HTI-5 Is Proposed. Does Your AI Agent Have an Identity?

Your AI agent touched a patient workflow last night. Maybe it summarized a chart. Maybe it routed a prior auth request. Maybe it recommended a next step to a clinician.

Now imagine a regulator asks a simple question: Who authorized that action?

Can your team answer confidently?

Healthcare organizations have spent the last two years racing to deploy AI. Ambient scribes, prior authorization copilots, intelligent intake systems, denial prediction engines, and workflow automation tools are moving from pilot programs into production environments faster than most governance models can follow. What started as experimentation is quickly becoming operational infrastructure. For many organizations, the choice of an artificial intelligence development company now carries as much operational weight as the technology itself.

At the same time, regulators are beginning to shift the conversation. HTI-5 is a proposed rule, released by ONC in December 2025, with a public comment period that closed in February 2026. No final rule has been issued as of this writing.

But as a policy signal, it’s significant: it would explicitly bring automated AI access and use of electronic health information into the information-blocking framework, while simultaneously proposing to remove many of the certification-era guardrails around authentication, audit controls, and AI transparency that organizations have relied on. That changes the stakes significantly.

The Governance Gap Is Becoming Operational Risk

The conversation isn’t just about whether AI can improve workflows or reduce administrative burden. It is increasingly about whether organizations can explain how AI participated in those workflows, what data informed those decisions, who approved the process, and what safeguards exist when something goes wrong. For many healthcare organizations, that’s where the real challenge begins.

Most AI initiatives were launched before governance models fully matured. Teams focused on proving value, accelerating implementation, and responding to executive pressure around AI adoption. In many cases, that meant deploying tools faster than organizations could establish operational guardrails around them.

Now those same systems are touching clinical documentation, utilization management, care coordination, patient engagement, coding workflows, and payer interactions. AI is no longer operating at the edge of healthcare operations. It’s becoming embedded directly into the workflows that drive care delivery and revenue operations.

Most organizations still cannot answer some foundational questions about the AI systems they have already deployed. Which AI systems are making recommendations? Which workflows are partially autonomous? Where are those decisions logged? Which model version generated the output? What happens if a recommendation is challenged? Can teams distinguish AI-generated actions from human actions inside audit trails?

Those gaps become especially important as AI systems integrate more deeply into EHRs, FHIR-based ecosystems, CDS Hooks workflows, and API-driven orchestration layers.

The Identity Problem Nobody Solved First

Identity management is a good example. Healthcare organizations already have mature identity and access controls for human users. They know how to manage clinician permissions, role-based access, authentication, and audit logging. But very few organizations have established the same standards for AI agents themselves. That creates operational blind spots quickly.

Does the AI system have scoped permissions? Can access be revoked immediately? Are downstream systems aware that an AI agent initiated a workflow? Are AI actions distinguishable from human actions in audit logs? If a recommendation triggers downstream operational or clinical activity, can teams reconstruct the chain of events later?

Many organizations simply are not structured to answer those questions yet. This becomes even more important as healthcare organizations move toward multi-agent orchestration, SMART on FHIR ecosystems, and AI-powered workflow automation that spans multiple systems and vendors.

Why Data and Workflow Design Still Matter

Healthcare AI doesn’t fail in clean, isolated ways. A model is rarely the sole point of failure. Problems often emerge from fragmented data, incomplete interoperability, weak workflow integration, or poor governance surrounding the AI system itself.

AI reliability depends on clean, contextual, interoperable data foundations. Fragmented EHR data, inconsistent mappings, and disconnected systems create unreliable AI outputs long before model quality becomes the issue.

This is one reason many healthcare AI projects remain stuck in proof-of-concept mode. The technology may function technically, but operational scalability becomes difficult when organizations cannot establish trust, traceability, or governance around the workflows the AI is influencing.

Workflow fit creates another major challenge. Many AI tools still operate outside the systems clinicians already use. Staff are forced to move between applications, review disconnected recommendations, or manually validate outputs without context. Adoption suffers quickly in those environments because clinicians don’t want more friction added to already overloaded workflows.

Pegasus One knows that successful healthcare AI must align directly with clinical and operational workflows, rather than functioning as disconnected automation layered on top of existing systems. That distinction matters because the direction of HTI-5 (regardless of when it is finalized) is toward operational accountability, not just technical capability.

Traditional security governance asks questions like: Who had access? Was the system secured? Were credentials managed appropriately? AI governance introduces a much broader operational requirement: How did this system influence decision-making, and under whose authority did it operate? That is a fundamentally different level of maturity.

An AI Governance Readiness Checklist

Healthcare organizations don’t need to solve every governance problem overnight. The proposed HTI-5 rule has no finalized enforcement date, but its direction is clear: the certification-era guardrails many organizations have relied on for authentication, audit controls, and AI transparency may not be there when they need them. The organizations that invest in the right AI development solutions and governance foundations now will scale AI more safely than those waiting for a final rule.

Inventory Every AI System Touching Clinical or Operational Workflows

Most healthcare organizations already have more AI in production than leadership realizes. Ambient documentation tools, denial prediction models, workflow automation, chatbot layers, embedded vendor copilots, and internal scripts often operate across disconnected teams with little centralized visibility.

Document every:

• AI copilot
• Workflow automation tool
• Embedded vendor AI feature
• Internally developed model
• Rules engine influencing decisions
• AI agent interacting with clinical or operational systems

If it influences healthcare workflows, it should be visible and governed. You cannot govern systems that your organization does not fully understand.

Establish Identity and Access Controls for AI Agents

Healthcare organizations already know how to manage identity for human users. The problem is that many AI systems still operate through vague service accounts, shared credentials, or loosely governed API access.

Every AI system should have:

• Scoped permissions
• Role-based access controls
• Revocable credentials
• Separate identities from human users
• Attributable activity logs

As AI agents begin triggering downstream workflows across EHRs, payer systems, and operational platforms, organizations need to know exactly which system initiated the action and under whose authority it operated.

Create End-to-End Audit Trails

One of the biggest operational risks with healthcare AI is the inability to reconstruct what happened after the fact. That becomes a serious problem during audits, patient complaints, payer disputes, or clinical investigations.

Your organization should be able to reconstruct:

• What the AI system did
• When it acted
• What data informed the output
• Which model version generated the response
• Whether a human reviewed or approved the action
• What downstream workflow occurred afterward

If an AI recommendation influences a clinical or operational workflow, teams need traceability. Without it, organizations are left defending decisions they cannot fully explain.

Define Human-in-the-Loop Governance

Not every workflow requires the same level of oversight. An AI-generated scheduling suggestion doesn’t carry the same operational risk as an AI-assisted clinical recommendation or utilization management workflow.

Organizations need clear rules around:

• When human review is required
• Which workflows can operate autonomously
• Escalation paths for exceptions
• Override authority
• Approval thresholds for higher-risk actions

Many healthcare organizations deployed AI before these governance boundaries were properly established. The direction of proposed regulation is toward operational accountability, not just technical experimentation.

Implement AI Change Management Procedures

Healthcare organizations already manage change control for infrastructure, security, and software releases. AI systems now require the same discipline.

Track:

• Model updates
• Prompt modifications
• Workflow changes
• Retraining events
• Integration changes
• Rollback procedures

Without structured change management, organizations risk introducing silent workflow changes that affect clinical or operational outcomes without clear oversight.

Validate Data Provenance and Quality

AI reliability depends heavily on the quality and consistency of the underlying data. Fragmented EHR records, inconsistent terminology mapping, and disconnected workflows create unreliable outputs long before model quality becomes the issue. Effective AI data analysis in healthcare requires normalized, interoperable data at the source, not just capable models at the output.

Organizations should evaluate:

• Normalized clinical data
• Terminology mapping
• Interoperability consistency
• Longitudinal patient context
• Accurate FHIR mappings
• Reliable source system integrations

Fragmented or poorly normalized healthcare data creates unreliable AI outputs long before model quality becomes the issue. This is one reason many healthcare AI projects remain stuck in proof-of-concept mode instead of scaling successfully into production.

Ensure AI Fits Into Existing Clinical WorkflowsEnsure AI Fits Into Existing Clinical Workflows

Many AI tools fail because they create operational friction instead of reducing it. Clinicians and operational teams don’t want disconnected recommendations living outside the systems they already use.

AI systems should operate inside existing workflows through:

• EHR integration
• SMART on FHIR compatibility
• CDS Hooks workflows
• Notification routing
• Operational escalation paths
• Workflow-aware user experiences

Disconnected AI tools create adoption problems quickly, even when the underlying technology performs well.

Define Governance Ownership Across Teams

One of the most common problems in healthcare AI is fragmented accountability. IT owns infrastructure. Compliance owns policy. Clinical teams own workflows. Security owns risk. Nobody fully owns the AI lifecycle itself.

Organizations need clear ownership around:

• AI deployment approval
• Compliance review
• Operational monitoring
• Incident escalation
• Rollback decisions
• Long-term model validation

Without clear ownership, governance tends to break down during real-world operational incidents.

Stress-Test Incident Response Scenarios

Healthcare organizations routinely stress-test cybersecurity incidents. AI systems now require similar operational planning.

Teams should ask:

• What happens if the AI generates an unsafe recommendation?
• What happens if data mappings fail?
• What happens if an integration breaks?
• Can affected workflows be isolated quickly?
• Can recommendations be audited after the fact?
• Is there a rollback process?

Operational resilience matters just as much as model accuracy, especially as AI systems become more deeply embedded into clinical and operational workflows.

Build for Interoperability and Traceability From Day One

AI systems become much harder to govern when they are layered onto fragmented architectures. Interoperability and traceability need to be foundational design decisions, not post-deployment fixes. Organizations scale AI more safely when systems are built on FHIR-native architectures, governed APIs, interoperable workflows, standardized data models, and traceable orchestration layers.

The organizations that prepare for governed AI infrastructure now will be in a far stronger position as the HTI-5 proposal moves toward finalization and broader healthcare AI regulation continues to evolve.

How Pegasus One Approaches This Differently

Pegasus One isn’t a generic machine learning development company offering off-the-shelf tools or disconnected pilots. As a healthcare-focused artificial intelligence services development partner, Pegasus One delivers the machine learning development services that healthcare technology organizations actually need: governed, interoperable, workflow-aligned AI systems built to survive production realities and regulatory scrutiny.

Rather than treating AI as an isolated feature layer, Pegasus One approaches healthcare AI as operational infrastructure. That means building FHIR-native architectures, governed workflows, interoperable data pipelines, and workflow-aligned AI systems that can survive production realities, regulatory scrutiny, and long-term scale.

Because ultimately, the hardest part of healthcare AI is rarely the model itself. The hard part is everything surrounding it: the orchestration, the workflow alignment, the governance, the interoperability, the auditability, and the operational accountability. The direction of proposed regulation is simply making that reality impossible to ignore.

The healthcare organizations that prepare now will be positioned to move faster and more confidently as AI adoption accelerates. The ones waiting for a final rule may find themselves scrambling to retrofit governance into systems that were never designed for accountable AI operations in the first place.