United States (federal) · regulation
ONC HTI-1: what it asks, and the records to keep
HTI-1 updated the ONC certification program: it replaced the old clinical decision support criterion with the decision support interventions criterion, added algorithm transparency and risk management duties for predictive models, moved the baseline to USCDI v3, and revised information blocking rules. It was the first US federal rule to require transparency about AI and other predictive models embedded in EHRs.
01 / What it asks
What ONC HTI-1 asks
Developers of health IT certified under the ONC Health IT Certification Program, plus actors subject to the information blocking rules (developers, health information networks and exchanges, and health care providers).
- 01Certify to the decision support interventions criterion (45 CFR 170.315(b)(11)), which replaced the clinical decision support criterion (a)(9).
- 02Provide users source attribute information for supplied predictive and evidence-based decision support tools.
- 03Apply intervention risk management practices to supplied predictive DSIs and publish summary information about them.
- 04Review and update source attributes and risk practices on an ongoing basis from January 1, 2025.
- 05Support USCDI version 3 as the baseline data standard for certified modules.
- 06Comply with revised information blocking definitions and exceptions in 45 CFR part 171.
02 / AI work
Where it touches AI work
HTI-1 defines 'predictive decision support intervention' to cover models that learn from training data, which includes machine-learning and generative AI features in certified EHRs. It requires those tools to come with disclosed development, validation, fairness and monitoring details.
03 / Dates
The dates that matter
HTI-1 proposed rule published
Final rule published at 89 FR 1192
Final rule effective
DSI criterion replaces CDS criterion; ongoing attribute review begins
HTI-5 proposes removing DSI transparency and risk management parts
04 / Enforcement
Who enforces it
ONC and ONC-Authorized Certification Bodies (corrective action, suspension or termination of certification). Information blocking by developers can draw HHS-OIG civil money penalties of up to $1 million per violation.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Certification to 170.315(b)(11) listed on the Certified Health IT Product List
- 02Source attribute records for each supplied DSI
- 03Intervention risk management documentation and public summary
- 04Records of ongoing attribute review and updates
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
When did the ONC HTI-1 predictive-DSI requirements take effect?+
HTI-1 took effect on February 8, 2024, and its decision support intervention criterion, 45 CFR 170.315(b)(11), became the only version in the Base EHR definition on January 1, 2025, when the old clinical decision support criterion expired. Developers had through December 31, 2024 to move certified modules to the new criterion, and the ongoing duty to review and update source attributes and risk management practices began January 1, 2025. HTI-5, proposed in December 2025, would remove the source attribute and risk management requirements; it was not final as of October 2026. Read the full answer
How do I demonstrate FAVES for a predictive DSI?+
HTI-1 does not require you to demonstrate FAVES (fair, appropriate, valid, effective and safe). ONC said it set no regulatory baselines, measures or thresholds for FAVES; the rule instead requires certified developers to disclose source attributes so users can judge those qualities. The attributes that speak to FAVES include intended use and out-of-scope cautions, external validation, validity and fairness results in test, external and local data, and the monitoring and update schedule, backed by risk analysis covering validity, reliability, robustness, fairness, intelligibility, safety, security and privacy. Read the full answer
How can an AI tool deployment audit produce one evidence record across HTI-1, §1557, FDA PCCP, and CMS at once?+
A single, well-documented evaluation can feed several of these regimes, but it cannot replace their separate duties, which fall on different parties. Validity and fairness results across demographic groups can support a certified developer's HTI-1 source attributes, a covered entity's §1557 mitigation efforts and a device maker's PCCP acceptance criteria. Repeated measurements over time support HTI-1's ongoing review and PCCP performance monitoring. Medicare Advantage rules need something different: case records showing each coverage decision rested on the individual patient's history and clinician review, not only a model's output. Read the full answer
SOURCES
Go back to the source
Federal Register (ASTP/ONC)
Federal Register (CMS/ONC)
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: ONC HTI-1 for medicine AI workflows · NIST AI RMF · OMB M-25-21/22 · DoW RAI S&IP · EO 14179 · FIPS 140-3 · SHA-256 / FIPS 180-4