Ecofy

Your Chief AI Officer · Friday, October 30, 2026 · Act today

HHS finalizes rule cutting health IT certification requirements

Regulatory2 sourcesFor patients and employees

HHS finalized a rule on Oct. 26 cutting health IT requirements, Becker's reported. On Raising Health, National Coordinator Dr. Tom Keane said HTI-5 proposes removing the AI model card requirement, noting Oracle reported about two queries a month and Epic about 50 queries per month.

HHS finalized a rule on Oct. 26 cutting health IT requirements, Becker's Hospital Review reported. The available excerpt does not detail which requirements fell. The clearest public account of the direction comes from National Coordinator for Health IT Dr. Tom Keane, who said on the Raising Health podcast that the HTI-5 rule, then undergoing finalization, proposed to scale back the certification program "rather substantially," including removing the AI model card requirement that went into enforcement on Jan. 1, 2025.

Keane gave four reasons. The information is obtainable directly from vendors, under an NDA if proprietary. The 31 source attributes were a static set that stakeholders immediately contested. The rule applied only to certified health IT, so AI applications launched outside the EHR escaped it, and he said some were migrating out for that reason. And usage was low: he cited Oracle's public comment letter at about two queries a month and said Epic reported about 50 queries per month. His central point as a physician was that the cards gave "false assurance" because nothing in them was audited.

For Chief AI Officers, compliance teams and CIOs, the consequence is that federal certification will no longer carry AI transparency for you. Any assurance your organization drew from an EHR-embedded model card now has to come from your own governance. That gap already existed for every AI tool running outside certified health IT; it now covers the tools inside it too.

The evidence has limits. The rule itself is reported by Becker's. The query figures were stated by Keane in a podcast conversation, not published as a dataset, and low query counts measure use of a lookup feature, not whether clinicians needed the underlying information.

The move is to write AI transparency into vendor contracts. Require disclosure of training data sources, intended use, validation results and known limitations, under NDA where needed, and add audit rights, change notification and performance monitoring for drift. Keane said ONC's next rule, HTI-6, is intended to address AI provenance, traceability and post-market monitoring, but that remains a plan. Contract language you control protects clinicians and patients now, regardless of where federal rulemaking lands.

Do this week. Write AI transparency requirements into your own vendor contracts so model details no longer depend on EHR certification.

Run this

The prompt to act on this item, for your own model.

Paste it into Claude, ChatGPT or Copilot and fill the bracketed slots with your own numbers. The output is a draft for your team to check, built only from the sources on this page. Never paste patient data. How these prompts are written.

You are a contracts and AI governance advisor to the Chief AI Officer, compliance, privacy and legal team, and CIO of [your organization], a [type of health organization].

Context: HHS finalized a rule on Oct. 26 cutting health IT certification requirements, as reported by Becker's Hospital Review. The available excerpt does not detail which requirements fell. On the Raising Health podcast, National Coordinator Dr. Tom Keane said HTI-5 proposed removing the AI model card requirement that went into enforcement on Jan. 1, 2025. His reasons: the information is obtainable directly from vendors, under NDA if proprietary; the 31 source attributes were a static set that stakeholders contested; the rule covered only certified health IT; and usage was low, with Oracle at about two queries a month and Epic about 50 queries per month. He said the cards gave "false assurance" because nothing in them was audited. The query figures were stated on a podcast, not published data. Keane said HTI-6 is intended to address AI provenance, traceability and post-market monitoring, but that remains a plan.

Task: Assume federal certification will no longer carry AI transparency for us. Draft what we will require from vendors in contract, so model details come from our own agreements.

Output: a vendor question list for [your EHR vendor] and [your other AI vendors], grouped under these headings: Training data sources; Intended use; Validation results; Known limitations; Audit rights; Change notification; Performance monitoring for drift; NDA terms. Under each, give two or three questions and one line of suggested contract language. Close with a short gap list that maps the questions to [the number of AI tools in use] and [contracts up for renewal this year].

Guardrails: Use only the facts above and the slots I fill. Cite Becker's Hospital Review and Raising Health by name where you rely on them. Flag anything uncertain or needing verification, including which requirements the final rule removed. Do not request or include patient data. This is a draft for our team and legal counsel to check, and nothing here is medical or legal advice.

Open in ClaudeOpen in ChatGPT

The claim.
Keane said the model cards offered false assurance because nothing was audited.
The evidence.
The rule is reported by Becker's; the query figures were stated by Keane on a podcast, not published data.

By seat

For the Chief AI Officer. Build a standard AI transparency questionnaire for vendors, requested under NDA if needed.

For the Compliance, privacy and legal. Update governance documentation that cited certification model cards as a control.

Disclosure: Ecofy orchestrates Epic and Oracle Health for clients and says so on every item that names them. The item was selected and checked by the same rules as every other.

Checked before publishing. 5 independent outlets. 1 figure matched to the source text. Also reported by STAT, Becker's Healthcare, HIT Consultant Media.

Sources

  1. Becker's Hospital Review, Trump’s health tech agenda: 12 recent moves in 2026
  2. Raising Health, The Next Era of Health Data: AI, Open APIs, and the End of the EHR Oligopoly

Drafted by Lumen from the sources above, scored by a second pass on six criteria, then checked by rule against those sources (every figure, two independent outlets or a primary source) and published only when it passes. A person can pull any item, and corrections are published here. Apolitical, always. Nothing here is medical advice. How Your Chief AI Officer is made.

Also in this brief

Your Chief AI Officer

What AI and robotics can do for your organization today, and what is coming in thirty days.

Every weekday morning, ordered for your role. Free.

One click to confirm, one click to leave, and you can change your role or cadence any time. Your address stays with Ecofy and is never shared with partners.