Reference · Healthcare

ONC HTI-1 Decision Support Interventions, Explained

45 CFR 170.315(b)(11): source attributes and intervention risk management for predictive decision support

Last reviewed October 11, 2026

At a glance

Criterion: 45 CFR 170.315(b)(11), Decision support interventions
Adopted by: HTI-1 final rule, published 9 January 2024 (89 FR 1192), effective 11 March 2024
Who must comply: Developers of certified health IT, through the ONC Health IT Certification Program
Source attributes: 31 for a predictive intervention, 13 for an evidence-based one
Risk management: Risk analysis, risk mitigation and governance for each predictive intervention a developer supplies
Status: In force. HTI-5, proposed 29 December 2025, would remove the source attribute and risk management requirements; no final rule as of 11 October 2026.
Official text: 45 CFR 170.315(b)(11) (eCFR)

The HTI-1 final rule replaced the ONC certification program's clinical decision support criterion with a decision support interventions criterion, 45 CFR 170.315(b)(11), that reaches predictive models.HTI-1 Since 1 January 2025 it is the only decision support criterion that satisfies the Base EHR definition, and the older criterion has expired.45 CFR 170.102 · Base EHR

For each predictive intervention a developer supplies with its certified product, the criterion requires 31 source attributes that users can read in plain language and three risk management practices: risk analysis, risk mitigation and governance.45 CFR 170.315 · (b)(11)(iv) to (vi) The duty sits with the developer. The hospitals, physician practices and other organizations that run the product receive the attributes and can read the developer's public risk management summary.

Developers comply; the organizations using the EHR receive the information

The criterion is a condition of certification for health IT developers. A predictive decision support intervention, in the rule's definition, is technology that supports decision-making based on algorithms or models that derive relationships from training data and produce a prediction, classification, recommendation, evaluation or analysis.45 CFR 170.102 · Predictive DSI

The attribute and risk management duties attach to the predictive interventions a developer supplies as part of its certified product. For a model the organization builds itself or buys from another party, the product has to let a limited set of identified users record, change and access source attributes, including attributes beyond the regulation's list.45 CFR 170.315 · (b)(11)(v)(B) HTI-1 states that developers are not responsible for what those users record.HTI-1 · DSI preamble

Hospitals feel the criterion indirectly. Medicare's Promoting Interoperability program for eligible hospitals and critical access hospitals requires certified EHR technology, defined to include technology that meets the Base EHR definition, which since 2025 requires (b)(11).FY 2027 IPPS rule · CEHRT definition

31 source attributes describe every predictive intervention

For each predictive intervention it supplies, the developer's product must give a limited set of identified users complete and up-to-date plain language descriptions of 31 source attributes.45 CFR 170.315 · (b)(11)(iv)(B), (v)(A)(1) Together they cover who built the intervention and what it outputs, what it is for, where it should not be used, how it was developed, how fairness was addressed, how it was validated outside its training data, how it performs, how it is monitored and how often it is updated.

Fairness runs through the list. Nine variables appear repeatedly: race, ethnicity, language, sexual orientation, gender identity, sex, date of birth, social determinants of health and health status assessments. The developer discloses whether each is an input feature, how representative the training data and the external test data were on them, and how fairness is measured in test, external and local data.45 CFR 170.315 · (b)(11)(iv)(A)(5) to (13), (iv)(B)(4) to (8)

Eleven attributes may be shown as not available, and the product must say so when they are: the four external validation attributes, validity and fairness in external data, references to outcome evaluations, validity and fairness in local data, and the two update schedule attributes.45 CFR 170.315 · (b)(11)(v)(A)(2) The other twenty have no such allowance.

An evidence-based intervention carries 13 attributes: the bibliographic citation, the developer, the funding source, the release and revision dates, and whether it uses each of the nine variables.45 CFR 170.315 · (b)(11)(iv)(A)

Bars

Source attributes per group, and how many may be marked not available

Counted from 45 CFR 170.315(b)(11)(iv)(B), 31 attributes in all; the not-available allowance is (b)(11)(v)(A)(2). The first four groups hold the eleven attributes that may be marked not available. Performance is highlighted because it holds the validity and fairness results.

Group	Paragraph	Attributes the developer describes
Details and output	(iv)(B)(1)	Name and contact information of the developer; funding source of the technical implementation; the value the intervention produces as an output; whether that output is a prediction, classification, recommendation, evaluation, analysis or other type of output.
Purpose	(iv)(B)(2)	Intended use; intended patient populations; intended users; the decision-making role it was designed for, for example to inform, augment or replace clinical management.
Cautioned out-of-scope use	(iv)(B)(3)	Tasks, situations or populations where users are cautioned against applying it; known risks, inappropriate settings, inappropriate uses and known limitations.
Development details and input features	(iv)(B)(4)	Exclusion and inclusion criteria that influenced the training data set; use of the nine variables as input features; demographic representativeness of the training data on those variables; relevance of the training data to the intended deployed setting.
Fairness process	(iv)(B)(5)	The developer's approach to ensuring the output is fair; approaches to manage, reduce or eliminate bias.
External validation	(iv)(B)(6)	The data source, clinical setting or environment where validity and fairness were assessed, other than the training and testing data; the party that conducted the external testing; demographic representativeness of the external data; the external validation process.
Quantitative measures of performance	(iv)(B)(7)	Validity and fairness in test data from the same source as the training data; validity and fairness in external data; references to evaluations of the intervention's effect on outcomes such as morbidity, mortality or length of stay.
Ongoing maintenance	(iv)(B)(8)	Process and frequency for monitoring validity over time; validity in local data; process and frequency for monitoring fairness over time; fairness in local data.
Update schedule	(iv)(B)(9)	Process and frequency for updating the intervention; how often its performance is corrected when validity or fairness risks are identified.

Source: 45 CFR 170.315(b)(11)(iv)(B), eCFR current to 7 October 2026. Attribute names are condensed; the regulation's wording governs. 45 CFR 170.315(b)(11) (eCFR)

Risk analysis, risk mitigation and governance for each predictive intervention

Intervention risk management applies to every predictive intervention the developer supplies with its certified product, in three practices.45 CFR 170.315 · (b)(11)(vi)

Risk analysis: potential risks and adverse impacts associated with eight characteristics, namely validity, reliability, robustness, fairness, intelligibility, safety, security and privacy.
Risk mitigation: practices to mitigate the risks the analysis identifies.
Governance: policies and implemented controls, including how data are acquired, managed and used.

Summary information about these practices is public. The developer submits it by a publicly accessible hyperlink that anyone can open without preconditions, and it appears in the certified product listing.45 CFR 170.523 · (f)(1)(xxi) HTI-1 required the practices to be in place and the summary submitted before 31 December 2024.HTI-1 · risk management From 1 January 2025 the developer reviews and updates the attributes, the practices and the summary as necessary, on an ongoing basis.45 CFR 170.402 · (b)(4)

What a deploying organization should ask its developer for

An organization that runs certified health IT can ask its developer for five things the criterion makes available:

The predictive interventions supplied with the certified product, and which of them are activated in the organization's configuration. Selection is limited to a set of identified users.45 CFR 170.315 · (b)(11)(iii)
The source attributes for each activated intervention, with the attributes marked not available listed separately. External validation and local performance are among those that may be missing, and local testing is how the organization fills them.
The public summary of the developer's risk management practices, and the date it was last reviewed.
For evidence-based interventions, the export of user feedback data: the intervention, the action taken, the feedback, the user, the date and the location, in a computable format.45 CFR 170.315 · (b)(11)(ii)(C)
For models built in-house or bought from a third party, the organization's own source attributes, recorded in the same product so clinicians see one format.

Section 1557's rule on patient care decision support tools requires a covered entity to make reasonable efforts to identify the tools that use inputs measuring race, color, national origin, sex, age or disability, and to mitigate the risk of discrimination from them.45 CFR 92.210 · (b), (c) The input feature attribute answers the first question for each predictive intervention in the EHR. See HHS Section 1557 and decision support tools and state healthcare AI laws for the duties that start from the same inventory.

HTI-5 would remove the transparency requirements, and it has not been finalized

The HTI-5 proposed rule, published on 29 December 2025, would remove the source attribute requirements, their access and modification, and intervention risk management from (b)(11), together with the ongoing review duty and the public summary.HTI-5 proposal · DSI It would also narrow the data the predictive selection capability must support to the listed data types plus the clinical notes and assessment and plan of treatment data classes. ONC cited burden and Executive Order 14179, and said it had no publicly available evidence that any doctor, nurse or administrator had accessed, recorded or modified a source attribute.HTI-5 proposal · DSI Comments closed on 27 February 2026.ONC

The changes would apply from the effective date of a final rule.HTI-5 proposal · DSI As of 11 October 2026 no final rule has appeared in the Federal Register, and the eCFR, current to 7 October 2026, still carries (b)(11)(iv) to (vi).Federal Register 45 CFR 170.315 The 2026 Unified Agenda listed final action for August 2026, and CMS's FY 2027 inpatient payment rule of 4 August 2026 says the HTI-5 final rule will be issued after it.Unified Agenda FY 2027 IPPS rule · HTI-5

Until a final rule takes effect, a developer that supplies a predictive intervention owes its users the attributes and the risk management practices on this page.

Before and after

What the HTI-5 proposal would change in 170.315(b)(11)

In force todayHTI-5 proposal

Source attributes, predictive: 31 required; →; Removed
Source attributes, evidence-based: 13 required; →; Removed
Intervention risk management: Required; →; Removed
Public risk management summary: Required; →; Removed
Ongoing review and update: Required since 2025; →; Removed
Data predictive selection must support: All USCDI data; →; Listed data, clinical notes, assessment and plan

Proposals from the HTI-5 proposed rule, 90 FR 60986 to 60987, 61001 to 61002 and 61004 to 61005. Nothing in the right column applies until a final rule takes effect.

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Predictive intervention inventory	Know which predictive interventions the EHR supplies and which are activated	The developer's list, the activation record, and the users allowed to activate
Source attributes (b)(11)(iv)	Hold the developer's attributes for each activated intervention	Attributes per intervention, with the not-available ones flagged and dated
Risk management (b)(11)(vi)	Read the developer's public summary and record the organization's own review	The summary link, its review date, and the organization's risk decision
Local performance	Supply validity and fairness in local data where the developer cannot	Local testing results, owner and review cadence
Section 1557 identification (92.210(b))	Decide for each tool whether it uses protected-class inputs	A dated determination per tool, citing the input feature attribute

Key dates

Timeline, drawn to scale

From the HTI-1 criterion to the HTI-5 proposal

In effect as of October 11, 2026Criterion required, and the proposal to cut it back

Dates from the HTI-1 final rule, 45 CFR 170.102 and the HTI-5 proposed rule. Status as of October 11, 2026.

9 January 2024HTI-1 final rule published (89 FR 1192), adopting the decision support interventions criterion.
11 March 2024HTI-1 takes effect, after a correction moved the date from 8 February 2024.
31 December 2024Developers apply intervention risk management to each predictive intervention they supply and submit the public summary; last day the older criterion satisfies the Base EHR definition.
1 January 2025Only (b)(11) satisfies the Base EHR definition; the clinical decision support criterion expires; ongoing review of attributes and practices begins.
29 December 2025HTI-5 proposed rule published (90 FR 60970), proposing to remove source attributes and risk management.
27 February 2026HTI-5 comment period closes.
11 October 2026No HTI-5 final rule published in the Federal Register; (b)(11) remains in force.

Sources cited

Common gaps

Where deploying organizations most often lose the thread.

Attributes nobody has read. The developer made them available inside the EHR. Nobody in the organization can say, for a given model, whether external validation exists or whether local performance has ever been measured.
Not available treated as not applicable. Eleven attributes may be marked not available.45 CFR 170.315 · (b)(11)(v)(A)(2) An unavailable external validation or local fairness result is a gap the organization has to close or accept in writing.
A predictive model activated by a vendor update. The configuration changed and the inventory did not. The activation record is the evidence of who switched it on.
Models from other parties left out. Attribute and risk management duties cover what the developer supplies. A model the organization licensed elsewhere has no attributes until someone records them.
Waiting for HTI-5. A proposal changes nothing until a final rule takes effect, and the Section 1557 identification duty needs the input feature attribute now.

In practice

How Meilynx maps to HTI-1 for deployers →

Last reviewed October 11, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.