The federal government's healthcare tech arm finalized a sweeping regulation that requires new technology upgrades while also advancing interoperability and transparency in predictive decision support tools.
The regulation establishes first-of-its-kind nationwide requirements for transparency around AI and algorithms used in health IT, ONC said in a press release.
Called the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency and Information Sharing, or the HTI-1, implements key provisions of the 21st Century Cures Act, with a specific emphasis on health IT certification and information blocking.
This rule would further implement provisions of the 21st Century Cures Act and make updates to the ONC Health IT Certification Program – a certification program that includes various standards, implementation specifications and certification criteria for electronic health record (EHR) software companies and health IT developers. ONC provides fact sheets, resources and timelines here.
"The exciting thing about today is that it's part of a larger strategy of work that we're involved in," said Steven Posnack, ONC's deputy national coordinator for health IT on a call with reporters Wednesday. He noted other regulatory efforts to implement provisions of the 21st Century Cures Act, including a rule issued in October that outlines “disincentives” for providers found to have committed information blocking.
"Our rulemakings have largely taken the shape now of including both updates to our certification program in order to be responsive to industry changes, technology changes and updates to standards that can help improve and enhance interoperability and as well as updates and changes now to the information blocking regulations," Posnack said.
AI transparency
The regulation creates new transparency and risk management expectations for artificial intelligence and machine learning technology that aid decision-making in healthcare. Provisions within ONC’s HTI-1 rule addressing clinical decision support (CDS) and decision support interventions (DSIs) mark a major evolution in the agency's approach to artificial intelligence and predictive models.
The provisions seek to increase the transparency and trustworthiness of predictive algorithms with the ultimate goal of supporting their widespread use in healthcare, ONC officials said.
Within the rule, ONC defines AI/ML technologies as "predictive decision support interventions” and the requirements will significantly impact the development, deployment and use of AI/ML tools in healthcare, according to many experts.
"It's been a long time in the making to have an update to this certification criterion to be reflective of the technical evolution in the industry, as well as in response to some of the new challenges posed by artificial intelligence, machine learning and other types of large language models," Posnack said. "This is really a first approach that we have included to focus on transparency and risk mitigation."
ONC-certified health IT supports the care delivered by more than 96% of hospitals and 78% of office-based physicians around the country.
"HHS’ leading-edge regulatory approach will promote responsible AI and make it possible for clinical users to access a consistent, baseline set of information about the algorithms they use to support their decision making and to assess such algorithms for fairness, appropriateness, validity, effectiveness, and safety," ONC officials said.
While the proposed regulations stop short of directly regulating developers of AI and machine learning ML, they do so indirectly by imposing requirements on developers of certified health IT, according to a blog post from law firm Hooper, Lundy and Bookman.
Those provisions are part of ONC certification program updates for EHR vendors and health IT developers.
Developers will have to comply with the decision support intervention requirements by the end of 2024.
When the proposed HTI-1 one was proposed in April, industry groups pushed back on the timeline for compliance. The EHR Association said the implementation timeframe would create a significant compliance burden for healthcare providers and health IT developers. The proposed rule included 18 new and revised certification criteria across a 600+ page proposal (the final rule clocks in at more than 900 pages).
In response to industry feedback, ONC adjusted the timeframe to "pace and space many of the different requirements over time, including two-, three- and four-year associated compliance timelines in order to give health IT developers and industry the ability to incrementally adjust and make changes over time in implementing this final rule," Posnack said.
He added, "Certainly recognizing that the algorithm-related transparency was a high priority for our office and the Secretary and administration, that's one of the ones that we've required straight out of the gate within a one year time period. By the end of 2024, there's an expectation and requirements for health IT developers to update their certified health IT to meet these new transparency requirements and begin complying with some ongoing conditions of certification and maintenance requirements."
The rule introduces requirements to ensure algorithms don’t contribute to health disparities or decrease health equity, ensure that clinical decision support tools include access to supporting evidence for unbiased decision-making and new vendor reporting requirements to enhance patient safety.
Jeff Smith, ONC's deputy division director within the certification and testing division, acknowledged there would be a "learning curve" for clinicians to assess the quality of the algorithms being used in certified health IT technology.
"It's important to understand that we're not being prescriptive about how this information gets to the end user, how the information is presented within clinical workflows. We're going to be leaving that to developers and to their client bases. For folks who may be worried about disruptions within the workflow or having to go through a bunch of information in order to actually use the algorithm, that's not at all on the table with our requirements," Smith said.
The regulation does not apply to a health system that self-develops a predictive decision support intervention, an ONC official said.
USCDI Version 3
The finalized rule also advances United States Core Data for Interoperability (USCDI) Version 3 (v3) as the new baseline standard within the ONC Health IT certification program as of January 1, 2026.
"Currently to date, the industry is now on USCDI version one. As we look to the future that creates a predictable step for industry to now move forward and build new services and new connectivity," Posnack said.
Developers of certified health IT will also have the ability to move to USCDI v3 sooner, ONC officials said.
USCDI v3 includes updates to prior USCDI versions focused on advancing more accurate and complete patient characteristics data that could help promote equity, reduce disparities, and support public health data interoperability.
New interoperability-focused reporting metrics, information blocking requirements
The rule also revises certain information blocking definitions and exceptions to support information sharing, and adds a new exception to encourage secure, efficient, standards-based exchange of electronic health information under the Trusted Exchange Framework and Common AgreementSM (TEFCA).
And, the rule requires new interoperability-focused reporting metrics for certified health IT technology.
“The public feedback and participation in the HTI-1 process was tremendous,” said Micky Tripathi, Ph.D., national coordinator for health information technology, in a statement. “Through the HTI-1 final rule, our upcoming HTI-2 proposed rule, and our broader efforts, ONC continues its important work to build health care’s digital foundation, make interoperability easier, and ensure that digital information and tools are being appropriately used to support patient access and to improve the health and well-being of all Americans.”