WEDI Submits Comment Letter to FDA on GenAI Medical Devices. WEDI submitted a comment letter to the Food and Drug Administration in response to the “Considerations for the Regulation of Generative AI-Enabled Medical Devices: Discussion Paper and Request for Feedback.” The stated intent of the discussion paper is to engage stakeholders on the challenges associated with generative artificial intelligence (GenAI)-enabled medical devices and ways to advance regulatory approaches for these devices. The FDA sought feedback on topics that included: (i) Assessment of risk; (ii) Premarket evaluation; (iii) Postmarket monitoring; and (iv) Other topics relevant to the regulation of GenAI-enabled medical devices. WEDI called for transparency of AI data sources, algorithm limitations, and bias mitigation. WEDI’s comments also focused on AI and the patient perspective, opportunities that AI offers health care providers, potential for bias in the data leveraged for AI, and other challenges AI presents for health care. 

CMS Publishes Proposed Rule to Implement REAL Health Providers Act of CAA. The Centers for Medicare & Medicaid Services (CMS) published the “Medicare Program; Implementation of Sections 6219, 6220, and 6224 of the Consolidated Appropriations Act, 2026” proposed rule. Section 6220 of the Consolidated Appropriations Act, 2026 (CAA), also known as the Requiring Enhanced and Accurate Lists of (REAL) Health Providers Act, mandates new provider directory accuracy and accountability requirements for Medicare Advantage (MA) organizations beginning in contract year 2028. The proposed rule, if finalized, would establish provider directory verification and maintenance standards, annual accuracy analysis and reporting, public reporting of accuracy scores, and cost sharing protections for enrollees who rely on inaccurate provider directory information. CMS also proposes to codify the statutory requirements for contract year 2029, including that CMS must publicly display provider directory accuracy scores in a machine-readable format and MA organizations must prominently display those scores in their provider directories.

CMS’ 2026 MVP Registration Open until November 30. The CMS 2026 Merit-based Incentive Payment System (MIPS) Value Pathways (MVP) registration window is open for the 2026 performance year. Clinicians, groups, and Advanced Payment Model Entities that want to participate must register. MVP participants may report traditional MIPS instead of, or in addition to, the MVP that was registered. Registration for MVP is available on the QPP website. More information is available in the QPP Access User Guide. 

OCR Calls for Input on HIPAA Privacy and Security Video. The Department of Health and Human Services (HHS) Office for Civil Rights (OCR) is calling for input on a pre-recorded video on the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. The agency announced that the speaker for the video will be Nicholas Heesters, OCR Senior Advisor for Cybersecurity. Topics expected to be covered in the video include: (i) HIPAA Privacy and Security Rules’ sanction requirements; (ii) OCR investigation findings of potential sanction violations; (iii) Sanction and related resources; and (iv) Responses to select submitted questions. The video is intended for HIPAA covered entities and business associates and will review the HIPAA Privacy and Security Rules’ sanction policy requirements. Suggestions for questions that could be addressed in the video are to be submitted to OCRPresents@hhs.gov by October 30, 2026.

AHRQ Launches Competition to Transform Health Care Evidence and Data. The Agency for Healthcare Research and Quality (AHRQ) announced the launch of its Super Intelligence (SI) for Healthcare Improvement Initiative, a two-part prize competition. The first part, the Clinical Evidence Synthesis Transformation Challenge, seeks to revolutionize the evaluation of medical evidence. Finalists will be judged on the submission’s transformative potential, including factors such as accuracy, throughput, reproducibility, usability, and ease of operation. Individuals, teams, and for-profit and nonprofit entities are invited to compete. AHRQ will hold an informational webinar on the SI Tech Sprint December 1, 2026. Phase 1 submissions for the Clinical Evidence Synthesis Transformation Challenge are due March 12, 2027, and SI Tech Sprint submissions are due September 9, 2027. The full timeline, competition details and webinar registration is available here.

CISA and FBI Release Joint Cybersecurity Advisory on SafePay Ransomware. The Cybersecurity and Infrastructure Security Administration (CISA), the FBI, U.S. Secret Service, and international partners released a joint Cybersecurity Advisory, #StopRansomware: SafePay Ransomware. The advisory details the SafePay ransomware activity, including known tactics, techniques and procedures, indicators of compromise, incident response actions, and mitigations to help organizations reduce the likelihood and impact of an incident. SafePay is one of the most active ransomware groups and has affected businesses and critical infrastructure globally since August 2024. SafePay threat actors gain initial access through a variety of means, including credential exposure, brute force password attacks, and exploiting virtual private network access. CISA recommends that organizations implement mitigations aligned to Cybersecurity Performance Goals 2.0, including patching and updating systems regularly; employing identity, credential, and access management policies; and restricting administrative tools and privileges to necessary users only.

NIST and CISA Release Voluntary Incident Response Practices. The National Institute of Standards and Technology (NIST) and CISA, in collaboration with the National Security Agency’s Super Intelligence Security Center, released the joint product “Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation.” The product is intended for organizations that train and evaluate highly capable SI agents. Ten voluntary practices are outlined for managing SI control incidents and align with best cybersecurity practices, as in the NIST cybersecurity framework. These practices identify considerations for managing SI control incidents involving increasingly capable SI agents.

ONC 2027 Annual Meeting Registration Now Open. Registration for the 2027 Office of the National Coordinator for Health Information Technology (ONC) Annual Meeting is now open. The meeting is being held in Washington, DC on February 3-4. Both onsite and virtual attendance are available and there is no cost to attend. Topics that will be highlighted include the Trusted Exchange Framework and Common Agreement™ (TEFCA®), SI, information blocking, and more.