What does HTI-5 change for AI tools in EHRs?

It removes the source attribute (model card) requirements and the intervention risk management requirements from the decision support interventions criterion, 45 CFR 170.315(b)(11)(iv) to (vi). Certified EHR developers no longer have to show users how a predictive tool was built, tested and monitored.

When does the HTI-5 model card removal take effect?

December 28, 2026. The rule was published in the Federal Register on October 28, 2026. Three other amendatory instructions in the rule wait until January 1, 2027, but the decision support changes are not among them.

Do providers still have to check clinical AI tools for bias after HTI-5?

Yes, if they are covered entities under Section 1557. 45 CFR 92.210 requires reasonable efforts to identify decision support tools that use race, color, national origin, sex, age or disability as inputs, and to mitigate the risk of discrimination. HTI-5 itself points users to that section.

HTI-5 Drops AI Model Cards: 31 Questions for Your EHR Vendor

From December 28, 2026, certified EHR software no longer has to give you a model card for its AI tools. HHS's HTI-5 rule, published in the Federal Register on October 28, deletes the 31 "source attributes" that predictive decision support tools had to carry, the 13 for evidence-based tools, and the developer's duty to run and publish risk management for them. What it does not delete is 45 CFR 92.210, which makes providers covered by Section 1557 find and reduce discrimination risk in those same tools. HHS's answer to the gap is one sentence in the rule: "We encourage users of certified health IT to ask their developers for such information." This checklist is that ask, built from the text being removed.

Event date: October 28, 2026 (Federal Register, 91 FR 67916; the decision support changes take effect December 28). First report: HHS press release, October 26, 2026.

What HTI-5 deletes on December 28

Under the HTI-1 rule, a certified EHR had to support a fixed set of source attributes for each decision support intervention, show users plain-language versions for the tools the developer supplied, and let a limited set of users record and change them. The developer also had to apply "intervention risk management" to each predictive tool it supplied and post a public summary on its certified product listing (CHPL). HTI-5's amendatory instruction 11 removes paragraphs (b)(11)(iv) through (vi); instructions 13 and 18 remove the matching maintenance and listing duties.

Requirement	Old cite	After December 28, 2026
Source attributes: 13 for evidence-based tools, 31 for predictive tools	45 CFR 170.315(b)(11)(iv)	Removed
Plain-language access to those attributes; users can record and change them	170.315(b)(11)(v)	Removed
Risk analysis across validity, reliability, robustness, fairness, intelligibility, safety, security and privacy; mitigation; data governance	170.315(b)(11)(vi)	Removed
Public hyperlink to the developer's risk management summary on the CHPL listing	170.523(f)(1)(xxi)	Removed and reserved
Review and update attributes and practices "on an ongoing basis" since January 1, 2025	170.402(b)(4)	Removed
Role-based configuration and selection of evidence-based and predictive tools	170.315(b)(11)(ii)(A), (iii)	Kept; predictive selection narrowed to the listed data plus Clinical Notes and Assessment and Plan of Treatment
Feedback export for evidence-based tools only: intervention, action taken, feedback, user, date, location	170.315(b)(11)(ii)(C), now (ii)(B)	Kept; it never covered predictive tools

45 CFR 170.315(b)(11)(iv) in the October 1, 2025 edition of the Code of Federal Regulations, listing the source attributes for evidence-based and predictive decision support interventions, representing the model card fields HTI-5 removes

Screenshot: 45 CFR 170.315, page 760, 45 CFR Subtitle A (10-1-25 Edition), govinfo.gov. Rendered November 1, 2026.

HHS's reasons are in the preamble. It calls the attributes model cards that "essentially function as nutrition labels," then says it found no evidence that users relied on them "or that the requirements have led to positive impacts on patient care." It counts 251 products from 206 developers certified to the criterion and puts the developers' annual savings at $7,361,579 to $53,275,503. The rule, by the way, calls AI "super intelligence (SI)."

The comment record went the other way. "A large majority of commenters were not supportive," the rule says, and several warned the burden would land on "small, rural, safety-net" providers "that lack data-science, governance, legal, or IT capacity." HHS disagreed and finalized the removal as proposed.

The duty HHS left with you: 45 CFR 92.210

Section 92.210 applies to covered entities under Section 1557, which includes any recipient of federal financial assistance from HHS. It has three parts, and the last two have applied since May 2025 (the rule gave 300 days from July 5, 2024):

Don't discriminate on the basis of race, color, national origin, sex, age or disability "through the use of patient care decision support tools."
Make "reasonable efforts to identify" tools that "employ input variables or factors that measure" any of those characteristics, as an "ongoing duty."
For each tool you find, make "reasonable efforts to mitigate the risk of discrimination."

"Patient care decision support tool" means "any automated or non-automated tool," so this covers a sepsis score in the EHR and a third-party risk model alike. Step 2 is the one HTI-5 makes harder. Until December 28, predictive source attribute (4)(ii) told you whether a vendor-supplied tool uses race, ethnicity, language, sexual orientation, gender identity, sex, date of birth, social determinants or health status data as input features. After that, you know only if you ask. HHS's own paragraph on the removal ends by reminding users to comply with requirements "to identify potential bias in PDSIs," and cites 92.210. HHS took the label off the box. The duty to make reasonable efforts to find out what is inside stayed with you.

Federal Register of October 28, 2026, page 67941: HHS encourages users of certified health IT to ask their developers for information on intended use, provenance, training data, limitations, performance and known risks, and cites 45 CFR 92.210, representing the provider duty HTI-5 leaves in place

Screenshot: HTI-5 final rule, 91 FR 67941, Federal Register of October 28, 2026, via govinfo.gov. Rendered November 1, 2026.

The 31 questions, in the rule's own groups

These are the predictive source attributes in 170.315(b)(11)(iv)(B) as they stand until December 28, turned into questions. Send them for every predictive tool switched on in your EHR, and for third-party tools that run inside it.

Group (old cite)	Items	What to ask the vendor
1. Details and output, (B)(1)	4	Who built it and how to reach them; who funded the technical build; what value it outputs; whether the output is a prediction, classification, recommendation, evaluation, analysis or other
2. Purpose, (B)(2)	4	Intended use; intended patient population; intended users; whether it informs, augments or replaces clinical decisions
3. Cautioned out-of-scope use, (B)(3)	2	Tasks, settings or populations where it should not be used; known risks and limitations
4. Development details and input features, (B)(4)	4	Inclusion and exclusion criteria for the training data; which of the nine demographic and social variables are inputs; demographic makeup of the training data; how relevant that data is to a setting like yours
5. Fairness in development, (B)(5)	2	How the developer tried to make the output fair; how it manages or reduces bias
6. External validation, (B)(6)	4	Where it was validated outside the training source; who did the testing; demographic makeup of that data; how the validation was run
7. Quantitative performance, (B)(7)	5	Validity and fairness on same-source test data; validity and fairness on external data; published evaluations of effect on outcomes such as mortality or length of stay
8. Ongoing maintenance, (B)(8)	4	How and how often validity is monitored; validity in your local data; how and how often fairness is monitored; fairness in your local data
9. Update schedule, (B)(9)	2	How and how often the model is updated; how often performance is corrected when validity or fairness problems are found

Source: 45 CFR 170.315(b)(11)(iv)(B), eCFR as of October 29, 2026. Items counted from the text: 31.

For evidence-based tools, such as rules built from a guideline, the 13 old attributes reduce to two questions: what is the citation, developer, funding source and release or revision date, and which of the same nine variables does the rule use.

Then ask for the risk management file. Until December 28 each certified developer had to analyse predictive tools for "validity, reliability, robustness, fairness, intelligibility, safety, security, and privacy," keep mitigation and governance controls, and link a public summary from its CHPL listing. Ask for the full analysis, not only the summary, and download the summary now while the link is still required.

Commenters in the rule made one more point worth borrowing: funding-source "disclosures help detect hidden commercial or pharmaceutical influence" on decision support. Keep group 1 even if you trim the rest.

How to get the answers in writing before December 28

List the predictive tools switched on in your EHR. The criterion limits activation to "a limited set of identified users," so your EHR administrator has the list.
Save today's source attribute pages for each tool, and the CHPL risk management summary links, with the date. They are required until December 28 and not after.
Send the 31 questions to the EHR vendor and to any third-party model vendor. Health AI startups selling into EHRs should expect the same list from buyers and can answer it before anyone asks.
Attach the answers to the contract as a schedule, with a duty to update when the model changes. That replaces the ongoing update duty HTI-5 removes from 170.402(b)(4). Our AI vendor contract redline template has wording for a 30-day model version notice (clause 5).
Mark every tool whose answer to group 4 includes race, sex, age, disability or a proxy for them, and write down the mitigation for each. That record is your evidence of reasonable efforts under 92.210(b) and (c).
Keep using the feedback export for evidence-based tools. It survives HTI-5 and gives you local evidence the vendor doesn't control. It never covered predictive tools, so for those, ask the vendor how you can export alerts and user actions.
Ask groups 7 to 9 again at each model update. Our AI vendor due diligence checklist covers the rest of the review.

What we could not confirm

We don't know which vendors will keep publishing model cards on their own, and we did not survey them. We don't know whether the CHPL will take down existing risk management summary links on December 28 or leave them up. For Section 1557 we relied on the eCFR text as of October 29, 2026 and on HTI-5's own reference to 92.210; we did not review every court order on the 2024 Section 1557 rule. HHS says it "will further consider for future rulemaking" whether evidence-based source attribute requirements should return, with no date. The October roundup of AI regulation changes and our AI regulation deadline calendar carry the December 28 date.