Privacy and Security

HEALTH POLICY BRIEF — Monday, September 14

ONC has published USCDI Version 7, adding 31 data elements and expanding the federal vocabulary around patient safety, nutrition care, and other clinical…

Matt Reid

— 4 min read
Share

Executive Briefing

ONC has published USCDI Version 7, adding 31 data elements and expanding the federal vocabulary around patient safety, nutrition care, and other clinical needs. This is not a mandate; it is the shelf from which future certification, SVAP, and HHS program requirements may be built. The pressure point is whether new exchange requirements arrive with useful workflow design—or simply create more fields for clinicians to populate. Policy relevance: review the v7 delta early for documentation, terminology, implementation, and vendor-accountability consequences. Prepare: produce a short delta memo before the next federal adoption proposal. ONC, USCDI page (https://isp.healthit.gov/united-states-core-data-interoperability-uscdi#uscdi-v7) and official announcement, Sept. 11 (https://x.com/ONC_HealthIT/status/2098500256983814446).

ONC and OCR released Security Risk Assessment Tool 3.7 with unusually practical changes for small and medium practices. The update adds a location-complete assessment-scope question, remote-access and telework content, modernized asset-inventory and activity-logging questions, assessment-review triggers, report improvements, and updated software libraries. The tool also reminds users that its survey may not identify every risk—useful honesty in a compliance market fond of magic checklists. Live training is Tuesday, September 15 at noon ET and Wednesday, September 16 at 3 p.m. ET. Physician policy angle: this can reduce small-practice compliance friction if paired with plain-language implementation support. Practices should calendar the release and webinar dates, and ask whether their own physician-facing guidance needs a refresh. ONC/OCR, Security Risk Assessment Tool (https://healthit.gov/privacy-security/security-risk-assessment-tool/).

CMS has put CY 2024 Quality Payment Program results onto clinician, group, and ACO profiles in the Provider Data Catalog and Medicare.gov Care Compare. The public display includes MIPS performance information and Advanced APM participation. Once program data move onto consumer-facing profiles, an attribution or display error stops being back-office trivia and becomes a reputation problem. Policy relevance: clinicians need an accuracy check, not another brochure. Act this week: spot-check a sample of profiles for attribution, star-rating, suppression, and display defects; escalate a short defect list if problems appear. CMS, Care Compare: Doctors and Clinicians Initiative (https://www.cms.gov/medicare/quality/physician-compare-initiative).

FDA codified Class II special controls for cardiovascular machine-learning notification software. The category covers software that suggests the likelihood of a cardiovascular condition for referral or follow-up—not diagnostic-quality output—and the controls address false results, model bias, generalizability, unsupported populations, human factors, and overreliance. Required labeling must say the output cannot replace a full clinical evaluation. The order creates a concrete premarket benchmark, but postmarket performance, workflow burden, and liability allocation remain separate policy questions. Prepare: compare the controls with physician-led AI governance positions and flag gaps before this pathway is treated as a template. FDA final order, 91 FR 57785–57788, Sept. 11 (https://www.federalregister.gov/documents/2026/09/11/2026-18612/medical-devices-cardiovascular-devices-classification-of-the-cardiovascular-machine-learning-based).

The HL7 September ballot clock expires today for most items; selected ballots remain open through September 21. Project-level details require Ballot Desktop access, so the useful move is internal rather than speculative. Act today: confirm whether any priority ballot still needs a vote or comment before close. HL7 official reminder, Sept. 12 (https://x.com/HL7/status/2098836287771857394).

Federal Health Policy Watch

CMS opened a November 13 comment window on three information collections: a new QIN-QIO provider-experience survey covering outpatient clinical practices, revised CMS data-use-agreement forms, and continued Medicaid access-monitoring collections. This is a burden-and-data-quality watch, not an emergency. Worth reading the supporting statements if the QIN-QIO, CMS data-access, or Medicaid-access provisions raise utility or burden questions. CMS, Federal Register notice, Sept. 14 (https://www.federalregister.gov/documents/2026/09/14/2026-18649/agency-information-collection-activities-proposed-collection-comment-request).

The FTC rescinded its 2021 health-app breach policy statement because the amended 2024 Health Breach Notification Rule now expressly covers health apps and connected devices. Policy relevance: this is guidance cleanup, not evidence that the rule’s substantive coverage disappeared. Monitor: reopen only if FTC changes the rule text, enforcement posture, or compliance guidance. FTC, “FTC Withdraws Obsolete Policy Statement,” Sept. 9 (https://www.ftc.gov/news-events/news/press-releases/2026/09/ftc-withdraws-obsolete-policy-statement).

Digital Health / AI / Privacy / Cyber / Interoperability

Today’s federal technology signals are unusually concrete: ONC is defining the next data baseline and handing small practices an updated security tool, while FDA is specifying minimum controls for a narrow clinical-ML category. The common advocacy test is whether standards and safeguards assign implementation work to vendors and developers with the capacity to perform it, rather than quietly transferring it to clinicians.

Signal Scan

The cached X scan was partial but useful: its CMS/ONC-first lane surfaced the USCDI, SRA Tool, and QPP announcements, all verified against official pages; targeted follow-up confirmed the HL7 deadline. The broader standards/coding and congressional topics timed out, so no unsupported social signal was added.

Policy Action Implications

  • Small practices should put the SRA Tool 3.7 release and the September 15–16 training on the calendar this week.
  • Confirm any outstanding HL7 September ballot votes or comments before today’s close.
  • Start a focused USCDI v7 delta review for documentation, terminology, workflow, and vendor-accountability implications.
  • Spot-check CY 2024 QPP public profiles this week and compare FDA’s ML special controls with physician-led AI governance positions.

Read more