CMS Awards Contract to Develop National Provider Directory. The Centers for Medicare & Medicaid Services (CMS) awarded a 5-year contract of nearly $78 million to H1 Insights, Inc. to provide professional information technology services supporting the development of a National Provider Directory (NPD). The contract scope of work for H1 Insight includes supporting two core areas of the NPD initiative, which are Ground Truth Data Sourcing and Licensing, and Data Aggregation, Quality, and Assurance Services. H1 Insights is expected to assist CMS improve the completeness and reliability of provider records in the NPD by sourcing and licensing authoritative data, normalizing and validating it, and conducting data-quality assessment, enrichment, and correction activities.

OCR Releases Guidance on Part 2 SUD Patient Records. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) released guidance clarifying when the regulation on Confidentiality of Substance Use Disorder (SUD) Patient Records. The guidance outlines how 42 CFR part 2 (Part 2) permits a state Medicaid agency to use patient records protected under Part 2 to verify an exclusion from the community engagement requirement for Medicaid eligibility. OCR administers and enforces Part 2, which protects the privacy of certain SUD patient records and describes when and how Part 2 records may be used and disclosed. The guidance is expected to help state Medicaid agencies use information they already have to identify individuals who are excluded from the community engagement requirement, while continuing to protect the confidentiality of SUD patient records as required by Part 2. 

CDC Seeking Public Input on Strengthening Public Health Data Exchange and Data Intermediaries. The Centers for Disease Control and Prevention (CDC) released a request for information (RFI), titled “Data Intermediaries and Approaches to Strengthen Public Health Data Exchange.” The agency is seeking public input on how public health data intermediaries, such as health information exchanges, health data utilities, and qualified health information networks, could help health information flow more easily and securely across systems and organizations. The RFI also explores how data intermediaries can advance broader goals to prevent disease, detect emerging threats, drive state-of-the-art solutions that empower communities, and strengthen public health systems for a safer, healthier population. CDC intends to use the feedback received to inform approaches to making health data more accessible and usable, strengthening connections across public health and health care, and advancing secure, scalable, standards-based data exchange. Responses to the RFI are due by November 20, 2026.

CMS Invests in Health Outcomes for Medicaid Quality Measurement. CMS announced the launch of Investing in Health Outcomes, partnering with 37 states to focus on how quality is measured in Medicaid and the Children’s Health Insurance Program. The agency’s goal is to refocus quality measurement on health outcomes instead of processes and procedures. CMS and the participating states intend to prioritize measures that demonstrate meaningful improvements in prevention, chronic disease management, and behavioral health. A May 2026 analysis of Medicaid managed care programs across 42 states, conducted by CMS, found a wide variation measures for federal and state-specific quality reporting programs. CMS’ new effort is built around four principles: (i) Prioritize health outcomes over process, (ii) Streamline quality measure inventories, (iii) Advance digital quality measurement, and (iv) Align financial accountability with outcomes-oriented measures. CMS plans to hold workshops later this year focused on measure prioritization and value-based arrangements, reduced reporting burden, and digital quality measurement.

CMS’ Report States CJR Model Saved $180M. The CMS Innovation Center released the final evaluation report for the Comprehensive Care for Joint Replacement (CJR) Model statedthe model generated $180 million in Medicare savings while supporting care quality. To continue the CJR Model’s positive outcomes, the mandatory CJR Expanded (CJR-X) Model will start in 2028 with the goals of ongoing savings and improving joint replacement experiences for people with Medicare. The evaluation report found the CJR model demonstrated that episode-based payment models can both lower costs and maintain quality. Lessons learned from CJR model have been applied to the Transforming Episode Accountability Model (TEAM) Model.   

FBI Releases Cyber Strategy Roadmap Aimed at Defending the Nation’s Infrastructure. The Federal Bureau of Investigation (FBI) released a Cyber Strategy developed by its Cyber Division. The Strategy is a roadmap for defending the nation's critical infrastructure and focuses on four pillars: (i) Investigating and disrupting adversaries, (ii) Supporting victims, (iii) Increasing impact through partnerships, and (iv) Enhancing cyber capabilities. It also sets the course for the FBI Cyber Division and defines the priorities, objectives, and framework for countering malicious cyber activity directed at the United States.

CISA Releases Framework for Quality Era in CVE Program. The Cybersecurity & Infrastructure Security Agency (CISA) released a new white paper, “CVE Program: Establishing a Quality Era Framework.” The paper introduced four dimensions of quality and explains how they align with the six lines of effort outlined in “CISA's Strategic Focus on CVE Quality for a Cyber Secure Future” published last year. The Common Vulnerabilities and Exposures (CVE) Program is the global standard for vulnerability identification. With new pressures across the software development lifecycle, CISA recognized the need for a holistic maturation effort to transition the program from its growth period to a new Quality Era. This sets up the CVE Program to respond to the pressures and challenges facing the CVE ecosystem and to continue meeting the cybersecurity community’s needs. The framework’s four dimensions include: (i) Program governance, (ii) Ecosystem participation, (iii) Data infrastructure, and (iv) CVE record content. 

HRSA Announces Awards to Expand Access to Telehealth and Innovative Technologies. The Health Resources and Services Administration (HRSA) announced awards of approximately $19 million to expand access to health care through telehealth and technology-enabled learning. The awards were announced during Telehealth Awareness Week and will fund increased access to nutrition services, expanded use of emerging technologies, and strengthened health care workforces in rural and limited access communities. These awards build on HRSA’s leadership in telehealth and are part of HRSA’s broader telehealth portfolio of more than 3,600 awards associated with telehealth.