AI Governance

HEALTH POLICY BRIEF — Tuesday, September 8

Today’s useful signals all expose the same policy failure: safeguards and access rules look tidy at the product or agency level, then fray where…

Matt Reid

— 2 min read
Share

Executive Briefing

Today’s useful signals all expose the same policy failure: safeguards and access rules look tidy at the product or agency level, then fray where clinicians actually work. OpenAI has drawn a sharper boundary around which AI functions its BAA covers; a new cancer drug reached FDA approval before payer systems were ready to cover it; and a CPT critic is conceding that tearing out the common code set could be worse than reforming access to it. The recurring question is who owns the seam—because “the workflow” too often means the physician’s staff.

Digital Health / AI / Privacy / Cyber / Interoperability

OpenAI’s current HIPAA matrix says ChatGPT for Healthcare, regulated Enterprise workspaces, ChatGPT for Clinicians, and specified API configurations can be covered under a BAA—but coverage is feature-specific. Cloud Codex, cloud browser/network access, event-triggered tasks, and improved memory are excluded; local Codex coverage does not extend to the customer’s machine or third-party services. Policy relevance: a product-level BAA check is no longer enough. Physician policy angle: practices need configuration controls that keep PHI from crossing into an uncovered function. Coordinate: add a feature-level BAA map to physician-led AI deployment checklists before connected or agentic tools are enabled. OpenAI Help Center, “HIPAA eligible products and functionality,” accessed September 8, 2026 (https://help.openai.com/en/articles/20001069-hipaa-eligible-products-and-functionality).

Prior Authorization / Payer Policy / Administrative Simplification

FDA approved Rasonque for certain patients with metastatic pancreatic adenocarcinoma on August 26. STAT now documents the launch gap: expanded access closed, while payer drug files and formulary workflows lagged; one Medicare Part D denial displayed by an oncologist said the drug was not properly listed with FDA, and Aetna initially lacked a route to open the authorization. Coverage was later arranged, but only after escalation. Policy relevance: approval without payer readiness can turn urgently needed therapy into phone calls, exceptions, and appeals. Physician policy angle: oncology practices become the integration layer. Monitor: develop a payer-readiness standard for urgent launches, including a functioning exception path before routine formulary loading is complete. FDA, “FDA Approves First in Class Targeted Therapy for Metastatic Pancreatic Cancer,” August 26, 2026 (https://www.fda.gov/news-events/press-announcements/fda-approves-first-class-targeted-therapy-metastatic-pancreatic-cancer) | STAT, “A breakthrough pancreatic cancer drug won approval. They still struggle to access it,” September 8, 2026 (https://www.statnews.com/2026/09/08/pancreatic-cancer-patients-caught-beween-fda-drug-approval-insurance-coverage/).

Policy Action Implications

  • Add feature-level BAA coverage and configuration controls to AI procurement and deployment reviews.
  • Test a payer launch-readiness concept against Rasonque and the next high-urgency therapy approval.
  • Finalize CPT access, infrastructure, and transition-risk language before September 14.

Read more