On December 13, 2023, the US Department of Health and Human Services (HHS), through its Office of the National Coordinator for Health Information Technology (ONC), released a long awaited "Health Data, Technology, and Interoperability" final rule (referred to as “HTI-1”). Among other things, this final rule creates a new framework governing the use of artificial intelligence (AI) and other predictive technologies in electronic health record (EHR) systems and other certified health technologies (Certified Health IT) used by healthcare companies. The rule also includes updates to the HHS Health IT Certification Program (Certification Program) and new rules relating to information blocking that are meant to enhance interoperability amongst Certified Health IT.

HTI-1 is significant because it represents a first-of-its-kind approach by HHS to regulate the use of AI by developers of Certified Health IT. Thus, the rule governs the “supply side” of the healthcare digital ecosystem (i.e., EHR system developers). Notably, on December 14, the day after issuance of the HTI-1 final rule, the White House and HHS also announced they had obtained voluntary commitments from the “demand side” of the healthcare ecosystem – i.e., 28 leading healthcare providers and payers who promised to only deploy AI solutions responsibly and in alignment with the principles set forth in HTI-1.

These developments are important to note because they follow the White House’s sweeping October 30, 2023 AI Executive Order, requiring HHS to support “responsible AI development and use,” including through prioritized grantmaking and awards, and to evaluate and report on the use of AI-enabled technologies in the healthcare sector. The measures in HTI-1, coupled with the commitment by industry stakeholders highlighted in the White House announcement, together represent a significant step forward in HHS’s efforts to carry out the Executive Order’s mandate, and in the federal government’s larger effort to regulate AI in the healthcare space.

Below we detail key features of HTI-1 and the White House’s announcement of voluntary commitments by major industry stakeholders to align with HTI-1 principles. We also offer important takeaways for organizations looking to leverage AI within the healthcare sector in a responsible and trustworthy manner.

HTI-1 Overview

The ONC oversees the Certification Program, which requires developers of certain health information technology (i.e., Certified Health IT) to meet specified criteria in order for their software to receive a certification. Participation in the Certification Program is voluntary, but EHR developers who obtain certification can receive certain benefits. ONC-certified Health IT is used in more than 96 percent of non-federal acute care hospitals and by 78 percent of office-based physicians in the US.

HTI-1 imposes new requirements on the use of predictive Decision Support Interventions (DSI) as part of a Certified Health IT. Under the final rule, predictive DSI is any technology that supports decision-making based on “algorithms or models that derive relationships from training data and then produces an output that results in prediction, classification, recommendation, evaluation, or analysis.” For example, predictive DSIs can include models that predict certain illnesses through radiology.

Under HTI-1, if the Health IT does use a predictive DSI, the Health IT developer must make available to the software users (e.g., healthcare providers) information about the predictive DSI, including, without limitation: (1) the purpose of the intervention; (2) funding sources for the intervention’s development; (3) criteria used to influence the training data set; (4) the process used to ensure fairness in the development of the intervention; and (5) a description of the external validation process.

The predictive DSI must also be subject to an analysis of potential risks and adverse impacts associated with its validity, reliability, robustness, fairness, intelligibility, safety, security, and privacy. Responsible AI governance and controls must also be adopted.

ONC will be hosting information sessions regarding the final rule on the following dates:

• January 4, 2024 at 1pm ET (Topic: Overview Session #1)
• January 17, 2024 at 1pm ET (Topic: Decision Support Interventions (DSI))
• January 25, 2024 at 1pm ET (Topic: Information Blocking)
• February 1, 2024 at 1pm ET (Topic: Overview with Q&A Session #2)
• February 8, 2024 at 3pm ET (Topic: Insights Condition)

Registration information and ONC’s HTI-1 fact sheets are available here on the ONC website. For convenience, sessions will be recorded.

White House Announcement

One day after HTI-1 was released, the White House announced it had secured voluntary commitments from 28 healthcare providers and payer organizations to align with the principles and framework outlined in HTI-1, as well as to develop AI solutions that promote fairness, trustworthiness, and responsible governance. The companies who signed the commitment include: Allina Health, Bassett Healthcare Network, Boston Children’s Hospital, Curai Health, CVS Health, Devoted Health, Duke Health, Emory Healthcare, Endeavor Health, Fairview Health Systems, Geisinger, Hackensack Meridian, HealthFirst (Florida), Houston Methodist, John Muir Health, Keck Medicine, Main Line Health, Mass General Brigham, Medical University of South Carolina Health, Oscar, OSF HealthCare, Premera Blue Cross, Rush University System for Health, Sanford Health, Tufts Medicine, UC San Diego Health, UC Davis Health, and WellSpan Health. The President previously secured commitments from several AI companies in July, 2023 who committed to a series of actions designed to promote safety, security, and trust around AI.

Main Takeaways

• Takeaway #1 - HTI-1 Has Limited Application, But Potentially Broad Impact. HTI-1 impacts certified developers of Health IT. It does not necessarily directly impact healthcare providers who use AI in other applications. However, HTI-1 may telegraph to other players in the healthcare space how HHS will view the use of AI from a responsibility standpoint.

• Takeaway #2 - Keep Other HHS Developments On Your Radar. HTI-1 is not the only effort by HHS to regulate AI. HHS is considering another proposed rule under the Affordable Care Act to prevent discrimination in the use of clinical algorithms in decision-making in connection with certain health care programs and activities. The FDA has issued draft guidance on marketing submission recommendations for AI-enabled medical devices. And, CMS has announced that it is examining whether algorithms used by health plans and providers to identify high-risk patients and manage costs can introduce inappropriate bias in the delivery of medical care. Bottom line – AI and healthcare is a complicated and quickly evolving area, facing increasing regulatory oversight. 

• Takeaway #3 - Build A Responsible AI Governance Program Now. Regardless of whether your organization is directly impacted by HTI-1, it is critically important to look into developing and implementing responsible AI governance processes. This includes creating an AI use case registry, adopting a responsible AI governance framework, and building out a suite of policies, procedures, and working groups to thoughtfully analyze how and to what extent your organization will leverage AI.

If you would like more information about these developments or want to learn more about how your organization can leverage AI in a responsible manner, contact our Dentons AI Advisory Team by reaching out to one of the contacts listed here.