HEALTH POLICY BRIEF — Monday, August 17

Executive Briefing

HHS telegraphs HTI-6, but has not released a rule. The 2026 Unified Agenda, published Friday, lists ONC’s planned Health Data, Technology, and Interoperability: Application Programming Interfaces and Information Blocking rulemaking for the first time. The economically significant entry points toward standards adoption, expanded API uses, targeted Conditions of Certification, and revised information-blocking regulations, with a nonbinding November 2026 NPRM target—not a publication or comment deadline. Policy relevance: This is the first official marker for the next major ONC regulatory package. Physician policy angle: The developer-facing requirements could flow through to practices as vendor-transition, training, contracting, and compliance costs, while better APIs could reduce manual exchange burden. Prepare: Map physician-facing API, vendor-accountability, information-blocking, and small-practice priorities before an NPRM appears. Source: OIRA/ONC, RIN 0955-AA10 (https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0955-AA10&pubId=202510)

OCR opens a new HIPAA access front. A first-time agenda entry says OCR plans to propose changes addressing how much time covered entities have to answer HIPAA right-of-access requests, also with a nonbinding November target. OCR has not yet shortened the deadline or published proposal text. Policy relevance: The eventual rule could materially change records-release and patient-access operations. Physician policy angle: Faster access may benefit patients, but compressed identity-verification, amendment, staffing, and vendor workflows could hit small practices hardest. Prepare: Collect current response-time, edge-case, staffing, and EHR/release-of-information vendor data so feasibility arguments are ready when text arrives. Source: OIRA/OCR, RIN 0945-AA28 (https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA28&pubId=202510)

The HIPAA Security Rule moves off the imminent-final track. The new agenda places the rule in “Long-Term Actions” and projects July 2027; the Spring 2025 agenda had listed it at final-rule stage with a May 2026 target. That is a 14-month planning deferral, not withdrawal or evidence that the policy has softened. Policy relevance: Near-term implementation pressure eases, although agenda dates are not binding. Physician policy angle: Small-practice positions on scalability, technical assistance, safe harbors, implementation runway, and affordable security support remain relevant. Monitor: Preserve those positions and restart active work only if OCR, OIRA, or the Federal Register moves. Current agenda (https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202510) | Spring 2025 comparison (https://www.reginfo.gov/public/do/eAgendaViewRule?RIN=0945-AA22&pubId=202504)

Federal Health Policy Watch

ONC seeks a formal TEFCA performance-feedback channel. A 30-day notice requests approval for three years of TEFCA monitoring, primarily from an estimated 15 QHIN respondents, with 1,420 annual burden hours. Comments are due September 16. Policy relevance: The reporting design may shape which TEFCA service problems ONC sees and acts on. Physician policy angle: Practices are not the direct respondents, so downstream workflow burden could be undercounted unless the QHIN-centered metrics capture it. Coordinate: By September 2, ask the interoperability team for a go-or-no-go recommendation on comments addressing physician experience, service resolution, and implementation burden. Source: Federal Register (https://www.federalregister.gov/documents/2026/08/17/2026-16766/agency-information-collection-request-30-day-public-comment-request-submission-for-office-of)

Congress / Hearings / Oversight

No fresh congressional development cleared the official-source, freshness, and action gate this morning.

Digital Health / AI / Privacy / Cyber / Interoperability

The strategic picture shifted from an imminent compliance scramble to pre-proposal evidence building: prepare for HTI-6 and HIPAA access work, keep the Security Rule file warm, and avoid treating planning targets as deadlines carved into regulatory stone.

Signal Scan

The Monday Federal Register, OIRA/agency, Congress, standards/coding, implementation, and curated trade-press scans were reviewed. The implementation monitor’s ONC and TEFCA page fingerprints changed again, but publisher dates did not and no substantive new page-level policy delta was verified. The X scan errored, so no usable fresh social signal was incorporated.

Policy Action Implications

- Build a one-page HTI-6 physician-impact and evidence map.

- Gather operational evidence for a possible HIPAA access-time proposal.

- Keep existing HIPAA Security advocacy positions intact; no new compliance push yet.

- Obtain a TEFCA-comment go/no-go recommendation by September 2.