HHS Rolls Back AI Transparency Rules for Health IT, Leaving Hospitals to Fill the Gaps

When a hospital adopts a new AI tool to flag sepsis risk or recommend a treatment pathway, clinicians need to trust that tool. That trust has, until now, rested partly on federal certification standards designed to make AI transparent: what data trained it, how it performs, where its limits lie. A new rule from the Department of Health and Human Services is about to change that calculus, and not necessarily in patients' favor.

HHS finalized the HTI-5 rule last week through the Office of the National Coordinator for Health Information Technology. The rule eliminates 14 of the 60 certification criteria currently governing health IT products, and revises seven more. That is a scaled-back version of the original proposal, which had sought to remove 34 criteria. Most of the changes take effect December 28, 2026, with a handful following on January 1, 2027. ONC projects the deregulation will save more than $1.5 billion in regulatory costs.

On paper, that sounds like a win for innovation. Fewer compliance hoops for health IT developers could mean faster product development and lower prices passed on to the hospitals buying these tools. But the savings come with a tradeoff, and it is one that shifts real weight onto the shoulders of hospitals and health systems that may not be equipped to carry it.

What Hospitals Lose When Certification Shrinks

Think of certification requirements like a nutrition label on food. You may not read every line, but you trust it is there, verified, and consistent across products. The HTI-5 rule removes a version of that label for one of the most consequential categories of health IT: decision support interventions. These are the predictive tools clinicians increasingly lean on to help diagnose conditions, flag risks, or recommend treatments.

Under the old rules, developers had to provide source attributions explaining the data behind an AI tool's recommendations. That requirement is gone now. According to documents released by the Government Publishing Office, HHS has "finalized removal of source attribute information transparency for evidence-based and predictive decision support interventions," along with related access, modification, and risk management requirements.

Mel Soliz, an attorney who focuses on health data privacy and interoperability law, put it bluntly in an email. Certification, she said, "no longer guarantees access to information about a predictive tool's intended use, training data, performance, or limitations." The task of figuring out those answers does not disappear. It simply moves. "In practice, the responsibility for doing this evaluation is going to fall on the users of these tools; that is, the hospitals and health care providers," Soliz said.

That is a significant ask. Hospitals vary widely in their technical capacity to evaluate AI systems. A large academic medical center might have a data science team capable of auditing a vendor's training data and performance claims. A rural community hospital likely does not. Without a federal baseline, the depth of scrutiny an AI tool receives before reaching a patient's bedside could depend less on the tool's actual safety and more on the sophistication of the buyer.

Soliz recommends that health systems respond by building their own safeguards directly into procurement contracts, specifying disclosure obligations, validation testing, and bias audits before signing with a vendor. It is a reasonable workaround. It is also, functionally, each hospital reinventing a wheel that used to be standardized nationally.

A second change in the rule has drawn sharper criticism. HTI-5 eliminates the voluntary certification criteria for security tags, the digital labels used to flag especially sensitive health records, including those related to behavioral health or substance use disorder treatment. HIPAA protections for this information remain in place on paper. But the practical mechanism many systems relied on to apply those protections consistently is going away.

Soliz calls this one of the most disappointing parts of the rule. "This tagging enables providers to create a summary record that is tagged as restricted and subject to restrictions on redisclosure to support compliance with sensitive data laws and patient privacy preferences," she explained. Strip away the tagging infrastructure, and applying the right privacy rules to the right records becomes far harder. "It becomes exceedingly challenging to apply the appropriate consent rules to the appropriate records at the level of granularity desired," she said.

Picture a patient whose substance use disorder treatment history needs to stay restricted even as the rest of their medical record gets shared for ongoing care. Security tags made that kind of selective sharing possible at scale. Without a standardized tagging system, health systems will need to find other ways to segment sensitive data, likely through more manual processes that are harder to audit and easier to get wrong.

Supporters of the rule frame this as cutting red tape that slowed innovation without improving outcomes. ONC's $1.5 billion savings estimate suggests the agency sees real economic benefit in trimming these requirements. Developers freed from certain compliance burdens may indeed bring products to market faster and at lower cost. Whether those savings translate into better care, or simply into lower friction for sellers while risk quietly accumulates on the buyer's side, remains an open question.

Why It Matters

Healthcare runs on trust that is layered and largely invisible to patients. We trust that the AI tool guiding a diagnosis has been checked. We trust that our mental health records stay private unless we choose otherwise. Federal certification standards were one of the quiet mechanisms holding that trust in place, even if most patients never knew they existed.

Removing those standards does not necessarily mean AI tools will get worse or privacy will erode immediately. But it does mean the burden of ensuring safety and confidentiality now falls more heavily on individual hospitals, many of which lack the resources, staff, or leverage to demand the same transparency the federal government used to require by default. For an industry already stretched thin, that is a meaningful shift, one worth watching closely as the December deadline approaches and hospitals scramble to build their own safety nets.