HTI-5: decision-support certification changes
United States, federal · Law or regulation · Adopted, future application
- United States
- Healthcare
- Transparency
AI Regulation Tracker
Selected federal and state requirements for AI deployments.
Resources › AI Regulation Tracker › United States
Overview · United States · European Union · Canada · Standards & Frameworks
December 28, 2026
HTI-5 · Rule change
January 1, 2027
California CCPA regulations · Compliance deadline
January 1, 2027
Colorado SB 26-189 · Application date
December 31, 2027
California CCPA regulations · Compliance deadline
April 1, 2028
California CCPA regulations · Compliance deadline
US requirements can depend on the organization, state, data, product, and decision involved. This page brings together selected healthcare, privacy, cybersecurity, and automated-decision rules, with scope notes and links to the responsible authorities.
In each entry, “What this means for your AI deployment” and “Evidence you may need” describe assessment work Medoya suggests. They do not mean that every listed test or document is expressly required by the cited law.
This resource provides general information about selected regulations and technical considerations. It is not legal advice or a determination that a particular system complies. Check the linked official sources and obtain advice for your circumstances.
Assess what an agent can access and do, test relevant attack paths, and document findings and limitations.
Examine how a vendor's product fits the intended use, including data flows, deployment options, available evidence, and open questions.
Review trust boundaries, permissions, human approvals, logging, and recovery arrangements before deployment or expansion.
A healthcare tool, an employment decision system, and a general assistant can raise different questions. Start with the affected people, data, product classification, and your organization's role. Read any exemptions and enforcement notes before applying an entry to a deployment.
Jurisdiction: United States, federal · Type: Law or regulation (federal regulation) · Status: Applicable
Topics: Healthcare, Privacy, Cybersecurity · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. HIPAA covered entities and business associates handling electronic protected health information (ePHI).
Summary. The Security Rule covers ePHI that covered entities and business associates create, receive, maintain, or transmit, so it reaches AI tools and workflows that handle ePHI. Organizations must assess and manage risks and maintain appropriate safeguards. Changes to technology and risk can require reevaluating those safeguards.
Watch item (proposed). HHS published proposed changes to the Security Rule on January 6, 2025. As of October 29, 2026, the Federal Register shows no final rule. The Fall 2025 federal regulatory agenda listed a July 2027 target for final action: that is an agency planning target, not a compliance deadline.
What this means for your AI deployment. Map ePHI across prompts, retrieval, model providers, logs, and connected tools. Assess access restrictions, information exposure, monitoring, and incident handling.
Evidence you may need. Data-flow diagrams, access-test results, risk and remediation records, and applicable business associate agreements.
Scope and limitations. HHS's summary of the rule does not address AI specifically; applying it to AI workflows follows from the rule's coverage of ePHI. A scoped AI security assessment can support a wider risk analysis. It does not establish organization-wide HIPAA compliance.
Official sources (checked October 29, 2026)
Related services: AI Agent Security Review · AI Vendor Assessment
Jurisdiction: United States, federal · Type: Law or regulation (federal statute), with separate FDA guidance · Status: Applicable
Topics: Healthcare, Cybersecurity · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Sponsors of qualifying cyber devices making relevant premarket submissions.
Summary. Section 524B of the FD&C Act applies to relevant premarket submissions from March 29, 2023. It addresses vulnerability management, processes supporting cybersecurity and updates, and a software bill of materials (SBOM). FDA's February 2026 final guidance, which replaced the June 2025 version, gives recommendations on device cybersecurity and submission documentation; those recommendations are separate from the statutory requirements.
Key dates
What this means for your AI deployment. Establish device scope, threat-model relevant components, and assess vulnerabilities and update processes.
Evidence you may need. Component inventory, SBOM, test evidence, traceability, and vulnerability-response plans.
Scope and limitations. These requirements do not cover every healthcare chatbot or software product. Security testing alone does not establish clinical safety, effectiveness, or FDA clearance.
Official sources (checked October 29, 2026)
Related services: AI Agent Security Review · AI Architecture Review & Design
Jurisdiction: United States, federal · Type: Law or regulation (federal final rule) · Status: Adopted, future application
Topics: Healthcare, Transparency · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Developers of health IT certified to ONC's decision support interventions criterion, 45 CFR 170.315(b)(11).
Summary. Published on October 28, 2026 (91 FR 67916), HTI-5 removes the source-attribute requirements that ONC describes as supporting model cards for predictive decision support interventions (DSIs), and the intervention risk-management requirements for predictive DSIs. The DSI criterion remains, with revisions. These changes take effect on December 28, 2026; other HTI-5 amendments effective January 1, 2027 do not affect this criterion.
Key dates
What this means for your AI deployment. Update certification requirement maps and vendor questionnaires. Decide which documentation and controls remain appropriate under contracts, other obligations, and customer needs.
Evidence you may need. Versioned requirements mapping, change assessment, vendor documentation, and retained-control decisions.
Scope and limitations. These are changes to ONC certification. They do not eliminate all AI transparency, security, or clinical-governance responsibilities.
Official sources (checked October 29, 2026)
Related services: AI Vendor Assessment
Jurisdiction: United States, California · Type: Law or regulation (state law) · Status: Applicable
Topics: Healthcare, Transparency · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Covered health facilities, clinics, and physician practices using generative AI for patient clinical communications.
Summary. Covered communications require disclosure of generative AI use and clear instructions for contacting a human. Requirements vary by communication format. Communications read and reviewed by an appropriately licensed or certified healthcare provider qualify for an exemption. Administrative matters such as scheduling and billing are outside the definition of patient clinical information.
Key dates
What this means for your AI deployment. Test disclosure placement, human-contact instructions, and any workflow relying on human review of the final communication.
Evidence you may need. Message examples, interface screenshots, transcripts, and reviewer records.
Scope and limitations. Confirm the communication, organization, and review process meet the statutory conditions.
Official sources (checked October 29, 2026)
Related services: AI Architecture Review & Design · AI Agent Security Review
Jurisdiction: United States, Texas · Type: Law or regulation (state law) · Status: Applicable
Topics: Healthcare, Transparency · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Developers and deployers within the law's scope, including covered healthcare uses.
Summary. TRAIGA prohibits specified AI uses, some only for governmental entities and several only when done with the required intent, and includes a healthcare disclosure requirement. A covered healthcare provider must give clear, conspicuous notice of AI use to the recipient or their personal representative no later than the date the service or treatment is first provided. In an emergency, notice is due as soon as reasonably possible.
Key dates
Enforcement note. The Texas Attorney General has exclusive enforcement authority; the Act creates no private right of action.
What this means for your AI deployment. Identify covered uses and check that the disclosure appears at the required point in the care workflow. Test relevant deployment safeguards within an agreed scope.
Evidence you may need. Disclosure versions, delivery records, safeguard tests, and remediation records.
Scope and limitations. Assess the statutory definitions and exceptions. TRAIGA does not impose a universal annual independent AI audit requirement.
Official sources (checked October 29, 2026)
Related services: AI Agent Security Review · AI Architecture Review & Design
Jurisdiction: United States, California · Type: Law or regulation (state regulations) · Status: Partly applicable
Topics: Privacy, Automated decisions, Employment, Healthcare, Financial Services · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Covered businesses undertaking processing within the regulations' scope.
Summary. The final regulations address privacy risk assessments and automated decisionmaking technology (ADMT). ADMT includes technology that replaces or substantially replaces human decision-making. Significant decisions can include healthcare, employment, housing, education, and financial services. Coverage and exemptions must be assessed separately.
Key dates
What this means for your AI deployment. Examine the actual decision workflow, meaningful human involvement, notices, opt-outs, and access processes.
Evidence you may need. Applicability analysis, assessments, decision-flow diagrams, reviewer authority, and workflow tests.
Scope and limitations. These are not requirements for every AI system. The CCPA does not apply to medical information governed by California's Confidentiality of Medical Information Act, to protected health information collected by a HIPAA covered entity or business associate, or to personal information collected or processed under the federal Gramm-Leach-Bliley Act and certain other financial-privacy laws (Civil Code section 1798.145). Examine those exemptions for your data before relying on them. The same regulations also phase in cybersecurity audit duties, which this entry does not cover.
Official sources (checked October 29, 2026)
Related services: AI Vendor Assessment · AI Architecture Review & Design
Jurisdiction: United States, Colorado · Type: Law or regulation (state law) · Status: Adopted, future application
Topics: Automated decisions, Transparency, Employment, Healthcare · Last verified: October 29, 2026 · Last updated: October 29, 2026
Who it may affect. Developers and deployers of covered technology used in consequential decisions.
Summary. SB 26-189 replaces earlier Colorado AI provisions with requirements addressing developer information, consumer disclosures, correction and review processes, and records. Most duties apply to consequential decisions made on or after January 1, 2027. The Attorney General rulemaking provisions took effect on signing, with rules due on or before January 1, 2027.
Key dates
Enforcement note. The Attorney General enforces the act, with a 60-day cure period before January 1, 2030, and it creates no new private right of action. Colorado Legislative Council Staff's final fiscal note of September 8, 2026 reports that on April 27, 2026 a U.S. District Court ordered the Attorney General not to initiate enforcement of SB 24-205, or legislation amending it, until rulemaking is complete and the court rules in X.AI LLC v. Weiser. That reflects the fiscal note's date, not necessarily the current litigation position. On rulemaking, the Attorney General's office filed proposed rules on August 11, 2026, released an interim draft on October 6, 2026 and held a formal rulemaking hearing on October 26, 2026; its page did not show final rules as of October 29, 2026. Recheck final rules and court orders separately from the statutory start date.
What this means for your AI deployment. Establish scope, then review developer documentation, notices, correction requests, and human-review workflows.
Evidence you may need. Role and applicability records, vendor documentation, notices, and workflow-test results.
Scope and limitations. The core duties do not apply to a HIPAA covered entity, or its business associates for services rendered to it, to the extent it does business in Colorado, except for consequential decisions related to employment. For healthcare providers, the exemption applies only when operating from a Colorado location. Covered entities must still give patients a general notice of their use of advanced technologies, and make specified disclosures when covered technology decides financial-assistance eligibility. FDA-overseen medical devices are separately exempt. Read the specific provisions before concluding that a healthcare use is exempt.
Official sources (checked October 29, 2026)
Related services: AI Vendor Assessment · AI Architecture Review & Design
Medoya reviews AI agent behavior, vendor evidence, and architecture within an agreed technical scope. We document findings, limitations, and practical next steps so your team can decide what to change and what needs further review.
Select an entry to read its scope, dates, evidence examples, and official sources below.
United States, federal · Law or regulation · Adopted, future application
United States, California · Law or regulation · Partly applicable
United States, Colorado · Law or regulation · Adopted, future application
United States, federal · Law or regulation · Applicable
United States, federal · Law or regulation · Applicable
United States, California · Law or regulation · Applicable
United States, Texas · Law or regulation · Applicable