HHS Leaders Featured at WEDI National Conference. The WEDI National Conference, held October 27-29 in Washington, D.C., featured multiple Department of Health and Human Services leaders updating attendees on the latest in federal health information technology (IT) initiatives.
Paula Stannard, Director of HHS Office for Civil Rights (OCR) outlined OCR’s vision for strengthening the privacy and security of health information alongside recent statistics and trends of data breaches. She also discussed the agency’s regulatory priorities, enforcement actions, and recently released guidance on Part 2 Substance Use Disorder patient records.
John Rancourt, Deputy Director of the Office of Standards, Certification, and Analysis, Office of the National Coordinator for Health Information Technology (ONC) and member of the WEDI Board of Directors, highlighted the progress made by the agency in supporting its priorities for data liquidity, access and affordability, and technology advancement. Rancourt walked attendees through the key provisions of the recently-released HTI-5 Final Rule (see below) and indicated the agency would HTI-6 in the near future. He also spoke to the evolving role of interoperability in clinical and administrative data exchange, the Trusted Exchange Framework and Common Agreement® (TEFCA®), and emerging technologies in meeting the data connectivity needs for patients, providers, payers, and the broader health care community.
Abe Sutton, Director, CMS Innovation Center, and Denny Brennan, Massachusetts Health Data Consortium and WEDI Chair-Elect, had an in-depth conversation on the Innovation Center’s strategy for advancing value-based care through innovative payment models, evidence-based prevention, and patient choice. Sutton spoke about the focus on costs and value that the can be demonstrated through the Center’s models and how that work continues to advance new models.
Dr. Shaney Halim, Director, Division of Policy, Standards & Interoperability Group, Office of Health Technology & Products, Centers for Medicare & Medicaid Services (CMS) and member of the WEDI Board of Directors, provided a deep dive into the claims attachments and digital signatures regulatory requirements. She outlined when the digital signature requirements apply and what payers, providers, clearinghouses, and technology vendors need to consider as they prepare for implementation.
ONC Publishes HTI-5 Final Rule. ONC published the “Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5)” Final Rule. The regulation finalizes a subset of the proposals made in the Notice of Proposed Rulemaking (NPRM). Included in the final rule are: (i) Removal of 14 and revision of 7 ONC Health Information Technology (IT) Certification Criteria; (ii) Removal of several transport, functional, content and exchange, application programming interface (API), and vocabulary standards; (iii) Revisions to the Base Electronic Health Record (EHR) definition; (iv) Removal of the Common Clinical Data Set term; (v) Revisions to the Conditions and Maintenance of Certification requirements; and (vi) Revisions to the Health IT Certification Program administrative requirements. The agency indicated that certain proposals included in the NPRM remain under review by ONC and may be finalized in future regulation, including additional Health IT Certification Criteria and information blocking requirements. ONC stated that the final rule advances administration initiatives to reduce health IT administrative burdens and is projected to save more than $1.5 billion in regulatory costs.
ONC Announces AHRQ-ONC ADT/Notifications Modernization Initiative at WEDI Conference. John Rancourt, Deputy Director, ONC and member of the WEDI Board of Directors, announced at WEDI’s National Conference the launch of the Agency for Healthcare Research and Quality (AHRQ)-ONC Admission, Discharge, and Transfer (ADT)/Notifications Modernization Initiative. The initiative was developed in response to industry input on current challenges and potential opportunities related to the ADT/Notifications data exchange. Opportunities for improvements to the process include the use of Fast Interoperability Healthcare Resources® (FHIR®) attribution and FHIR subscription services. The objectives of the initiative are to: (i) Create technical tooling to support the industry; (ii) Generate educational materials; and (iii) Conduct pilots among payers and providers to make notifications more computable, more usable, and less burdensome.
OCR Announces Ransomware Breach Settlement with Provider. OCR announced a settlement with a Pennsylvania health system for potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy, Security, and Breach Notification Rules. The settlement resolves an investigation of a February 2023 ransomware attack that was reported to OCR in May 2023 in which protected health information (PHI) of more than 248,000 individuals was exfiltrated and posted to the dark web. Affected PHI included names, addresses, dates of birth, Social Security Numbers, driver’s license numbers, financial information, diagnoses and conditions, lab results, medications, treatment information, and sensitive photographs of patients receiving treatment
OCR’s investigation found that the health system had potentially violated the HIPAA Privacy, Security, and Breach Notification Rules by failing to conduct an accurate and thorough risk analysis, failing to implement procedures for regularly reviewing records of information, and impermissibly disclosing PHI. Under the terms of the resolution agreement, the provider agreed to implement a three-year corrective action plan and to pay OCR $800,000. This settlement marks OCR’s 22nd ransomware enforcement action.
OMB Reviewing CIRCIA Final Rule. The Office of Management and Budget (OMB) is reviewing a final rule that will complete regulations to implement certain aspects of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CIRCIA directs the Cybersecurity and Infrastructure Security Agency (CISA) to develop and implement regulations requiring covered entities to submit reports to CISA on covered cyber incidents and ransom payments. CISA published the proposed rule on April 4, 2024, and a significant number of public comments were submitted. Many of the comments emphasized the need to reduce the scope and burden of the proposed reporting requirements, improve harmonization of CIRCIA with other federal cyber incident reporting requirements and clarify terms. Additional information about this rulemaking is available on the CISA website.
CISA Releases Strategy on National Cyber Defense and Critical Infrastructure Security. CISA released its new strategy, “CISA 2030: Defend, Harden, Prevail,” to strengthen the security and resilience of the nation’s critical infrastructure. The goal of the strategy is to address the current complex threat environment, strengthen national cyber defense, and prioritize the infrastructure to support national security, economy, public health, and safety. The strategy calls for organizations to identify, disrupt, and eliminate emerging threats through the three pillars of defend, harden, and prevail. The strategy sets out CISA’s priorities for the coming year to: (i) Begin reviewing core services and capabilities to meet key objectives within 60 days; (ii) Provide a plan to implement the strategy and measure its results within 180 days; and (iii) Report on the progress in carrying out the strategy within 365 days
CISA Issues Alert on Critical Vulnerabilities in PHP. CISA issued an alert strongly urging organizations to immediately patch the recently disclosed critical vulnerabilities in Hypertext Preprocessor (PHP), CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as “php2shell,” allow for unauthenticated remote code execution in PHP and affect all PHP installations serving web requests. Organizations are urged to update their current software to fix vulnerabilities that pose a risk if left unpatched. Actions to mitigate this threat include identifying the systems running any version of PHP, applying the patch immediately, prioritizing internet-facing systems, and monitoring for suspicious activity.
X12 to Hold Webinar on HIPAA Version 008060 275 Claims Attachment Transaction. X12 will hold a webinar on Tuesday, November 10 at 2 pm ET on the 008060 version Additional Information to Support a Health Care Claim or Encounter (275). The session is part of X12’s education/information series on the 008060 version transactions. Registration is now open. Additional webinars and on-demand presentations will be offered in the future. Questions about the 008060 education/information series can be submitted via the X12 feedback form.