I spent 15 years building software for healthcare revenue cycle. One lesson from those years stuck with me: the customer who asks hard questions before signing gets a better product than the customer who waits for a regulator to ask them. On October 26, Washington made that lesson a lot more important.
What did HTI-5 change about AI transparency?
HHS finalized a rule called HTI-5 that eliminates 14 federal health IT certification criteria and revises seven more. HHS first proposed cutting 34 of the program's 60 criteria in December 2025, so the final version is narrower, but it still removed one requirement CFOs should care about: AI model cards.
Model cards came from the Biden-era HTI-1 rule. They required certified health IT developers to give health systems information about predictive algorithms and other decision-support tools built into their software: what the model was trained on, how it was tested, and where it might fall short. That requirement is gone. HHS projects $1.55 billion in regulatory savings and says developers can redirect those resources to better technology. Most provisions take effect 60 days after the rule's October 28 publication, and some take effect January 1, 2027. (Becker's)
Epic said on October 30 that it will keep giving customers its AI transparency documentation and evaluation tools anyway. (Becker's) That's good news for Epic customers. It's a voluntary choice by one vendor, though, and your stack has a lot more vendors in it than Epic.
Why did I expect the opposite?
In my RCM 2030 Operations companion guide, I wrote that Project 2025's emphasis on fraud and abuse made it clear that black-box AI would not fly, and that CFOs should expect a formal rule by the end of the decade requiring vendors to prove how their models make decisions.
I got half of that right. Project 2025 did signal a smaller federal footprint, and HTI-5 delivers it. What I got wrong was assuming the fraud-and-abuse focus would turn into transparency rules for AI vendors. So far, it hasn't. I'd rather tell you that plainly than pretend the forecast is on track.
Who is responsible for AI transparency now?
If the federal government isn't requiring it, the job falls to whoever buys the software. That's you.
The industry is still arguing about who should be on the hook. In comments to the FDA on regulating generative AI devices, the American Hospital Association, the American Medical Association and the American Telemedicine Association said developers, not providers, should be responsible for the safety and performance of those tools. The AMA added that a human reviewing AI output doesn't necessarily reduce the risk, because people can over-rely on the tool. WEDI asked the FDA for "nutrition labels" on AI tools, the same idea as model cards. (MedTech Dive)
Those are fair positions. But until a rule says otherwise, the only place a hospital can guarantee it gets this information is the contract.
There's another wrinkle. Vendors are adding AI features to software you approved years ago. Reid Health's CIO told Becker's the health system now requires those new AI features to go through their own review, even when the underlying product was already approved. (Becker's) If your contracts don't require notice when a vendor turns on AI, you may not know it's there.
What should hospital CFOs put in AI vendor contracts?
Here's the language I'd want in every new contract and renewal that touches AI, whether it's a coding tool, a denial predictor or a patient-facing assistant:
Model documentation on request. What the model does, what data trained it, how it was validated and known limitations. In other words, the model card, written into the contract instead of the regulation.
Notice before new AI features go live. A set number of days' warning before the vendor turns on AI in a product you already own, with the right to keep it off.
Performance reporting. Regular reports on accuracy and error rates in your environment, not the vendor's demo environment.
Change notices. Written notice when the underlying model changes, since a new model can change results overnight.
Responsibility for errors. Who pays when the tool gets it wrong, including denials, rework and compliance findings.
Data use limits. Whether the vendor can train on your data, and what happens to it when the contract ends.
None of this is legal advice; your counsel should draft the final language. But if a vendor won't put any of it in writing, that tells you something about how much they want you to see.
Then give the contracts teeth internally. An AI governance committee should review new AI tools and new AI features before they're turned on. Keep using the documentation vendors like Epic still provide. Ask your other vendors, in writing, whether they plan to keep providing theirs.
Why does the Cassidy AI payment bill matter to revenue cycle?
The same week HTI-5 landed, Sen. Bill Cassidy, who chairs the Senate HELP Committee, released a discussion draft of the PATIENT AI Act. It would create a coverage framework and payment methods for AI-based services, set up HCPCS Level II codes for them, have CMS's innovation center test a payment model for AI that delivers care on its own, and extend federal preemption of state product liability laws to software-based devices. (Becker's)
It's a discussion draft, so it may change a lot or go nowhere. But read it as a revenue cycle leader. Billing codes mean chargemaster entries, documentation requirements and, eventually, denials. Payers will want proof that an AI service was performed and was appropriate. Comments are due December 1 at patientai@help.senate.gov. Somebody who has worked a denial queue should be in that conversation.
What does AI transparency look like in 2030?
Here's my revised forecast. Federal certification won't force AI transparency by 2030. Contracts and payment will. Hospitals that negotiate hard will get real documentation and performance data. Hospitals that don't will get a glossy one-pager. And if AI services start getting billing codes, payers will start asking for documentation of how those services work, which may bring back a version of the model card through the payment door instead of the certification door. That last part is my guess, not a sure thing.
Either way, the work starts now: inventory where AI lives in your vendor stack, fix your contract language at the next renewal and send a comment by December 1.
If you want to know where your organization stands today, the RCM AI Readiness Scorecard walks through governance, coding and documentation, denial prevention and more, and only counts what's live, not what's planned. Grab it here: https://www.aprilwilson.net/resources/p/rcm-ai-readiness-scorecard
Sources: Becker's on HTI-5 · HTI-5 final rule (ONC) · Becker's on Epic transparency · MedTech Dive on FDA comments · Becker's on the Cassidy draft · Becker's on unauthorized AI
