In late October, ONC finalized a deregulatory rule known as HTI-5. Among other things, it removes the AI transparency requirements that applied to certified EHRs. Under the earlier HTI-1 rule, developers had to disclose details about the predictive decision support tools built into their products, things like how the model was trained, how it was validated, and where it was and wasn't expected to perform well. They also had to maintain risk management practices around those tools. Under the final rule, those obligations are gone.
Epic responded quickly and publicly. It said it will keep giving customers the documentation ONC no longer requires, and that health systems using Epic will keep access to the tools it built for evaluating the fairness, validity, and other attributes of its software.
That is the right thing to say. It is also worth reading carefully.
The Problem
Epic's statement doesn't say what the documentation covers, what format it comes in, how often it gets updated, or whether it will look the same from one release to the next. I'm not criticizing that. A short public statement isn't supposed to carry that much detail. But it does mean the commitment is only as specific as the statement, and a commitment on LinkedIn is a different thing than a requirement in a certification rule.
A requirement applies to every vendor. It is enforceable. It gives buyers a common format, so you can compare one tool against another. A promise depends on the intentions and incentives of one company on a given day, and it can change quietly. Epic choosing to stay transparent is good news for Epic customers. It does nothing for the other vendors in your stack, and most health systems are running AI from more than one place.
ONC's own guidance points the same direction. It tells EHR users to ask their developers for this information directly. Read that again. The responsibility didn't disappear. It moved from the rule to the customer. The Texas Medical Association said as much in its comments, warning that dropping the requirement leaves clinicians and health systems to assess algorithmic risk without visibility into how the tools actually work. ONC has also said it may revisit similar requirements in future rulemaking, so this may not be the last word.
The Point of View
If I were running vendor management or IT governance at a health system right now, I would treat this as a procurement problem, not a news item. Three things.
First, get the documentation commitment into the contract. Not a press statement, not a customer portal page. The contract should say what gets provided: training data sources, validation results, known limitations, and how the model performs across patient groups. Second, require notice when a model changes. Documentation that describes last year's version of a model is worse than none, because it looks like assurance. Third, own your local validation. No vendor document can tell you how a model performs on your patients, in your workflows, with your data. That was always the health system's job. The rule change just removed the cover.
This applies on the consulting side too. When the formal requirements that used to carry the weight go away, trust gets carried by relationships and accountability. The people who understand both the vendor's commitments and the customer's obligations are the ones who keep an AI program defensible.
The Takeaway
Epic is doing the right thing, and health systems should take them up on it, in writing. A good vendor's voluntary commitment is a reason to build your own governance, not a reason to skip it.