HTI-5 Final Rule for Practices in 2027: What Changes and What to Do

The HTI-5 final rule removes 14 of the 60 criteria in the federal health IT certification program and revises seven more. Most changes take effect 60 days after its October 28, 2026 publication. For your practice, the EHR stays certified, privacy and security rules stay in place, and AI tools lose their required disclosure labels.

HTI-5 is the latest rule from the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health IT (ASTP/ONC). It governs what an EHR vendor must build and test to keep its certification. It does not regulate practices directly, but your Medicare reporting depends on that certification.

This guide is for practice owners, managers and EHR administrators. It covers what changed, what did not, the dates that matter, and what to check with your vendor before year end. doctor.ebiz covers the business side of healthcare, and certified health IT sits underneath almost every dollar a practice reports to Medicare.

What Does the HTI-5 Final Rule Change for a Practice?

The HTI-5 final rule mostly changes your vendor's obligations, not yours. It trims what EHR developers must certify, test and report. Your practice still uses a certified system, still reports Promoting Interoperability, and still answers to the same information blocking rules. The main practical change is less vendor documentation about AI tools.

The program currently holds 60 certification criteria. Each criterion is a capability an EHR must prove, such as e-prescribing or patient API access. ASTP/ONC lists the full set of changes on its HTI-5 final rule page, along with separate fact sheets on removed and revised criteria.

The final rule is far narrower than the proposal. Healthcare Dive reported that the December 2025 draft would have removed 34 criteria, according to its coverage of the HTI-5 final rule. HHS estimates the final version will cut about $1.5 billion in regulatory costs.

Several areas survived the cuts. The rule keeps privacy and security criteria, accessibility-centered design, quality measurement, implantable device information and selected public health reporting. In practice, your EHR administrator should see few workflow changes from the removals alone.

HTI-5 Effective Dates to Put on the Calendar

The HTI-5 final rule phases in over three dates. Most provisions start 60 days after Federal Register publication, which lands in late December 2026. Some changes wait until January 1, 2027. Specified transitions-of-care changes are delayed to January 1, 2030, which gives developers more time to move off older exchange methods.

More rules may follow soon. Law firm Holland & Knight expects an HTI-6 proposed rule before the end of 2026, per its analysis of HTI-5's certification changes, and ASTP/ONC has said future requirements will build on FHIR-based APIs. FHIR (Fast Healthcare Interoperability Resources) is the data standard modern EHRs use to share records through apps.

In practice, the EHR admin should ask the vendor for its HTI-5 release notes before the January upgrade.

AI Tools Lose Their Certified Disclosures

Decision support interventions are the alerts, risk scores and predictive tools built into an EHR. The 2024 HTI-1 rule required developers to disclose source attributes for these tools, often called a model card. A model card states a tool's intended use, training data, performance and known limits.

HTI-5 removes that requirement. Developers no longer need to supply certified disclosures on how a predictive tool was trained, validated or tested. The rule also drops the related risk management requirements for predictive decision support.

Testing obligations shrink as well. Developers no longer submit annual real-world testing plans, and detailed safety-enhanced design testing becomes a simpler attestation. Real-world testing showed how a certified feature behaved in live clinics, so practices lose one public check on vendor claims.

The vetting burden now sits with you. Hospital and clinician groups objected during comments for this reason. If a sepsis alert or no-show predictor runs in your EHR, the vendor no longer has to document it to keep certification.

This matters most when outside vendors bring their own predictive tools. Remote monitoring services are a common example, and our guide to outsourced RPM staffing under CMS's 2027 proposal covers how those contracts are changing. Ask for a written description of any risk scoring before you sign.

In practice, the medical director and practice manager should keep a short inventory of every AI tool in use and who supplied it.

Privacy, Security and Information Blocking Rules Stay Put

ASTP/ONC did not finalize its proposals to remove privacy and security criteria. Certified health IT must still include capabilities that support HIPAA compliance. Your annual security risk analysis is also unaffected, and our walkthrough on running a HIPAA security risk analysis at a small practice still applies as written.

Information blocking rules did not change either. Information blocking means a practice or vendor interferes with a patient's or another provider's access to electronic health information without a valid exception. ASTP/ONC postponed every proposed change to those rules, including clarifications about autonomous AI.

Enforcement is already active. The HHS Office of Inspector General (OIG) and ASTP/ONC issued a joint information blocking enforcement alert on September 4, 2025. Developers and health information networks face fines of up to $1 million per violation. Providers face CMS disincentives in programs such as MIPS.

The OIG says it will prioritize cases with patient harm, long duration or financial loss to federal programs. ASTP/ONC can also ban a developer from the certification program or terminate a product's certification. A terminated certification would leave a practice without the CEHRT it needs for Medicare reporting.

Records requests are where most practices face this risk. A patient's request for their chart, or another clinic's request for a referral history, should move without unexplained delay. If your front desk routinely holds records until a fee is paid or a form is mailed, review that policy against the exceptions.

The newer HTI-4 criteria also stay. Those cover electronic prior authorization and real-time prescription benefit checks. They connect directly to the payer deadlines in our guide to prior authorization APIs arriving in January 2027.

doctor.ebiz's compliance note: a slimmer certification program does not relax any rule your practice is audited against. In practice, the privacy officer's checklist for 2027 stays the same.

MIPS Promoting Interoperability Still Needs Certified EHR Technology

The Merit-based Incentive Payment System (MIPS) Promoting Interoperability category depends on certified EHR technology (CEHRT). The CMS 2026 Promoting Interoperability quick start guide sets the category at 25% of a traditional MIPS final score. HTI-5 does not change that weight.

The 2026 performance period requires a continuous 180 days. The last eligible window runs from July 5 to December 31, 2026. Your EHR must be certified by the last day of that period, and you need a CMS EHR Certification ID from the Certified Health IT Product List (CHPL) when you submit.

Two attestations still trip practices up. You must answer "Yes" to the security risk analysis and to the SAFER Guides self-assessment. A "No" on any required attestation scores zero for the whole category.

Small practices have more room. CMS reweights Promoting Interoperability to 0% for small practices automatically, so no submission is required. Other clinicians can apply for a hardship exception by December 31, 2026. Submission opens January 4 and closes March 31, 2027.

In practice, the billing lead should confirm the CHPL certification ID matches the EHR version installed after any HTI-5 update.

Monday Morning Checklist for HTI-5

These steps follow the order most practices can complete them, starting this week.

HTI-5 lightens your vendor's load more than yours. The obligations that carry penalties for a practice, from HIPAA to information blocking, have not moved.

Fact-checked against ASTP/ONC's HTI-5 final rule materials and the CMS 2026 Promoting Interoperability guide on November 6, 2026.