HTI-5 vs HIPAA AI Logging Requirements: What Each Rule Covers

What changed: HTI-5 is a deregulatory rule, not an AI evidence rule

Many teams still frame this question as a choice between two AI logging rules. The premise needs updating. HTI-5, the ONC deregulatory rulemaking, was proposed on December 22, 2025 and finalized on October 26, 2026. Its stated aims were to reduce burden on health IT developers by streamlining the certification program, update the information blocking regulations, and lay a foundation for AI-enabled interoperability through modernized standards and certification.

The final rule removes or revises certification criteria and scales back the Conditions and Maintenance of Certification requirements. It removes the clinical decision support criterion (§ 170.315(a)(9)) and lists the decision support interventions criterion (§ 170.315(b)(11)) as revised. The proposal would have fully removed the AI model card requirements from that criterion. ONC describes the final rule as reducing compliance costs for developers and resetting the program's scope.

The practical consequence is that HTI-5 obligations fall on developers, and its AI-related provision was reduced rather than expanded. A health system cannot treat a developer's certification as the source of its own AI audit evidence.

HTI-5 and HIPAA side by side

The two instruments differ in who they bind, what they reach and what they ask for. They are complementary in the sense that they apply to different parties, not in the sense that one satisfies the other.

• Regulated party: HTI-5: health IT developers in the ONC Health IT Certification Program. HIPAA: covered entities and business associates, which includes the health system.
• Instrument type: HTI-5: certification criteria (45 CFR 170.315) and Conditions and Maintenance of Certification (§§ 170.402 to 170.407). HIPAA: Security Rule and Privacy Rule requirements in 45 CFR Part 164.
• What it reaches: HTI-5: certified health IT functionality and developer program obligations. HIPAA: PHI and the systems that hold ePHI, including ePHI used in AI data and models.
• Logging relevance: HTI-5: no AI logging requirement in the final rule. HIPAA: 164.312(b) audit controls, within the technical safeguards in 164.312.
• AI transparency: HTI-5: the AI model card requirements in the DSI criterion were proposed for removal, and the criterion is listed as revised. HIPAA: no AI transparency artifact is specified.
• Who closes the gap: HTI-5: developers, through what they choose to document. HIPAA: the health system, through its own risk analysis and procedures.

What HIPAA means for AI logging at a health system

HIPAA applies directly to health plans, health care clearinghouses, and health care providers that transmit information electronically in connection with a standard transaction. Business associates are bound as well. Part 164 provides that a covered entity or business associate may not use or disclose PHI except as permitted or required by the rule. 164.312 sets the technical safeguards, and 164.312(b) is the audit controls provision that compliance teams map logging to.

HHS addressed AI directly in the preamble to its January 6, 2025 Security Rule proposal. It states that ePHI, including ePHI in AI training data, prediction models and algorithm data maintained by a regulated entity for covered functions, is protected by the HIPAA Rules. The same preamble says regulated entities should review activity in their electronic information systems regularly and consider automating those reviews. It also says they are responsible for establishing standard operating procedures, including which types of audit trail data and monitoring procedures they need.

That proposal is not current law, and its proposed requirements should not be cited as obligations. It is still a useful statement of how HHS reads the existing framework. AI workflows that process ePHI are candidates for the same audit logging and review as any other system holding ePHI, and the health system decides what that means for AI.

Where neither rule prescribes an AI evidence artifact

Neither HTI-5 nor the HIPAA text described here specifies a log format, a field set, a retention period, or an artifact for AI prompts and tool calls. That is the gap a health system has to close. Teams that read HIPAA audit controls loosely tend to log too little, such as model request counts or user sign-ins. They cannot then answer the questions an auditor will ask: what the AI system was permitted to do, what it did, and which calls touched PHI.

The opposite failure is also common. Capturing full prompts and tool-call payloads can produce logs that contain PHI. Such logs are likely ePHI themselves and fall under the use and disclosure limits in Part 164, so counsel should confirm the position. Retaining them without a documented rationale, access control and retention decision creates a second compliance problem while solving the first.

Because HTI-5 reduced developer-side requirements, the health system should also ask each certified developer directly what AI documentation it supplies. For tools delivered by business associates, contracts and oversight should state who records what. The split is simple to state: ONC certification obligations sit with developers, and HIPAA audit and logging responsibilities sit with the covered entity and its business associates.

Where runtime policy enforcement fits

Trussed enforces policy in the execution path of AI interactions and tool calls, across models, agents, tools and MCP servers. Each interaction is allowed, redacted, blocked, rate limited or escalated for human approval at runtime, not reviewed after the fact. The enforcement decision produces audit-ready evidence, which is mapped to HIPAA, including PHI handling and 164.312(b) audit controls.

For a health system, that evidence supports its own audit-control responsibilities: what a policy allowed, what an AI system did, and which interactions were redacted or blocked before PHI moved. Trussed runs in production with healthcare organizations. It deploys self-managed in the customer cloud, with configurable retention and data residency, which helps when a health system has to set and justify its own retention decisions for evidence that may contain PHI.

This does not replace the health system's risk analysis or its decision about which AI events to record. It gives that decision an enforcement point and a durable record.