WEDI Issues Recommendations to CMS on QHP Directory Pilot. WEDI submitted its Member Position Advisory (MPA) report, done at the request of the Centers for Medicare & Medicaid Services (CMS), on the CMS Qualified Health Plan (QHP) Directory Pilot underway in Oklahoma. WEDI’s MPA process is designed to collect feedback from its members on critical health care issues as part of its advisory role to the Department of Health and Human Services (HHS). The “WEDI MPA Report: CMS QHP Directory Pilot” highlighted the broad stakeholder input WEDI members provided during a live event on topics that included data accuracy, data exchange, data architecture, consumer value, user experience, provider burden, and scalability of provider directories.

Several overarching recommendations were identified in the Report for CMS to consider in its future work on provider directory initiatives. These included: (i) Ensuring consumer, patient, and caregiver needs are fully met; (ii) Focusing on the reusability, quality, and transparency of data; (iii) Reducing the administrative burden providers face in populating directories; (iv) Ensuring the accuracy of provider information; (v) Developing a strategic approach for future directory solutions; and (vi) Replacing fragmented data reporting with a flexible, interoperable framework that can evolve to meet future needs. Special thanks to the MPA facilitators and attendees.

CMS Publishes Transparency in Coverage Final Rules. CMS, in partnership with the Departments of Labor and the Treasury, published the Transparency in Coverage final rules in the Federal Register. These final rules build on the 2020 health care price transparency rules and seek to improve the underlying health care pricing data by reducing duplicative and unnecessary information, providing more context about in-network prices, increasing available out-of-network pricing information, and strengthening accountability for the completeness and accuracy of published data. The rules also require group health plans and health insurance issuers to provide consumers with personalized cost-sharing information by phone, in addition to existing online tools. The stated goal of these rules is to assist technology developers build better consumer tools, give consumers more reliable information when comparing costs before receiving care, and enable employers and researchers to better analyze health care markets. The CMS Fact Sheet on the final rules is available here.

OCR Announces HIPAA Privacy Rule $140,000 Settlement with Provider. The HHS Office for Civil Rights (OCR) announced a settlement with a Pennsylvania provider for a potential Health Insurance Portability and Accountability Act (HIPAA) privacy violation. The settlement resolves an investigation of a complaint alleging a failure to provide timely access to an individual’s protected health information (PHI) despite multiple requests, and the fact that the record was stolen by a staff member. OCR’s investigation determined that the provider failed to implement policies and procedures to comply with the Privacy and Breach Notification Rules. Under the terms of the resolution agreement, the provider agreed to pay OCR $140,000. 

Senate Passes Legislation to Strengthen Health Care Cybersecurity. The Senate passed the bipartisan “Health Care Cybersecurity and Resilience Act” (S.3315). The legislation was introduced by Bill Cassidy, M.D. (R-LA), Chairman of the Senate Health, Education, Labor, and Pensions Committee, and co-sponsored by Sens. Maggie Hassan (D-NH), John Cornyn (R-TX), Mark Warner (D-VA), Cindy Hyde-Smith (R-MS), and Angus King (I-ME). The bill calls for expanded federal requirements and resources for preventing and responding to cybersecurity incidents in the health care and public health sectors. If enacted, HHS would be required to issue policies that: (i) Require private health care-related entities to adopt minimum cybersecurity practices; (ii) Identify standards for mitigating penalties relating to violations of health information privacy and security; (iii) Expand and update cybersecurity protocols for HHS personnel; (iv) Provide training and best practices to support the expansion of the workforce for health care cybersecurity; (v) Provide guidance on cybersecurity readiness to rural entities; and (vi) Designate a representative to lead the oversight and coordination of cybersecurity activities within HHS. 

CMS and NCHS Request Comments on Fall 2026 ICD-10 Code Proposals. CMS has posted the Fall 2026 ICD-10-PCS procedure code topic materials and is soliciting public comments on any clinical questions or coding options consistent with the approach used since the Spring 2025 Update and as of March 2021 for the procedure code requests that involve a new technology add-on payment application for the administration of a therapeutic agent. The update materials, slide presentations, and recordings for the CMS procedure code portion of the Fall 2026 ICD-10 Coordination and Maintenance Committee Update are available for review.

Separately, the proposals for the Centers for Disease Control and Prevention’s National Center for Health Statistics (NCHS) diagnosis code topics are available for review. October 16, 2026, is the deadline to submit comments on proposed new codes, addenda, and revisions being considered for implementation on April 1, 2027. November 13, 2026, is the deadline to submit comments on proposed new codes, addenda, and revisions being considered for implementation on October 1, 2027. Comments on procedure code topics should be directed to CMS at ICDProcedureCodeRequest@cms.hhs.gov and comments on diagnosis code topics should be directed to NCHS at nchsicd10cm@cdc.gov.

 ONC’s CHPL Attestation Submissions Now Open. The Office of the National Coordinator for Health Information Technology’s (ONC) second 2026 attestations submission window opened October 1, 2026. Certified Health Information Technology (IT) developers are now able to submit their attestations to their ONC-Authorized Certification Body (ONC-ACB) for review using the Certified Health IT Product List (CHPL) through October 31, 2026. More information is available in the Certification Program’s Attestations Resource Guide. Questions about the Attestations requirements or CHPL registration should be directed to the developer’s ONC-ACB.  

ONC Announces 2026 LEAP in Health IT Awardees. ONC announced two awards totaling $1.5 million under the Leading Edge Acceleration Projects in Health Information Technology (LEAP in Health IT) funding opportunity. The award recipient in the category of agentic AI solutions is Medstar Health Research Institute for its “Sovereign Execution: Vigilant, Gated and Verifiable Agentic Care” project. In this project, they are seeking to move the health care ecosystem beyond passive patient data access and into vigilant, gated, and verifiable agentic care orchestration, giving patients sovereign control over the AI executing their care. The awardee in the category of laboratory interoperability gaps is Regenstrief Institute, Inc. Their project, “A Readiness-to-Remediation Toolkit for Standardized Laboratory Terminology Adoption in Small, Independent Laboratories” seeks to recruit at least three representative small, independent laboratories and guide each through a structured and scalable implementation framework that progresses from readiness assessment to data quality assessment, targeted terminology data quality improvement, implementation validation, and long-term sustainability. 

CISA and FBI Release Fact Sheet on Reducing Risk with Third-Party ICS Integrators. The Cybersecurity & Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) released a fact sheet, “Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators,” to assist critical infrastructure (CI) organizations work with their third-party industrial control systems (ICS) integrators to establish secure practices and frameworks that protect the operational environment. Third-party ICS integrators provide various services that support CI organizations, and CI organizations should apply the principle of least privilege within their operational environments to help ensure that integrators can complete their assigned tasks while reducing the risk of threat actors exploiting third-party access to compromise equipment and critical functions. Key recommendations in the fact sheet include: (i) Prepare contracts and service agreements that include cybersecurity and supply chain cybersecurity; (ii) Evaluate devices with external internet exposure; (iii) Ensure integrators access equipment through routes the organization is able to monitor; (iv) Request an inventory of all software and hardware supplied by the integrator; and (v) Practice procedures and maintain capabilities for manual operations.