, ASTP/ONC proposes to eliminate or revise more than half of the existing current certification criteria. Specifically, the HTI-5 proposed rule would eliminate 34 and revise seven of the existing 60 certification criteria, as shown here.
Among the certification criteria that ASTP/ONC proposes to revise is the requirement applicable to decision support interventions (“DSIs”). Currently, health IT developers must provide detailed source attribute information for “predictive DSIs”—including AI‑based systems—when such tools are supplied as part of certified health IT. These source attributes, referred to by ASTP/ONC as the “AI model card” requirements, include information such as the intervention’s intended use, the target patient population and end users, known risks, the nature of the training data and inputs, and the processes used for external validation, among other specified details. The HTI‑5 proposed rule would amend this criterion by eliminating both the requirement for developers to supply this source attribute information and the requirement to implement certain risk management practices for predictive DSIs.
ASTP/ONC also proposes to remove the privacy and security certification criteria in 45 C.F.R. § 170.315(d), which include, among others, authentication, access control, and authorization requirements. ASTP/ONC states in the proposed rule that there is a disconnect between these existing criteria and the requirements that most purchasers and users of certified health IT are subject to under the HIPAA Privacy and Security Rules, which has led to unnecessary regulatory burden.
- Prioritization of a FHIR-Based API Ecosystem for Information Exchange: In the proposed rule, ASTP/ONC states that its proposals to revise the ONC Health IT Certification, as discussed above, aim to “reset” the program to prioritize FHIR-based APIs over “functionality-oriented criteria.” In particular, ASTP/ONC states that it intends to “sharpen the [program’s] future focus to prioritize FHIR-based APIs that: (1) enhance automation and API performance; (2) move beyond read-only interactions; and (3) expand the scope of data available to support clinical efficiency, patient-centered care, and timely reporting (e.g., public health, quality, government programs) use cases.” ASTP/ONC states that this movement toward the prioritization of FHIR-based APIs will also support the development of “creative [AI]-enabled interoperability solutions.”
- Revisions to Information Blocking Requirements: For background, the 21st Century Cures Act and ONC’s implementing regulations prohibit “information blocking,” which is a practice that is likely to interfere with access, exchange, or use of electronic health information (“EHI”), unless an exception applies. The HTI-5 proposed rule proposes to update the definitions of “access” and “use” to emphasize that these definitions include automated means of access, exchange, or use of electronic health information (“EHI”), including autonomous AI systems.
ASTP/ONC also proposes to revise its exceptions for practices that are not information blocking to: (1) remove or revise certain conditions from the Infeasibility Exception, (2) remove the TEFCA Manner Exception, and (3) revise the “manner requested” condition in the Manner Exception. As it relates to the proposal to remove the TEFCA Manner Exception, ASTP/ONC states that the exception was intended to incentivize participation in TEFCA, but ASTP/ONC believes the exception is sometimes applied in a manner that demonstrates a misunderstanding of the exception and harms information exchange. ASTP/ONC states that it is no longer necessary to retain this exception to incentivize participation in TEFCA, as there has been significant maturation and advancement of TEFCA in recent years.
In addition to the HTI-5 proposed rule, ASTP/ONC also recently issued several new information blocking FAQs, which relate to several of the proposals discussed above, including access to EHI by automated technologies and the information blocking exceptions noted above.
The HTI-5 proposed rule may be one of multiple HTI proposals issued in the coming months, as ASTP/ONC has signaled that a HTI-6 proposed rule may be issued this spring or summer and could require electronic health records to support data exchange with wearables.
Withdrawal Notice
The notice, the Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability; Withdrawal formally withdraws the proposals in the HTI-2 proposed rule that were not finalized in the HTI-2 and HTI-4 final rules.
ASTP/ONC states that its decision to formally withdraw the remaining proposals is based on several reasons, including comments received in response to the HTI-2 proposed rule and the administration’s recent request for information related to deregulation, the Trump administration’s broader deregulatory focus, and changes in technology, such as newer standards, updated API interfaces, and emerging AI technologies.