How to read this page. 5Q publishes calibrated analysis. Claims below carry the same confidence tags we attach to client deliverables:
HIGH verified against the primary source (Federal Register, CFR, CMS documents) · MED supported by credible secondary analysis; primary verification noted · PENDING depends on a rule not yet final
1. HTI-5: the federal AI transparency floor is slated for removal
HTI-5 proposes to remove 34 and revise 7 of the 60 certification criteria in the ONC Health IT Certification Program. HIGH Three of those changes land directly on healthcare organizations that use AI-enabled tools:
- The AI "model card" requirements go away. Certified health IT developers are currently required to disclose source attributes for predictive decision support interventions (DSIs) — intended use, target population, training data characteristics, known risks, external validation — and to maintain related risk management practices. HTI-5 proposes revising 45 C.F.R. § 170.315(b)(11) to fully remove them. HIGH These were among the only federal transparency requirements for healthcare AI. Their removal converts AI transparency from a certification obligation into a voluntary vendor practice.
- The privacy and security certification proxy narrows. HTI-5 proposes removing privacy and security certification criteria, including the authentication, access control, and authorization criterion at 45 C.F.R. § 170.315(d)(1). HIGH Organizations that treated ONC certification as evidence their vendor products aligned with HIPAA obligations lose that proxy and must verify independently.
- Agentic access to health data accelerates while defenses narrow. The rule frames FHIR-based APIs — explicitly including automated and AI-enabled access to electronic health information, and naming the Model Context Protocol used by large language models — as the program's future foundation, and simultaneously proposes removing or tightening information blocking exceptions (the third-party modification condition of the Infeasibility Exception, the "manner exhausted" condition, and the TEFCA Manner Exception in its entirety). HIGH The practical effect: AI agents gain a legitimized pathway into health data while the recognized reasons to refuse shrink.
The deregulatory savings flow to health IT developers — an estimated 1.4 million compliance hours industry-wide in the first year, and $1.53 billion in total projected savings. HIGH The verification burden those hours used to represent does not disappear. It moves downstream, to the organizations deploying the tools. Large systems will absorb it. Federally Qualified Health Centers, Critical Access Hospitals, and independent suppliers were not budgeted for it. MED — 5Q assessment
2. Annual DMEPOS accreditation: the survey clock now runs continuously
Separately — and on a faster track, because this one is already final — CMS has restructured DMEPOS supplier accreditation:
- Reaccreditation moves from every 36 months to every 12 months. Suppliers on an existing 3-year cycle transition when their current accreditation expires; suppliers initially accredited on or after January 1, 2026 are annual from the start. HIGH
- Every survey remains unannounced and on-site — now every year instead of once per cycle. Survey readiness stops being an event and becomes a standing operational state. HIGH
- Temporary accreditation for new locations is eliminated, and a change in majority ownership within 36 months of enrollment triggers re-enrollment and a new survey. HIGH
- Revocation exposure expands. Industry analyses report expanded authority for retroactive effective dates on enrollment revocations arising from lapses that are often administrative — a late-reported ownership or address change — not just fraud. A retroactive revocation converts paid claims into overpayments. MED — reported in industry analyses; verify against the enacted rule text, which controls
The cost math is blunt: accreditation that ran roughly $6,000–$10,000 per three-year cycle now trends toward comparable amounts per year, per location, before counting the internal cost of continuous readiness — documentation currency, ongoing training records, mock surveys, and a compliance function that never stands down. MED — industry estimates; verify against your AO's published fees CMS itself acknowledged in rulemaking that smaller rural suppliers may exit under this pressure — which, in the communities 5Q serves, is not an abstraction. It is a beneficiary-access problem. HIGH — acknowledged in rule commentary
3. The convergence: AI adoption under pressure, without a governance layer
These two actions interact. Annual unannounced surveys and continuous-readiness expectations are pushing suppliers and providers toward exactly the tools the market is now selling them: AI-assisted documentation, automated compliance monitoring, audit-readiness platforms, denial-prediction software. MED — observed market response At the same moment, HTI-5 proposes removing the certification framework that provided even minimal federal assurance about what those AI tools disclose and how they manage risk. PENDING — final rule
The result is a structural gap: organizations under the most regulatory pressure are adopting AI the fastest, with the least independent verification available, and the thinnest internal capacity to supply their own. Voluntary frameworks — however well built — do not close that gap on their own; they define what a well-resourced organization can do, and leave everyone else to a two-tier standard of accountability. MED — 5Q core thesis; see our analysis library
Assurance is the missing layer. Not the tools — the governance of the tools: knowing what your AI-enabled systems actually do, what your vendor attestations actually cover, what your current controls silently depend on, and what you would show a surveyor, an auditor, or a court.
4. Common questions
What is the HTI-5 rule?
HTI-5 — Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions to Unleash Prosperity — is a proposed federal rule published in the Federal Register on December 29, 2025. It proposes removing 34 and revising 7 of the 60 certification criteria in the ONC Health IT Certification Program, including the AI "model card" transparency requirements for predictive decision support, and revises several information blocking exceptions.
Is the HTI-5 final rule out yet?
No. As of July 15, 2026, HTI-5 remains a proposed rule. The comment period closed February 27, 2026, and no final rule has been published; the federal Unified Agenda lists no projected final rule date. This page is re-verified and revised when that changes.
Does HTI-5 apply directly to healthcare providers?
Not directly — it regulates certified health IT developers. But its practical effect lands on the organizations deploying the tools: transparency and risk-management disclosures that were certification obligations become voluntary vendor practices, so providers must verify independently what their AI-enabled systems disclose and how vendor products align with HIPAA obligations.
How often must DMEPOS suppliers be reaccredited in 2026?
Annually. Under the DMEPOS provisions of the CY 2026 Home Health PPS final rule (CMS-1828-F), published December 2, 2025 and effective January 1, 2026, reaccreditation moves from every 36 months to every 12 months, with unannounced on-site surveys. Suppliers on an existing 3-year cycle transition when their current accreditation expires.
What should organizations do before the final rule publishes?
Inventory AI-enabled decision support and certified health IT in use; map which current assurances silently depend on certification criteria slated for removal; collect vendor attestations and transparency documentation while it still exists; verify HIPAA alignment independently rather than through the certification proxy; and build survey-ready governance evidence — annual unannounced surveys now test it every year.
5. Where 5Q Health fits
5Q Health is a healthcare AI governance consultancy built for organizations of any size, with particular depth in the safety-net and supplier settings these rules hit hardest. Every engagement uses 5Q's three-pass validation methodology and ships with an explicit confidence map — the same calibration you see on this page.
HTI-5 Impact & Audit Readiness Assessment
Inventories your AI-enabled decision support; maps which of your current assurances silently depend on certification criteria slated for removal; identifies independent HIPAA verification gaps; reviews information-blocking exposure under the revised exceptions; delivers a prioritized remediation roadmap. Designed to be revised — not redone — when the final rule publishes.
Denial Exposure Scan
A focused diagnostic of where automated and AI-driven payer review creates denial and recoupment exposure in your current documentation and workflows — the same exposure an annual unannounced survey now tests every year.
AI Governance Readiness Build
A working governance program — policies, AI inventory, risk documentation, and evidence practices — built on NIST AI RMF and ISO/IEC 42001 vocabulary and crosswalked to the Joint Commission's Responsible Use of AI in Healthcare (RUAIH) certification areas. Continuous survey readiness is a governance artifact problem; this builds the artifacts.
Standing Advisory
Ongoing monthly counsel: rule monitoring (including the HTI-5 final rule when it lands), survey-readiness review, vendor attestation checks, and a standing partner for the questions that arrive unannounced — like the surveys.
AI Governance Operations
Full-scope governance operations for organizations running AI across multiple sites, product lines, or accreditation footprints — including sampling-based survey strategies for multi-location suppliers.
Open tools
Two self-serve instruments from the 5Q tools library apply directly here: the RUAIH Readiness Scorecard (34 items, evidence-maturity scoring, with dual-protection items covering beneficiary-critical functions) and the Rural-AI Deployment Evaluator (a structured screen for whether an AI tool is fit for a resource-constrained deployment environment).
Request a scoping conversation
A scoping conversation is free, thirty minutes, and ends with a written recommendation — including "you don't need us yet," when that's the honest answer.
Email 5Q HealthConfidence map for this page
What this analysis rests on, and what would change it.
| HIGH | HTI-5's proposed removals (DSI model-card attributes at § 170.315(b)(11), the § 170.315(d)(1) criterion, information-blocking exceptions) — verified against the proposed rule and healthit.gov materials. CMS-1828-F annual accreditation provisions — verified against the final rule and accrediting organization guidance. |
| MED | Retroactive revocation effective dates (industry analyses; enacted text controls). Cost estimates for annual accreditation (industry figures; your accrediting organization's fee schedule governs). The characterization of market response — AI compliance tooling adoption under survey pressure — is observed, not quantified. |
| PENDING | Everything conditioned on HTI-5 becoming final. Several major stakeholders formally objected to removing AI transparency and privacy/security criteria; provisions may change. |
What would change this analysis: publication of the HTI-5 final rule (in any form); CMS sub-regulatory guidance modifying accreditation implementation timelines; litigation staying either rule. This page carries a verification date and is revised, not quietly edited, when the record changes.
Sources & verification
Analysis re-verified July 15, 2026, from: the HTI-5 proposed rule, 90 FR 60970 (Dec. 29, 2025); the ASTP/ONC HTI-5 fact sheet; the HHS press release (Dec. 22, 2025), source of the 1.4-million-hour and $1.53 billion estimates; the Unified Agenda entry, RIN 0955-AA09; the CY 2026 HH PPS final rule (CMS-1828-F), published Dec. 2, 2025; CMS DMEPOS accreditation guidance; and accrediting-organization and law-firm analyses (ACHC, VGM, McGuireWoods). Confidence notes: rule dates, criteria counts, and survey-cycle changes — HIGH (primary sources). Retroactive revocation scope and accreditation cost figures — MED, as tagged above. This page will be updated when the HTI-5 final rule publishes.