Privacy and Security

HEALTH POLICY BRIEF — Friday, October 2

Today’s implementation pressure: a final CMS drug model, a refreshed ONC cybersecurity tool, and Medicare Advantage enforcement all test who owns the…

Matt Reid

— 2 min read
Share

Executive Briefing

Today’s implementation pressure: a final CMS drug model, a refreshed ONC cybersecurity tool, and Medicare Advantage enforcement all test who owns the work—or inherits the friction.

Federal Health Policy Watch

CMS finalizes the mandatory GLOBE drug-pricing model. The October 2 final rule (CMS-5545-F) (https://www.federalregister.gov/d/2026-20281) is effective November 30. The model starts January 1, 2027; coinsurance and payment adjustments run April 1, 2027–March 31, 2032. Manufacturers—not practices—are participants. Selected drugs for CMS-identified beneficiaries in areas covering about 25% of Original Medicare may carry lower coinsurance; clinicians continue ordinary buy-and-bill. Policy relevance: this is a live CMMI test. Physician policy angle: CMS says no new compliance process is required, but mixed eligibility could complicate estimates, collections/refunds, remittance review, and patient explanations. Prepare: track ZIP-region, HCPCS/coinsurance, FAQ, and claims files before April 1.

Medicare Advantage chart review draws a $22.5 million settlement. DOJ said October 1 (https://www.justice.gov/opa/pr/independence-blue-cross-pay-225m-resolve-false-claims-act-allegations) that Independence Blue Cross agreed to resolve allegations that it retained overpayments after chart review found inaccurate diagnosis codes. There was no determination of liability. Policy relevance: risk-adjustment validation remains a payer-accountability issue. Physician policy angle: do not convert plan-owned cleanup into more practice documentation. Monitor: reopen if CMS or OIG changes provider expectations.

Digital Health / Privacy / Cybersecurity

ONC’s SRA Tool 3.7 is a better checklist, not a compliance shield. The refreshed tool (https://healthit.gov/privacy-security/security-risk-assessment-tool/) adds prompts for all ePHI locations, telework, asset inventories, logging, and reassessment triggers. It targets small and medium providers, but is optional, non-exhaustive, and creates no deadline or HIPAA safe harbor. Physician policy angle: compare existing resources with the new prompts at the next assessment cycle.

Standards / Coding / Data Infrastructure

ONC clarifies Cartos’s operating boundaries. Updated September 30, the Cartos guide (https://healthit.gov/resources/cartos-oncs-terminology-service/) describes a public FHIR R4 service aligned with certification and SVAP. For CPT, Cartos supplies metadata and routes users to the publisher; it does not host the codes. Policy relevance: federal infrastructure currently preserves licensing controls. Monitor: watch new collections and certification dependencies.

Policy Action Implications

  • Build the GLOBE watch around patient estimates, collections/refunds, remittance accuracy, and small-practice feedback—not hypothetical compliance duties.
  • Fold SRA Tool 3.7’s telework, asset, logging, and multi-site prompts into the next practice cybersecurity refresh.
  • Keep Medicare Advantage diagnosis validation focused on payer accountability; watch for attempts to push correction work downstream.

Read more