HIMSS Electronic Health Record Association (Leigh Burchell)

On behalf of the HIMSS Electronic Health Record Association, we appreciate the opportunity to respond to the Center for Devices and Radiological Health discussion paper on generative AI-enabled medical devices. Our comments are attached.

550 W Van Buren Street, Suite S1 110
Chicago, IL 606 07

@EHRAssociation | ehra.org

October 19, 2026

Dockets Management Staff
Food and Drug Administration
5630 Fishers Lane, Room 1061
Rockville, MD 20852

Re: Docket No. FDA-2026-N-7874, Considerations for the Regulation of Generative AI Enabled Medical
Devices: Discussion Paper and Request for Feedback

To whom it may concern,

On behalf of the HIMSS Electronic Health Record (EHR) Association, we appreciate the opportunity to
respond to the Center for Devices and Radiological Health discussion paper on generative AI-enabled
medical devices. Our member companies serve most hospitals, specialty, ambulatory, and post-acute
providers that use EHRs across the United States. Many of our members already build generative AI into
their products for documentation, summarization, and administrative work. Others are working with
clinicians and health systems to test new clinical uses.

We thank the U.S. Food and Drug Administration (FDA) for starting this discussion early and openly.
Congress has not set a national framework for AI in health care, and states have moved ahead with their
own laws. The FDA’s work here can bring some consistency.

Our main recommendation is simple: the FDA should align its approach with the decision support
intervention requirements that ASTP/ONC already enforces, so that, where multiple HHS agencies
regulate a feature, developers meet one set of expectations for that AI feature instead of several
overlapping ones. We address that point first and then respond to selected discussion questions.

Harmonization with ASTP/ONC Decision Support Intervention Requirements and Other Federal
Frameworks
Certified health IT developers already meet detailed transparency and risk management requirements
for AI under the ASTP/ONC HTI-1 Final Rule. The decision support interventions criterion at 45 CFR
170.315(b)(11) requires developers to give users source attribute information for predictive decision
support interventions. It also requires developers to apply intervention risk management practices
covering risk analysis, risk mitigation, and governance, and to make summary information about those
practices publicly available. Many of the transparency, monitoring, and documentation topics in the
FDA’s discussion paper cover the same ground.
When two agencies ask for the same information in different formats and under different definitions,
developers spend time on paperwork that does nothing for patient safety. Providers also get mixed
signals about what a given tool has been reviewed for. Clear, aligned rules make it easier for developers
to innovate and operate safely, and help keep clinicians and patients safe. We believe the FDA can fully
meet its goals for safety and effectiveness and still avoid adding duplicative obligations.

There is good precedent for this kind of coordination. The FDA, ONC, and FCC jointly developed the 2014
FDASIA Health IT Report, which set out a risk-based approach to health IT oversight. The 21st Century
Cures Act clarified the line between regulated device software and other health IT functions through
section 520(o). The FDA has also worked with Health Canada and the UK MHRA on shared Good
Machine Learning Practice and transparency principles for machine learning-enabled devices. We ask
the FDA to build on this record.

Timing also matters. ASTP/ONC is revisiting parts of the DSI requirements through HTI-5. It would create
real confusion if one agency scaled back AI transparency requirements while another added similar
requirements in a different format. We urge the FDA and ASTP/ONC to coordinate directly so that any
remaining transparency expectations are consistent across both agencies.

We also note the growing number of state AI laws, including those in Colorado, California, Texas, Utah,
and Illinois. Each sets its own disclosure, documentation, or risk assessment rules, often for the same
products. A consistent federal approach from the FDA and ASTP/ONC would give states a clear model to
follow and help limit this patchwork.

We recommend that the FDA allow one documentation artifact describing an AI feature to satisfy the
agency’s transparency expectations, the HTI-1 source attribute requirements, and recognized consensus
standards, rather than requiring separate versions for each. Where FDA expectations overlap with HTI-1
intervention risk management requirements, the FDA should treat HTI-1 compliance as meeting them or
clearly explain where it needs something more. The FDA should also use definitions consistent with
ASTP/ONC terms for predictive decision support interventions and publish a crosswalk showing how its
device software function categories relate to them. Finally, we ask the FDA to coordinate with
ASTP/ONC and CMS before issuing draft guidance and to invite public input on a joint approach.

Framing the FDA’s GenAI Regulatory Strategy
The Discussion Paper states that the “FDA does not regulate GenAI as such. It regulates medical devices,
including GenAI-enabled devices.” This critical point must remain front and center as the FDA develops
its GenAI regulatory strategy. Any framework or policy (including the FY 27 Under Construction guidance
“Risk Assessment and Evidentiary Considerations for Generative Artificial Intelligence-Enabled Devices”)
that results from this process must very clearly specify that it applies exclusively to GenAI-enabled
device software functions. As expressed above, harmonizing requirements and deliverables across
agencies where direct overlap exists is important. But maintaining the scope of authority is equally
critical to avoid unnecessary burden for developers and deployers alike.

For our member companies, clearly distinguishing between EHR-based administrative and decision
support software functions exempt from FDA authority under the 21st Century Cures Act and those that
qualify as a medical device remains a sizable challenge. That challenge is only exacerbated when GenAI
enters the picture.
As the FDA works to resolve this uncertainty, it must also fundamentally acknowledge that EHRs are the
foundation of how medicine is practiced in the United States today, and that integrating GenAI into
these systems is essential to continue improving both the clinician experience and overall delivery of
quality care to patients. Thus, the FDA must avoid imposing unnecessary regulatory burdens on new
tools that reduce administrative burdens and help clinicians deliver optimal care. This is particularly true
when those tools are already subject to authority under other agencies, like the ONC.

Question 2: Non-Directive Versus Action-Directing Outputs
We ask the FDA not to rely on subjective measures, such as how strongly an output directs a user
toward an action. Developers cannot measure that consistently, and reviewers would likely apply it
unevenly. Furthermore, clinicians are highly educated, capable professionals who are skilled at
evaluating the source and basis of clinical decision support outputs before acting, regardless of how
strongly those outputs are worded. Instead, the FDA should assess risk through three factors that
developers can document and test.

The first factor is clinical context. The same output carries different risks depending on where and how it
is used. For example, a summary of lab results reviewed during a routine outpatient follow-up differs
greatly from the same summary used to guide decisions for a patient in the ICU. Care setting, acuity, and
time pressure should all count.

The second factor is the intended user. Users differ in role, training, and experience. A tool used by an
experienced specialist presents different risks than the same tool used by a new clinician or by staff
outside their usual scope. Risk assessment should account for the intended user and the safeguards built
in for that user.

The third factor is intended use, as the developer states, including the workflow the function is designed
for and the review steps between the output and any action.

We recommend that the FDA use these factors to build a tiered approach to risk, and that it publishes
worked examples showing where common EHR functions fall. That would give developers the clarity and
predictability the question asks about.

Question 21: Shared Ecosystem Responsibility
Manufacturers should remain accountable for their products. To meet that responsibility, though, they
depend on health care organizations and end users to actively participate in post-market monitoring.
Developers often cannot see how a tool performs in a specific local setting unless the customer tells
them. When a problem first shows up at one site, early reporting lets the developer fix it before it
becomes a problem everywhere.

This shared responsibility only works when data sharing makes it possible. We ask the FDA to:

1. Recognize that deploying organizations have a role in reporting performance issues and
supporting local monitoring, without shifting the manufacturer’s core responsibilities onto
them.

2. Encourage simple, structured ways for users to report problems directly to developers.
 3. Clarify how developers and their customers can share performance and usage data for
monitoring purposes, consistent with HIPAA, including the use of de-identified data.

4. Align these expectations with the governance and risk management practices already required
under HTI-1, so organizations do not run separate monitoring programs for each agency in
instances where software is legitimately subject to dual authority.

Question 24: Third Party Foundation Model Changes
Most EHR developers that offer generative AI features build them on foundation models from a small
number of large companies. Those companies can change, update, or retire a model with little notice.
We agree that manufacturers need ways to detect and respond to these changes. Version pinning,
advance notice of changes and retirements, and access for evaluation are all helpful.

However, we caution the FDA against requiring specific contract terms. Smaller developers have far less
negotiation leverage with large model companies than larger developers do. A contract requirement
would put them at a real disadvantage and could reduce competition. It would also make developers
responsible for model behavior they cannot see or control.

We recommend that the FDA work directly with foundation model developers on notice and
transparency practices since they are best placed to provide that information. The FDA should also allow
predetermined change control plans to cover anticipated foundation model updates, with re-evaluation
proportionate to the expected impact of the change. Lastly, when a Certified Health IT Developer is
involved, the FDA should limit manufacturer responsibility to what a manufacturer can reasonably
observe, test, and control.

The EHR Association supports the FDA’s goal of a safe and effective path for generative AI in health care.
Close alignment with ASTP/ONC, CMS, and recognized standards will help developers innovate
responsibly and help providers and patients trust the tools they use. We welcome continued
engagement with FDA on this work and would be glad to serve as a resource.

Sincerely,

Leigh Burchell
Chair, EHR Association
Altera Digital Health
 HIMSS EHR Association Executive Committee

Kayla Frederickson Danielle Friend
Oracle Health Epic

Steve Holt, JD Michelle Knighton
PointClickCare NextGen Healthcare

Ida Mantashi Shari Medina, MD
Modernizing Medicine Harris Computer/MEDHOST

Established in 2004, the Electronic Health Record (EHR) Association is comprised of 27 companies that supply the vast majority of EHRs to physicians’ practices
and hospitals across the United States. The EHR Association operates on the premise that the rapid, widespread adoption of EHRs will help improve the quality of
patient care as well as the productivity and sustainability of the healthcare system as a key enabler of healthcare transformation. The EHR Association and its
members are committed to supporting safe healthcare delivery, fostering continued innovation, and operating with high integrity in the market for our users and
their patients and families. The EHR Association is a partner of HIMSS. For more information, visit www.ehra.org.