CMS’ Amy Gleason Addresses WEDI Town Hall, Calls for Patient-Focused Action. Amy Gleason, Administrator, U.S. DOGE and Deputy Administrator and Chief Product Officer of Office of Health Technology and Products, Centers for Medicare & Medicaid Services (CMS), addressed the recent WEDI Town Hall, a WEDI-Members only event. Ms. Gleason highlighted several patient-centered initiatives underway in the CMS Health Tech Ecosystem, part of the overall effort to move from digitizing data to interoperable data flow. She outlined several agency initiatives, including the Medicare App Library, Kill the Clipboard initiative, conversational artificial intelligence, and diabetes care management. Ms. Gleason spoke about her personal experience as a mother of a child with chronic health issues and the success of using a QR code at three of her daughter’s providers. She emphasized that a priority of the Ecosystem initiatives is getting patients involved in the use of their health data to improve their care. Questions from attendees generated discussion about voluntary actions vs. regulatory requirements, the expected release of several key regulations, and the implementation status of the electronic prior authorization and access APIs, and the clear need for trading partners to test all new standards.

Ms. Gleason’s address was followed by a reaction panel of industry experts. Moderated by WEDI Board Chair Merri-Lee Stine, the panelists included Denny Brennan (WEDI Board Chair-Elect, Massachusetts Health Data Consortium), Muhammed Chebli (NextGen), Steven Johnson (WEDI Board member, HCSC), and Andrea Preisler (American Hospital Association). They discussed their organization’s perspectives and priorities related to Administrator Gleason’s remarks. The panelists also stressed the importance of building trust among industry partners, using existing standards to advance solutions, putting the patient at the center of the work, and demonstrating clear value in the work being done to drive stakeholder adoption. 

CMS Releases 2025 MIPS Performance Feedback and Final Scores. CMS released the Merit-based Incentive Payment System (MIPS) performance feedback and final scores for the 2025 performance year. The 2025 final score determines the payment adjustment qualified providers will receive in 2027. The performance feedback and scores are available on the Quality Payment Program (QPP) website. Practice representatives can access individual group feedback for review. Resources are also available to assist in reviewing the feedback, including 2025 MIPS Performance Feedback FAQs for Small Practices (PDF), 2025 MIPS Performance Feedback FAQs (PDF), and 2025 MIPS Performance Feedback Supplemental Reports Guide (PDF) 

Clinicians, designated staff, and authorized third-party intermediaries may request that CMS review their MIPS final scores through a process called “targeted review.” The targeted review period opens with the release of final scores and will close 30 days after the release of MIPS payment adjustments. A targeted review can be requested, via the QPP website, if there is believed to be an error in the calculation of the MIPS final score. The 2025 Targeted Review User Guide (PDF) outlines the process for requesting a targeted review and examples for requesting a targeted review.

ONC Publishes Data Brief on Availability of RTPB Information Among U.S. Hospitals. The Office of the National Coordinator for Health Information Technology (ONC) published a data brief titled “Availability of Real-Time Prescription Benefit Information Among U.S. Hospitals” that provides an analysis of the availability of Real-Time Prescription Benefits (RTPB) information by hospitals. The analysis found that in 2025, 55% of U.S. hospitals reported RTPB information availability across all or almost all payers, 20% reported availability for a limited set of payers, and 25% reported no or unknown availability. RTPB information provides patient-specific prescription benefit, formulary, and cost information within the electronic health record (EHR) at the point of prescribing and has the potential to reduce health care costs and provide patients with information at the point of care to make informed decisions.

Other findings include that: (i) RTPB information availability across all or almost all payers was lower among smaller, rural, critical access, and independent hospitals; (ii) Hospitals using the market-leading EHR developer were substantially more likely to report RTPB information availability across all or almost all payers than hospitals using other large or smaller EHR developers; and (iii) RTPB information availability across all or almost all payers was higher among fully interoperable hospitals than among hospitals that were not fully interoperable (69% vs. 42%). Starting in 2028, the ONC certification program will require EHRs to support RTPB.

ONC Releases Expanded Test Suite for eRx and RTPB Certification. ONC released an updated Electronic Prescribing (eRx) Test Suite. Developers preparing to certify products to the eRx criterion and RTPB criterion can now begin testing against the latest National Council for Prescription Drug Programs (NCPDP) standards. The updated eRx Test Suite now supports the NCPDP SCRIPT Standard Version 2023011 and NCPDP Real-Time Prescription Benefit Version 13. This release gives developers an early opportunity to test and identify potential issues for the 2028 certification deadline. 

NIST Introduces Small Business Cybersecurity Support Tool. The National Institute of Standards and Technology (NIST) introduced the Small Business Cybersecurity Support Programs Finder tool to assist small businesses and entities locate cybersecurity programs. The programs are hosted by non-profit institutions that have dedicated services helping their region’s small business community proactively manage cybersecurity risks. Resources include conducting risk assessments and penetration tests, compliance services, and helping with preparedness and response measures. The tool is provided by NIST as a public service. 

FBI and CISA Issue Warning of Threats from Automated and Hands-On Tools. The Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency (CISA), along with the National Security Agency and international partners released a joint Cybersecurity Advisory “Chinese Government-linked Cyber Threat Actors Combine Automated and Hands-on Hacking Tools to Steal Sensitive Data.” The advisory details malicious cyber activity enabled a China-based company targeting organizations around the globe. Organizations being targeted include government services and facilities, critical manufacturing, health care and public health, information technology, law enforcement, education, and religious organizations. The threat actors use a combination of exploitation tools to infiltrate networks and exfiltrate sensitive data. CISA has added five Common Vulnerabilities and Exposures to the Known Exploited Vulnerabilities Catalog (KEV) based on this activity. Organizations are encourage to read the full advisory and use available resources, such as CISA’s Eviction Strategies Tool and Internet Exposure Reduction Guidance. 

CISA Updates Guidance on Detecting and Mitigating Active Directory Compromises. CISA, in collaboration with international partners, updated joint guidance titled “Detecting and Mitigating Active Directory Compromises.” The guidance, last updated in January 2025, describes 17 common techniques that threat actors use to compromise Microsoft’s Active Directory. The updates identify new methods threat actors use to gain access to accounts in a Windows domain while evading detection. Due to the functionality of Active Directory, it poses risk to compromising the entire enterprise, allowing malicious actors to access systems, data, and business applications. CISA encourages identity and directory service administrators, security operations teams, and incident responders to review the recommendations and implement necessary mitigation techniques.

Provider Data Collective Launched by DataSpring to Improve Provider Directories. Several health care organizations, working with DataSpring, powered by CAQH, launched the Provider Data Collective (“Collective”) with the goal of improving the accuracy and reliability of provider directory data. The organizations participating in the Collective include Aetna, the American Medical Association, Centene, The Cigna Group, DataSpring, Elevance Health, Horizon Healthcare Services, Inc., Humana, the National Committee for Quality Assurance (NCQA), and UnitedHealth Group. The announcement of the Collective included the release of “Provider Data Quality Measurement: Standard for the Evaluation of Individual Clinician Data in Provider Directories” described by DataSpring as a measurement framework solution designed to evaluate the collection of data for use in provider directories.