Industry News

HTI-5 Is Final: Federal AI Model Cards End December 28. What Small Practices Should Do First

ONC cut its deregulatory plan from 34 removed certification criteria to 14, but finalized the end of AI model cards anyway, over the objections of a large majority of commenters. We read the rule: what goes on December 28, what survives, why the 45 CFR 92.210 duty still falls on you, and seven steps to take first.

By MedAI Directory · November 2, 2026

The federal requirement that EHR vendors publish a plain-language account of their AI models now has an end date: December 28, 2026.

HHS announced the HTI-5 final rule on October 26, and it was published in the Federal Register on October 28, 2026 (91 FR 67916). The headline is that the Office of the National Coordinator for Health IT (ONC) backed away from most of its deregulatory plan. It proposed removing 34 of the program's 60 certification criteria and finalized removing 14.

AI transparency was not part of that retreat. ONC finalized the AI changes exactly as proposed, even though by its own account "a large majority of commenters" opposed them.

We explained what model cards are and how to find yours in September, when this was still a proposal. This post covers what the final rule does, what it leaves in place, and what a small practice should do in the eight weeks before it takes effect.

What ONC removed from decision support

The change sits in 45 CFR § 170.315(b)(11), the "decision support interventions" (DSI) certification criterion. Four things go on December 28:

Source attributes, § 170.315(b)(11)(iv). These are the 31 disclosure fields for predictive AI, commonly called the "model card," and the 13 fields for ordinary evidence-based rules.
Access and modification of those attributes, (b)(11)(v). This was the requirement that users be able to view them and that the practice's own information could be recorded and changed.
Intervention risk management, (b)(11)(vi). Developers no longer have to certify that they analyze and mitigate risks to validity, fairness, safety, security and privacy for the predictive tools they supply.
The two provisions that kept the information current and public. The duty to keep it updated, § 170.402(b)(4), is removed. So is § 170.523(f)(1)(xxi), which required the risk-management summary to be reachable by a public link with no login or other preconditions.

That last item is the one we would watch most closely. The rule does not say what happens to links vendors have already posted, and from December 28 no certification requirement keeps them up.

What survives

The criterion itself stays, and it stays in the Base EHR definition (§ 170.102). An EHR that counts as certified must still let "a limited set of identified users" select and activate decision support tools. Two smaller changes apply:

Predictive tools now have a narrower data floor. Certified systems must support selection based on the data listed for evidence-based tools plus Clinical Notes and Assessment and Plan of Treatment, rather than any data element in the USCDI standard. ONC's example of the old rule's overreach was that a phone number is a USCDI data element.
Feedback tools for evidence-based DSIs remain, renumbered as (b)(11)(ii)(B). These let a practice share, export and report on how those tools perform. ONC repeatedly points to them as the remaining transparency mechanism, but they do not apply to predictive AI.

ONC left one door open, and only part way. It acknowledged that the older source-attribute requirements for evidence-based tools "have been part of the Certification Program for many years," and said it will consider reinstating "these or similar requirements" in future rulemaking. It made no similar statement about predictive AI model cards.

ONC's reasoning, and the pushback

ONC's central claim is an absence of evidence. It wrote:

"we have identified no evidence through peer reviewed publication or trade press indicating that users of certified health IT have relied on the transparency requirements in § 170.315(b)(11) to access, record, or modify source attributes, or that the requirements have led to positive impacts on patient care."

It adds that developers reported most clinicians lack the time or technical background to use this information during care, and that the requirements were burdensome. ONC puts the savings from this one revision at $7.4 million to $53.3 million a year across 251 certified products from 206 developers. For the whole rule it estimates a present value of $1.55 billion in developer cost savings, at a 7% discount rate. ONC also states that it "did not quantify benefits."

Commenters made three arguments worth knowing:

The requirements were too new to judge. They had been in effect for less than two years.
Clinicians at the point of care were never the main audience. Some commenters said the real users are "governance, procurement, implementation, compliance, and safety teams."
The burden moves to those least able to carry it. Commenters said the shift would be especially problematic for "small, rural, safety-net, shared-network, community healthcare" organizations lacking data-science, legal or IT capacity.

ONC's response to the second point was to acknowledge "that there is value in transparency" and then return to developer burden and low use. Elsewhere it says it found no evidence the requirements improved organizations' evaluation and use of these tools, which is again an absence of evidence rather than a finding that they had no value. On the third, it said a significant shift in evaluation, governance or liability burden was "unlikely."

California's Attorney General had argued in a February 27 comment letter that removal "would eliminate one of the most significant guardrails currently in place on a federal level for the use of AI in healthcare." The letter's examples include a UCSF report of a no-show model that double-booked low-resourced and marginalized patients more often than others. That is the kind of ordinary scheduling tool a small practice might never think of as "AI."

Where ONC says the responsibility goes now

Read closely, the preamble moves the work to three places. Each has limits.

1. To you, by asking. ONC writes: "We encourage users of certified health IT to ask their developers for such information." It also says the removal does not mean this information "is unknown or unavailable." That is true, but asking is now the entire mechanism. Nothing in the certification program obliges a developer to answer, and a contract is the place to make that obligation real.

2. To you, under civil rights law. In the same passage, ONC reminds users to comply with 45 CFR § 92.210, the Section 1557 rule on patient care decision support tools. This is the point most summaries pass over, and it is the one that carries legal weight for a practice:

It applies to covered entities, which include recipients of federal financial assistance. Under the 2024 rule that generally includes practices paid by Medicare, as we explain in our language-access guide.
It defines these tools broadly, as any "automated or non-automated tool, mechanism, method, technology" used to support clinical decision-making.
Since May 1, 2025, it has required ongoing reasonable efforts to identify tools that use input variables measuring race, color, national origin, sex, age or disability, and reasonable efforts to mitigate the resulting discrimination risk.

HTI-5 does not change § 92.210. It does remove a standardized federal disclosure that told you, among other things, whether a supplied tool used those kinds of variables. So the duty to identify such tools remains while one of the simplest ways of doing it goes away. According to a DLA Piper analysis of the 2024 rule, OCR's assessment of reasonable efforts considers a practice's size and resources and whether it received product information from the developer. A small practice is not held to a health system's standard, but it is not exempt either.

3. To FDA. ONC says it is "concentrating requirements solely within other Department authorities, such as those exerted by the FDA," and that risk management may still be incentivized through FDA policies. FDA, however, only reaches software that is a device. Its January 2026 clinical decision support guidance moved more software outside that line, and its generative AI discussion paper said agentic documentation uses may not be a focus of its device oversight. A no-show model, for instance, is not obviously something FDA would ever review.

What the final rule did not do

The narrowing matters, because some coverage of the proposal is now out of date.

Privacy and security criteria stay. ONC proposed removing all of § 170.315(d) and then "decided not to finalize" that, though it warned that future rulemaking may revisit it.
Information blocking is unchanged. The rule amends only 45 CFR parts 170 and 172. The proposed changes to the information-blocking exceptions in part 171 were not finalized, and the current rules still apply.
Some older exchange requirements have a longer runway. Removing certain document-exchange requirements from the transitions-of-care criterion waits until January 1, 2030.
Standalone AI tools are unaffected. The rule only ever reached DSIs supplied by a certified developer. If you bought Freed, Heidi, Abridge, Suki or Nabla directly, no model card was ever required for it. These tools never had this floor, so the questions below apply to them too.

Two terminology notes will help if you read the rule itself. It uses "super intelligence" (SI) where you would expect "AI," following Executive Order 14434 of September 29, 2026, which defines the term by reference to the existing statutory definition of artificial intelligence. It also drops "ASTP" from the regulations, so the agency is once again referred to as ONC.

What to do before December 28

None of this requires a consultant. It is a few hours of work, most of it easier to do now than in January.

Download the disclosures while they are still required. Search your product on CHPL, open the (b)(11) criterion, and follow the risk-management link. Ask your vendor for the source attributes of any predictive tool you use, since those are generally shown within the EHR. Save everything with the date.
List the decision support tools you actually have turned on. Find out who holds the "limited set of identified users" role at your practice, which may be your vendor's support team. Include risk scores, no-show predictions, coding suggestions and clinical decision support alerts.
Mark which ones use protected characteristics. That list is your starting point for § 92.210. Note what you found, what you decided, and when. A one-page dated record is much better than none.
Send your vendor a written request. Something like this works:

"After December 28, 2026, will you continue to publish source attributes and risk-management information for each predictive decision support tool you supply? Please tell us where it will be, how we will be notified when a model is changed or retrained, and whether any of this will carry a separate fee."
Put the answer in the contract at renewal. Keep the ask small: continued access to the same categories of information, advance notice of material model changes, and help meeting § 92.210. The fee question is not idle. ONC's commenters warned that capabilities no longer required can "reappear as optional modules, implementation fees, or premium features."
Ask standalone vendors the same questions. Intended use, out-of-scope use, training data, validation, fairness, monitoring, and update schedule. Our guide to choosing an AI scribe and rollout guide show where these fit in a purchase.
Borrow a governance structure. CHAI's free playbooks, covered in our earlier model-card post, are written to scale down to smaller clinics. If you operate across states, check the 2026 state AI law map too, since this federal rule does not touch those duties.

As of November 2, we did not find a public commitment from a major EHR vendor either to keep or to take down its existing disclosures. That is one more reason to get the answer in writing.

The bottom line

ONC's evidence argument has some force. The disclosures were little used, and we said so in September. But the agency treats low use by clinicians during visits as proof of low value for everyone, and then asks practices to obtain the same information themselves and to meet a civil rights duty that depends on it.

For a small practice, the change is simple to state. Since January 2025, this information has been a vendor's certification obligation. After December 28, getting it is your job, and your leverage is your contract.

If you are reviewing options, you can compare clinical decision support tools for small clinics or browse all tools.

This article is for general information only and is not legal or medical advice. It reflects the HTI-5 final rule as published on October 28, 2026 (91 FR 67916) and sources available as of November 2, 2026. Check the current text of 45 CFR parts 92 and 170, consult qualified counsel about your obligations, and confirm a vendor's disclosures and contract terms directly with the vendor.

FDA's Generative AI Device Paper: What It Means for the AI Tools Your Practice Uses (Comments Due Oct. 19)

On August 18, 2026, FDA published its first detailed sketch of how it might regulate generative AI medical devices: a two-axis risk map, clinician-style competency testing, and more postmarket monitoring. It is not guidance and binds no one yet. Here is what it says, where scribes, CDS, patient chatbots and imaging tools land, what the first 'patient-facing LLM' clearance actually covered, and which of the 26 questions clinicians should answer before the October 19 deadline.

HIPAA & Compliance

The AI Model Card in Your EHR: What HTI-5 Would Delete, and How to Read Yours First

Since January 2025, every certified EHR has had to publish a plain-language disclosure of what its built-in AI was trained on, how it was validated, and what it should never be used for — free, at a public link. ASTP/ONC has proposed deleting that requirement. Here is how to find yours before it goes, and why your standalone AI scribe was never covered by it in the first place.

Guides

The CY 2027 Fee Schedule Final Rule and AI: What CMS Now Allows in the Wellness Visit, the New MIPS AI Activity, and the RPM Delay

Medicare still will not pay separately for AI in 2027, but the final fee schedule spells out, element by element, where AI may and may not help in the Annual Wellness Visit, adds a MIPS improvement activity for clinician AI use, and pushes the outsourced remote-monitoring ban to 2029. We read the rule so you do not have to.