On October 28, ONC published a final rule removing decision-support intervention disclosure and risk-management requirements from its health IT certification program. The changes take effect December 28, 2026.
The question is what justified removing them. Were they imposing costs without improving decisions, or had the healthcare industry not yet learned how to use them?
To understand that question, it helps to separate three things: explaining a clinical recommendation, describing the system that produced it, and managing the risks of using that system.
The Original Disclosures Identified the Clinical Foundation
Under the traditional CDS certification criterion, evidence-based interventions had to make available:
-
a citation to the clinical research or guideline,
-
the intervention developer,
-
the funding source for implementation, and
-
release or revision dates.
The developer was the person or organization that translated the clinical research into computable form. The information could be available through a link or additional user action. It did not have to appear automatically alongside every recommendation. That criterion expired on January 1, 2025 under HTI-1; this rule removes the lapsed text.
These disclosures identified the clinical foundation and who implemented it. They did not generally require access to either:
-
the source code or
-
complete executable logic
so that a clinician could audit whether the software faithfully reproduced the guideline.
That distinction matters. A respected guideline does not establish that software correctly implements it. Nor does correct implementation establish that a recommendation fits a particular patient with several conditions, competing treatment priorities, or circumstances outside the guideline’s assumptions.
ONC Added Requirements for Systems That Learn Relationships From Data
The HTI-1 rule, published in January 2024, added requirements for “predictive decision support.” Its scope included qualifying:
-
generative AI applications and
-
third-party models
incorporated into a certified developer’s offering.
ONC declined to consider additional measures regarding what it called “explain-ability,” and instead required developers to analyze and mitigate risks relating to intelligibility. It imposed no interpretability requirement.
The resulting requirements addressed:
-
intended use,
-
populations,
-
limitations,
-
development data,
-
fairness,
-
validation,
-
performance, and
-
maintenance.
They also required
-
risk analysis,
-
mitigation, and
-
governance
for predictive interventions supplied by the certified developer as part of its Health IT Module, with ongoing review and updating.
The Administration Directed Reconsideration
Executive Order 14179 directed review of actions taken under the revoked AI order. It called for appropriate suspension, revision, or rescission of identified inconsistent actions, subject to applicable law.
In its reevaluation, the ONC said it had found no publicly available evidence demonstrating improved evaluation or patient care. In particular, it cited developer reports that clinicians lacked time or technical expertise to use the disclosures during care. Additionally, it identified uneven treatment: certified developers faced requirements that did not apply equally to other companies producing similar healthcare AI.
Key Changes
The final rule removes:
-
source-attribute support,
-
access and modification requirements,
-
predictive-intervention risk management.
It retains other decision-support provisions, including feedback functionality for evidence-based interventions.
ONC expects lower entry barriers and more provider choice. It encourages purchasers to request performance and quality information directly from developers. This approach gives market demand and purchaser negotiations a greater role in determining what information and assurances developers provide, in place of the deleted certification requirements.
