HTI-5: When Certification Stops Requiring the Record, Who Keeps the Evidence?

The question before deployment

Imagine a hospital reviewing a predictive tool before deployment. A reviewer asks which patients it was tested on, where it performs poorly and whether the documentation matches the version being purchased. This is an illustrative situation, not a reported incident.

The practical question behind HTI-5 is who will keep those answers accessible, current and connected to the eventual decision.

What HHS and ONC changed

The US Department of Health and Human Services, through the Office of the National Coordinator for Health Information Technology, published the HTI-5 final rule on 28 October 2026: document 2026-21943, 91 FR 67916.

The rule removes specific requirements within the ONC Health IT Certification Program. It does not prohibit model cards or abolish AI risk management generally.

The DATES clause sets 28 December 2026 as the general effective date, except for instructions 7, 10 and 12. Instructions 11 and 13 are outside those exceptions. Other HTI-5 changes have different timings; this article examines the identified removals.

The earlier framework had limits

ONC’s decision support interventions test method distinguishes supporting information fields from responsibility for every field’s content. Access could be limited to identified users rather than every user of a module.

For predictive interventions, developer responsibility for obtaining source information was scoped to interventions supplied as part of the certified module. That could include third-party interventions supplied by the developer; it was not limited to models built in-house.

Unavailable information could be identified as unknown, with ONC expecting due diligence and updates when information later became available. Certification therefore did not establish universal completeness of evidence for every AI tool used by a hospital.

What ONC says—and what it does not establish

In the final rule, ONC reports that it did not identify published evidence of the benefits described in its discussion of the transparency requirements. This documents the agency’s stated assessment. It is not independent proof that transparency has no benefit.

ONC also says that removing certification requirements does not mean information about intended use, provenance, training data, limitations, performance and known risks is necessarily unavailable. It encourages users to request information from developers before deployment.

The agency considers a significant increase or shift in providers’ evaluation, governance or liability burden unlikely. Its reasoning includes retained electronic feedback requirements for evidence-based interventions. These retained requirements should not be equated with every removed predictive-intervention requirement.

ONC acknowledges other authorities, including FDA policies. This analysis does not inventory all FDA, state, professional or contractual obligations applicable to any particular product or organisation.

The QEN Sovereign question

Editorial interpretation: the change makes it useful to investigate which arrangements will sustain access, updates and review in individual organisations. An actual transfer of workload or legal liability is not established by the material examined.

Cognitive Logic applies QEN Sovereign, its proprietary analytical methodology, to examine which evidence supported a decision, which information remained outside the record and who retained authority to act.

For a predictive healthcare intervention, we propose following the record through:

Model provenance → intended use → validation population → limitations → local deployment → clinical decision → human review → outcome → incident or appeal.

• Which model, version and deployment configuration were involved?
• What information was available, missing or excluded at decision time?
• Who could approve, challenge, override or suspend use?
• Who owned the update and retention process?
• Could a later reviewer recover the relevant record and test the declared safeguards?

These are analytical questions, not new duties imposed by HTI-5. QEN Sovereign is not a certification, a recognised international standard or a substitute for legal, scientific or regulatory assessment.

Three possible paths, no established outcome

A developer could continue supplying usable documentation and updates. Another arrangement could make access more dependent on individual negotiations. Information might also remain available while becoming outdated or mismatched to a local deployment.

These are scenarios to investigate, not findings about current vendors. Contracts, documentation histories and observed implementation are needed to distinguish them.

An explicitly recorded unknown differs from an invisible gap. Likewise, information supplied once differs from information kept current for the version used in a consequential decision.

Evidence and verification limits

What to watch next

1. 28 December 2026: the identified removals take effect, subject to any subsequent material legal change.
2. Developer practice: documented changes to access, update commitments and version histories.
3. Hospital practice: procurement and clinical-governance records showing what reviewers can obtain and reconstruct.

HTI-5 changes specific certification requirements. Whether evidence becomes harder to obtain or maintain must be investigated in implementation.

If an AI-assisted healthcare decision is questioned later, who will be able to reconstruct the evidence available when it was made?

Primary sources

1. Govinfo: HTI-5 final rule, 28 October 2026, 91 FR 67916 — DATES; sections III.A.2.e and III.D.1; instructions 11(g) and 13(b).
2. Federal Register: document 2026-21943 — document reference; local HTML acquisition was blocked.
3. ONC: HTI-5 final rule resources.
4. ONC: Decision support interventions test method — explanatory baseline, to be read alongside the amendments.

Related Cognitive Logic analysis: NIST agent identity, mandates and verifiable evidence · AI decision rights and verifiable evidence.