Federal Health IT Rule Trims Certification Rules but Punts on AI Information Blocking Fight

For patients, health IT regulation can feel abstract, a world of acronyms and certification criteria that never touches daily life. But these rules shape something very concrete: whether your doctor's software can talk to your hospital's software, whether your records follow you when you switch providers, and whether the companies building these tools spend their money on innovation or on compliance paperwork. That tension sits at the heart of a new federal rule finalized this week.

The Department of Health and Human Services issued the final Health Data, Technology, and Interoperability: Deregulatory Actions to Unleash Prosperity Final Rule, known as HTI-5, on Monday. The name is a mouthful, but the goal is simple: strip back some of the technical requirements that health IT developers must meet to get their software certified by the federal government, on the theory that fewer rules mean faster innovation and lower costs.

The numbers tell part of the story. The Office of the National Coordinator for Health Information Technology, or ONC, had originally proposed removing 34 certification criteria and revising seven others. What actually made it into the final rule was more modest: 14 criteria removed, seven revised. Think of certification criteria as a checklist a car has to pass before it's allowed on the road. HTI-5 shortens that checklist in some places, while leaving plenty of safety checks intact.

ONC released a fact sheet spelling out exactly which proposed changes survived and which didn't. Some provisions take effect Thursday, when the rule is expected to publish in the Federal Register. Others phase in on Dec. 28 or Jan. 1, 2027, giving developers a staggered runway rather than a cliff.

What's Changing and What Isn't

One notable shift involves decision support interventions, the software features that flag potential drug interactions or suggest a diagnosis based on patient data. ONC moved or removed certain attributes tied to evidence-based and predictive decision support tools. Officials said during a media briefing that some of these changes could return in future rulemakings, so this isn't necessarily the final word.

Other revisions simply slow things down rather than eliminate requirements outright. The deadline for adopting Bulk FHIR, a data exchange standard that lets providers and insurers pull large datasets at once, has been pushed back. Developers also learned that even where older standards are being phased out of certification requirements, they may still need to support legacy exchange formats for customers who haven't yet made the switch to FHIR. Deregulation, in other words, doesn't always mean a clean break with the past.

Dr. Tom Keane, the National Coordinator for Health IT, framed the broader intent at the briefing: the certification program should meet "the floor of healthcare needs" without becoming "the ceiling innovation keeps hitting." It's a useful image. Regulations are supposed to set a minimum standard of safety and function, not cap how far the technology can go.

HHS Secretary Robert F. Kennedy Jr. put the savings figure at $1.5 billion in unnecessary regulatory costs eliminated. "We are freeing America's health technology innovators to build better tools, lower costs and help doctors spend more time caring for patients," he said in the announcement.

Not every proposal survived contact with public comment. ONC acknowledged that feedback emphasizing safety-enhanced design, privacy and security protections, and the need to preserve legacy standards for patient access to certain services carried real weight in the final decisions. That's a meaningful signal. Deregulation efforts often invite pushback that safety gets sacrificed for speed, and here the agency explicitly credited public input with shaping a more cautious outcome in several areas.

The most consequential item, though, is what didn't get finalized at all. ONC had proposed changes to information blocking rules, the regulations that penalize providers who improperly withhold patient data from other providers, payers, or patients themselves. Those changes remain under review and were left out of this rule entirely, even as the agency has separately promised new resources and renewed enforcement around information blocking.

Part of the holdup appears tied to a genuinely novel question: what happens when the party requesting patient data isn't a person, but an artificial intelligence agent acting on behalf of a patient, payer, or another provider? ONC's original proposal would have required providers to accommodate such AI-driven requests, with noncompliance treated as information blocking. That sounds reasonable in theory. In practice, it would require health systems and their IT vendors to build new infrastructure just to verify that an AI request is legitimate and properly authorized, adding real technical and financial burden on top of everything else providers already manage.

Industry groups have been watching this closely. The American Hospital Association and the HIMSS Electronic Health Record Association Association submitted comments earlier this year largely supporting deregulation, while flagging concerns that new market entrants might skip standardized data exchange approaches needed for interoperability to actually work across systems. Leigh Burchell of Altera Digital Health, who chairs the EHR Association, said in a statement that the group is still evaluating the final rule but is "pleased to see that the agency finalized a number of recommendations raised by our Association and other stakeholders." She added that the association appreciated ONC's decision to defer the information blocking changes for further consideration, and said it would keep working with the agency "toward a clear, practical and sustainable regulatory framework."

Why It Matters

Rules like HTI-5 rarely make headlines outside trade publications, but their effects ripple outward. When certification requirements shrink, developers have more room to build new features rather than chase compliance deadlines. That can mean faster progress on tools that help doctors spend less time on paperwork and more time with patients, which is the promise Kennedy and Keane are leaning on.

But the unresolved AI information blocking question deserves attention from anyone who cares about patient data rights. As AI agents increasingly act on behalf of patients and providers, the rules governing whether a hospital must honor a data request from a bot, not a human, will determine how much friction exists in getting your own health information when and where you need it. ONC says that debate isn't over. A future HTI-6 proposal may expand APIs further, and officials left open whether information blocking changes will come through a new rulemaking or a separate one entirely. For now, the deregulatory momentum is real, but the hardest questions about AI and patient data access remain unanswered.