Written and maintained by CASRAI Editorial Board
Last updated
The ONC HTI-1 Final Rule—formally titled Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (published in the Federal Register at 89 FR 1192 on January 9, 2024, and codified at 45 CFR Parts 170 and 171)—is the landmark federal regulation issued by the U.S. Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC, now the Assistant Secretary for Technology Policy / ASTP). HTI-1 establishes the first binding federal AI and algorithm transparency rules for certified Electronic Health Record (EHR) developers through the 45 CFR § 170.315(b)(11) Decision Support Interventions (DSI) certification criterion, raises the national clinical data baseline to USCDI Version 3, launches the Insights Condition EHR reporting program, and refines Information Blocking Rule exceptions.
What Is the ONC HTI-1 Final Rule? Core Regulatory Pillars & Compliance Timeline
Implementing key mandates of the 21st Century Cures Act, the HTI-1 Final Rule overhauls how Health IT Modules listed on the Certified Health IT Product List (CHPL) are certified and maintained across five regulatory domains:
| HTI-1 Regulatory Pillar | CFR Citation | Core Technical & Governance Requirement | Key Compliance Milestone |
|---|---|---|---|
| 1. Decision Support Interventions (DSI) | 45 CFR § 170.315(b)(11) |
Replaces legacy Clinical Decision Support (§ 170.315(a)(9)); mandates user access to 13 source attributes for Evidence-Based DSIs and 31 source attributes for Predictive DSIs, plus developer Intervention Risk Management (IRM). |
January 1, 2025 (and ongoing Maintenance of Certification under § 170.402(b)(4)). |
| 2. USCDI Version 3 Transition | 45 CFR § 170.213 |
Updates the United States Core Data for Interoperability standard from USCDI v1 to USCDI v3 across C-CDA and HL7 FHIR R4 API criteria (adding expanded SDOH, health insurance, specimen, and result status elements). | January 1, 2026 (when USCDI v1 expires for certified Health IT Modules). |
| 3. Electronic Case Reporting (eCR) & Patient Restrictions | § 170.315(f)(5) & § 170.315(d)(14) |
Requires standards-based HL7 FHIR or C-CDA electronic case reporting to public health agencies (by Dec 31, 2025) and establishes a revised privacy criterion for patient-requested restrictions. | December 31, 2025 / January 1, 2026. |
| 4. Insights Condition (EHR Reporting Program) | 45 CFR § 170.407 |
Requires qualifying health IT developers (with ≥50 hospital sites or ≥500 clinician users) to report standardized quantitative metrics on FHIR API usage, patient access, C-CDA reconciliation, and immunization reporting. | Phased data collection beginning 2026, first reporting cycle in 2027. |
| 5. Information Blocking Enhancements | 45 CFR Part 171 |
Defines what constitutes an “offer” of certified health IT, clarifies the Infeasibility Exception (uncontrollable events and third-party seeking modification use), and creates the TEFCA Manner Exception (§ 171.403). |
Effective February 8 / March 11, 2024. |
What Does § 170.315(b)(11) Require for Predictive Decision Support Interventions (DSI)?
The centerpiece of HTI-1 is 45 CFR § 170.315(b)(11), which retires the static 2015 Edition § 170.315(a)(9) Clinical Decision Support criterion and replaces it with Decision Support Interventions (DSI). The rule divides DSIs into two distinct regulated categories:
- Evidence-Based DSIs: Deterministic, rule-based alerts, order sets, and Best Practice Advisories (BPAs) actively tied to USCDI clinical data elements (Problems, Medications, Drug-Drug/Drug-Allergy Interactions, Demographics, Laboratory Tests, and Vital Signs). Certified EHRs must support 13 bibliographic and clinical provenance source attributes for Evidence-Based DSIs, plus allow clinical users to record celebratory or corrective feedback that can be exported by authorized clinicians.
- Predictive DSIs: Formally defined at
45 CFR § 170.102as “technology that supports decision-making based on algorithms or models that derive relationships from training data and then produce an output that results in prediction, classification, recommendation, evaluation, or analysis.” This definition encompasses statistical risk calculators derived from regression models, machine learning classifiers (such as sepsis, deterioration, or readmission models), and generative AI / Large Language Models (LLMs) that generate clinical recommendations or evaluations.
The FAVES Framework and Intervention Risk Management (IRM)
ONC designed § 170.315(b)(11) around the FAVES trustworthiness framework—ensuring that clinical users and hospital AI governance committees have the transparent model card disclosures needed to determine whether a Predictive DSI is:
- F — Fair: Does the model exhibit performance disparities or harmful bias across patient subpopulations defined by race, ethnicity, sex, age, disability, or socioeconomic status?
- A — Appropriate: Is the model matched to the intended clinical workflow, target patient population, and user role?
- V — Valid: Has the model’s discrimination and calibration been verified on internal test splits and external multi-site clinical cohorts?
- E — Effective: Does deploying the model measurably improve real-world patient outcomes or clinical processes?
- S — Safe: Are the model’s failure modes, out-of-scope contraindications, and drift risks actively mitigated?
In addition to technical software capabilities, 45 CFR § 170.315(b)(11)(vi) mandates that any certified Health IT developer supplying a Predictive DSI must apply written Intervention Risk Management (IRM) practices across three areas—(1) Risk Analysis, (2) Risk Mitigation, and (3) Governance—specifically evaluating validity, reliability, robustness, fairness, intelligibility, safety, security, and privacy, and must make a summary of those IRM practices publicly accessible via a hyperlink on the ONC CHPL.
How Must EHR Developers Disclose AI Model Training Data and Fairness Risks Under HTI-1?
Under 45 CFR § 170.315(b)(11)(iv)(B), a certified Health IT Module must enable authorized clinical and administrative users to view, author, and modify 31 Predictive DSI source attributes—essentially embedding an interactive regulatory “nutrition label” or healthcare AI model card directly inside the EHR:
Source Attribute Category (§ 170.315(b)(11)(iv)(B)) |
Required Training Data, Fairness & Performance Disclosures |
|---|---|
| 1–3. Intervention Details, Value & Purpose | Plain-language description of the model’s clinical output, intended patient population, intended user role, intended decision-making setting, and specific cautions or out-of-scope uses where the model must not be used. |
| 4. Training Data & Input Features | Detailed description of input features used by the model, plus the clinical setting, geographic location, and demographic representativeness of the training dataset across race, ethnicity, sex, sexual orientation, gender identity, age, and socioeconomic status to expose healthcare AI bias risks. |
| 5. Development Process & Fairness Mitigation | Exclusion and inclusion criteria applied during cohort construction, how the target outcome label was defined (e.g., avoiding cost-as-a-proxy-for-illness errors), and specific approaches taken during model training to identify and mitigate fairness disparities. |
| 6–7. Quantitative Validation & Fairness Metrics | Internal test-set performance metrics (AUROC, AUPRC, sensitivity, specificity, PPV, calibration) and fairness metrics disaggregated by demographic subgroups, plus results of external validation in independent clinical settings. |
| 8–9. Ongoing Maintenance, Local Monitoring & Updates | Schedule and triggers for model recalibration, procedures for continuous local performance and drift monitoring, and correction protocols when performance degrades. (Note: Under § 170.315(b)(11)(v)(A)(2), specific external validation and local monitoring sub-fields may be marked “not available” if not yet generated, but must never be omitted from the schema.) |
Crucially, while the EHR developer is legally responsible for populating the 31 source attributes and conducting IRM for Predictive DSIs that the developer supplies as part of its certified Health IT Module, the EHR software itself must provide the user interface capability for hospitals and health systems to record and maintain all 31 source attributes for self-developed or third-party Predictive DSIs deployed by the hospital.
How the ONC HTI-2 Proposed Rule Expands on HTI-1
Following HTI-1, ASTP/ONC released the HTI-2 Proposed Rule (Health Data, Technology, and Interoperability: Patient Engagement, Information Sharing, and Public Health Interoperability, 89 FR 63498) to advance the next wave of certification updates:
- USCDI v4 Adoption: Proposes advancing the baseline interoperability dataset from USCDI v3 to USCDI v4 (effective January 1, 2028).
- Public Health FHIR APIs (
§ 170.315(f)(21)–(29)): Modernizes immunization, syndromic surveillance, electronic laboratory reporting (ELR), and birth/cancer reporting from legacy HL7 v2 feeds to standardized HL7 FHIR APIs. - Payer-to-Provider & Prior Authorization APIs (
§ 170.315(g)(30)–(36)): Aligns ONC health IT certification with the CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) using HL7 Da Vinci Patient Access, Provider Access, Payer-to-Payer, and Prior Authorization (CRD/DTR/PAS) FHIR Implementation Guides, alongside NCPDP SCRIPT v2023011 and Real-Time Prescription Benefit (RTPB) criteria.
Frequently Asked Questions
What is the ONC HTI-1 Final Rule?
The ONC HTI-1 Final Rule (89 FR 1192, codified at 45 CFR Parts 170 and 171) is a federal regulation issued by HHS ASTP/ONC that establishes the 45 CFR § 170.315(b)(11) Decision Support Interventions (DSI) algorithm transparency and risk management requirements for certified EHRs, transitions certified health IT to USCDI Version 3, creates the Insights Condition EHR reporting program (§ 170.407), and updates Information Blocking exceptions including the TEFCA Manner Exception.
What does § 170.315(b)(11) require for predictive Decision Support Interventions (DSI)?
Under 45 CFR § 170.315(b)(11), certified Health IT Modules must support both Evidence-Based DSIs (13 source attributes) and Predictive DSIs (31 source attributes), enable authorized users to view and author those source attributes directly within the EHR to evaluate whether models are Fair, Appropriate, Valid, Effective, and Safe (FAVES), and—for Predictive DSIs supplied by the certified developer—apply formal Intervention Risk Management (IRM) practices and publish a public IRM summary on the ONC CHPL.
How must EHR developers disclose AI model training data and fairness risks under HTI-1?
Under 45 CFR § 170.315(b)(11)(iv)(B), EHR developers supplying a Predictive DSI must disclose the model’s input features, target outcome definition, training dataset demographic representativeness (across race, ethnicity, sex, gender identity, sexual orientation, age, and socioeconomic status), bias-mitigation methods applied during development, and disaggregated validation and fairness performance metrics across patient subgroups.
