Privacy and Security

HEALTH POLICY BRIEF — Monday, October 12

Today’s pressure point is operational accountability.

Matt Reid

— 2 min read
Share

Executive Briefing

Today’s pressure point is operational accountability. OCR has turned weak records custody and access procedures into a $140,000 small-practice compliance lesson, while Senators Patty Murray and Ron Wyden are using provider reports of WISeR delays and workload to intensify scrutiny of Medicare’s AI-assisted prior-authorization experiment. Neither development needs rhetorical inflation: both supply concrete questions about who absorbs friction, whether safeguards work in practice, and what federal officials can document.

Search Scope

  • Physician practice, payment, patient access, and administrative burden
  • Federal agencies, regulation, CMMI, and Congress
  • Digital health, AI accountability, HIPAA privacy, cybersecurity, interoperability, and EHRs
  • Prior authorization, payer policy, utilization management, and administrative simplification
  • Coding, terminology, standards, certification, and data infrastructure
  • Drug, device, workforce, and adjacent care-delivery policy
  • Social signals were partially searched; the congressional X lane timed out, so the Senate development below was verified directly from the official source

Congress / Hearings / Oversight

Murray and Wyden add provider testimony to the WISeR fight. At an October 9 Vancouver roundtable, the senators renewed opposition to CMS’s six-state WISeR model. Their statement quotes leaders from The Vancouver Clinic and EvergreenHealth describing delayed care, inconsistent processes, and added staff workload. Those accounts establish stakeholder experience and position—not model-wide performance—but they sharpen the questions CMS has not publicly settled: decision timeliness, overturn rates, contractor variation, provider burden, and beneficiary harm. The statement also highlights contractors’ compensation through a share of “averted expenditures,” making incentive design fair game for oversight. Policy relevance: implementation complaints now have senior Senate sponsors. Physician policy angle: practices need measurable accountability, not another black box wearing an efficiency badge. Prepare: update the WISeR oversight question set and request CMS data before the next congressional or agency exchange. — Office of Senator Patty Murray, “In Vancouver, Senators Murray & Wyden Affirm Commitment to Protecting Medicare from AI Prior Authorization,” October 9, 2026 (https://www.murray.senate.gov/in-vancouver-senators-murray-wyden-affirm-commitment-to-protecting-medicare-from-ai-prior-authorization/)

Digital Health / AI / Privacy / Cyber / Interoperability

OCR makes records custody part of the HIPAA access test. OCR announced its 56th Right of Access enforcement action after alleging that Shen Smiles failed to provide records despite repeated requests, lacked compliant access procedures, and did not reasonably safeguard protected information. The practice said a workforce member stole the records; OCR’s answer, in effect, was that missing records do not excuse missing controls. The matter settled for $140,000 before an administrative hearing, so the allegations were not adjudicated on the merits. HIPAA access is generally due within 30 days, with one possible 30-day extension. Policy relevance: access compliance now squarely implicates offboarding, record inventories, retrieval resilience, and breach analysis. Physician policy angle: small practices need controls that survive staff departure or suspected theft. Act: test access intake, retrieval, workforce offboarding, escalation, and breach-response paths now. — HHS Office for Civil Rights, “HHS’ Office for Civil Rights Settles HIPAA Privacy Rule Investigation with Dr. Linda L. Shen d/b/a Shen Smiles, P.C.,” October 8, 2026 (https://www.hhs.gov/press-room/hhs-office-civil-rights-settles-hipaa-privacy-rule-investigation-shen-smiles.html)

Policy Action Implications

  • Draft a focused WISeR data request covering turnaround times, denials and overturns, contractor-level variation, resubmissions, beneficiary harm, and staff burden.
  • Turn the OCR settlement into a short small-practice checklist: access-request logging, designated-record-set inventory, workforce offboarding, backup and retrieval testing, escalation, and breach assessment.

Read more