What happened
The U.S. Department of Health and Human Services’ Office of the National Coordinator released the HTI‑5 final rule, eliminating 14 of the 60 certification criteria for health‑IT products and revising seven others. Crucially, it retained all 13 core privacy and security certification criteria after receiving extensive public comments warning that removal would shift verification burdens to providers and could lead developers to drop essential protections. The rule aims to reduce compliance costs—projected $1.5 B in total savings—with most provisions effective Dec 28 2026 and a few on Jan 1 2027.
Why it matters for trust and compliance
- Preserving the core privacy‑security certification criteria sustains a verifiable control baseline for third‑party health‑IT products, supporting audit readiness across multiple frameworks.
- Map retained certification criteria to your vendor risk controls and collect evidence for audit readiness.
- Integrate ONC rule monitoring into continuous third‑party oversight to detect future deregulatory changes.
Who is affected
Health‑IT vendors (EHR developers) Healthcare providers, especially small and rural organizations
Recommended actions
- Conduct a gap analysis of the remaining certification criteria against your internal security and privacy controls.
- Update your third‑party risk management program to reflect the reduced certification set and establish ongoing monitoring of ONC regulatory updates.