🎧 Podcast episode for paid subscribers only. Also available on Apple Podcasts and Spotify.
To listen to paid episodes in Apple or Spotify, link your Substack subscription via the show settings on those platforms (instructions inside the Substack app under Subscriptions → Podcast).
Table of Contents
The final rule is smaller than the proposal
Where the billion-dollar savings come from
Clinical AI evidence becomes a purchasing problem
FHIR migration still has to survive discharge
Testing continues after reporting gets smaller
Security stays and usability evidence changes
The consequences for payers, pharmacy, and research
Where healthcare software businesses can make money
What belongs in the next contract
Abstract
The HTI Five final rule removes fourteen health technology certification criteria, revises seven, and leaves thirty-nine unchanged. Its most consequential changes remove source-attribute requirements and predictive-intervention risk-management requirements, reduce testing documentation, and replace detailed safety-enhanced design requirements with an attestation-based approach. Privacy and security certification survives, several public health reporting requirements remain, and important document exchange requirements continue until January two thousand thirty. The agency estimates more than one point five billion dollars in regulatory-cost savings, including approximately one point five five billion dollars in present-value savings and annualized net savings of approximately one hundred eight point one million dollars. Those figures describe modeled regulatory savings rather than demonstrated reductions in healthcare spending. For developers, the rule can release engineering capacity and reduce certification overhead. For buyers, some of the evidence previously supported by certification will increasingly need to come through procurement, validation, and contracts. The commercial opportunity depends on whether companies can turn that flexibility into reliable software without recreating the same administrative burden at every customer.
The final rule is smaller than the proposal
HTI Five gives healthcare software developers a shorter certification checklist, although considerably more of the original checklist survived than the proposal suggested. Published on October twenty-eighth, two thousand twenty-six, the final rule removes fourteen of the certification program’s sixty criteria and revises seven. The proposal would have removed thirty-four. Thirty-nine criteria remain unchanged, including the newer requirements supporting electronic prior authorization and prescription benefit information. That difference changes the interpretation of the rule. A product strategy built around the original proposal could assume the disappearance of requirements that are still very much present. Anyone who already deleted the compliance spreadsheet may want to check the recycling bin.
The timing also requires some care. The rule is effective sixty days after publication, on December twenty-eighth, two thousand twenty-six, except for specified provisions that take effect on January first, two thousand twenty-seven. Certain transitions-of-care requirements continue until January first, two thousand thirty. The separate information-blocking changes contemplated in the proposal were not finalized here. Consequently, the publication of HTI Five does not give a developer an immediate right to stop maintaining every affected capability, nor does it rewrite the rules governing interference with electronic health information access. Certification requirements, customer commitments, and information-blocking obligations have different legal foundations. A feature disappearing from a certification criterion does not automatically disappear from a signed agreement.
The policy rationale follows the administration’s executive orders on deregulation and anti-competitive regulatory barriers. ONC wants developers spending less effort satisfying requirements it considers duplicative, mature, or insufficiently useful. There is a reasonable economic argument behind that position. A fixed compliance expense consumes a larger share of a small developer’s resources than a large incumbent’s. But certification also gives purchasers a common baseline, reducing the need to investigate every capability independently. The agency’s cited survey data put certified electronic health record adoption at ninety-nine percent of hospitals and ninety-one percent of physicians. That makes the program consequential well beyond its formally voluntary status. Changing its scope changes what a large portion of the market can assume about a product before negotiations even begin.
