Privacy and Security

HEALTH POLICY BRIEF — Friday, September 11

Today’s strongest thread is operational accountability: Congress is putting physician payment and cybersecurity on one docket, ONC is giving implementers…

Matt Reid

— 3 min read
Share

Executive Briefing

Today’s strongest thread is operational accountability: Congress is putting physician payment and cybersecurity on one docket, ONC is giving implementers two tangible tools instead of another vision deck, and FDA is codifying what “safe enough” looks like for a narrow class of clinical machine-learning software. The pressure point is consistent: technology only counts as progress if it moves work and risk away from practices—not merely into a new portal.

Congress / Hearings / Oversight

Physician payment and cybersecurity share Tuesday’s House agenda. The Energy and Commerce Health Subcommittee will meet September 15 at 10:15 a.m. ET on bills spanning MIPS and payment stability, data-driven performance payment, claims data, radiology-order transmission, remote monitoring, and health-care cybersecurity. The pairing creates useful leverage: financially brittle practices cannot absorb security obligations as if cyber resilience were free. Policy relevance: This is a one-business-day preparation window, not a calendar curiosity. Next move: build a short bill-and-question matrix by Monday, separating proposals that materially reduce payment or reporting friction from those that simply rearrange it—and test whether cyber support reaches small and rural practices. House Energy and Commerce, “Chairmen Guthrie and Griffith Announce Legislative Hearing…” (Sept. 8, 2026) (https://energycommerce.house.gov/posts/chairmen-guthrie-and-griffith-announce-legislative-hearing-to-address-medicare-provider-payment-challenges-and-bolster-cybersecurity-in-american-health-care)

Digital Health / AI / Privacy / Cyber / Interoperability

ONC’s Security Risk Assessment Tool 3.7 is ready, with small-practice training next week. ONC’s September 10 announcement points to live sessions September 15 at noon ET and September 16 at 3 p.m. ET covering installation, use, new features, and Q&A for small and medium practices. Physician policy angle: a free federal tool can reduce process friction, but it is not a compliance talisman; usability, documentation quality, and how version 3.7 changes the workflow still matter. Next move: circulate the tool and webinar links today to privacy, cybersecurity, and small-practice support teams, then capture any material workflow changes. ONC, “Security Risk Assessment Tool” (https://healthit.gov/privacy-security/security-risk-assessment-tool/) | Official ONC announcement (Sept. 10, 2026) (https://x.com/ONC_HealthIT/status/2098120141879775335)

FDA has codified a concrete control model for cardiovascular machine-learning notifications. Effective today, FDA classifies this narrow software category as Class II, formalizing the pathway created by the 2023 Viz HCM De Novo decision. The controls require representative real-world validation, independent test data, subgroup analyses, at least three geographically diverse test sites, software verification, human-factors assessment, and labeling that the output does not replace a full clinical evaluation. Policy relevance: this is not a general clinical-AI rule, but it is useful federal precedent for physician-led AI governance—especially on bias, workflow fit, false results, and overreliance. Next move: extract the controls into the clinical-AI precedent file and watch for analogous classifications or broader FDA guidance. Federal Register, “Classification of the Cardiovascular Machine Learning-Based Notification Software” (Sept. 11, 2026) (https://www.federalregister.gov/documents/2026/09/11/2026-18612/medical-devices-cardiovascular-devices-classification-of-the-cardiovascular-machine-learning-based)

Standards / Coding / Data Infrastructure

ONC is putting public infrastructure around terminology—but not erasing the licensing boundaries. Its September 10 post introduced Cartos, a public terminology service with a read-only FHIR R4 API, browser access, and downloadable collections tied to ONC regulations, certification, SVAP, and implementation guides. The terms are unusually clear: users remain responsible for each steward’s licensing and redistribution rules, and some proprietary content may be limited or metadata-only. Policy relevance: central access may reduce implementation friction while making the public-access/licensed-content boundary more visible. Next move: monitor implementer uptake and reopen the policy watch if ONC or CMS formally incorporates Cartos into certification, SVAP, or payment workflows. ONC, “Cartos ONC’s Terminology Service” (https://healthit.gov/standards-and-technology/cartos/) | Official ONC announcement (Sept. 10, 2026) (https://x.com/ONC_HealthIT/status/2098146214633984080)

Policy Action Implications

  • Prepare the September 15 House hearing matrix by Monday, emphasizing physician-payment stability, reporting burden, remote-monitoring workflow, and cyber capacity for small practices.
  • Distribute ONC’s SRA Tool 3.7 training links today and capture what changed before recommending broader practice adoption.
  • Add FDA’s validation, subgroup, human-factors, and clinician-warning controls to the digital health policy precedent set; keep Cartos on standards-and-terminology watch.

Read more