ONC released the HTI-5 Final Rule on October 26, 2026, with most changes taking effect on December 28, 2026 (60 days after Federal Register publication). ONC initially proposed removing 34 out of 60 certification criteria.
However, the final rule removes only 14, revises 7, and leaves 39 unchanged. This means 20 more certification criteria remain than originally planned. The rule reduces certain EHR certification, testing, and reporting requirements while keeping important requirements for interoperability, privacy, and security.
In this blog, we explain the key changes, the requirements that remain, and what EHRs and Provider Organizations should review next.
What changed under HTI-5?
The HTI-5 Final Rule changes 4 main areas of certification, testing, and reporting. Here is a short list of the changes and their deadlines.
1. Decision Support Interventions (DSI)
Decision support tools help clinicians make care decisions using patient information, clinical guidelines, and predictive models. Under HTI-5, ONC removed certain certification requirements for these tools:
- Predictive tool information: Removed requirements to provide detailed information about how predictive models were developed, evaluated, and used.
- Risk management: Removed requirements to document how risks associated with predictive tools are identified, assessed, and managed.
The Decision Support Interventions certification criterion (b)(11) remains in place, with revised requirements.
2. Real World Testing (RWT)
Real World Testing checks how certified EHR technology performs in healthcare settings.
- Annual testing plans: EHRs no longer need to submit RWT plans to ONC.
- Results reporting: Detailed reports are now limited to specified APIs, including FHIR and electronic prior authorization APIs.
Annual testing still applies to other relevant certified capabilities, even when detailed reporting is no longer required.
3. Insights reporting
ONC removed 5 of the 7 measures to report how certified EHR technology is used. The 2 remaining measures track:
- FHIR application use: How applications access health information through FHIR APIs.
- Bulk FHIR use: How FHIR APIs access information for groups of patients.
The first Bulk FHIR reporting deadline has been moved to July 2029.
4. Application access and data exchange
- Application access: Removed older certification criteria for selecting patients and requesting all available patient data, effective January 1, 2027.
- Direct Protocol: Removed 2 secure messaging certification criteria, effective December 28, 2026.
- C-CDA: Revised certain requirements for creating and exchanging clinical summary documents, effective January 1, 2030.
What requirements remain under HTI-5?
HTI-5 keeps several important certification requirements for sharing health information, protecting patient data, and supporting clinical workflows.
These include:
FHIR APIs (g)(10): Allows authorized applications to securely access patient health information.
EHI Export (b)(10): Supports exporting electronic health information from certified EHR systems.
Privacy and security: All 13 certification criteria remain unchanged, including access controls, authentication, and data protection.
Quality management and accessibility: Requirements for software quality and accessibility continue.
Public health reporting: Requirements for sharing health information with public health agencies continue, with certain revisions.
Information blocking rules remain unchanged
ONC did not finalize its proposed changes to information blocking, including proposals involving AI-powered and automated access to health information. Existing information blocking rules still apply.
What HTI-5 means
For EHRs
For EHRs, the priority is to understand how HTI-5 affects their existing certifications and future product updates.
Removing a certification requirement does not automatically mean an existing feature should be discontinued. EHRs should review their certification plans while considering the services and integrations their customers rely on.
What to review now
- Certified modules: Identify which removed or revised criteria apply to your certified products.
- Certification documentation: Check whether certification records, technical documentation, or internal checklists need updating.
- Testing and reporting: Confirm which annual testing and reporting activities must continue, and which submissions are no longer required.
- Product features: Review planned changes to patient access, clinical quality measures, and data exchange capabilities.
- Customer commitments: Check that product updates will not disrupt existing integrations, MIPS reporting, or service commitments.
For Provider Organizations
HTI-5 does not require Provider Organizations to replace their EHR systems or change their existing clinical workflows.
However, EHRs may update certain features following the certification changes, which may modify certain features or workflows. Provider Organizations should understand whether these updates will affect their access to patient information, data exchange, or CMS reporting.
What to review now
- Existing EHR features: Confirm whether any features your organization currently uses are scheduled to change.
- Patient data exchange: Check that clinical summaries, referrals, and patient information can continue to be shared with other healthcare organizations.
- CMS reporting: Confirm continued support for applicable MIPS and Promoting Interoperability reporting requirements.
How Darena Health can help
For EHRs
Our ONC-certified modules support continuing requirements such as FHIR APIs and EHI Export, along with Decision Support Interventions. EHRs can integrate these capabilities without building every component internally.
For Provider Organizations
Our interoperability solutions help connect patient health information across EHR systems, supporting access to and exchange of health information for existing clinical workflows.
Have more questions about HTI-5?
Talk to our team about your certification and interoperability needs.
