HHS Establishes Certification Requirements for Artificial Intelligence and Machine Learning Software Developers

By Derek Flint and Paul J. Giancola

As the impact of artificial intelligence on various sectors of the U.S. economy grew in 2023, so did the involvement of regulators and policymakers. One of the most recent — and substantive — regulatory standards is the 916-page final rule, Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (the “Rule” aka “HTI-1”), that the U.S. Department of Health and Human Services ("HHS") issued through its Office of the National Coordinator for Health Information Technology ("ONC") on December 13, 2023. The Biden administration considers the Rule to be a significant step in advancing the President’s Executive Order on the “Safe, Secure and Trustworthy Development and Use of Artificial Intelligence” of October 30, 2023.

The Rule, which takes effect on February 8, 2024, implements and updates a variety of important data-compliance requirements for health IT developers who want to be eligible for the benefits of the ONC Health IT Certification Program. For software developers operating at the intersection of healthcare and AI, three aspects of the Rule stand out. 

First, the Rule establishes transparency requirements for AI algorithms that HHS has described as the “first of [their] kind.”¹ More specifically, algorithm transparency requires developers of “predictive decision support interventions”— i.e., technology that supports decision-making using AI—to disclose a long list of “source attributes” about their programs. The list of source attributes includes the intended patient population, exclusion and inclusion criteria that influenced the program’s training data set, and the process used to ensure fairness in the development of the intervention. The Rule also requires developers to allow a “limited set of identified users” to access a complete and up-to-date “plain language” description of all the required source attributes. As a result, this approach will make it possible for clinical users to have a consistent baseline of information about the algorithms they use to support their diagnostic and treatment decisions. 

Second, the Rule adopts version 3 of the United States Core Data for Interoperability (“USCDI”) as of January 1, 2026. The USCDI is a standardized set of health data elements and classes that generally need to be included in a healthcare software program for the program to obtain ONC certification. Version 3 includes a number of new data elements and classes, including health insurance information, health status, and certain patient demographic information.

Third, the Rule updates the definition of “information blocking” and the scope of the information-blocking exceptions to support information sharing. Information blocking rules, which have been in effect since April 2021, prohibit practices that are likely to interfere with the access, exchange, or use of electronic health information. Of note, both health IT developers and healthcare providers have obligations under HHS’s information-blocking rule. And failure to comply with the relevant information-blocking regulations can result in hefty civil penalties for IT developers. The proposed rule of penalties for healthcare providers has not been finalized. 

The novelty, broad scope, and complexity of the Rule should cause AI software developers and healthcare providers to closely review its specific provisions and assess the impact on their businesses. If AI software does not meet these new standards, it is unlikely to be eligible for use in hospitals and physicians’ offices or be acceptable in developing drugs. AI software developers should also be on the lookout for future regulations that may impose similar transparency requirements and consider developing a plan to balance compliance obligations with the protection of intellectual property. For a full analysis of the Rule’s impact on their businesses, AI software developers and healthcare providers should consider contacting a legal professional.
 

Footnotes

1. U.S. Department of Health and Human Services, HHS Finalizes Rule to Advance Health IT Interoperability and Algorithm Transparency (Dec. 13, 2023), https://www.hhs.gov/about/news/2023/12/13/hhs-finalizes-rule-to-advance-health-it-interoperability-and-algorithm-transparency.html. [BACK]