Digital Health and AI: Key Regulatory, Reimbursement and Policy Developments

Key Takeaways

• As AI becomes more entrenched in healthcare delivery, federal policy is beginning to evolve with it. CMS is considering how Medicare payments should account for AI-enabled care, has created an interim payment pathway for certain qualifying software-based diagnostic services and has expressly recognized potential uses of AI in Medicare Annual Wellness Visits and other clinical workflows. At the same time, pending legislation, including the PATIENT AI Act and Doctors Not AI Act, reflects growing congressional attention to AI reimbursement, regulatory oversight, privacy and security, and the appropriate role of human decision-making.
• Healthcare organizations should expect greater responsibility for AI governance and oversight. CMS's new MIPS AI Improvement Activity provides MIPS credit to organizations for maintaining policies governing the evaluation, deployment and monitoring of AI, even as the ONC has scaled back certain standardized AI transparency and risk management requirements for certified health IT in the HTI-5 rule. Together, these developments reinforce the importance of organizations' own AI governance, vendor diligence, contracting and post-deployment monitoring as AI use expands.
• Liability for patient harm involving AI is coming into sharper focus. The AMA's new framework would allocate responsibility among clinicians, AI developers and deploying healthcare organizations based on each party's authority, access to information and ability to control or mitigate the relevant risk. Notably, the framework rejects the assumption that simply keeping a physician "in the loop" necessarily shifts responsibility away from developers or health systems, which could influence AI contracting, governance and future malpractice and product liability arguments.

Healthcare organizations continue to face a rapidly evolving landscape for the payment, deployment and governance of digital health and artificial intelligence (AI) technologies. In the past week alone, the Centers for Medicare & Medicaid Services (CMS) finalized both the 2027 Hospital Outpatient Prospective Payment System (OPPS) and Medicare Physician Fee Schedule (MPFS) rules. The Office of the National Coordinator for Health Information Technology (ONC) also recently streamlined portions of the federal health IT certification framework, and the Office for Civil Rights (OCR) issued a new Health Insurance Portability and Accountability Act (HIPAA) cybersecurity newsletter (Newsletter). The American Medical Association (AMA) entered the debate over AI use in healthcare by releasing a clinical AI liability framework, while recently introduced legislation and a Senate discussion draft signal increasing federal attention to the use of AI in healthcare.

OPPS: CMS Recognizes Software as a Medical Service for Payment Purposes

In the Calendar Year 2027 OPPS final rule, CMS continued its recognition of the evolving role of software-based technologies in clinical diagnosis and decision-making. Specifically, CMS coined the term "Software as a Medical Service" (SaMS) to describe software-based technologies that support clinical decision-making through algorithmic analysis, including technologies that provide clinical diagnostic functionality. These technologies include clinical decision-support software, clinical risk modeling tools, and computer-aided detection technologies that analyze diagnostic images or use complex algorithms and predictive modeling to assist with diagnosis and treatment planning. CMS's terminology change is intended to distinguish these medical-function technologies from general cloud-based Software as a Service products and other digital health tools, such as remote patient monitoring and prescription digital therapeutics.

Interim OPPS Payment for SaMS. To address the challenges of reimbursing rapidly evolving SaMS technologies, CMS finalized an interim policy assigning qualifying SaMS services to New Technology Ambulatory Payment Classifications (APCs). New Technology APCs are temporary payment classifications used for new services for which CMS has insufficient claims and cost data to establish a permanent clinical APC assignment. CMS also established a new status indicator, O1, identifying SaMS services eligible for separate payment under the OPPS. The interim approach is intended to recognize the costs associated with these technologies while CMS develops a longer-term reimbursement framework. Importantly, the policy does not establish a general entitlement to separate payment for all AI-enabled or software-based clinical tools; payment remains dependent on the applicable service and coding requirements.

Algorithmic Analyses of Laboratory Data. CMS also finalized a separate payment pathway for certain stand-alone algorithmic analyses performed on data from previously completed laboratory tests, including secondary analyses of genomic sequencing results. These services will be treated as "other diagnostic tests" payable under the OPPS rather than as clinical diagnostic laboratory tests under the Clinical Laboratory Fee Schedule (CLFS). CMS will assign qualifying services to New Technology APCs, with payment rates aligned with the corresponding CY 2026 CLFS rates. This change is particularly relevant to companies developing proprietary genomic and other laboratory data analytics, as well as to hospitals seeking to offer these services. It also recognizes that the clinical value of diagnostic information may arise from subsequent algorithmic analysis of existing laboratory data rather than only from the original laboratory test.

Taken together, these policies reflect CMS's recognition that traditional Medicare payment categories may not adequately account for emerging software-based diagnostic services. Although the final rule does not establish a comprehensive reimbursement framework for SaMS, it creates distinct interim payment pathways for qualifying technologies and provides a basis for further development of Medicare payment policy in this area.

MPFS: AI-Enabled Care, Remote Monitoring, Telehealth and Digital Quality

Technology also featured prominently in the MPFS. Although CMS did not establish a new AI-specific payment pathway, the final rule reflects increasing attention to how technology may affect physician work, practice resources, care delivery and quality measurement.

AI and Technology-Enabled Care. CMS acknowledged that advances in technology, including generative and agentic AI, are poised to transform the patient experience and the role of clinicians but have not previously been taken into consideration when defining relative value units and the time and intensity of physician services. Accordingly, the MPFS includes a Request for Information (RFI) seeking industry input on the payment implications of technology-enabled primary care and how Medicare payment methodologies might be updated to account for the impact of technology and clinical AI on beneficiaries and clinicians.

The final rule also discusses responses to CMS's earlier RFI on AI's impact on healthcare delivery. CMS noted that AI adoption in primary care currently focuses largely on reducing administrative burdens and supporting clinical decision-making. AI documentation tools, such as ambient scribes, are among the most widely adopted, with an estimated 25 percent penetration among U.S. physicians according to CMS. CMS also identified OpenEvidence as likely the most widely used AI tool in primary care, noting that more than 40 percent of U.S. physicians had self-reported using the application, which allows clinicians to ask clinical questions and receive answers based on peer-reviewed journals and guidelines. Although AI-assisted care delivery agents have been deployed in some health systems, CMS does not believe they have yet achieved widespread use.

CMS also reported that many commenters expressed skepticism about AI in healthcare, citing concerns about current AI models and urging CMS to ensure that any AI-enabled care for which Medicare pays demonstrates proven clinical value. Nevertheless, commenters broadly supported AI tools that help clinicians synthesize longitudinal patient information, identify screening and vaccination gaps, flag risk factors, and generate clinically meaningful summaries from health assessments, prior visits, wearable data and test results. CMS also highlighted the value of automating repetitive, nonclinical tasks, such as questionnaire administration and documentation, to allow clinicians to focus more on patient interaction, care planning and shared decision-making. CMS indicated that it would consider this feedback in future rulemaking.

AI and the Medicare Annual Wellness Visit (AWV). CMS also addressed how AI and other technology may support Medicare AWVs, while emphasizing that the AWV must continue to be performed by a physician or other health professional and that clinicians must retain responsibility for clinical decisions. CMS clarified that AI may support several components of the AWV, including administering the Health Risk Assessment, extracting medical history and provider information from the electronic medical record, reconciling medications for clinician verification, summarizing clinical information, administering clinician-selected depression screening instruments and asking functional ability screening questions for clinician review. CMS noted, however, that it was not aware of how AI could be used to conduct a cognitive assessment under the current regulatory standard.

CMS indicated that AI may also assist in drafting a personalized prevention plan, including individualized health advice and referrals, for clinician review and approval. AI could also be used to prompt discussions about advance directives, future care decisions and caregiver identification to support an advance care planning discussion as part of the AWV. CMS emphasized that software applications provided to beneficiaries to support implementation of a prevention plan must not constitute the practice of medicine or replace the beneficiary-clinician relationship and must comply with applicable fraud and abuse laws, including the federal Anti-Kickback Statute and beneficiary inducement prohibition. CMS may provide further guidance in future rulemaking.

Remote Patient Monitoring (RPM) and Remote Therapeutic Monitoring (RTM). The MPFS finalizes several changes to Medicare coverage and payment requirements for RPM and RTM in response to findings by the Office of the Inspector General that additional oversight of RPM and RTM was needed given potential fraud, waste and abuse concerns. First, CMS extended the established-patient requirement to RTM, aligning it with RPM. Practitioners billing for either service must furnish a separately reportable initiating face-to-face visit, in person or via telehealth, before monitoring begins. Second, CMS finalized a requirement that clinical staff performing RPM and RTM services be directly employed by the billing practitioner or practice, subject to applicable incident to requirements. This requirement may materially affect digital health companies that provide outsourced monitoring services. CMS delayed its implementation until Jan. 1, 2029, giving providers and vendors additional time to evaluate and adjust their operating models.

Telehealth: Platform Transparency and Extended Flexibilities. Congress extended several Medicare telehealth flexibilities through Dec. 31, 2027, including broader access to telehealth services from beneficiaries' homes and audio-only telehealth. In implementing these extensions, CMS finalized the addition of several codes to the Medicare Telehealth Services List and confirmed that shared medical appointments (SMAs), or group visits for patients with a common condition, may be furnished via telehealth, subject to a limit of one SMA per beneficiary per week.

Separately, CMS finalized new telehealth modifiers, effective Jan. 1, 2027, for services furnished through certain virtual telehealth platform arrangements and for services furnished incident to. Although the modifiers do not currently affect payment, they will provide CMS with greater visibility into virtual-platform relationships and incident to telehealth arrangements. Virtual care companies and provider organizations should assess whether their contractual and operational arrangements fall within these categories and ensure that claims workflows capture the applicable modifiers.

MIPS HIPAA Security Risk Analysis Requirement. Beginning with the CY 2027 performance period - the 2029 MIPS payment year - CMS will remove the separate Security Risk Analysis (SRA) attestation from the MIPS Promoting Interoperability category, recognizing that the HIPAA Security Rule independently requires covered entities and business associates to conduct an SRA. The attestation requirement was previously included to promote awareness of the HIPAA Security Rule requirements, but CMS concluded that established awareness of these requirements obviated the ongoing need to include the SRA measure. Importantly, removal of the MIPS attestation does not eliminate the underlying HIPAA obligation to conduct and document an SRA and implement appropriate risk management measures. It does, however, provide clinicians with greater flexibility in timing the SRA because they will no longer need to satisfy the MIPS-specific timing requirement that it be conducted or reviewed during the year in which the applicable performance period occurs.

New MIPS Improvement Activity for AI Use. CMS finalized a new MIPS Improvement Activity, "Clinician Use of Artificial Intelligence (AI) to Improve Patient Care," which requires participating clinicians and organizations to "establish and maintain organizational policies and procedures for AI use in healthcare settings that guide the evaluation, deployment, and monitoring of AI-enabled tools" to receive credit for the activity. The policies must address key AI model characteristics, including fairness, appropriateness, validity and effectiveness, as well as risk mitigation and escalation. CMS also identified examples of qualifying initiatives, including AI-supported clinical decision support, predictive analytics, risk stratification, clinical documentation, literature review, population health management and care-gap identification.While the new activity does not require MIPS-eligible clinicians to use AI or participate in the activity, it provides an opportunity for clinicians and organizations to receive MIPS credit for adopting policies and workflows that support responsible and transparent use of AI in clinical and operational settings.

Electronic Prior Authorization. CMS established a voluntary electronic prior authorization measure for the CY 2027 performance period, which will become mandatory beginning with the CY 2028 performance period. The measure continues CMS's broader effort to move prior authorization away from manual, fragmented processes and toward more automated, interoperable workflows.

Removal of AI Transparency Requirements in the HTI-5 Rule

For years, ONC has revised the certification criteria that electronic health record systems must satisfy in order to participate in the ONC Health IT Certification Program. ONC's latest regulation, the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) final rule, streamlines several health IT certification requirements, although less extensively than initially proposed. Most significantly for AI-enabled health IT, the rule eliminates certain requirements under the Decision Support Intervention (DSI) certification criterion that required developers to provide standardized "model card" information about predictive algorithms, including their development, intended use, limitations, training data and performance. It also scales back requirements for risk analysis, mitigation and governance of predictive DSIs. These changes reduce AI-specific transparency and oversight through ONC's certification program, potentially placing greater responsibility on healthcare organizations to address these issues through their own AI governance, vendor diligence and contracting.

ONC acknowledged that a large majority of commenters opposed removing these criteria, citing concerns about reduced transparency and risk management protections; potential shifts in evaluation, governance and liability burdens to providers; and risks to patient safety, clinician trust and organizations' ability to assess bias and algorithmic performance. Commenters also questioned removing model card requirements less than two years after implementation, particularly as AI adoption accelerates. In response, ONC stated that certified health IT developers reported that most clinical users lack the time and technical capacity to engage with source-attribute information. ONC also noted that it had not identified peer-reviewed publications or trade press reports demonstrating that users of certified health IT relied on the transparency requirements. The resulting reduction in certification-based requirements underscores the importance of independent vendor diligence by healthcare organizations evaluating existing and contemplated AI uses.

Finally, although ONC has proposed several changes to the Information Blocking Rule through ongoing HTI rulemaking, as we previously analyzed, it did not finalize those changes in the HTI-5 rule. ONC noted that they "remain under consideration as part of HHS' ongoing efforts to address and eliminate information blocking."

HHS/OCR Reinforces Cybersecurity Expectations

OCR's October Newsletter reminds the healthcare industry of essential cybersecurity steps drawn from the HIPAA Security Rule and prior OCR guidance. The Newsletter provides a useful checklist for healthcare organizations to assess their cybersecurity posture and identify potential gaps:

• Phishing Awareness - Train employees to recognize and report phishing attempts. OCR notes that phishing simulations and periodic security updates can increase vigilance and help satisfy the Security Rule's security reminders requirement.
• Strong Passwords - Require strong passwords for all users to help prevent unauthorized account access.
• Multifactor Authentication (MFA) - Use MFA to strengthen account security, with phishing-resistant MFA where available.
• Software Updates and Patching - Promptly install security updates and patches to address known vulnerabilities and protect systems.
• Logging - Record and regularly review user activity on business systems to identify suspicious behavior and potential security incidents.
• Data Backups - Maintain robust, retrievable backups of business data to facilitate recovery and support operational resiliency.
• Encryption - Encrypt electronic protected health information at rest and in transit wherever reasonable and appropriate. Where encryption is not reasonable and appropriate under specific circumstances, organizations must implement equivalent alternative safeguards, where reasonable and appropriate, and document the decision and its rationale.
• Incident Reporting - Although HIPAA does not require reporting cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA), OCR encourages organizations to consider doing so to help inform national threat assessments and responses. OCR notes, however, that reporting to CISA does not satisfy separate HIPAA breach reporting obligations to OCR.
• Incident Response Plans - Develop, maintain and regularly exercise incident response plans for common threats, including ransomware. OCR recommends realistic exercises involving leadership, legal counsel and technical personnel, with plans reviewed and tested at least annually.
• Preparing for Disruptions - Develop contingency plans to restore critical systems and maintain essential operations during disruptions, including backup, disaster recovery and emergency mode operation plans, as well as procedures for testing and revising those plans.

Although the Newsletter largely reiterates existing OCR guidance and HIPAA Security Rule requirements, it provides a useful indication of the cybersecurity practices OCR expects regulated entities to prioritize.

AMA AI Liability Framework

One of the more interesting health AI developments in recent weeks came not from a regulator but from the AMA. By advancing its own proposed framework for aligning responsibility for AI among physicians, healthcare organizations and AI developers, the AMA is beginning to put structure around the question of who should bear responsibility when AI contributes to patient harm. The AMA's clinical AI liability framework focuses on who is best positioned to understand and control a particular risk. Its core principle is that responsibility should track each party's authority, access to information and ability to prevent or mitigate harm. According to the AMA's proposed framework:

• Physicians are responsible for the clinical judgment they can meaningfully exercise, based on the information available to them and their ability to evaluate and challenge AI outputs.
• Developers remain responsible for the systems they build and the risks within their control, including designing safe and effective tools and providing users with information about intended use, performance and limitations.
• Deploying healthcare organizations bear responsibility for how AI is selected, implemented and governed, including pre-deployment evaluation, vendor contracting, interface configuration, clinician training and post-deployment monitoring.
• Patients must retain meaningful avenues for accountability and appropriate remedies when AI contributes to harm.

The framework recognizes that responsibilities can overlap and that the presence of a clinician in the workflow does not necessarily eliminate the responsibility of the developer or deployer.

What makes the AMA's framework particularly noteworthy is that it moves beyond generalized calls for "human oversight" and attempts to allocate responsibility according to who actually controls the relevant risk. The AMA expressly recognizes that physicians may be unable to detect AI errors when they did not select the technology, cannot inspect or validate the model or lack sufficient information or authority to meaningfully challenge its output. At the same time, developers must provide sufficient information for users to identify and respond to errors, while healthcare organizations must evaluate AI tools before deployment, provide appropriate training and monitor performance over time. The framework also emphasizes that generic warnings and disclaimers are not substitutes for meaningful transparency and safeguards. Although the framework is not law, it may inform evolving discussions regarding AI contracting, institutional governance and the allocation of responsibility when AI contributes to patient harm.

Legislative Outlook: Congress Turns Its Attention to Healthcare AI

Congress is also considering legislation that could shape the regulation and use of AI in healthcare. On Oct. 29, Senate HELP Committee Chairman Bill Cassidy released a discussion draft of the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care Act, or PATIENT AI Act. The proposal addresses several key issues facing the industry, including U.S. Food and Drug Administration (FDA) and ONC oversight of AI-based health technologies, FDA review of software changes, HHS guidance on AI privacy and security, and a payment pathway for qualifying AI technologies. Although only a discussion draft, the proposal offers a broad potential framework for federal healthcare AI policy.

A separate bipartisan House proposal, the Doctors Not AI Act of 2026, focuses on AI use in health plan coverage decisions. The bill would prohibit AI systems from issuing or dictating adverse benefit determinations involving clinical judgment, requiring such decisions to be made by appropriately trained and licensed healthcare professionals. AI could still assist with administrative claims processing, but professionals could not simply defer to algorithmic recommendations. The proposal reflects growing congressional interest in requiring meaningful human involvement in AI-assisted coverage decisions, an issue also addressed in separate legislation concerning Medicare Advantage prior authorization.

Neither proposal has advanced beyond its current legislative stage, and their prospects will depend on congressional priorities and committee leadership in the next Congress. Together, however, they illustrate the expanding scope of federal attention to healthcare AI, from regulatory oversight and reimbursement to the limits of automated decision-making.