News
ONC publishes enforcement framework for HTI-2 algorithm transparency rule
The Office of the National Coordinator released its final enforcement framework for HTI-2 on October 14, setting out how certified health IT vendors must evidence Decision Support Intervention (DSI) source attribute compliance beginning January 1, 2027. The framework ties certification maintenance to quarterly attestations, random audit sampling, and public posting of DSI inventories for every certified installation.
- ONC
- HTI-2
- DSI
- regulation
- certification
- transparency
HTI-2 enforcement has been the biggest open question in U.S. health-IT policy for the last 18 months. The rule itself was finalized in late 2024; what the industry has been waiting for is how ONC intends to actually operationalize it. Monday’s framework answers that question in a way that is noticeably more rigorous than the compliance-light posture many vendors were anticipating.
Three provisions matter most. First, the quarterly attestation requirement — certified vendors must sign off every quarter that their DSI inventories are current and that each predictive algorithm shipping with the product carries complete source attribute metadata. Previously the industry had assumed this would be an annual lift. Quarterly cadence forces vendors to build and maintain a live catalog rather than a point-in-time snapshot.
Second, the random audit mechanism. ONC will sample installations — not just vendor-submitted documentation — to verify that the DSI metadata exposed inside a live customer deployment matches the attested inventory. That is the first time the certification regime will reach past the vendor and into the operational installation. It raises the practical compliance cost significantly, because vendors can no longer treat deployment-specific configuration (health-system-authored predictive models, locally-tuned thresholds, custom rules) as outside the scope of their attestation.
Third, the public posting requirement. Every certified installation’s DSI inventory will be published on an ONC-hosted registry, searchable by vendor and by site. The transparency effect of that is substantial — competitors, researchers, and journalists will be able to see which health systems are running which models, something the industry has resisted for years on competitive grounds.
Vendors who have been treating DSI compliance as a documentation exercise will find the next 10 weeks uncomfortable. The practical implementation lift — product-side metadata APIs, deployment-time inventory capture, customer-facing attestation workflows — is substantial. Expect to see a wave of integrator and consultancy capacity getting absorbed into HTI-2 remediation projects through the end of the year.
Related coverage: health-system copilots topic · FDA AI/ML-enabled devices topic.
Primary source: Read the full original on ONC ↗