Interoperability

HEALTH POLICY BRIEF — Tuesday, September 29

ONC has a better cyber checklist for smaller practices—but it is not a compliance shield.

Matt Reid

— 3 min read
Share

Executive Briefing

ONC has a better cyber checklist for smaller practices—but it is not a compliance shield. ONC’s September 28 announcement says its OCR-developed Security Risk Assessment Tool v3.7 is ready for download. The update adds prompts on assessment scope, remote access and telework, asset inventory, system logging, and reassessment triggers; ONC expressly targets small and medium providers. Policy relevance: this is practical implementation help, not a new HIPAA rule or safe harbor, and ONC cautions that the tool is neither exhaustive nor a compliance guarantee. Physician policy angle: test whether the workbook is usable for resource-constrained practices and identify controls—especially vendor-managed assets—that practices cannot inspect or fix alone. ONC, “Security Risk Assessment Tool,” page updated Sept. 18; availability announced Sept. 28 (https://healthit.gov/privacy-security/security-risk-assessment-tool/)

OIG has put Medicare Advantage coding accountability back where it belongs: on the plan’s submissions. In an audit issued September 23 and posted September 28, OIG found records did not support diagnoses for 172 of 230 sampled enrollee-years, producing $622,927 in sampled overpayments. OIG recommended recovery of $24,465,369—the lower-bound estimate for the high-risk sampling frame—not a final CMS debt determination. United disputed findings and asked OIG to withdraw the recommendations; OIG retained them after accepting support for nine contested cases. Policy relevance: payer remediation may generate chart chases, retrospective documentation requests, or recoupment pressure, but the audit creates no new physician documentation rule and does not establish provider fault. Physician policy angle: pull the affected diagnosis categories and watch whether CMS or United shifts remediation work downstream. HHS-OIG, audit A-07-24-01215, Sept. 23/28 (https://oig.hhs.gov/reports/all/2026/medicare-advantage-compliance-audit-of-specific-diagnosis-codes-that-unitedhealthcare-benefits-of-texas-inc-contract-h0609-submitted-to-cms/)

CMS says the 2027 MA market is “stable”; the practice-level facts are still offstage. CMS projects the weighted average MA premium falling 16.5%, from $14.37 to $12.00, while the average stand-alone Part D premium rises by less than $1. Broad plan choice is useful beneficiary context, but the release says little about networks, utilization management, prior authorization, or physician contracts. Monitor the plan-level disclosures that arrive before and during October 15–December 7 open enrollment. CMS, “Medicare Advantage and Medicare Prescription Drug Programs Expected to Remain Stable in 2027,” Sept. 28 (https://www.cms.gov/newsroom/press-releases/medicare-advantage-medicare-prescription-drug-programs-expected-remain-stable-2027)

Federal Health Policy Watch

CMS’s September 29 IPPS/LTCH correction, effective October 1, recalculates hospital rates, wage indexes, MS-DRG weights, and uncompensated-care factors after two hospital-classification errors; it also fixes ICD-10 references and a Promoting Interoperability reporting-period reference. CMS says it adopts no new policy or payment methodology. Monitor corrected files and follow-on guidance, but do not read this as a physician-fee-schedule or new-standards action. Federal Register, 91 FR 61328–61343, Sept. 29 (https://www.federalregister.gov/documents/2026/09/29/2026-19946/medicare-program-hospital-inpatient-prospective-payment-systems-for-acute-care-hospitals-ipps-and)

CMS also announced $169.6 million for 91 Colorado rural-health grantees and roughly 250 projects spanning telemedicine, remote monitoring, mobile care, workforce initiatives, EHR modernization, and shared data platforms. The real test is whether implementation expands rural capacity without relocating technical work onto thinly staffed practices. Reopen when grantees publish milestones and outcome measures. CMS, Colorado Rural Health Transformation announcement, Sept. 28 (https://www.cms.gov/newsroom/press-releases/trump-administration-announces-169-million-expand-specialty-care-strengthen-emergency-services-bring)

Signal Scan

The completed X scan produced credible official signals. The ONC v3.7 announcement changed today’s practical picture and is incorporated above. ONC’s other notable post was a final reminder that the USCDI v7 feedback window closed September 28 at 11:59 p.m. ET; it was a deadline reminder, not new policy. Reopen when ONC publishes the next version or feedback cycle. ONC USCDI page (https://isp.healthit.gov/united-states-core-data-interoperability-uscdi#uscdi-v7)

Policy Action Implications

  • Test SRA Tool v3.7 with small-practice workflows; document usability burden, vendor dependencies, and remediation gaps.
  • Review OIG’s affected diagnosis categories and monitor CMS/United follow-up for plan-driven chart requests or recoupment pressure.
  • Track 2027 MA plan details, Colorado award implementation, and any follow-on CMS guidance that changes physician-facing operations.

Read more