HTI-5 Changes Health IT Certification. Operators Still Have to Govern the Record.

What ONC says HTI-5 changes

According to ONC’s final-rule overview, HTI-5 removes 14 of the Certification Program’s 60 criteria and revises seven. It leaves 39 unchanged, including new and revised criteria adopted under HTI-4. Those counts describe certification criteria—not the number of clinical responsibilities eliminated, product features removed or obligations waived for every care provider.

ONC also describes conforming changes to the Assurances, Application Programming Interfaces and Attestations Conditions and Maintenance of Certification. Real World Testing requirements are scaled back, and Insights reporting requirements are reduced generally in line with April 29, 2025 enforcement discretion, with the use of FHIR bulk data access measure also retained.

The overview frames the changes as a reset toward FHIR-based API requirements and support for creative AI-enabled interoperability solutions. That is a stated regulatory direction, not proof that a particular AI product is safe, authorized or ready for operational use.

The timing is not one universal deadline

ONC’s companion fact sheet distinguishes changes taking effect on the final rule’s effective date from changes scheduled for January 1, 2027 and January 1, 2030. For example, it lists removal of family health history and patient health information capture criteria for January 1, 2027, while the transitions-of-care criterion is revised effective January 1, 2030.

The clinical information reconciliation and incorporation criterion is listed as revised—not removed—on the final rule’s effective date. Decision support interventions and safety-enhanced design are also listed as revised. The fact sheet lists removal of the separate clinical decision support criterion; that is not a blanket finding that decision-support safety no longer matters.

These fact sheets expressly say they are not legal documents. They do not establish a calendar date for every change described as effective on the rule’s effective date. Before changing a procurement requirement or compliance practice, have the responsible regulatory adviser confirm the final regulatory text, effective date, applicable criteria and any transition provisions for the specific product and program.

A certification change is not an instruction to remove a safeguard

A criterion’s removal from the Certification Program should not be read as an instruction to discontinue the underlying capability. Nor does a revision, by itself, establish that a product’s functionality has changed. Operators should ask their vendors which certified modules are affected, what will remain supported and how contracts, testing evidence and implementation practices will change.

The two ONC summaries are not a basis for treating privacy, security, clinical-safety or other applicable duties as waived. The operator’s clinical and compliance leads must assess those duties separately. Different settings and programs may have different requirements; a senior housing portfolio should not assume every community is affected in the same way.

A connected record can still contain two defensible answers

Consider a hypothetical care transition. An incoming hospital summary includes one medication list; the community’s clinical record contains another. Successfully receiving both does not decide which list is authoritative for medication administration. That decision requires clinical reconciliation, an authorized reviewer and a documented resolution under the community’s applicable procedures.

The example is illustrative, not a report of an HTI-5 requirement or a demonstrated SeniorCRE workflow. Its lesson is organizational: transport, interpretation and authorization are different responsibilities. An interface must not silently turn a newly received assertion into an approved clinical instruction.

The same distinction applies to operating reports. Census, billing and sales systems may disagree because they measure different populations or periods. A useful answer preserves those source assertions, states the reporting purpose and records the authorized definition and reconciliation—not merely whichever value arrived most recently.

Five questions to bring to your next vendor review

First, which of our actual certified modules and versions are affected? Request a criterion-by-criterion explanation and confirmed timing rather than a general claim that the product is “HTI-5 ready.”

Second, which capabilities will remain contractually supported even where certification requirements change? Make retention, migration, access and care-transition expectations explicit for the workflows your communities rely on.

Third, what evidence will we use to accept an interface? Define the test population, completeness checks, identity matching, exceptions, clinical review where needed and responsible approver. A connection alone is not acceptance evidence.

Fourth, who resolves disagreements? Assign authority by field and purpose, document the reconciliation rule and retain traceability to the sources and reviewer. Do not make an integration team or AI assistant the default clinical decision-maker.

Fifth, what may AI read, propose or execute? Identify permitted data, purpose limits, escalation rules and any separately authorized action. Access to information is not permission to change a record or act on a resident’s behalf.

Coherence before Intelligence

HTI-5’s deregulatory direction and an operator’s governance responsibilities address different problems. Developers may face fewer certification requirements. Operators still need an accountable basis for the information used in care, financial reporting and executive decisions. The procurement response is not to recreate every retired criterion mechanically; it is to specify the evidence and safeguards required for each intended use.

SeniorCRE’s Operator-Controlled Operating Record is a proposed way to make definitions, source authority, reconciliation and lineage explicit. That is the meaning of Coherence before Intelligence: establish what an answer means and who may authorize its use before relying on intelligence built on top of it.

The Operator-Controlled Operating Record is designed and not yet implemented in any community. This article does not establish HTI-5 conformity, ONC certification, working FHIR integration or validated clinical outcomes for SeniorCRE. Product acceptance requires function-specific implementation, testing and operator approval; current assurance and readiness information belongs in the Trust Center.