HHS finalizes HTI-5 rule, cuts EHR compliance burden

The Office of the National Coordinator for Health Information Technology released the HTI-5 Final Rule on Oct. 26, part of a broader deregulatory push HHS is branding "ONC Deregulatory Actions to Unleash Prosperity." The agency says the rule trims administrative burden inside the ONC Health IT Certification Program so vendors can redirect engineering time toward product work instead of compliance paperwork. STAT News' coverage independently confirmed the scope, reporting that the administration removed 14 distinct security, privacy and transparency requirements that had applied to certified EHR products.

The requirements being dropped touched areas like disclosure obligations around how certified products handle health data and some of the attestation steps vendors previously had to complete to keep a module certified. HHS frames the cuts as removing friction that didn't meaningfully improve patient safety, while critics quoted in STAT's piece warn that several of the removed provisions existed specifically to keep EHR vendors accountable for how patient data moves through their systems — accountability that doesn't disappear just because the certification checkbox does.

For EHR vendors and the clinics that run on their platforms, the practical effect is a shorter path from "we want to ship this feature" to production. Fewer mandatory disclosure and attestation steps means fewer gates between a product decision and a release — which is exactly the kind of opening that favors teams who can move fast on a scoped build rather than carrying the overhead of a full platform rewrite. Clinics and smaller EHR vendors evaluating what to build first under the loosened rule are, in practice, better served by shipping a focused minimum viable product to validate the feature with real users before committing to a larger rebuild — the kind of scoped build Epica's own clinical software work is built around.

What's actually changing for certified vendors

The certification program itself isn't going away — vendors still need to hold ONC certification to participate in CMS incentive programs tied to meaningful use of EHR technology. What changes is the list of conditions attached to that certification: fewer reporting obligations, fewer mandatory disclosures, and, per HHS's own framing, less time spent on paperwork that didn't directly affect how the software functions for a clinician at the point of care.

Why the accountability debate matters for builders

The removed provisions were, in several cases, the mechanism patients and regulators used to find out how a certified product actually handled sensitive data in production. Teams building on top of EHR platforms — integrations, patient apps, analytics layers — should treat the rollback as a reason to document their own data-handling practices more rigorously, not less, since vendor-level disclosure requirements are exactly what's being relaxed.