Continuum GRC warns health buyers to tighten AI due diligence after HHS HTI-5 rule

Continuum GRC is urging health organizations to revisit procurement and governance controls after HHS’ HTI-5 final rule reduced federal certification requirements for some decision-support tools. The shift leaves buyers with more responsibility to document validation, oversight and monitoring choices before the new effective dates later this year and in early 2027.

Why it matters: - HHS’ HTI-5 final rule lowers some federal certification requirements, but health organizations still need their own evidence before adopting AI-enabled and decision-support tools. - The change puts more weight on buyer-led due diligence for validation, bias review, oversight, incident response and vendor accountability. - Health organizations that do not update procurement and governance controls could end up with gaps between federal certification rules and internal risk management requirements.

What happened: - Continuum GRC advised health organizations and health IT buyers to reassess technology due-diligence controls after HHS released the HTI-5 final rule. - HHS said the rule streamlines the voluntary ONC Health IT Certification Program and will produce more than $1.5 billion in regulatory cost savings. - The final rule removes or revises multiple certification criteria for decision-support interventions. - HHS removed specified requirements tied to source-attribute information and intervention risk-management practices for predictive tools. - The related changes generally take effect December 28, 2026. - Selected certification changes take effect January 1, 2027. - HHS said comments on proposed information-blocking changes remain under consideration, so those proposals were not resolved in HTI-5.

The details: - Continuum GRC said a narrower certification requirement does not answer every question a provider, board, compliance team or clinical governance committee may have about a decision-support tool. - Buyers may still need evidence on intended use, training and validation data, performance limits, bias testing, change management, human oversight, incident handling and supplier responsibilities. - The appropriate evidence will depend on the use case and applicable obligations. - Organizations should request, review and retain that evidence through a repeatable process rather than handle it as an informal procurement exchange. - Regulatory change management should translate the rule into specific control decisions before the effective dates. - Organizations should identify affected certified modules, map removed or revised requirements to internal policies and contracts, decide which disclosures they will continue to require and assign owners for validation and ongoing monitoring. - The rule reduces particular federal certification obligations, but it does not by itself eliminate other laws, contractual duties, clinical standards or risk-management responsibilities.

Between the lines: - The rule appears to shift more responsibility from federal certification mechanics to local governance and procurement discipline. - That means health buyers may need to treat vendor due diligence as a formal control activity, not just a purchasing step. - The practical implication is that documented reasoning may matter as much as the underlying tool selection.

What's next: - Health organizations are expected to review which certified modules are affected before the December 28, 2026 and January 1, 2027 effective dates. - Boards, compliance teams and clinical governance groups may need to update contracts, validation workflows and monitoring records. - HHS still has proposed information-blocking changes under review, so more policy movement could follow.

The bottom line: - Federal certification requirements are easing, but the governance burden on health buyers is not going away. - Continuum GRC says organizations should document why they accept, reject or supplement vendor evidence now, before the rule changes take effect.