ONC finalizes HTI-5: 14 EHR certification criteria cut, MIPS measure-calculation tests end January 1

Fourteen of 60. That is how many health IT certification criteria the Office of the National Coordinator for Health Information Technology (ONC) removed in its final HTI-5 rule, published in the Federal Register on October 28 [1]. ONC had proposed removing 34 in December 2025 [1, 3]. The rule takes effect December 28, 2026, and the removals that touch the Medicare definition of certified electronic health record technology (CEHRT) wait until January 1, 2027 [1].

What changed

ONC kept 39 criteria unchanged, revised seven and removed 14 [1]. The rule says it will “aggressively reduce and remove long-standing functionality-oriented and non-FHIR-based certification criteria” to make room for future requirements built on FHIR application programming interfaces (APIs) [1].

The removals come in two batches [1]:

• December 28, 2026: clinical decision support (a)(9); the two security tag criteria and the care plan criterion, (b)(7) through (b)(9); Consolidated CDA creation performance (g)(6); and the Direct Project transport criteria in (h).
• January 1, 2027: family health history (a)(12); clinical quality measures filter (c)(4); patient health information capture (e)(3); automated numerator recording (g)(1); automated measure calculation (g)(2); and the two application access criteria, (g)(7) and (g)(9).

The best-known revision strips the AI “model card” requirements from the decision support interventions criterion. Developers no longer have to show source attributes, such as training and validation data, for predictive tools [1, 3]. ONC wrote that it found no evidence those transparency requirements “have led to positive impacts on patient care” [1].

Several proposals did not survive. ONC kept every privacy and security criterion and the privacy and security certification framework [1]. It kept the implantable device list, the cancer registry and health care survey reporting criteria, and clinical information reconciliation, which it turned into a functional criterion instead of removing it [1]. Developers no longer have to file annual real-world testing plans [1, 3].

ONC estimates $1.55 billion in present-value savings, or $108.1 million a year, calculated from developers’ reduced compliance costs [1]. National coordinator Tom Keane said the rule lets developers “spend more of their time developing solutions that improve interoperability, automation, and better healthcare for Americans” [3].

Who it affects

Certification is voluntary for vendors. It matters to practices because CMS programs require certified technology [1, 3]. ONC cites 2024 survey data showing 91% of physicians had a certified EHR [1].

MIPS clinicians. To report the Promoting Interoperability performance category, eligible clinicians must use CEHRT as defined in 42 CFR 414.1305. CEHRT is also required for Advanced APM determinations [1]. Five of the January 1 removals are named in that MIPS definition: family health history, patient health information capture, automated numerator recording, automated measure calculation and, as an option, the CQM filter [2].

Practices that rely on Direct messaging and C-CDA documents. The standalone Direct transport criteria end in December. Inside the transitions of care criterion, though, the send-and-receive, create, display and section-view requirements now expire January 1, 2030, not January 1, 2027 as proposed [1].

Community health centers and practices that use structured family history. Most commenters on the family history criterion opposed removing it. Several community health centers said it would reduce structured capture and weaken decision support, preventive care and population health work [1].

Will EHRs still meet the MIPS CEHRT definition in 2027?

That depends on a CMS decision. In the 2027 Physician Fee Schedule proposed rule, published July 16, CMS proposed removing the five criteria from the MIPS CEHRT definition for the CY 2027 performance period/2029 MIPS payment year [2]. Under that proposal, the criteria would count only for CY 2019 through CY 2026 [2]. CMS said all other criteria in the definition would still be required, and that its proposal “is not contingent upon the final actions that ONC will make” [2]. Our July coverage of that proposed rule focused on its payment provisions.

The hospital side is settled. CMS removed references to several of the same criteria from the Medicare Promoting Interoperability Program definition in the FY 2027 inpatient rule, published August 4 [1]. ONC said it set January 1 for the CEHRT-linked removals to give CMS time to update both definitions, and turned down requests to move that date earlier [1].

What it means for your practice

Start with measure reporting. The automated numerator and measure-calculation criteria are how certified EHRs have been tested to count Promoting Interoperability numerators and denominators [1]. After January 1 that testing stops. ONC expects developers to keep producing the counts because their customers need them, and points to CMS’s earlier position that “program participants may use a separate, non-certified system to calculate numerators and denominators and to generate reports on the measures” [1]. CMS said in July that it expects developers to keep supporting numerator and denominator reporting for measures such as e-Prescribing and Provide Patients Electronic Access [2]. Commenters warned that without the criteria, providers might have to test those metrics themselves [1].

Your patient-access measure gets simpler. Of the four criteria CMS lists for Provide Patients Electronic Access to Their Health Information, two are removed. If CMS follows through, you would need only the revised view, download and transmit criterion and the standardized API criterion, (g)(10) [2]. ONC said it does not expect the (g)(7) removal to create a mismatch with CMS measures [1].

Expect fewer changes on referrals. Because clinical information reconciliation stays as a functional criterion, ONC said it does not expect CMS to change its references for the referral-loop and health information exchange measures [1].

Pricing is the risk to watch. Many commenters told ONC that functions dropped from certification come back “as optional modules, implementation fees, or premium features that providers must purchase to achieve necessary functionality” [1]. ONC answered that the cost of those functions was likely already in what customers pay, and that separate pricing would let customers “see the cost of a specific functionality independent of the certified Health IT Modules” [1]. ONC pointed under-resourced providers to its EHR contract guide [1].

AI transparency now depends on your contract. With the model card requirements gone, a certified product no longer has to show you where a predictive tool’s training data came from [1, 3].

On security, nothing changes. Removing certification criteria would not have changed HIPAA Security Rule duties, and ONC kept the criteria anyway [1, 2].

What to do now

• Ask your EHR vendor in writing whether it will keep family health history capture, patient-entered data, CQM filtering and decision support features after the certification requirements end, and whether any will carry a separate fee [1].
• Confirm how your vendor will generate 2027 Promoting Interoperability numerator and denominator reports once (g)(1) and (g)(2) testing stops [1, 2].
• Check your product’s certification listing against the criteria the MIPS CEHRT definition will still require, including (g)(10) for patient access [2].
• If you exchange referrals by Direct and C-CDA, ask your vendor for its FHIR plan before the January 1, 2030 expiration [1].
• Put any new contract terms on removed functions in your next renewal [1].

The policy fight

The comment record split along familiar lines. Supporters said a FHIR-first program would let vendors “redirect effort away from low-value compliance activities,” as ONC summarized their views [1]. Opponents, who ONC said submitted numerous comments, argued that removing criteria without safeguards would weaken baseline functions and shift costs to providers and public health agencies [1]. A couple asked for grants for small and rural providers to pay for API and EHR upgrades [1].

On the measure-calculation criteria, commenters asked ONC to delay until CMS alignment was settled. ONC declined, pointing to CMS’s final hospital rule and its proposed MIPS rule [1].

Privacy and security drew the biggest reversal. The proposed rule argued that certified security tools did not help providers comply with HIPAA. ONC said the vast majority of commenters disagreed, saying certification gives a minimum baseline buyers can check, and it pulled the proposal [1]. ONC said it will revisit privacy and security certification in future rulemaking [1].

The rule also leaves out information blocking. ONC said comments on the proposals it did not address “remain under review and consideration” [1]. According to Healthcare Dive, those include revising the definitions of “access” and “use” to include autonomous AI systems [3].