ONC Narrows Certification as the API Clock Keeps Running

A deregulatory rule lands as the data surface expands

HHS finalized HTI-5 this fall, a rule projected to cut roughly $1.55 billion in ONC health IT compliance costs by narrowing what certification actually requires of health IT modules fiercehealthcare.com. Industry counsel is clear that the rule deregulates less than many expected, and that it punts rather than resolves the harder question of how information blocking enforcement should evolve reedsmith.com. What it does settle is scope. Certified modules now have to demonstrate less, while the information blocking policy changes that would have tightened enforcement get deferred to a later rulemaking mcguirewoods.com.

That timing matters because the data surface this certification regime oversees is not shrinking. CMS-0057-F still requires four FHIR-based APIs, covering patient access, provider access, payer-to-payer exchange, and prior authorization, generally in force by January 1, 2027 botminds.ai. One of the pieces covering HTI-5 explicitly frames the rule as something meant to accelerate FHIR API adoption, not slow it down hitconsultant.net. So the federal posture right now is narrower certification requirements layered under a widening set of live API endpoints, built by vendors who are themselves adjusting roadmaps to the new rule devprojournal.com.

Why a thinner backstop is not a free pass

Denial pressure gives this some weight. “Services not covered” is now the leading denial reason reported for 2026, ahead of the usual documentation and eligibility disputes medicaleconomics.com. That is exactly the kind of determination that increasingly runs through the same FHIR-based prior authorization and payer-to-payer channels HTI-5 touches. When certification scope narrows, the federal check on how those channels actually behave in production gets thinner too, at the same moment the volume of automated calls across them is growing.

None of this means ONC walked away from oversight. The rule is a calibrated cost reduction, not an abdication, and the information blocking framework stays in place while its next revision is worked out reedsmith.com. But compliance and interoperability leaders should read the narrowing correctly. A smaller certification footprint means fewer things ONC itself will verify about how a module performs, which puts more weight on what the health system or payer verifies internally before it trusts an automated process riding those APIs.

The practical task is straightforward. Treat the current FHIR conformance testing cycle under CMS-0057-F as necessary but no longer sufficient, because the certification regime behind it just got narrower, not stronger. Build the internal verification that HTI-5 isn’t going to do for you, and do it before the January 2027 deadline arrives, not after a denial pattern or an information blocking complaint forces the question.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—narrower certification plus expanding API surface shifts verification burden to health systems—is logically sound and well-sourced, though the causal link between denial trends and F
Source & Claim Verification	glm-5.3-flash-fp4 · local	cleared. Every claim checkable against opened sources is supported — ReedSmith confirms the deregulate-less-than-anticipated/punt framing, HIT Consultant confirms the $1.55B NPV savings and accelerate-FHIR fra
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects the regulatory shifts in HTI-5 and CMS-0057-F, but does not explicitly map its assertions to the specific certification criteria in 45 CFR Part 170 or the pending HTI-
Technical Accuracy	Llama	cleared. The article accurately discusses the implications of the HTI-5 rule on health IT certification and its relation to FHIR API adoption and information blocking enforcement.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively presents a nuanced argument by acknowledging the deregulatory intent of HTI-5 while highlighting the increased responsibility it places on implementers due to expanding API ma
Novelty & Non-Duplication	Grok	held. Restates the same-day HTI-5 + CMS-0057-F thesis already covered in ‘HTI-5 Loosens Certification While Prior Auth Tightens the API Layer’ and ‘ONC Just Narrowed the Safety Net,’ with only a denial-reas
Validation	DeepSeek	cleared. The central claim cannot be validated because its pivotal HTI-5 finalization is supported by sources dated after the current date, making the briefing’s timeline impossible as written.

Sources cited: 44. Validation challenges: 0. Learn how these briefings are written and verified.