CMS Announces Participants in GENEROUS Drug Payment Model. The Centers for Medicare & Medicaid Services (CMS) Innovation Center announced that all 50 states, the District of Columbia, and Puerto Rico have applied to participate in the GENErating cost Reductions fOr U.S. Medicaid (GENEROUS) Model. The model offers participants an initiative to provide discount pricing for certain prescription drugs to people with Medicaid. Forty states and Puerto Rico have already signed agreements. The projected cost saving from participating in the model is an estimated $5.2 billion annually. The model is also designed to improve quality of care and health outcomes by increasing access to critical medications and strengthening the Medicaid program overall. Participating manufacturers will make covered outpatient drugs available at discount pricing to participating state Medicaid programs. The GENEROUS Model launched in January 2026 and will run for five years.

CMS Publishes Findings from BPCI Advanced Model, Shows $800M in Net Savings. The CMS Innovation Center released the Final Evaluation Report for the Bundled Payments for Care Improvement Advanced (BPCI Advanced) Model. The report outlined the more than $800 million in net Medicare savings across eight model years. BPCI Advanced aimed to support providers in investing in practice innovation and care redesign to better coordinate care and reduce expenditures, while improving the quality of care for Medicare beneficiaries. The findings suggest that episode-based financial accountability can drive down spending while ensuring patients have a positive care experience. While BPCI Advanced did not meet the Innovation Center’s criteria for expansion, CMS is carrying forward key lessons from BPCI Advanced into the Transforming Episode Accountability Model (TEAM), which launched January 1, 2026. Outcomes from BPCI Advanced supported the Innovation Center’s effort to move people with Medicare into accountable care. 

Senate Bill Reintroduced to Strengthen Cybersecurity Standards for Health Care System. Sens. Mark Warner (D-VA) and Ron Wyden (D-OR) reintroduced the “Health Infrastructure Security and Accountability Act” to improve cybersecurity in the health care system. The bill seeks to address the growing number of cyberattacks that compromise health care information and disrupt access to health care services when they occur. If enacted, $1.3 billion would be made available to help hospitals strengthen their cybersecurity, including $800 million for hospitals in rural and underserved urban communities. The legislation would require covered entities to develop continuity plans describing how it would resolve a technology failure or intrusion, conduct annual cybersecurity tests, and undergo independent security audits. It would also increase fines for failure to meet security requirements and strength HHS oversight through required annual cybersecurity audits. Full text of the bill can be found here. 

Bipartisan Legislation Introduced to Protect Prior Authorization Coverage Decisions. Sens. Greg Landsman (D-OH) and Bob Onder (R-MO) introduced the bipartisan “Protecting Approved Care Act” that seeks to protect patients from Medicare Advantage (MA) insurance companies reversing coverage decisions or changing coverage after care was approved. If enacted, the MA plan would not be able to: (i) Deny coverage based on lack of medical necessity; (ii) Reopen the determination, except for good cause or fraud; or (iii) Change the billing code assigned to the claim to reduce payment except under limited exceptions. 

ONC Announces Next Health IT Certification Program Developer Roundtable. The Office of the National Coordinator for Health Information Technology (ONC) announced the next ONC Health IT Certification Program Developer Roundtable will be held on Wednesday, October 21, 2026. These public meetings are open to all health information technology (IT) developers, regardless of their participation in the ONC Health IT Certification Program. During these meetings, ONC leads discussions tailored for the health IT developer community on topics such as Certification Program updates, upcoming certification deadlines, and developer requirements. Registration is available at: ONC Events. 

NIST Announces Awards to Support Cybersecurity Workforce Development. The National Institute of Standards and Technology (NIST) announced awards of more than $1.7 million in cooperative agreements intended to support cybersecurity workforce development. The nine awards of up to $200,000 each will go to educational and community organizations in eight states to address the nation’s ongoing shortage of skilled cybersecurity professionals. The

selected organizations will lead Regional Alliances and Multistakeholder Partnerships to Stimulate Cybersecurity Education and Workforce Development (RAMPS program) initiatives aimed to align education and training with the workforce needs of local businesses and nonprofits.

CISA Updates Guidance on Detecting and Mitigating Active Directory Compromises. The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with international partners, updated joint guidance titled “Detecting and Mitigating Active Directory Compromises.” The guidance, last updated in January 2025, describes 17 common techniques that threat actors use to compromise Microsoft’s Active Directory. The updates identify new methods used to gain access to accounts in a Windows domain while evading detection. Because of the functionality of Active Directory, it poses risk to compromising the entire enterprise, allowing malicious actors to access systems, data, and business applications. CISA encourages identity and directory service administrators, security operations teams, and incident responders to review the recommendations and implement necessary mitigation techniques.

DataSpring Announces Transfer of CORE Operating Rules to X12. DataSpring, powered by CAQH, announced it has reached an agreement to transfer the Committee on Operating Rules for Information Exchange (CORE) Operating Rules and Certification Program to X12, the American National Standards Institute standards development organization. For over 20 years, CORE convened industry stakeholders to develop operating rules aimed at accelerating automation and streamlining administrative processes. CAQH transitioned earlier this year to DataSpring in an effort to focus on advisory support, insights, and applied research. Questions about the CORE Operating Rules and CORE Certification Program can be submitted to: operatingrules@x12.org.