HHS Cut 14 Health IT Rules, Not 34. The Retreat Is the Signal.

On Oct. 26 the Department of Health and Human Services finalized a rule that cuts 14 of the 60 criteria every certified electronic health record has to meet. Ten months ago it proposed cutting 34.¹ Most headlines will read that gap as a weaker deregulation. I read it the other way. The agency kept the privacy and security floor that buyers asked for and cut the parts that were taxing software design, including the AI "model card" rules. That is what good deregulation looks like, and it matters for the companies racing to put AI inside the medical chart.

Key Highlights

• The rule: HTI-5 removes 14 certification criteria, revises seven and leaves 39 intact.² The December 2025 proposal would have removed 34 and revised seven.¹
• The savings: HHS projects more than $1.5 billion in regulatory cost savings³, described as a $1.55 billion net present value, or $108.1 million a year at a 7% discount rate starting in 2027.⁴
• The retreat: HHS dropped its plan to remove all 13 privacy and security criteria after most commenters opposed it.⁵
• The AI piece: The rule removes the source-attribute "model card" and risk-management requirements for predictive decision support tools.⁶
• The idea: Oracle (ORCL), whose AI-native Oracle Health EHR earned ONC certification in 2025, trades at $129.54, down from a 52-week high of $285.46.^{7, 8}

Here is the part most people miss about electronic health records. The government does not just set rules for hospitals. It sets rules for the software itself, line by line, through a certification program run by the Office of the National Coordinator for Health IT.

Sixty criteria. Every one is a design spec a vendor has to build, test and maintain.

The surface story

The press release is short. HHS released the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity final rule, known as HTI-5, and said it "significantly reduces administrative burdens" for developers in the certification program.³ Secretary Robert F. Kennedy Jr. said doctors and patients "need better technology, not more Washington paperwork".¹⁰

STAT framed it as the administration removing 14 security, privacy and transparency requirements for vendors such as Epic and Oracle, in many cases over the objections of commenters.¹¹ The American Hospital Association put the number in context: 14 criteria removed "instead of 34 as previously proposed," and seven revised.¹²

So which is it? A gutting of safeguards, or a timid half-step? I think it is neither. Look at what moved between the proposal and the final rule.

The quiet second document

The proposal from December 2025 is the document to read next to this one. It would have removed 34 of 60 criteria and revised seven, changing nearly 70% of the program.¹³ That would have left only 19 criteria untouched.⁹ The biggest single piece was a plan to remove all 13 privacy and security criteria and the framework around them.¹⁴

That plan is gone. HHS kept the privacy and security criteria, and the reason is worth quoting. Providers worried that removal would "shift burden to healthcare providers to verify the existence of the capabilities and lead to developers removing P&S capabilities due to costs and burden".¹⁴ Small and rural providers were the most worried, because they have the least bargaining power to get those features written into a contract.¹⁴ An ONC official said simply, "We received a lot of comments arguing that these criteria should be kept".¹⁴

Now look at what survived the comment period on the other side. The AI provisions. Under the 2023 HTI-1 rule, any certified EHR that offered predictive decision support had to display standardized source attributes, the so-called model cards covering training data, validation and funding sources.⁴ HTI-5 removes those displays, the ongoing duty to update them, and the certification audits of model-drift monitoring.⁴ ONC said it had not seen benefits that justified the cost, and that the requirements hit a relatively limited group of developers.¹⁴

Put the two decisions side by side and you see a regulator drawing a line. Security that buyers cannot easily verify for themselves stays federal. Design choices about how a vendor explains its own AI move to the market, to the FDA and to existing anti-discrimination rules.⁴

The mechanism

Why does a certification criterion cost so much? Because it is not a checkbox. It is a feature a vendor must build to a federal spec, have tested by an accredited body, document, and keep current through every software release.

Take the model card. For every predictive tool, the vendor had to build a clinician-facing screen showing how the model was trained and validated, and keep that metadata updated.⁴ The agency's own conclusion was that clinicians in high-pressure workflows made little use of those technical cards.⁴ You were paying engineers to build a screen nobody read.

Testing changes too. Formal annual real-world testing plans are gone; results reporting now covers the core API criteria and the provider prior-authorization APIs.⁴ Safety-enhanced design stays, but moves from summative laboratory testing to attestation.⁴

And the timing is staged. Of the 21 removed or revised criteria, 13 change on the rule's effective date, seven on Jan. 1, 2027, and one on Jan. 1, 2030.¹⁵ Most provisions take effect Dec. 28.¹⁴

What stayed, and why it tells you more

A deregulation is easiest to judge by what the regulator refused to cut. The list here is long, and I think it is the most encouraging part of the rule.

The implantable device list stayed, aligned with a measure CMS uses in its fiscal 2027 inpatient payment rule.⁴ Quality management systems stayed. Accessibility-centered design stayed.⁴ The requirement that developers publish their public API service base URLs stayed, over vendor objections.⁴

That last one matters more than it sounds. A published API endpoint is how a third-party app, or a competing vendor, connects to a hospital's data. Keeping it public keeps the door open for new entrants. That is a pro-competition choice, not a pro-vendor one.

The agency also slowed down where speed would have hurt. Instead of stripping the older C-CDA document and Direct messaging requirements by 2027, it extended the transitions-of-care sunset to Jan. 1, 2030.⁴ Hospitals still exchange records that way. Pulling the plug early would have broken working connections to make a point.

And it loosened, rather than removed, where a rule had become too rigid. Clinical information reconciliation stays, but without the fixed document-format constraints and the requirement to show data sources side by side.⁴ The stated goal of the original proposal was to make room for newer FHIR-based standards¹⁶, and ONC says more proposals on expanded API use are coming.¹⁰

I have watched a lot of agencies announce deregulation by press release and then cut the wrong things. This one listened, kept the parts that protect buyers and competition, and cut the parts that protected nobody. National Coordinator Tom Keane put it well: a certification program "should establish the floor healthcare needs without becoming the ceiling innovation keeps hitting".⁴

Who wins and who loses

EHR developers building AI. This is the clearest win. Every predictive feature they ship no longer drags a federal display requirement and audit behind it. The agency said compliance overhead was depressing developer investment in frontier AI.⁴

Smaller developers. A fixed compliance cost is a bigger share of a small vendor's engineering budget than a large one's. Cutting 14 criteria lowers the entry fee for anyone trying to compete with the incumbents. Pro-market is not pro-incumbent, and a lighter certification program is how a challenger gets a hearing.

Small and rural providers. They won twice. They get cheaper software over time, and they kept the security floor they lobbied for.¹⁴

The losers. Testing labs and certification consultants lose volume. Developers who wanted public API endpoint publication scrapped lost that argument; ONC kept the requirement.⁴ Advocates of AI transparency lost the model card.

The numbers

The headline figure is more than $1.5 billion.¹⁰ The more honest version is $108.1 million a year, discounted at 7%, starting in 2027, with zero new ongoing compliance costs for developers.⁴ I prefer the annual number. It tells you what the industry actually saves each year, and it is real money for a niche of software companies.

Scale of the change: 14 removed, seven revised, 39 kept, out of 60.⁴ That is 35% of the program touched, by my arithmetic, against nearly 70% under the proposal.¹³

The national network these systems plug into is large. TEFCA, the federal interoperability network, has exchanged nearly 500 million health records.¹⁷ The interoperability plumbing stays certified. The decoration comes off.

The free-market read

The other side has a serious point, so I will start there. Commenters told HHS that certification is "a minimum baseline of privacy and security capabilities and a mechanism for verifying that these capabilities exist".¹⁴ On AI, the Texas Medical Association flagged the removal of model-card rules that require AI developers to disclose how their models are designed and tested.¹⁸ The Medical Group Management Association warned that the overhaul could shift costs and compliance burden onto medical practices.¹⁹

I take the security argument seriously, and so did HHS. That is why the final rule kept it. Security is a classic case where the buyer cannot inspect the product. A rural clinic cannot audit encryption. A common floor makes sense there.

The model card is different. A hospital buying an AI tool can ask the vendor for validation data, write it into the contract, and walk away if it does not get it. A large health system has the bargaining power to demand exactly that. And the government's own finding was that clinicians were not using the cards at the bedside.⁴ A mandated disclosure nobody reads is not safety. It is overhead.

There is also a speed argument, and I feel strongly about it. Clinical AI is changing every quarter. A federal spec written in 2023 for how to describe a predictive model was always going to lag the technology. Freezing the format in regulation locks in yesterday's idea of transparency. Letting buyers, the FDA and the courts set the standard keeps it current.

That is the free-market case. Keep the floor where the buyer is blind. Remove the ceiling where the buyer can see.

The bear case

I could be wrong, and here is how.

The retreat may be the trend. HHS cut less than half of what it proposed. If the next rule faces the same pushback, the deregulatory runway for health IT is shorter than the press release suggests.

The model card could come back. ONC said it is considering whether to add source attributes back in future rulemaking.¹⁴ Information-blocking changes are still under review and were not finalized.⁴

A bad AI outcome changes the politics. One widely reported failure of a clinical algorithm and the transparency rules return, possibly stricter.

For the stock idea, health is a small piece. Oracle's share price is driven by its cloud business, not by EHR certification. A health IT rule will not move a company of this size on its own.

The Idea

The Idea is Oracle (ORCL), through Oracle Health.

Why this helps Oracle. Its next-generation EHR was built from the ground up with AI embedded in every workflow and earned ONC Health IT certification on Oct. 3, 2025.⁷ Oracle planned to add acute-care functionality in 2026²⁰, which means more modules going through certification. Its Clinical AI Agent now drafts orders, suggests professional fee codes and supports nurses²¹, and nearly 10,000 clinicians were using it.²² A rule that removes the model-card and model-drift audit requirements for predictive tools inside certified EHRs lands directly on that roadmap.

The valuation. ORCL traded at $129.54 on Oct. 27, against a 52-week range of $114.50 to $285.46 and a trailing price-to-earnings ratio of 20.3 on $7.63 of earnings per share.⁸ The stock closed October 2025 at $262.61.⁸ That is a drop of about 51%, by my arithmetic.

What the market may be missing. Investors are pricing Oracle on cloud spending and debt. Almost nobody prices the health business on regulation. HTI-5 lowers the cost of shipping AI into the chart for every certified vendor, and Oracle is the listed company that has bet most visibly on an AI-native EHR.

The risks. Oracle's cloud capital spending and balance sheet dominate the stock. Health is one division, and it competes against well-established EHR vendors. What would prove me wrong: Oracle failing to certify its acute-care EHR in 2026, or ONC restoring the model-card requirements in its next rule. No price target. I keep score on every idea here, winners and losers: the FMR Idea Scorecard.

What to watch next

Three dates. Most provisions take effect Dec. 28, and the next set on Jan. 1, 2027¹⁴; I track dated deadlines like these on the Deregulation Investor's Catalyst Calendar. Second, ONC's promised follow-up proposals on expanded API use.¹⁰ Third, whether information-blocking changes come next.

You have seen this pattern here before. Yesterday the Labor Department buried the 80/20 tip rule by tying guidance back to the statute. A court told the FCC it never had the power to build USAC. The common thread is a government finally asking which of its rules buyers actually need. HTI-5 answers that question better than the headlines give it credit for.

Related analysis

• A Judge Certified an 80/20 Tip Case. Three Days Later, Labor Buried the Rule.
• The FCC Never Had the Power to Build USAC, a Court Says
• The Treasury Home-Buying Ban Locks In the Biggest Landlords

The Free Markets Report is provided by Lead-Lag Publishing, LLC. All opinions and views mentioned in this report constitute our judgments as of the date of writing and are subject to change at any time. Information within this material is not intended to be used as a primary basis for investment decisions and should also not be construed as advice meeting the particular investment needs of any individual investor. Trading signals produced by the Free Markets Report are independent of other services provided by Lead-Lag Publishing, LLC or its affiliates, and positioning of accounts under their management may differ. Please remember that investing involves risk, including loss of principal, and past performance may not be indicative of future results. Lead-Lag Publishing, LLC, its members, officers, directors and employees expressly disclaim all liability in respect to actions taken based on any or all of the information on this writing. Nothing in this report shall be construed as an offer to provide investment advice or services. Nothing in this report shall be construed to be an offer to provide investment advisory services. Nothing in this report shall be construed as an offer or solicitation to buy or sell any security. The Free Markets Report is for informational purposes only and does not constitute a complete description of our investment services or performance. THE INFORMATION IN THIS REPORT HAS BEEN PREPARED WITHOUT REGARD TO THE INDIVIDUAL CIRCUMSTANCES OF INDIVIDUALS WHO MIGHT RECEIVE IT. THE INVESTMENTS DISCUSSED MAY NOT BE SUITABLE FOR ALL INVESTORS. INVESTORS MUST MAKE THEIR OWN INVESTMENT DECISIONS BASED ON THEIR OWN PARTICULAR FINANCIAL SITUATIONS AND OBJECTIVES. This report is not an offer to provide investment advice or services. Nothing in this report shall be construed as an offer to provide investment advice or services. Nothing in this report shall be construed to be an offer to provide investment advisory services in any jurisdiction in which Lead-Lag Publishing, LLC is not authorized to provide such services. All investments involve risk, including the risk of loss of principal. No representation is being made that any security, account, or strategy is or is likely to achieve results similar to those shown. Investing in securities involves risks, and there is always the potential of losing money when you invest in securities. Before investing, consider your investment objectives, and Lead-Lag Publishing, LLC's charges and expenses. This report is not a prospectus and does not contain all of the information necessary to fully evaluate any security or strategy discussed, including, but not limited to, the risk of adverse effects of related market developments. You should not rely solely on the information contained in this report, and should seek advice based on your situation from a licensed investment professional. Carefully consider the investment objectives, risks, charges, and expenses of any investment product before investing. This report may not be copied or distributed without the express written consent of Lead-Lag Publishing, LLC. Any decisions made based on any or all of the information in this writing are the sole responsibility of the user, and the user should exercise caution and take appropriate advice before acting.