HTI-5 Loosens Certification While Prior Auth Tightens the API Layer

The compliance burden didn’t shrink. It moved.

HHS finalized the HTI-5 rule this week, and the headline is deregulation. ONC removed 14 certification criteria outright and revised seven more, while holding 39 criteria intact, including the privacy and security baselines and usability requirements that underpin most EHR certifications hitconsultant.net. HHS projects $1.55 billion in compliance cost savings from the change www.fiercehealthcare.com. The rule also drops the requirement to generate C-CDA documents for certification purposes, finishing a multi-year pivot away from document-centric exchange and toward FHIR-based APIs as the default conformance path www.reedsmith.com.

For a compliance or health IT leader, the instinct is to read this as less work. That instinct is only half right. HTI-5 narrows what certified health IT must prove about itself. It says nothing about what that health IT must actually do once deployed, and the obligations on the doing side are getting heavier, not lighter.

CMS-0057-F requires payers to stand up four FHIR-based APIs, including a Prior Authorization API that returns approvals, denials with specific reasons, or requests for more information, generally live by January 1, 2027, with exact dates varying by payer type www.botminds.ai. Blue Cross NC and other payers are already building to that deadline www.bcbsnc.com. Real-time prior authorization checks on HL7’s Coverage Requirements Discovery API went live at four health systems in August, with sixteen more payers in testing itirra.com. This is the infrastructure HTI-5 is clearing a path toward, not a parallel track.

The governance stakes rise further once AI agents start operating these APIs directly. Payers and providers are increasingly using agents to automate FHIR-based data exchange, prior authorization workflows, and risk adjustment coding, and those agents chain across systems governed by CMS-0057-F, the ONC Cures Act Final Rule, and TEFCA simultaneously trussed.ai. A certification regime that no longer requires certain conformance testing doesn’t reduce the governance work here. It shifts the burden of proof from the certifying body to the deploying organization.

One piece of the puzzle HHS deliberately left unresolved: information blocking. HTI-5 does not finalize the proposed changes to federal information blocking regulations that appeared in the same rulemaking, and those comments remain under consideration www.fiercehealthcare.com. Since information blocking rules govern how data actually flows between the systems HTI-5 just deregulated and the APIs CMS-0057-F just mandated, that gap matters more than either rule standing alone www.devprojournal.com.

For compliance leaders, the near-term decision isn’t whether to relax certification scrutiny because ONC did. It’s whether FHIR API readiness, prior auth automation governance, and TEFCA participation are funded ahead of the January 2027 deadlines, because that is where the actual exposure now sits.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The central argument—that HTI-5 shifts compliance burden rather than eliminating it—is coherent and well-supported, though the claim that AI agents ‘chain across systems governed by CMS-0057-F, the ON
Source & Claim Verification	glm-5.3-flash-fp4 · local	cleared. Core claims are corroborated by opened sources (ReedSmith confirms HTI-5 finalized Oct 28 2026 and information-blocking changes deferred; HIT Consultant confirms the $1.55B savings; Botminds confirms
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects HTI-5 and CMS-0057-F regulatory shifts but lacks explicit mapping to ISO 42001, NIST AI RMF, or CLIA/NERC/DO-178C frameworks where applicable.
Technical Accuracy	Llama	cleared. The article accurately describes the HTI-5 rule and its implications for health IT certification and FHIR-based APIs, with minor irrelevant sources listed.
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively anticipates and counters the natural inclination to view HTI-5 as a reduction in compliance burden, providing strong evidence for the shift in obligations and the rising stake
Novelty & Non-Duplication	Grok	held. Restates the same-day HTI-5 floor-drop/governance-burden brief and the 10-30 prior-auth/info-blocking deferral piece without a genuinely new fact, development, or reader decision.
Validation	DeepSeek	cleared. The central claim is supported by the cited regulatory split—HTI-5 narrows certification while CMS-0057-F imposes API/prior-auth obligations—but the causal framing that HTI-5 is clearing a path to CMS

Sources cited: 47. Validation challenges: 0. Learn how these briefings are written and verified.