Federal Rule Shifts AI Safety Checks to Hospitals
HHS's HTI-5 final rule drops AI source attribution and removes 14 health IT criteria, with most changes effective December 28, 2026.
Updated on Nov. 3, 2026 in Artificial Intelligence
Live Poll
Do you trust hospitals to vet AI tools used in your care?
The U.S. Department of Health and Human Services, through the Office of the National Coordinator for Health Information Technology, issued the HTI-5 final rule, which removes 14 of the 60 health IT certification criteria in effect and revises seven more. The rule is a final, enacted regulation, not an proposal: most changes take effect December 28, 2026, with remaining exceptions on January 1, 2027.
Why it matters
The rule drops requirements that developers provide source attributions for AI-generated recommendations and removes voluntary security-tag criteria for sensitive health data, shifting evaluation of clinical AI tools toward hospitals and health systems. It follows a federal pattern of scaling back certification requirements, with the original proposal having called for removing 34 criteria before the final version narrowed the cut.
The figures come from the final rule text itself, a federal regulatory document, and show that 14 of 60 criteria are removed and seven revised compared with the 34 removals originally proposed. The projected savings of more than $1.5 billion are an agency estimate, and the source does not describe how that figure was built or how the removed requirements will be replaced in practice.
The players
U.S. Department of Health and Human Services
The federal department whose rulemaking sets health IT certification standards that govern electronic health record software used across American hospitals and clinics.
Office of the National Coordinator for Health Information Technology
The HHS office that issued the HTI-5 final rule and oversees the federal certification program for health information technology products.
The details
The Office of the National Coordinator for Health Information Technology, the HHS office that sets standards for electronic health records, issued the HTI-5 final rule. Certification criteria are technical requirements that health IT developers must meet to have their products certified for federal programs, so removing a criterion means a product no longer has to demonstrate that feature. Source attribution is information showing where a decision-support recommendation came from, and the rule removes requirements to provide it for evidence-based and predictive tools, meaning the origin of an AI recommendation no longer has to be disclosed through certified software.
Timeline
October 27, 2026: HTI-5 final rule issued.
December 28, 2026: Most certification changes take effect.
January 1, 2027: Remaining exceptions take effect.
The Tech Race
The rule places the U.S. certification framework in a shift toward lighter federal oversight of health software, moving responsibility for validating clinical AI onto individual health systems. The source does not identify competing national programs or named rival standards, so the wider competitive positioning cannot be established from the extraction.
Hospitals and health systems will take on more of the work of checking whether AI decision-support tools are safe and accurate, since certified software will no longer have to show where its recommendations come from. The changes apply from December 28, 2026, with the remaining exceptions on January 1, 2027, so clinicians and administrators have a defined window to adjust their evaluation processes.
The takeaway
The removal of source attribution for AI recommendations is the trajectory to track, because it moves accountability for clinical AI from certified software to the institutions that deploy it. Watch the December 28, 2026 effective date, when most of these certification changes begin to apply to health IT products used across U.S. health systems.
What happens next
Most HTI-5 certification changes take effect on December 28, 2026, and the remaining exceptions take effect on January 1, 2027.
Further reading
For the wider policy context, see our Artificial Intelligence coverage of how AI tools are regulated and evaluated in the United States.
Live Poll
Do you trust hospitals to vet AI tools used in your care?
