Patients need more flexible policies on Medicare enrollment changes
The AMA wrote to Centers for Medicare & Medicaid Services (CMS) Administrator Mehmet Oz, MD, MBA, to urge that CMS change its policy (PDF) for people who switch from traditional Medicare to Medicare Advantage (MA) and then find that they need to reverse that decision.
Currently, people who enroll in MA for the first time and have a Medigap supplemental policy at the time of their MA enrollment can switch back to traditional Medicare within the first 12 months, but people who do not have Medigap cannot. Instead, they would need to wait until the next open enrollment period. The AMA is recommending that all Medicare enrollees be allowed to change back to traditional Medicare within 12 months of joining MA for the first time should they find that it is not a good fit for their healthcare needs or financial resources, regardless of whether they had a Medigap plan.
Although there have been some notable improvements, such as placing MA plan network directories on the online Medicare Plan Finder, people making Medicare enrollment decisions often lack basic information about the impact that plans’ networks, cost-sharing requirements, and prior authorization policies can have on their health or out-of-pocket costs. Patients should not be stuck in an MA plan that does not work for them just because they did not purchase supplemental insurance when they were in traditional Medicare.
Before the current letter, the AMA sent a prior letter (PDF) to CMS Deputy Administrator and Director of the Innovation Center Abe Sutton proposing a new model that would vastly improve the information about the Medicare program and their coverage options that people receive before and during the period when they first become Medicare-eligible. This information would help them understand the fundamental differences between traditional Medicare and MA, as well as important topics such as late enrollment penalties and supplemental insurance policies. It is important for CMS to adopt both policies; that is, the agency should ensure that people have better information to guide their decision about their Medicare coverage and should also allow them to change those decisions and return to traditional Medicare if needed.
Organizations seek delay in Ambulatory Specialty Model
The AMA has joined the Medical Group Management Association, American Hospital Association, Premier Inc., and several other national organizations in a letter (PDF) to CMS Deputy Administrator and Director Abe Sutton urging that the scheduled Jan. 2027 implementation of the Ambulatory Specialty Model (ASM) be delayed. Citing significant operational and technical problems to date, the joint letter seeks to delay the initial launch of ASM until all operational and technical infrastructure is available, tested, and ready for model launch. It also asks CMS to hold participants harmless from downside risk in the first year if the launch is not delayed.
The letter also asks CMS to provide ongoing communications and support, including timely data, operational guidance, technical support, and a single, consolidated help desk, as the lack of guidance and technical support have materially constrained participants’ ability to prepare. In addition, the organizations are reinforcing a longstanding AMA recommendation that CMS share prospective performance thresholds for cost and quality performance categories in advance of the model’s start date. Finally, it asks CMS to allow practice-level reporting of quality measures, instead of requiring reporting at the individual physician level, to align with other CMS models and programs and minimize participant burden.
ONC finalizes scaled-back health IT deregulatory rule
The Department of Health and Human Services (HHS) Office of the National Coordinator for Health Information Technology (ONC) issued the Health Data, Technology, and Interoperability: ONC Deregulatory Actions to Unleash Prosperity (HTI-5) Final Regulation. HTI-5 is intended to focus on implementing deregulatory actions in support of innovation while reducing burden and offering flexibility to physicians and health IT developers, and move the U.S. toward an open, interoperable health data ecosystem.
This Final Rule removes specific EHR regulations while freeing developers to focus on the needs of physicians and medical staff. In its comments, the AMA viewed the original proposed rule as too aggressive. In response to the AMA's concerns, the Final Rule removed only 14 criteria, revised seven, and left 39 unchanged. ONC recognized the need to maintain several core EHR functions essential for patient care continuity, data privacy, and information security.
For example, ONC originally proposed to remove the 13 privacy and security-related certification criteria. The AMA (PDF), along with many other physician and healthcare provider organizations, called on ONC to reconsider these changes and not add to the technological burden that eliminating these criteria would place on physician practices. In the face of strong pushback from physicians, ONC acknowledged the public comments it received to retain the privacy and security criteria and decided to not eliminate them.
The AMA also recommended that ONC not make any changes to the Information Blocking Exceptions and instead redouble its efforts on enforcement and civil monetary penalties for bad actors misusing the exceptions, continuing to put pressure on EHR developers willfully blocking medical record access and exchange.
However, the final rule removes important augmented intelligence (AI) transparency requirements, weakening the limited federal protections in place. The AMA successfully advocated for transparency requirements for AI in certified EHRs, which took effect in Jan. 2025 and gave physicians access to information to help evaluate AI tools’ safety, security and effectiveness. By removing these requirements, the final rule leaves physicians with less clarity about how to assess AI tools in their EHRs. The AMA will continue working with ONC and EHR developers to preserve AI transparency, despite the removal of the federal requirements.
Free federal cybersecurity resources help physicians strengthen HIPAA Security Rule compliance
With Cybersecurity Awareness Month wrapping up, physicians should be aware that the Department of Health and Human Services (HHS) Office for Civil Rights (OCR) has a library of free guidance for physicians and other healthcare organizations that safeguard electronic protected health information (ePHI). The resources address risk analysis and risk management, ransomware, and mobile and remote access.
Among the newest offerings is a video presentation on the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule’s risk management requirement. It explains how effective risk management supports both compliance and broader cybersecurity readiness, by reducing risks and vulnerabilities to a reasonable and appropriate level. The video covers the Security Rule’s requirements, findings from OCR investigations, and further resources. OCR also gathered questions from the regulated community while developing it, and the final segment answers a selection of them.
Moreover, a second video explains “recognized security practices,” which requires OCR to consider whether a regulated entity had recognized security practices in place for the prior 12 months when it conducts certain Security Rule enforcement and audit activities. OCR’s presentation describes the categories of recognized practices, how organizations can demonstrate they established, and how OCR requests that evidence. It also points to further resources and answers common questions. Both videos are available on OCR’s YouTube channel, @USGovHHSOCR.
OCR also has a HIPAA Security Rule Educational Paper Series that covers the foundations of healthcare cybersecurity on such topics as:
Security 101 for Covered Entities
Administrative, Physical, and Technical Safeguards
Organizational Requirements, Policies and Procedures, and Documentation
Basics of Risk Analysis and Risk Management
Security Standards: Implementation for the Small Provider
Smaller physician practices can use the small-provider paper to match their safeguards to their size and resources.
HHS has also published guidance on risk analysis, remote use of ePHI, mobile devices and ransomware. The HHS Security Risk Assessment Tool is a free desktop application that supports providers conducting HIPAA security risk assessments.
More articles in this issue
- Top stories of Advocacy Update: October 2026
- Oct. 30, 2026: State Advocacy Update
- Oct. 30, 2026: Judicial Advocacy Update
