WEDI Submits Comments on Digital Quality Measurement RFI. WEDI submitted comments to the Centers for Medicare & Medicaid Services (CMS) on the “Fast Healthcare Interoperability Resources^® (FHIR^®)-Based Digital Quality Measurement in the Quality Payment Program and Other CMS Quality Programs - Request for Information” (RFI) in the 2027 Medicare Physician Fee Schedule proposed rule. WEDI supported CMS' goal of moving toward standardized, interoperable, and more timely digital quality measurement based on the benefits of reducing manual abstraction, improving the reuse of data already generated in care delivery, supporting more timely quality improvement, and reducing the number of one-off reporting interfaces. To complement these benefits, WEDI advised CMS to implement coordinated changes to source data, measure logic, terminology, vendor products, aggregation, patient matching, attribution, governance, testing, submission, scoring, audit, and feedback workflows. In addition, WEDI urged CMS to not require FHIR-based reporting until objective readiness criteria are met and at least two end-to-end performance, submission, validation, and scoring cycles have been completed. Special thanks to Julie Brown-Georgi (AMA) and Michael Pattwell (Cotiviti), co-chairs of the WEDI Value-Based Care Workgroup, for their work on the letter.

OCR Announces HIPAA Breach Settlement with Provider. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced a settlement with a California-based lab testing provider for a potential Health Insurance Portability and Accountability Act (HIPAA) breach violation. The settlement resolves an investigation of a January 2020 email phishing attack that was reported to OCR in March 2020 in which an employee’s email account was compromised, and the protected health information (PHI) of 225,370 individuals was potentially exfiltrated. Affected PHI included names, addresses, dates of birth, some Social Security Numbers or driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, and treatment information.

OCR’s investigation found that the lab testing provider had potentially violated provisions of the Security Rule by failing to conduct an accurate and thorough risk analysis, failing to implement procedures for terminating access to PHI when it is no longer appropriate, and failing to assign a unique name or number for identifying and tracking user identity in systems containing PHI. Under the terms of the resolution agreement, the provider agreed to implement a corrective action plan that OCR will monitor for two years and agreed to pay OCR $700,000.

House Subcommittees Holds Hearing on Cybersecurity and Claims Data Bills. The U.S. House Committee on Energy and Commerce’s Subcommittee on Health, led by Rep. Brett Guthrie (R-KY), Chairman of the House Committee on Energy and Commerce, and Rep. Morgan Griffith (R-VA), Chairman of the Subcommittee on Health, held a hearing on a slate of bills, including two on cybersecurity and one on claims data. The “Health Care Cybersecurity and Resiliency Act of 2026” discussion draft would require the Secretary of HHS and Director of the Cybersecurity & Infrastructure Security Agency (CISA) to coordinate efforts to improve cybersecurity in the health care and public health sector, clarify cybersecurity responsibilities at HHS, direct HHS establish a cybersecurity incident response plan, update cybersecurity standards regulations, and issue guidance on rural cybersecurity readiness. The “Rural Hospital Cybersecurity Enhancement Act” (H.R. 9908) would require HHS to create a comprehensive workforce development strategy that addresses the need for cybersecurity professionals in rural hospitals and publish free materials to train staff on cybersecurity efforts. The “Access to Claims Data Act” (H.R. 4331) would require the HHS Secretary to establish a process under which certain clinical data registries can request claims data to conduct assessments of quality and clinical outcomes, in addition to quality improvement activities, to support research and quality improvement analyses. 

ONC Releases USCDI+ Quality Version 2. The Office of the National Coordinator for Health Information Technology (ONC) released US Core Data for Interoperability+ (USCDI+) Quality Version 2. This release builds on USCDI+ Quality Version 1 and Draft USCDI+ Quality Version 2, reflecting public feedback, coordination with federal partners, alignment with USCDI and US Core implementation guidance, and continued work to advance standardized data for digital quality measurement and reporting. USCDI+ Quality supports digital quality measurement by identifying standardized, interoperable data elements that can be used across quality programs.

ONC also released two related data element lists: (i) USCDI+ Quality v2, which focuses on data elements that are aligned with USCDI, are represented in relevant implementation guidance, or are necessary to calculate CMS electronic clinical quality measures; and (ii) Updated Quality Overarching, which tracks a broader set of quality-relevant data elements identified through program review, implementation guide analysis, and community input that may be considered for a future version of USCDI+ Quality or retained for reference and alignment purposes. ONC will continue coordinating with federal and industry partners on implementation of USCDI+ Quality v2 and monitor community feedback for future work. 

NIST and CISA Release Report on Protecting Identity Tokens. The National Institute of Standards and Technology (NIST) and CISA released an Interagency Report titled “Protecting Tokens and Assertions from Forgery, Theft, and Misuse: Implementation Recommendations for Agencies and Cloud Service Providers (CSPs).” The purpose of the report is to help federal agencies and CSPs safeguard the identity tokens and assertions that serve as the basis for single sign-on, federation, and application programming interface-based access. These systems are increasingly being targeted by cyber threat actors to infiltrate enterprise networks and access sensitive data. The report expands on NIST’s Special Publication 800-53 titled “Security and Privacy Controls for Information Systems and Organizations” and includes input from CISA’s ongoing work with CSPs. It also addresses recent high-profile attacks, emphasizes the importance of secure and configurable cloud services, and provides technical recommendations. Recommendations in the report apply to commercial and government-operated cloud services. 

CMS Releases List of Final Participants for Mandatory ASM. CMS released the final participant list for the mandatory Ambulatory Specialty Model (ASM) for the 2027 performance year. Provider specialists who frequently treat Medicare patients for low back pain or heart failure in an outpatient setting need to visit the ASM Participants webpage to see if they have been selected. All model requirements for the 2027 performance year must be met, including reporting the required measures and attestations. CMS will review the ASM requirements during the virtual ASM Participant September 2026 Office Hour on Wednesday, September 30 at 1 pm ET. 

CMS Expands Medical Conditions Eligible Under ACCESS Model. CMS expanded the number of medical conditions eligible in the disease management Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model starting in spring 2027. The medical conditions being added are heart failure, chronic obstructive pulmonary disease, substance use disorders, and nicotine dependence. The ACCESS Model is part of CMS’s efforts to modernize the nation’s digital health ecosystem and empower Medicare beneficiaries through greater access to innovative health technologies. It supports participating organizations in providing virtual care, health coaching, remote monitoring, and connected devices and wearables between regular doctor visits and is designed to integrate with the broader health care system. Currently, 160 organizations are participating in the ACCESS Model, and it is planned to run until 2035. 

CMS Planning for Investing in Health Outcomes Pledge. Stephanie Carlton, Deputy Administrator and Chief Clinical AI Officer at CMS spoke about the upcoming “Investing in Health Outcomes Pledge” during a Manatt webinar. With the Pledge, CMS’ goal is to move its quality reporting measures in the Medicaid program to mostly outcomes-focused measures with an emphasis on standardized and digital quality measures incorporating work from the National Committee on Quality Assurance and ONC. Work is underway on planning, education, and providing technical assistance to states. The implementation period is expected to begin in 2027.