HHS health IT certification rollback shifts AI evaluation to health systems

HHS is rolling back several health IT certification requirements through the HTI-5 final rule issued by ONC, MedCity News reports. The rule removes 14 of the 60 certification criteria now in effect and revises seven more. The original proposal had sought to remove 34. Most changes take effect December 28, 2026, with a few on January 1, 2027. ONC expects the changes to save more than $1.5 billion in regulatory costs, according to the outlet.

The consequential piece for AI buyers is that the rule removes source attribute transparency requirements for evidence-based and predictive decision support interventions. It also removes intervention risk management requirements. Health data attorney Mel Soliz told MedCity News that certification "no longer guarantees access to information about a predictive tool's intended use, training data, performance, or limitations," and that the evaluation will fall on hospitals and providers. She recommends building disclosure, validation and bias-testing requirements into procurement contracts. The rule also eliminates voluntary certification criteria for security tags used to shield behavioral health and substance use disorder records. HIPAA is unchanged, but Soliz says applying consent rules at the right level of granularity becomes far harder without tagging. That is a direct issue for privacy and security teams managing redisclosure of sensitive records.

In a guest article in Healthcare IT Today, Dr. Michael T. Neely argues that one-time validation is incomplete because a vendor may replace a model, change prompts or thresholds, or retrain without changing the product name clinicians see. He proposes an internal version record for each tool, predefined material-change triggers, revalidation matched to risk, and a working ability to suspend or roll back. He cites FDA guidance on predetermined change control plans and the NIST AI Risk Management Framework as lifecycle models.

The evidence has limits. MedCity News documents the rule changes and the shift in where evaluation sits. There is no data yet on how health systems are absorbing that work, and Neely's piece is opinion, not a study.

The move: before the December 28 effective date, have legal, compliance and the CIO's team write vendor contract terms requiring notice and revalidation whenever a purchased AI tool's model or logic changes. Add the intended use, training data, performance and limitations disclosures that certification will no longer guarantee, and confirm how sensitive records will be segmented without security tags. The return is an AI inventory clinicians can trust and incident reviews built on records rather than guesswork.

You are a compliance, privacy and legal advisor to the executive team of [your organization].

Context: MedCity News reports that HHS is rolling back several health IT certification requirements through the HTI-5 final rule issued by ONC. The rule removes 14 of the 60 certification criteria now in effect and revises seven more. Most changes take effect December 28, 2026, with a few on January 1, 2027. It removes source attribute transparency and intervention risk management requirements for decision support interventions, and eliminates voluntary certification criteria for security tags that shield behavioral health and substance use disorder records. HIPAA is unchanged. Health data attorney Mel Soliz told MedCity News that certification no longer guarantees access to a predictive tool's intended use, training data, performance, or limitations, and recommends building disclosure, validation and bias-testing requirements into procurement contracts. In an opinion piece in Healthcare IT Today, Dr. Michael T. Neely argues that one-time validation is incomplete because vendors may replace a model, change prompts or thresholds, or retrain without changing the product name. He proposes a version record per tool, predefined material-change triggers, revalidation matched to risk, and the ability to suspend or roll back. There is no data yet on how health systems are absorbing this work.

Task: Before December 28, 2026, draft vendor contract terms requiring notice and revalidation whenever a purchased AI tool's model or logic changes, plus the disclosures certification will no longer guarantee and how sensitive records will be segmented without security tags.

Output: a one-page memo for the executive team with these sections: Why this matters now; Draft contract terms; Contracts to amend first; Owners and deadlines; Open questions to verify.

Use my details: [number of purchased AI tools in our inventory], [our current AI vendor contract or addendum language], [upcoming AI contract renewal dates], [named owners in legal, compliance and the CIO's team].

Use only the facts above and the details I fill in. Cite MedCity News and Healthcare IT Today by name. Flag anything uncertain or needing legal verification. Include no patient data. This is a draft for the team to check, not legal or medical advice.