HTI-5: From Proposed Rule to Final Rule, and What It Means for AI Platform Teams

What HTI-5 is and where it stands

HTI-5 is the common name for "Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity." The proposed rule was released by ASTP/ONC on December 22, 2025 and published on December 29, 2025. Searches for the HTI-5 proposed rule still return fact sheets, charts and slides that describe that proposal. Those materials describe superseded text. The final rule, published October 28, 2026, is the current reference.

HHS and ASTP/ONC described three goals for the proposal: reduce developer burden by streamlining the voluntary Health IT Certification Program and removing redundant requirements; update the information blocking regulations to better promote access, exchange and use of electronic health information; and advance a foundation of FHIR-based APIs that support AI-enabled interoperability through modernized standards and certification.

Two scoping points matter for platform teams. First, the Certification Program is voluntary and the rule's obligations fall on health IT developers within it, not on every organization that runs AI. Second, ONC frames HTI-5 as a reset of the program's regulatory scope and a foundation for future FHIR-based API requirements. It is not a set of new AI-specific controls. Separately, ASTP/ONC withdrew the non-finalized provisions of the HTI-2 proposed rule effective December 29, 2025, so that earlier proposal is not a live source of requirements.

Proposed versus final: what changed

The final rule is materially narrower in its removals than the proposal. Any internal compliance mapping built on the December 2025 proposal should be redone against the final table, and it should record which version it references.

• Criteria removed: Proposed: 34 of 60. Final: 14.
• Criteria revised: Proposed: 7. Final: 7.
• Criteria retained unchanged: Proposed: 19. Final: 39, including the new and revised HTI-4 criteria.
• Clinical information reconciliation and incorporation, § 170.315(b)(2): Proposed: remove, effective January 1, 2027. Final: revise, effective on the final rule's effective date.
• Transitions of care, § 170.315(b)(1): Proposed: revise, effective January 1, 2027. Final: revise, effective January 1, 2030.
• Real World Testing, § 170.405: Scaled back in the final rule, covering test plans, results and use of the Standards Version Advancement Process.

The provisions that bear on AI-enabled functionality

The criterion most directly tied to AI is decision support interventions at § 170.315(b)(11). The proposal would have narrowed its scope to remove the AI "model card" requirements entirely. The final-rule table lists (b)(11) as Revise, effective on the final rule's effective date. The older clinical decision support criterion at § 170.315(a)(9) is listed as Remove. Safety-enhanced design at § 170.315(g)(3) is listed as Revise, and the security tags criteria at § 170.315(b)(7) and (b)(8) are listed as Remove.

The practical reading is that certification-driven documentation of AI behavior is shrinking. The proposal's impact analysis recalled the HTI-1 rationale that transparency into AI applications helps delivery organizations choose more accurate tools, and then proposed to reduce that transparency requirement. Teams that relied on model-card style disclosures from certified developers as a source of assurance should assume less of it will arrive through certification.

The other relevant areas are the information blocking updates and the FHIR-based API direction. These govern how electronic health information is accessed, exchanged and used, which is where AI agents and tools often connect. Teams should read the final text of those provisions and the (b)(11) revision before turning them into engineering requirements.

What the rule leaves to the implementer

HTI-5 does not say that an AI platform must enforce policy at runtime, scope access for models, agents and tools, or retain enforcement records. Treat any such architecture as an internal engineering and governance decision. The reasoning is straightforward: when external certification asks for less documentation, an organization's own record of what each model, agent or tool was permitted to access, and what it accessed, carries more weight in answering a regulator, auditor or clinical safety reviewer.

This is a design judgment, not a regulatory duty. It also keeps two things separate that are easy to blur: certification-program obligations on health IT developers, and an organization's own AI governance commitments. Mappings to HIPAA and NIST AI RMF are a separate exercise from HTI-5 and need their own analysis. Retention periods for enforcement records should be set by the policy and legal requirements that apply to your organization, not inferred from HTI-5.

A useful test is where the policy decision happens. Policy that is reviewed afterward from logs tells you what went wrong. Policy enforced before an action executes determines what can go wrong, and it leaves a record of the decision made at the time of the request.

Where Trussed fits

Trussed is runtime control and evidence infrastructure for regulated enterprises that must show what their AI was allowed to do and what it did. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Actions are allow, redact, block, rate limit, or escalate for human approval, applied to individual interactions and tool calls. Enforcement is at runtime, not reviewed after the fact.

That enforcement generates continuous, audit-ready evidence, mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST. Trussed can be deployed self-managed in the customer cloud, with configurable retention and data residency. In production it has run continuously for 18+ months in a regulated enterprise, at 99.95% uptime on live traffic, with 100+ models under one policy plane.

Trussed does not make an organization HTI-5 compliant, and HTI-5 does not mandate specific tooling. The capabilities above are relevant to the internal control and evidence questions in this guide, whichever tools you use to answer them.