HEALTH POLICY BRIEF — Monday, June 1

Executive Briefing

• CMS finalized Performance Year 2 changes to the mandatory IOTA transplant model. The CMMI final rule is published today and effective July 1, 2026. Policy relevance: CMS is adjusting a mandatory specialty-care payment model after implementation feedback, including eligibility, risk adjustment, payment, emergency-flexibility, and transparency provisions. Physician policy angle: useful precedent for how CMS recalibrates specialty models, handles Medicare Advantage in model payment calculations, and responds to provider/professional-association comments. Source: https://www.federalregister.gov/documents/2026/06/01/2026-10890/medicare-program-alternative-payment-model-updates-and-the-increasing-organ-transplant-access-iota
• OCR's HIPAA Privacy Rule final rule remains under economically significant OIRA review, with fresh stakeholder meetings on May 28. Policy relevance: the "Coordinated Care and Individual Engagement" final rule is still pending at OMB/OIRA, and the meeting docket shows continuing activity late last week. Physician policy angle: watch for near-term release because it could affect care coordination, patient access, individual engagement, and regulatory-burden positions. Source: https://www.reginfo.gov/public/do/eoDetails?rrid=1334515 and https://www.reginfo.gov/public/do/eom12866SearchResults?pubId=202204&rin=0945-AA00&viewRule=true
• House Homeland Security will examine frontier/agentic AI and cybersecurity on June 4. Policy relevance: the hearing is not health-specific, but it targets AI-enabled cyber risk, coding tools, frontier models, and critical infrastructure resilience. Physician policy angle: health care cybersecurity arguments should track whether Congress moves toward CISA, critical-infrastructure, software-supply-chain, or AI governance obligations that could reach health systems, vendors, and practices. Source: https://homeland.house.gov/2026/05/28/media-advisory-subcommittee-chairman-ogles-announces-hearing-on-frontier-ai-agentic-ai-systems-and-the-future-of-cybersecurity/

Federal Health Policy Watch

• CMS/CMMI IOTA final rule: CMS finalized selected updates for Performance Year 2 and future years of the six-year mandatory Increasing Organ Transplant Access model. Notable changes include excluding VA and military treatment facilities, raising the low-volume eligibility threshold from 11 to 15 adult kidney transplants in each baseline year, modifying the composite graft survival metric with risk adjustment, including Medicare Advantage beneficiaries in upside/downside payment calculations, and updating emergency/disaster flexibility. Policy relevance: specialty model implementation and CMMI mandatory-model precedent. Physician policy angle: monitor how CMS handles risk adjustment, specialty-program burden, beneficiary communications, and MA inclusion in model economics.
• OCR/HIPAA Privacy Rule at OIRA: OIRA lists the final rule as received April 2, 2026, economically significant, and in final-rule stage; the meetings list includes scheduled stakeholder meetings on May 11 and May 28 plus completed April meetings. Policy relevance: changed-state signal is process movement, not rule text. Physician policy angle: prepare for quick review if the final rule clears OIRA.
• CMS PRA notice, low priority: CMS opened a June 29 comment deadline on the Social Security Office Report of State Buy-in Problems collection. Policy relevance is limited for this publication's coverage focus; it is Medicare/Medicaid eligibility administration rather than a physician-practice burden item. Source: https://www.federalregister.gov/documents/2026/05/29/2026-10777/agency-information-collection-activities-submission-for-omb-review-comment-request

Congress / Hearings / Oversight

• June 4 AI cybersecurity hearing: Witnesses include Google Threat Intelligence, the Frontier Model Forum, Corridor Security, and EFF. Policy relevance: likely discussion of frontier-model misuse, agentic AI, AI coding tools, vulnerability discovery, and critical infrastructure resilience. Physician policy angle: monitor for positions that could shape health-sector cyber expectations, vendor accountability, model provenance, and federal support for smaller practices.

Digital Health / AI / Privacy / Cyber / Interoperability

• HIPAA final-rule watch: Keep this in the near-term release queue; the OIRA posture suggests the final rule could move without much warning.
• AI/cyber hearing watch: The hearing may create useful hooks for physician-led AI governance, vendor cyber accountability, digital health policy, and practical safeguards for AI-enabled software development in health care.

Prior Authorization / Payer Policy / Administrative Simplification

• DMEPOS prior authorization exemption cycle starts today. CMS' DMEPOS prior authorization page says suppliers that qualified for exemption are exempt starting June 1, 2026, after a one-time opt-out window that closed May 26. Policy relevance: narrow but fresh operational change in Medicare prior authorization administration. Physician policy angle: mostly watch-only unless physician practices are coordinating DMEPOS ordering workflows or hearing supplier implementation concerns. Source: https://www.cms.gov/data-research/monitoring-programs/medicare-fee-service-compliance-programs/prior-authorization-and-pre-claim-review-initiatives/prior-authorization-process-certain-durable-medical-equipment-prosthetics-orthotics-and-supplies

Related coverage

• OCR makes records custody part of the HIPAA access test (October 12, 2026)
• OpenAI’s current HIPAA matrix says ChatGPT for Healthcare (September 8, 2026)
• Federal agencies, regulation, Congress, and implementation deadlines (October 13, 2026)
• HEALTH POLICY BRIEF — Friday, September 25 (September 25, 2026)