What happened
The US Department of Health and Human Services has backed away from removing core privacy and security requirements from its electronic health records certification programme. The final rule, HTI-5, was released on Monday by the Office of the National Coordinator for Health IT and is part of a wider deregulatory push aimed at cutting compliance costs and speeding up innovation.
ONC had proposed eliminating 34 of the 60 certification criteria, including all 13 privacy and security criteria. The final rule removes 14 and revises seven, and the privacy and security set stays. HHS estimates savings of more than 1.5 billion dollars for developers, with annualised net savings of about 108 million dollars from 2027. Publication in the Federal Register was scheduled for Wednesday, most provisions take effect on December 28, and some on January 1, 2027.
The stated reason for the retreat was the comment record. ONC said most commenters opposed removing all of the privacy and security criteria, arguing that certification provides a minimum baseline of capability and a way to verify that it exists in the products providers buy. Small and rural providers said removal would shift verification onto them and could lead developers to drop features to save cost. Some commenters linked the capabilities to patient safety.
One removal did go ahead. The rule drops transparency and risk management requirements for predictive clinical decision support, the model card style disclosures introduced under HTI-1. ONC said it had not seen benefits that justified the cost and burden, that the requirements applied to a limited group of developers, and that the four source attributes involved are under consideration for future rulemaking.
Why this is a GRC story
The comment file was the control. Nothing about the underlying risk changed between proposal and final rule. What changed was that enough organisations wrote down what would break. That is a risk assessment with a paper trail, doing the job a risk assessment is supposed to do.
Certification is procurement assurance. Buyers of health IT rarely have the access or expertise to test a vendor's access controls themselves. The criteria were the substitute for that testing. Removing them would not have removed the risk, only the evidence that anyone checked.
The cost shift is the quiet part. The savings accrue to developers while the verification work lands on providers with the least capacity to carry it. That is a third party risk transfer dressed as deregulation. The removed AI disclosures matter too, because model cards were the closest thing to a documentation duty for clinical AI in the programme.
What to watch
Whether developers keep privacy and security capabilities as a differentiator now that they no longer have to prove them, and whether providers update procurement questionnaires to ask for the evidence certification used to supply. Nothing else will ask for it. Watch for ONC returning to predictive decision support transparency in the next rulemaking.
For healthcare GRC, the takeaway is unglamorous. HIPAA and state law did not move, the 46 remaining criteria still apply, and December 28 belongs in the compliance calendar. The removed items are where assurance now has to happen in-house.
Attribution: Analysis based on DataBreachToday and related public reporting. This article is original commentary, not a repost of the source material.