Attachments Final Rule at OMB. A final rule, titled “Administrative Simplification: Adoption of Standards for Health Care Attachment Transactions and Electronic Signatures (CMS-0053)” is currently under review by the Office of Management and Budget (OMB). This regulation, developed by the Centers for Medicare & Medicaid Services (CMS), is expected to finalize new standards for health plans and providers to support both health care claims transactions, and standards for electronic signatures to be used in conjunction with health care attachment transactions. The rule will also address the outstanding requirements by the Health Insurance Portability and Accountability Act (HIPAA) and the Patient Protection and Affordable Care Act (ACA) to put in place a standard electronic transaction for the sending of attachments. The final rule was received by OMB on January 9. OMB typically has up to 90 days to complete its review, and this must be completed prior to the publication of the rule.

HHS Regulatory Changes to NPP for Part 2 Now in Effect. The regulatory changes to the Confidentiality of Substance Use Disorder (SUD) Patient Records regulations at 42 CFR part 2 (“Part 2”) made by Department of Health and Human Services (HHS) through the Substance Abuse and Mental Health Services Administration and the Office for Civil Rights are now in effect. The change requires updates to a HIPAA covered entities’ Notice of Privacy Practices (NPP) provided to patients. The NPP now must include information on how covered entities use and disclose SUD records from federally assisted treatment programs, per the scope of Part 2. The effective date for the alignment of HIPAA NPPs and Part 2 requirements is February 16, 2026. Additional information on exchanging Part 2 data is available here.

CMS Announces Major Health Plans’ Pledge to Join ACCESS. CMS announced that several major health plans pledged to adopt an outcomes-based payment structure aligned to then Medicare-focused Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model. The health plans that signed the pledge are Aetna CVS Health, Arkansas Blue Cross and Blue Shield, Blue Shield of California, Blue Cross and Blue Shield of Minnesota, Blue Cross Blue Shield of North Dakota, BlueCross BlueShield of Tennessee, CareFirst BlueCross BlueShield, Centene, Cigna, Devoted Health, Guidewell, Horizon Blue Cross Blue Shield of NJ, Humana, and UnitedHealthcare. The pledge brings alignment across Medicare, Medicaid, and commercial health plans around payments for technology-supported care that incentivize flexibility in care delivery, coordination with primary care and clinicians, measurable improvements in patient health outcomes. The ACCESS Model begins its 10-year performance period in July 2026 and the health plans under the ACCESS Payer Pledge committed to offering payment arrangements that align with core principles of the model by January 1, 2028.

RCE® Opens Application Process for TEFCA™ Participant/Subparticipant Caucus, Deadline March 3. The Trusted Exchange and Common Agreement™ (TEFCA™) Recognized Coordinating Entity® (RCE®), The Sequoia Project, opened the application process for Qualified Health Information Networks®, Participants, and Subparticipants to apply to be a voting member on the TEFCA Participant/Subparticipant Caucus. The Caucus is a forum for Participants and Subparticipants to discuss issues related to TEFCA Exchange and vote on amendments to Standard Operating Procedures, as outlined in the Common Agreement. The term on the Caucus is two years (April 1, 2026, through March 31, 2028). The deadline to apply is March 3.

FTC Issues Second Report to Congress on Ransomware and Cyberattacks. The Federal Trade Commission (FTC) issued 2025 Ransomware Report. This is the second report to Congress, as required by the Reporting Attacks from Nations Selected for Oversight and Monitoring Web Attacks and Ransomware from Enemies Act, detailing the agency’s efforts to fight ransomware and other cyberattacks. The report provides an update from its initial 2023 submission and discusses the FTC’s data security enforcement program aimed at ensuring companies take reasonable steps to protect the personal data they hold. Highlighted in the report are the more than 90 enforcement actions taken by the FTC. The agency also cited its efforts to educate the public and businesses on how to secure and protect data from cyberattacks.

OIG Releases Report on Top Management and Performance Challenges for HHS in 2025. HHS OIG released its annual report titled “Top Management & Performance Challenges Facing HHS” for 2025. For 2025, the top five top challenges were financial integrity, Medicare and Medicaid, public health, beneficiary safety, and cybersecurity. The report provides details of the challenges and examples of work completed to address them.

ASTP/ONC Hosting ONC Health IT Certification Program Developer Roundtable March 4. The Assistant Secretary for Technology Policy (ASTP)/Office of the National Coordinator for Health Information Technology (ONC) is hosting its next ONC Health Information Technology (IT) Program Developer Roundtable event on March 4. This public meeting is open to all health IT developers, regardless of their participation in the ONC Health IT Certification Program. The meeting will focus on topics of importance for the health IT developer community, including program updates, upcoming certification deadlines, and developer requirements. Go here to register for the Roundtable.

CMS Burden Reduction Conference Scheduled for February 25, 2026. CMS is holding its 2026 Burden Reduction Conference on February 25, 2026, from 9:00 a.m. to 1:00 p.m. ET. at the Hubert H. Humphrey Building in Washington, DC. A virtual option will be available for remote attendees. The in-person attendance will be limited due to space. The conference will continue the work of the 2023 and 2024 Optimizing Healthcare Delivery conferences. Change makers from the health care community and federal government are expected to be in attendance and share new ideas, lessons learned, and best practices aimed at increasing transparency, transforming chronic care, and empowering clinicians and patients. Registration is now open.