ONC released the HTI-5 final rule today.
Short version: some of the safeguards survived .. decision support did not.
The proposed rule would have removed 34 of the 60 certification criteria. The final rule removes 14, revises 7 & leaves 39 alone. Twenty criteria ONC wanted gone are still standing.
What they kept#
- Every privacy & security criterion, (d)(1) through (d)(13)
- The quality management system (g)(4) & accessibility (g)(5)
- Safety-enhanced design (g)(3), but only as an attestation (more below)
- Clinical information reconciliation (b)(2) & the implantable device list (a)(14)
- Cancer registry & health care survey reporting
- A runway to 2030 for C-CDA instead of a cliff
On hti5.org there were 298 unique comments aggregated from the Federal Register. 51% opposed the rule & 90% of individual clinicians did. ONC heard that.
One caution. ONC says it kept the privacy & security criteria “at this time,” & that future rulemaking may remove some or all of them. This fight is not over.
Decision support safety is effectively gone#
This is the part that worries me most.
ONC took out the three things that made clinical decision support much safer:
- Source attributes: who built it, who paid for it & what evidence sits behind it
- Intervention risk management for predictive models
- The testing & reporting behind safety-enhanced design, which is where certification looked at decision support as a high risk function
What is left is a requirement to apply user-centered design & the ability to select interventions. Nobody tests it. Nobody reports it. Nobody can see who made it and why.
These are not theoretical risks. Our JAMIA Perspective, with Raj Ratwani, Terry Fairbanks & Matt Weinger, walks through what the certification program has already caught:
- Practice Fusion admitted soliciting nearly $1 million from an opioid manufacturer to build a decision support alert meant to increase prescribing of extended-release opioids. $145 million settlement.
- eClinicalWorks was alleged to have hard-coded the 16 drug codes used in certification testing, & to have shipped software that did not reliably perform drug interaction checks or keep an accurate audit log. $155 million settlement.
- Both cases worked because providers attest to using certified technology, so misrepresenting conformance meant False Claims Act liability. Remove the criteria & that accountability goes with them.
And the harm from poor design is documented. A 2005 study of a leading order entry system linked 22 types of medication error to the software’s design. A decade later, an analysis of 9,000 pediatric safety reports found EHR usability contributed to 609 events that may have harmed children, most often through improper dosing. In 2011 the Institute of Medicine called poor usability “one of the single greatest threats to patient safety.”
Known risks. Proven safety checks. Now abandoned.
It is like dropping seatbelt requirements because most cars already have seatbelts. Like pulling the guardrails off the road because most drivers stay in their lane. Like ending pasteurization because most milk is fine.
And this lands just as predictive models & generative AI arrive in every EHR.
What they should not have cut#
Decision support source attributes & risk management, at ยง170.315(b)(11)(iv), (v) & (vi). ONC’s own preamble calls them the “model card” requirements. They are the fields that tell a clinician who built an intervention, who paid for it & what evidence sits behind it.
The funding source attribute is the regulatory answer to the Practice Fusion fact pattern.
Now every EHR developer is wiring in predictive models & generative AI, some built by a third party, some paid for by someone with a stake in what the model recommends. A clinician looking at a suggestion deserves to know who made it, who paid for it & what it was trained on.
ONC says it “will take under consideration for future rulemaking whether such elements of ‘source attributes transparency’ should be restored.” Pulling a guardrail & then promising to think about putting it back is the wrong order. ONC says it found no evidence the requirements were used or improved care, & points to FDA & the Section 1557 rule as the safety net. On funding source disclosure specifically, it gave no direct answer.
The rule says its next planned action is FHIR-focused. It gives no date.
Also gone: C-CDA creation performance (g)(6), family health history (a)(12) (that one lands on my specialty), the care plan (b)(9) & Direct. Pulling Direct before a FHIR replacement is certified pushes nursing homes, home health agencies & small practices back toward fax.
The economics did not move either. ONC still claims about $1.55 billion in savings, still assigns developers zero cost & still leans on “widely adopted” reasoning. Every car has seatbelts, & nobody proposes dropping the seatbelt standard because adoption is universal. More on the math below.
The $1.55 billion#
ONC says this rule saves about $1.55 billion. I do not believe it. I think the real number is much less - and their own analysis reveals that they don’t quite believe it either:
- The figure assumes the savings run forever. ONC’s own 10 year number at 7% is about $945 million.
- It counts developer hours saved & assigns developers $0 in costs. It does not count what shifts to hospitals, clinics & patients. ONC says itself it has “limited data” on those.
- It counts nothing for harm. A wrong-patient order, a missed reconciliation or a breach has a cost, & somebody pays it. Wrongful death, liability law suits .. etc.
- ONC says these capabilities are already “widespread,” which is why they can go. If developers keep doing the work (& the responsible ones will), the savings are not there. If they stop, the safety is not there either. So … with HTI-5, it’s lose-lose. ONC can’t have it both ways.
Most of the claimed savings come from three places: safety-enhanced design, decision support & real world testing. Those are exactly the places where safety lives.
But the dollar figure is not what troubles me most. Asking how many lives we lose at what cost is the wrong question. Patient safety does not belong on a ledger. I am saddened by the premise behind this rule, that health care of all industries should trade safety for profits.
In the middle#
- Information blocking is not in this rule at all. That includes the proposals on agentic AI & the Manner Exception. I most want the agentic AI language, because patients & their tools will use agents to pull records whether the rule says so or not.
- Reconciliation survived, but the side-by-side display of two sources is gone.
- Real world testing & Insights were scaled back. Fewer measures means less visibility into whether the rest of this was safe.
- Data segmentation (b)(7) & (b)(8) removed. The next privacy fight will probably run through them.
- Safety-enhanced design is kept, but now it is one paragraph: user-centered design processes must be applied. The testing & reporting paragraphs are gone, & ONC’s own analysis counts that revision as roughly $19 to $28 million a year in savings. The principle survived & the verification did not. My first question for the October 29 info session: what, if anything, will certification bodies check?
What next#
The ask for HTI-6 is clear: restore funding source, developer & evidence attributes & intervention risk management, & extend them to predictive & generative AI interventions with a risk-based tier.
The comment process worked, mostly. On safety, the movement tracks our recommendations almost line by line. On economics & rationale, ONC changed nothing. Fair trade for this round, & it tells us where to aim next.
The full analysis, with our position on every provision, is at hti5.org.
LMK what I got wrong ..
- Jacob