United States (federal) · regulation
DSI Source Attributes: what it requires, and the records to keep
Certified EHRs must let users see plain-language source attributes for the decision support tools they supply: 13 for evidence-based tools and 31 for predictive (AI or other model-based) tools, covering purpose, training data, fairness, external validation, performance and ongoing monitoring. It is the main US federal rule that forces disclosure of how a clinical prediction model was built and tested, though a pending proposal would remove it.
01 / What it requires
What DSI Source Attributes requires
Developers of Health IT Modules certified to 45 CFR 170.315(b)(11) under the ONC Health IT Certification Program; hospitals and clinicians are not directly regulated.
- 01Support all 31 source attributes for each predictive DSI and 13 for each evidence-based DSI the developer supplies.
- 02Give a limited set of identified users complete, up-to-date plain-language access to those attributes.
- 03Show when validation, local performance or update-schedule information is not available for a predictive DSI.
- 04Let identified users record, change and access source attributes, including extra attributes for predictive DSIs.
- 05Apply risk analysis, risk mitigation and governance to each supplied predictive DSI across eight characteristics, including validity, fairness and safety.
- 06From January 1, 2025, review and update source attributes and risk practices on an ongoing basis (45 CFR 170.402(b)(4)).
02 / AI work
Where it touches AI work
A predictive DSI is any technology that learns relationships from training data and outputs a prediction, classification, recommendation, evaluation or analysis, so machine-learning and other AI models in certified EHRs fall squarely in scope. The attributes amount to a mandated model card for those tools.
03 / Dates
The dates that matter
HTI-1 final rule published, adopting (b)(11) and source attributes
Deadline to deliver (b)(11)-certified updates to customers
Ongoing duty to review and update source attributes begins
HTI-5 proposed rule would remove source attribute and risk management requirements
HTI-5 comment period closed
04 / Enforcement
Who enforces it
ONC and ONC-Authorized Certification Bodies through surveillance and direct review; remedies include corrective action plans, suspension or termination of certification, and bans on recertification. No fines under this criterion itself.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Source attribute record for each supplied predictive and evidence-based DSI
- 02External validation and fairness test results by demographic group
- 03Intervention risk management analysis and mitigation log
- 04Dated review history showing attributes kept current
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What are the 31 source attributes required for predictive DSI under HTI-1?+
They are 31 items in nine groups at 45 CFR 170.315(b)(11)(iv)(B) that certified health IT must support for each predictive decision support intervention the developer supplies: details and output (4), purpose (4), cautioned out-of-scope use (2), development details and input features (4), fairness approach (2), external validation (4), quantitative performance (5), ongoing maintenance and local monitoring (4), and update and revalidation schedule (2). They cover who built the model, what it outputs, its training data, fairness, validation and monitoring. HTI-5, proposed in December 2025, would delete them; it was not final as of October 2026. Read the full answer
Do I have to keep HTI-1 source attributes updated, and how often?+
Yes, if you develop a Health IT Module certified to 45 CFR 170.315(b)(11). Since January 1, 2025, 45 CFR 170.402(b)(4) has required developers to review source attributes, intervention risk management practices and the related public summary information on an ongoing basis and update them as necessary. The rule sets no fixed interval, so updates should follow changes to the model, its data or its measured performance. The duty falls on certified developers, not directly on hospitals. HTI-5, proposed in December 2025, would remove these requirements, but no final rule had been issued as of October 2026. Read the full answer
SOURCES
Go back to the source
Federal Register (ASTP/ONC)
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: DSI Source Attributes for medicine AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4