Part 170: Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing

• Authority: Department of Health and Human Services
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2024-02-08

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI system security vulnerabilities
• Overreliance and unsafe use

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on discrimination and fairness (1.1, 1.3), privacy (2.1), AI system transparency and robustness (7.3, 7.4), and governance structures. Coverage is concentrated in healthcare AI safety, fairness in clinical decision support, and technical standards for interoperability.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Professional & Technical Services
• Scientific Research & Development Services
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This regulation primarily governs the Health Care and Social Assistance sector, with specific focus on health information technology systems used in clinical settings. It also has implications for the Information sector (health IT developers) and Professional and Technical Services sector (IT consultants implementing these systems).

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation from the Department of Health and Human Services with mandatory compliance requirements, enforcement mechanisms, and legal authority under 42 U.S.C. 300jj-11 and 300jj-14. The document uses mandatory language throughout ('must', 'shall') and establishes certification requirements for health IT systems.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Department of Health and Human Services; Office of the National Coordinator for Health Information Technology (ONC)
• Summary: The document is a federal regulation issued by the Department of Health and Human Services, with the Secretary adopting certification criteria. The ONC is explicitly identified as the responsible office.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: health IT developers; Health IT Module developers; certified Health IT Module providers
• Summary: The regulation explicitly targets health IT developers who create and provide certified Health IT Modules, including those with Predictive Decision Support Interventions. These entities must comply with certification criteria and update requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Department of Health and Human Services; Office of the National Coordinator for Health Information Technology (ONC); The Secretary
• Summary: The Department of Health and Human Services, through the Secretary and ONC, has enforcement authority over the certification program and compliance with the established criteria.

Monitor

• Entity Types: AI_Governance_Actor, AI_Deployer
• Entities: Office of the National Coordinator for Health Information Technology (ONC); limited set of identified users
• Summary: The ONC oversees the certification program. The regulation also requires health IT systems to enable designated users to monitor intervention performance, validity, and fairness over time.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily focuses on the Deploy and Operate and Monitor stages of the AI lifecycle, with significant coverage of Verify and Validate. It establishes requirements for how Predictive Decision Support Interventions must be validated, deployed with appropriate documentation, and monitored for ongoing performance. There is some coverage of Build and Use Model through requirements for training data documentation and model development practices.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Predictive AI
• Task-specific AI

Technical Scope Summary

The document explicitly defines and covers Predictive Decision Support Interventions (Predictive DSI) as a specific type of AI system for healthcare. It also addresses evidence-based decision support interventions. The document focuses on task-specific AI for clinical decision support rather than general-purpose AI. There is no mention of compute thresholds, foundation models, or open-weight models.