Federal: AI health law and policy
31 entries on the map: 24 in force or in effect, 1 final or enacted and not yet in force (main duties begin Oct 1, 2026), 4 proposed rules and 2 draft guidance documents.
The federal section records statutes, final and proposed rules, agency guidance, executive orders and CMS programs that govern or directly shape the use of AI in health care, and lists a bill in Congress once it has passed a committee.
Dates ahead
- Oct 1, 2026
Devices and FDA oversight
FDA's oversight of AI-enabled medical devices and software, including clinical decision support and change control plans.
FDA, Technology-Enabled Meaningful Patient Outcomes (TEMPO) for Digital Health Devices Pilot, notice, 90 FR 56768 (Dec. 8, 2025)
A pilot of FDA's device center, linked to the CMS ACCESS model, under which FDA may decline to enforce requirements such as premarket authorization and investigational device exemption requirements for selected manufacturers' digital health devices, including AI-enabled devices, when offered to or by ACCESS participants, in return for risk mitigation and collection and reporting of real-world performance data.
Physician read. It places no duty on physicians. Patients in the ACCESS model may be offered devices from the first four selected manufacturers (SonderMind, Limbic, Cadence Solutions and Dexcom) for which FDA does not intend to enforce premarket authorization requirements in that setting.
Notes: Docket FDA-2025-N-6461. FDA said it expected to select up to about 10 U.S. manufacturers in each of four clinical areas (early cardio-kidney-metabolic, cardio-kidney-metabolic, musculoskeletal pain and behavioral health) and began accepting statements of interest Jan. 2, 2026. Its participants page (current as of Aug. 21, 2026) lists four manufacturers: SonderMind and Limbic (behavioral health), Cadence Solutions (early cardio-kidney-metabolic) and Dexcom (early cardio-kidney-metabolic and cardio-kidney-metabolic), and says FDA will update the list as more are selected. The notice sets no end date.
21st Century Cures Act, Pub. L. 114-255, div. A, title III, sec. 3060(a), adding section 520(o) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360j(o)), software functions excluded from the device definition
Removes five kinds of software functions from the device definition: administrative support of a health care facility, general wellness, electronic patient records, transfer or display of laboratory and device data, and clinical decision support that does not acquire, process or analyze a medical image or signal, displays or analyzes medical information, supports or provides recommendations to a health care professional, and lets that professional independently review the basis for the recommendations instead of relying primarily on them.
Physician read. It places no duty on physicians. It decides whether a decision support tool a physician uses is an FDA-regulated device: software that analyzes medical images or signals, or whose basis the clinician cannot independently review, remains a device.
Notes: FDA explains how it applies the clinical decision support exclusion in its clinical decision support software guidance and the wellness exclusion in its general wellness guidance, both revised in January 2026 (separate entries). The U.S. Code shows no effective-date provision for subsection (o); under Gozlon-Peretz v. United States, 498 U.S. 395 (1991), a federal law takes effect on enactment absent a clear direction from Congress to the contrary.
Food and Drug Omnibus Reform Act of 2022 (Consolidated Appropriations Act, 2023, Pub. L. 117-328, div. FF, title III, sec. 3308(a)), adding section 515C of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360e-4), Predetermined change control plans for devices
Lets FDA approve, in a premarket approval application or supplement, or clear, in a 510(k) notification, a predetermined change control plan describing planned changes to a device if the device remains safe and effective without the changes and, for a cleared device, would remain substantially equivalent to its predicate; changes consistent with an authorized plan then need no new premarket approval supplement or 510(k) notification.
Physician read. It places no duty on physicians. A device with an authorized plan, such as an AI device, can be changed after purchase as the plan describes without a new FDA submission.
Notes: FDA's final guidance on plans for AI-enabled device software functions is a separate entry. Its general draft guidance, Predetermined Change Control Plans for Medical Devices (August 2024, docket FDA-2024-D-2338), is still listed as a draft on FDA's guidance page. The U.S. Code shows no effective-date note for the section; under Gozlon-Peretz v. United States, 498 U.S. 395 (1991), a federal law takes effect on enactment absent a clear direction from Congress to the contrary.
Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2022-D-2628)
Recommends that a predetermined change control plan for an AI-enabled device describe the planned modifications, the methods to develop, validate and implement them, and an assessment of their impact, and that the labeling tell users that the device incorporates machine learning and has an authorized plan.
Physician read. It places no duty on physicians. Under an authorized plan, software updates may change an AI device's performance, its inputs or certain aspects of its use, within its intended use, without new FDA review, and the labeling should explain that the device incorporates machine learning and has an authorized plan.
Notes: FDA reissued the guidance on Aug. 18, 2025; the document says it was originally issued Dec. 4, 2024, and FDA's guidance pages now list it as issued in August 2025. The Federal Register notice of availability is 89 FR 96259 (Dec. 4, 2024). The documents opened do not say what changed in the 2025 reissue. Guidance is nonbinding.
General Wellness: Policy for Low Risk Devices: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2014-N-1039), issued Jan. 6, 2026
Describes the low-risk products intended only for general wellness that FDA does not intend to regulate as devices, and says products using non-invasive sensing to estimate values such as blood pressure, oxygen saturation, blood glucose or heart rate variability can qualify when intended solely for wellness uses, but not if they reference specific diseases or diagnostic thresholds, prompt specific clinical action, or claim clinical accuracy or medical grade.
Physician read. It places no duty on physicians. Patients may bring blood pressure, oxygen saturation or glucose estimates from wearables sold as wellness products outside FDA device review, which may not claim clinical accuracy or medical grade.
Notes: Supersedes the version issued Sept. 27, 2019. Guidance is nonbinding.
Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2017-D-6569), issued Jan. 29, 2026
Explains how FDA applies the four statutory criteria that exclude some clinical decision support software from device regulation; software intended for a critical, time-sensitive task or decision does not meet the fourth criterion, and FDA intends not to enforce device requirements when software that otherwise meets all four criteria gives a single recommendation because only one option is clinically appropriate.
Physician read. It places no duty on physicians. Decision support that offers a single recommendation can reach clinicians without FDA device review when only one option is clinically appropriate and the other criteria are met, while software that detects a condition such as stroke or sepsis and alerts a clinician remains a regulated device.
Notes: The Jan. 29, 2026 document says it supersedes the version issued Jan. 6, 2026 and was revised under FDA's Level 2 procedures to delete a reference to time-critical decision-making on pages 13 and 14, for alignment with the Jan. 6 update; FDA's list of recent final device guidances dates the guidance Jan. 6, 2026. That the Jan. 6, 2026 version replaced FDA's final guidance of Sept. 28, 2022 (same docket) rests on a law firm alert; FDA's own documents do not say what it replaced. Guidance is nonbinding.
Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance for Industry and Food and Drug Administration Staff (docket FDA-2024-D-4488), notice of availability, 90 FR 1154 (Jan. 7, 2025)
Draft recommendations on what marketing submissions for devices with AI-enabled software functions should contain across the product life cycle, including labeling that states AI is used and explains how, describes performance across subgroups such as sex, age, race and ethnicity, and explains any tools for monitoring performance, with a model card as an option; comments closed April 7, 2025.
Physician read. It places no duty on physicians and is still a draft. As proposed, the labeling of an AI-enabled device would state that AI is used and explain how, describe performance across patient subgroups and describe any methods or tools for users to monitor performance.
Notes: FDA lists it as a draft on its guidance page and on its AI-enabled medical devices page (current as of Sept. 22, 2026), which also says FDA had authorized more than 1,600 AI-enabled devices as of September 2026. Guidance is nonbinding, even when final.
Clinical decision and chatbot limits
Limits on AI in clinical decisions and on health chatbots, including AI presenting itself as a licensed professional.
Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1), final rule, 89 FR 1192 (Jan. 9, 2024), RIN 0955-AA03; 45 CFR 170.315(b)(11), Decision support interventions
Replaced the clinical decision support certification criterion with a decision support interventions criterion that requires certified health IT to support source attributes, a standard set of information about evidence-based and predictive decision support tools, and requires developers that supply predictive tools to apply intervention risk management practices and keep that information current.
Physician read. It places no duty on physicians directly. Since Jan. 1, 2025, only the new criterion counts toward the Base EHR definition, so certified EHRs must support source-attribute information on decision support tools, including predictive tools the EHR developer supplies.
Notes: The rule was published with an effective date of Feb. 8, 2024, which a correction published that day (89 FR 8546) changed to March 11, 2024. Under 45 CFR 170.402(b)(4), developers must review and update source-attribute and risk management information starting Jan. 1, 2025, and under the Base EHR definition in 45 CFR 170.102 only the decision support interventions criterion counts from Jan. 1, 2025. eCFR, current as of Sept. 24, 2026, still shows 170.315(b)(11) with its source-attribute and risk management requirements. ASTP/ONC's HTI-5 proposed rule (separate entry) would remove the source-attribute ('model card') requirements.
HHS Office for Civil Rights, Dear Colleague letter: Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies (Jan. 10, 2025)
Explains 45 CFR 92.210, lists steps covered entities may take to identify and mitigate discrimination risk from decision support tools, including AI, and says OCR will judge reasonable efforts case by case, considering factors such as the entity's size and resources, the information available when the tool was used, and whether the tool was used as its developer intended.
Physician read. It adds no duty beyond 45 CFR 92.210. Its examples of mitigation include written policies, monitoring, human review of a tool's decisions, staff training, real-world audits and disclosing to patients the use of tools identified as posing a risk of discrimination, and it says OCR weighs an entity's size and resources.
Notes: Signed by then-OCR Director Melanie Fontes Rainer. The letter was read from a copy hosted by a third party; no copy was found on hhs.gov. The hhs.gov address of HHS's Jan. 10, 2025 blog post on the subject (hhs.gov/blog/2025/01/10/ensuring-nondiscrimination-use-ai-good-medicine.html) now redirects to HHS's web archive hosted by PageFreezer, which was not opened, and OCR's newsroom sends readers to that archive for releases through Jan. 19, 2025. No notice rescinding the letter was found in the Federal Register; HHS's May 14, 2025 notice rescinding four guidance documents (90 FR 20393) does not include it. OCR's current view of the letter could not be confirmed.
Nondiscrimination in Health Programs and Activities, final rule, 89 FR 37522 (May 6, 2024); 45 CFR 92.210, Nondiscrimination in the use of patient care decision support tools
Bars covered entities from discriminating on the basis of race, color, national origin, sex, age or disability through the use of patient care decision support tools, and requires ongoing reasonable efforts to identify tools that use those characteristics as input variables and to mitigate the risk of discrimination from each such tool.
Physician read. Since May 1, 2025, a practice or hospital covered by Section 1557 must make ongoing reasonable efforts to identify decision support tools, including AI and clinical algorithms, that use race, color, national origin, sex, age or disability as inputs and to mitigate the risk of discrimination from each. The ban on discriminating through such tools has applied since July 5, 2024.
Notes: The rule took effect July 5, 2024; 45 CFR 92.1 sets compliance with paragraphs (b) and (c) within 300 days of that date (May 1, 2025). On Oct. 22, 2025, a federal court in Tennessee v. Kennedy (S.D. Miss.) vacated the rule's provisions that extend sex discrimination to gender identity; HHS's notice (91 FR 32887, June 2, 2026) lists the vacated sections, does not list 92.210 and says the rule's other provisions remain in force. No HHS proposal to rescind or stop enforcing 92.210 was found in the Federal Register.
Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity (HTI-5), proposed rule, 90 FR 60970 (Dec. 29, 2025), RIN 0955-AA09
Proposes to remove or revise many certification criteria, including narrowing the decision support interventions criterion to fully remove the artificial intelligence 'model card' requirements; comments closed Feb. 27, 2026.
Physician read. It binds no one yet. If finalized, certified EHRs would no longer have to support source-attribute information on predictive decision support tools, though they would still support evidence-based and predictive tools, according to a law firm summary.
Notes: ASTP/ONC's fact sheet (updated June 26, 2026) still describes it as a proposed rule, and the Federal Register lists no final rule under RIN 0955-AA09.
Also relevant here: 21st Century Cures Act, Pub. L. 114-255, div. A, title III, sec. 3060(a), adding section 520(o) of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360j(o)), software functions excluded from the device definition (under devices and FDA oversight); Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2017-D-6569), issued Jan. 29, 2026 (under devices and FDA oversight).
Payer and utilization review AI
Insurers', benefit managers' and utilization reviewers' use of AI, including prior authorization and claim denials.
Medicare Program; Contract Year 2024 Policy and Technical Changes to the Medicare Advantage Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, and Programs of All-Inclusive Care for the Elderly, final rule (CMS-4201-F), 88 FR 22120 (April 12, 2023), RIN 0938-AU96; 42 CFR 422.101(b)(6) and (c)(1) and 422.566(d)
Requires Medicare Advantage plans to base medical necessity determinations on Medicare coverage criteria and the enrollee's own circumstances, including medical history, physician recommendations and clinical notes; allows internal coverage criteria only when Medicare criteria are not fully established, if publicly accessible and based on current evidence; and requires a physician or other appropriate health care professional with expertise in the field of medicine or health care appropriate for the services at issue to review a partly or fully adverse medical necessity decision before it is issued.
Physician read. Since Jan. 1, 2024, a Medicare Advantage plan must base a medical necessity decision on Medicare's coverage rules and the patient's own medical history, the physician's recommendations and clinical notes, and a physician or other health care professional with expertise appropriate to the service must review a partly or fully adverse decision before the plan issues it. CMS's Feb. 6, 2024 FAQ (separate entry) applies these rules to algorithms and AI.
Notes: The rule took effect June 5, 2023; its DATES section says the provisions apply to coverage beginning Jan. 1, 2024. Its amendment to 422.566(d) concerns review of adverse medical necessity decisions by a physician or other health care professional with expertise in the field of medicine appropriate to the requested service; the regulation says the reviewer need not, in all cases, share the treating physician's specialty or subspecialty. In the CY 2026 final rule (CMS-4208-F, 90 FR 15792, April 15, 2025), CMS did not finalize its proposed 'Guardrails for Artificial Intelligence' provision and said it will continue to consider future rulemaking in this area. The CY 2027 final rule (CMS-4208-F3/CMS-4212-F, 91 FR 17384, April 6, 2026) amended 422.101 to add an off-cycle model of care submission window; the current eCFR text of 422.101(b)(6) and (c)(1) matches this entry, and CMS's fact sheet on that rule does not mention AI.
CMS, Frequently Asked Questions related to Coverage Criteria and Utilization Management Requirements in CMS Final Rule (CMS-4201-F), HPMS memo, Feb. 6, 2024
Says an algorithm or software tool can assist Medicare Advantage plans in coverage determinations but the plan must ensure the determination follows the coverage rules; that a tool deciding coverage from a larger data set instead of the patient's own history would not comply; that algorithms or AI alone cannot be the basis to deny admission or downgrade to an observation stay, and a predicted length of stay alone cannot be the basis to end post-acute care; that AI cannot be used to shift coverage criteria over time; and that plans should make sure a tool does not perpetuate or introduce bias before using it.
Physician read. Under CMS's Feb. 6, 2024 FAQ, a Medicare Advantage plan may use an algorithm to assist a coverage decision, but the decision must rest on the patient's individual circumstances. AI alone cannot be the basis to deny an inpatient admission or downgrade it to observation, and an algorithm's predicted length of stay alone cannot be the basis to end post-acute care.
Notes: The memo, on CMS letterhead, is addressed to all Medicare Advantage organizations and Medicare-Medicaid Plans. CMS posts that week's HPMS memos only as a ZIP file, so the text was read from a copy hosted by the American Hospital Association; CMS's HPMS archive page still lists that week's memos. A separate answer in the memo says that if a plan expects to issue a partly or fully adverse medical necessity decision, a physician or other appropriate health care professional must review it before it is issued (42 CFR 422.566(d)). The memo also cites Section 1557 of the Affordable Care Act on discrimination.
Medicare Program; Implementation of Prior Authorization for Select Services for the Wasteful and Inappropriate Services Reduction (WISeR) Model, notice (CMS-5056-N), 90 FR 28749 (July 1, 2025)
A six-year CMS Innovation Center model, running Jan. 1, 2026 through Dec. 31, 2031, in which participating companies use technologies such as AI and machine learning, with human clinical review, to conduct prior authorization or prepayment review of selected services in Original Medicare and are paid a percentage of the spending averted by their reviews.
Physician read. Since Jan. 1, 2026, clinicians in the six states who furnish selected services, such as skin and tissue substitutes, electrical nerve stimulator implants and knee arthroscopy for knee osteoarthritis, to Original Medicare patients must either request prior authorization or go through post-service, prepayment review. CMS says every recommendation for non-payment is made by an appropriately licensed clinician.
Notes: An April 6, 2026 notice (CMS-5056-N2, 91 FR 17282) delayed deep brain stimulation for essential tremor and Parkinson's disease and percutaneous image-guided lumbar decompression for spinal stenosis, to allow time for operational readiness, until a date to be announced in a later notice; a correction to the 2025 notice was published the same day. No later Federal Register notice on WISeR had appeared as of Sept. 29, 2026, and CMS's operational guide (version 7.0, updated July 24, 2026) lists 13 services in effect and the two as delayed. WISeR does not apply to Medicare Advantage. CMS's FAQ says the model plans to launch a 'gold carding' exemption program in 2026 for providers that consistently meet coverage criteria and that a human clinician with relevant expertise must review every non-affirmation.
Medicare and Medicaid Programs; Patient Protection and Affordable Care Act; Advancing Interoperability and Improving Prior Authorization Processes, final rule (CMS-0057-F), 89 FR 8758 (Feb. 8, 2024), RIN 0938-AU87
Requires impacted payers other than qualified health plan issuers on the federally facilitated Exchanges to decide prior authorization requests for items and services other than drugs within 72 hours for expedited and seven calendar days for standard requests from 2026; requires all impacted payers to give a specific reason for denials from 2026 and to post prior authorization metrics annually starting March 31, 2026; and requires them, beginning in 2027, to run a Prior Authorization API that lists covered items and services, identifies documentation requirements and supports requests and responses.
Physician read. Since 2026, Medicare Advantage plans and state Medicaid and CHIP programs and their managed care plans must decide prior authorization requests for items and services other than drugs within 72 hours for expedited and seven calendar days for standard requests, and they and federally facilitated Exchange plans must give a specific reason for any denial. Beginning in 2027 (Jan. 1, 2027, or the first rating period or plan year starting on or after that date), these payers must support electronic prior authorization requests and responses through an API.
Notes: The rule took effect April 8, 2024. The decision timeframes and denial reasons apply from Jan. 1, 2026 for Medicare Advantage and Medicaid and CHIP fee-for-service programs and from the rating period beginning on or after that date for Medicaid and CHIP managed care; Exchange plan issuers must give denial reasons beginning Jan. 1, 2026 (45 CFR 156.223(a)). The Prior Authorization API is due Jan. 1, 2027 for Medicare Advantage and fee-for-service programs, by the rating period beginning on or after Jan. 1, 2027 for managed care and for plan years beginning on or after Jan. 1, 2027 for Exchange plans. The rule's policies do not apply to drugs, and it sets no AI-specific requirement; a Federal Register text search finds AI only in a commenter's suggestion that prior authorization data include the software or AI tools used. A proposed rule, CMS-0062-P (91 FR 19890, April 14, 2026), would extend the requirements to drugs; comments closed June 15, 2026. The FY 2027 IPPS final rule (91 FR 49570, Aug. 4, 2026; docket CMS-0062-F) adopted updated versions of certain API standards proposed in CMS-0062-P and says comments on the other CMS-0062-P proposals are still being reviewed. CMS's rule page (modified Aug. 31, 2026) notes that on Feb. 28, 2024 its National Standards Group said it would not take HIPAA enforcement action against covered entities that do not use the X12 278 standard as part of an electronic FHIR prior authorization process.
Payment for AI
How Medicare pays for AI-enabled services, software and devices.
Medicare physician fee schedule payment for digital mental health treatment devices, HCPCS G0552, G0553 and G0554: CY 2025 final rule (CMS-1807-F), 89 FR 97710 (Dec. 9, 2024), expanded in the CY 2026 final rule (CMS-1832-F), 90 FR 49266 (Nov. 5, 2025)
Pays under G0552 for supplying a digital mental health treatment device, with initial education and onboarding, per course of treatment that augments a behavioral therapy plan, and under G0553 and G0554 for monthly treatment management of its use (first and each additional 20 minutes), for FDA-cleared or authorized devices classified under 21 CFR 882.5801, a class the CY 2025 rule says covers use cases for insomnia, substance use disorder, depression and anxiety; the CY 2026 rule extended payment to ADHD devices classified under 21 CFR 882.5803.
Physician read. Since Jan. 1, 2025, clinicians can bill Medicare codes G0552 through G0554 for supplying an FDA-cleared or authorized digital mental health treatment device classified under 21 CFR 882.5801 that augments a behavioral therapy plan, and for monthly treatment management of its use. Since Jan. 1, 2026, the codes also cover ADHD digital therapy devices classified under 21 CFR 882.5803.
Notes: These codes pay for software-based devices generally, not AI specifically. In the CY 2026 final rule CMS did not finalize new coding and payment for other digital tools used with mental health treatment; its fact sheet says it received feedback on other digital therapy devices and will consider it for future rulemaking. A Federal Register search of the CY 2027 physician fee schedule proposed rule found no mention of these codes or of digital mental health treatment devices.
CMS Innovation Center, Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model (request for applications issued Dec. 5, 2025; version 1.1, Feb. 12, 2026)
A 10-year Innovation Center model, begun July 5, 2026 and running through June 30, 2036, that pays participating organizations recurring outcome-aligned payments for managing qualifying chronic conditions with technology-supported care, which CMS says may include FDA-authorized devices or software, with full payment tied to measurable outcomes; participants may not bill Medicare fee-for-service for aligned beneficiaries during active care periods.
Physician read. In the ACCESS model, which began July 5, 2026, clinicians who co-manage an Original Medicare patient with a participating organization can bill a new co-management service, with no patient cost-sharing, for documented review of ACCESS updates and care coordination. Medicare Advantage enrollees are not in the model, and participating organizations cannot bill Medicare fee-for-service for aligned patients during active care periods.
Notes: Tracks are early cardio-kidney-metabolic, cardio-kidney-metabolic, musculoskeletal and behavioral health conditions, with heart failure, COPD, substance use disorder and tobacco cessation starting April 1, 2027, per CMS's model page (modified Sept. 18, 2026). Participants must designate a physician clinical director. The co-management service is paid at $30, subject to geographic adjustment, once every four months per beneficiary per track, up to about $100 a year. CMS's model page does not mention AI; the request for applications mentions AI in its description of technology-enabled care, with examples such as AI-assisted documentation and an AI-guided exercise therapy program. FDA announced its TEMPO pilot (separate entry) in connection with the model.
Medicare Program; Hospital Inpatient Prospective Payment Systems for Acute Care Hospitals (IPPS) and the Long-Term Care Hospital Prospective Payment System and Policy Changes and Fiscal Year (FY) 2027 Rates, final rule (CMS-1849-F), 91 FR 49570 (Aug. 4, 2026), RIN 0938-AV79; new technology add-on payments under 42 CFR 412.87 and 412.88
Approves FY 2027 new technology add-on payments, including for AI tools such as Aidoc's BriefCase-Triage: CARE (Clinical AI Reasoning Engine) Multi-Triage CT Body (up to $137.53 per case) and the Bayesian Health Sepsis Flagging Device, described by its applicant as AI and machine learning-based software (up to $61.84 per case), each capped at 65 percent of the technology's average cost.
Physician read. It places no duty on physicians. From Oct. 1, 2026, hospitals can receive add-on payments above the MS-DRG payment for eligible inpatient cases that use approved technologies, including these AI tools.
Notes: Both AI tools were approved under the alternative pathway for FDA Breakthrough Devices. The add-on is the lesser of 65 percent of the technology's average cost or 65 percent of the case's costs above the MS-DRG payment (42 CFR 412.88(a)(2)). Other technologies approved or continued for FY 2027 were not reviewed for AI. CMS's new technology page (modified Sept. 4, 2026) says the alternative pathway for FDA Breakthrough Devices applies to applications for fiscal years 2021 through 2029 for technologies designated as Breakthrough Devices as of Sept. 30, 2026 that receive marketing authorization for the designated indication by May 1, 2028. Applications for FY 2028 are due Oct. 5, 2026.
Medicare Program: Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems; and Quality Reporting Programs, CY 2027 proposed rule (CMS-1850-P), 91 FR 41734 (July 7, 2026), RIN 0938-AV83
Proposes to rename software as a service (SaaS) as software as a medical service (SaMS), designate 36 HCPCS codes as SaMS, move separately paid SaMS services from clinical APCs into New Technology APCs at rates close to their CY 2026 payment, and create a new status indicator, O1, for separately paid SaMS for CY 2027 and later; comments closed Aug. 31, 2026.
Physician read. It places no duty on physicians and binds no one yet. If finalized, hospital outpatient departments would be paid for 36 designated software services that perform algorithmic analyses, such as AI analysis of MR images, under a new status indicator, O1, with separately paid services moved to New Technology APCs at rates close to their CY 2026 payment.
Notes: Section X.B of the proposal carries the SaMS payment policy; CMS proposes to keep SaMS already assigned to New Technology APCs for CY 2026 in their current assignments. The proposal describes one SaMS technology, LiverMultiScan, as analyzing MR images with proprietary AI algorithms. No final rule had appeared in the Federal Register as of Sept. 29, 2026.
Medicare and Medicaid Programs; CY 2027 Payment Policies Under the Physician Fee Schedule and Other Changes to Part B Payment and Coverage Policies, proposed rule (CMS-1848-P), 91 FR 43842 (July 16, 2026), RIN 0938-AV82
Proposes to have Medicare administrative contractors price, under the physician fee schedule, 10 HCPCS codes for software as a medical service (SaMS) analyses performed on laboratory tests that are now payable under the Clinical Laboratory Fee Schedule, and requests information on how technology and clinical AI are affecting primary care, care management and the annual wellness visit, including a possible two-track approach to care management with a technology-enabled track; comments closed Sept. 14, 2026.
Physician read. It binds no one yet; if finalized, Medicare administrative contractors would set physician fee schedule payment for 10 codes for software analyses of laboratory tests now payable under the Clinical Laboratory Fee Schedule. The questions on clinical AI in primary care, care management and the annual wellness visit are a request for information, not a payment proposal.
Notes: Comments were due Sept. 14, 2026. The primary care request for information is section II.E, 'Redesigning Primary Care To Make America Healthy Again.' CMS says these algorithmic analyses belong within its broader proposed framework for SaMS and should be treated consistently with comparable SaMS analyses. No final rule had appeared in the Federal Register as of Sept. 29, 2026.
Also relevant here: FDA, Technology-Enabled Meaningful Patient Outcomes (TEMPO) for Digital Health Devices Pilot, notice, 90 FR 56768 (Dec. 8, 2025) (under devices and FDA oversight).
Data and privacy
Health and consumer data, biometrics, and data used to train AI.
HHS Office for Civil Rights, Business Associates guidance (web page, content last reviewed July 30, 2026): AI chatbot example
Lists a third-party vendor's AI chatbot on a provider's patient portal that provides services involving patients' PHI, such as symptom assessment, medical reminders and appointment scheduling, as an example of a business associate.
Physician read. A practice that puts a vendor's AI chatbot handling PHI on its patient portal is dealing with a business associate. Before disclosing PHI, it must document the vendor's assurances in a written business associate agreement under 45 CFR 164.502(e).
Notes: The date HHS added the AI chatbot example could not be confirmed; the page was last reviewed July 30, 2026, which is the year used in this entry's id.
HHS Office for Civil Rights, Use of Online Tracking Technologies by HIPAA Covered Entities and Business Associates (bulletin issued December 2022, revised March 18, 2024)
Says regulated entities may not use online tracking technologies in a way that results in impermissible disclosures of PHI to tracking vendors, that tracking on user-authenticated webpages and in a regulated entity's mobile apps generally involves PHI, and that a tracking vendor that meets the definition is a business associate; otherwise patients' HIPAA authorizations are required before PHI is disclosed to the vendor.
Physician read. Under this guidance, tracking technologies on a practice's patient portal and in its mobile app generally have access to PHI, and PHI may go to a tracking vendor only as the Privacy Rule permits, under a business associate agreement where the vendor is a business associate, or with patients' HIPAA authorizations. On June 20, 2024, a federal court vacated the part treating a visitor's IP address combined with a visit to a public, unauthenticated page about specific health conditions or providers as PHI.
Notes: The court declared the 'Proscribed Combination' in the March 18, 2024 bulletin unlawful and vacated it, denied a permanent injunction and said the vacatur does not limit the rest of the bulletin; its opinion describes the original bulletin as issued in December 2022. HHS's page (content last reviewed June 26, 2024) carries a banner noting the order, and its guidance on user-authenticated webpages, mobile apps, business associate agreements and HIPAA authorizations remains posted. The bulletin does not mention AI.
Health Breach Notification Rule, final rule, 89 FR 47028 (May 30, 2024), RIN 3084-AB56, 16 CFR part 318
Clarifies that the rule covers health apps and similar technologies outside HIPAA and that an unauthorized disclosure of identifiable health information, not only a cybersecurity intrusion, is a breach; notice goes to affected individuals within 60 calendar days of discovery, to the FTC at the same time when 500 or more people are affected (otherwise within 60 calendar days after the end of the calendar year), and to the media when 500 or more residents of a state or jurisdiction are affected.
Physician read. It places no duty on HIPAA-covered practices or on business associates acting for them. It covers health apps and connected devices outside HIPAA that patients use, which must notify users and the FTC of a breach, including an unauthorized disclosure of identifiable health information.
Notes: On Sept. 9, 2026, the FTC rescinded its Sept. 15, 2021 Statement of the Commission on Breaches by Health Apps and Other Connected Devices, saying it had been superseded by the 2024 rulemaking; the rescission does not change the rule. The rule does not mention AI.
HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, proposed rule, 90 FR 898 (Jan. 6, 2025), RIN 0945-AA22
Proposes to strengthen the Security Rule's cybersecurity requirements, including a written technology asset inventory and network map, encryption of electronic protected health information (ePHI) at rest and in transit and multifactor authentication; its preamble states that ePHI in AI training data, prediction models and algorithm data that a regulated entity maintains for covered functions is protected by the HIPAA Rules, and it asks for information on AI and other emerging technologies; comments closed March 7, 2025.
Physician read. It binds no one yet; reginfo.gov's current regulatory agenda (the edition it labels 2026) lists the rule as a long-term action with final action in July 2027. The preamble states that electronic protected health information in AI training data, prediction models and algorithm data that a practice maintains for covered functions is protected by the HIPAA Rules.
Notes: Docket HHS-OCR-2024-0020. The AI statement is in section K.2 of the preamble, its request for information on new and emerging technologies. The preamble also asks how quantum computing, AI, virtual reality and augmented reality may affect the security of ePHI. Reginfo.gov labels the agenda edition with publication ID 202510 as 2026; it is the latest edition listing the rule, and it places the rule under Long-Term Actions with final action in July 2027. The proposed rule is the only Federal Register document under RIN 0945-AA22 as of Sept. 29, 2026; no final rule or withdrawal has been published.
Also relevant here: Executive Order 14355, Unlocking Cures for Pediatric Cancer With Artificial Intelligence, 90 FR 48153 (Oct. 7, 2025) (under government-wide AI policy).
Mental health AI
AI in therapy and mental health care.
No federal statute, rule or final guidance is specific to AI in mental health care. FDA's Digital Health Advisory Committee met on generative AI-enabled digital mental health devices on Nov. 6, 2025, and FDA has issued no guidance on them since; Medicare's payment for digital mental health treatment devices is listed under payment.
Also relevant here: Medicare physician fee schedule payment for digital mental health treatment devices, HCPCS G0552, G0553 and G0554: CY 2025 final rule (CMS-1807-F), 89 FR 97710 (Dec. 9, 2024), expanded in the CY 2026 final rule (CMS-1832-F), 90 FR 49266 (Nov. 5, 2025) (under payment for AI); CMS Innovation Center, Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model (request for applications issued Dec. 5, 2025; version 1.1, Feb. 12, 2026) (under payment for AI).
Patient disclosure of AI use
Telling patients that AI is used in their care or in messages to them.
No federal statute or rule requires telling patients that AI is used in their care. Federal transparency duties run to device labeling and certified health IT, and those entries are listed under devices and clinical.
Also relevant here: Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions: Guidance for Industry and Food and Drug Administration Staff (docket FDA-2022-D-2628) (under devices and FDA oversight); Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1), final rule, 89 FR 1192 (Jan. 9, 2024), RIN 0955-AA03; 45 CFR 170.315(b)(11), Decision support interventions (under clinical decision and chatbot limits); HHS Office for Civil Rights, Dear Colleague letter: Ensuring Nondiscrimination Through the Use of Artificial Intelligence and Other Emerging Technologies (Jan. 10, 2025) (under clinical decision and chatbot limits); Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance for Industry and Food and Drug Administration Staff (docket FDA-2024-D-4488), notice of availability, 90 FR 1154 (Jan. 7, 2025) (under devices and FDA oversight); Health Data, Technology, and Interoperability: ASTP/ONC Deregulatory Actions To Unleash Prosperity (HTI-5), proposed rule, 90 FR 60970 (Dec. 29, 2025), RIN 0955-AA09 (under clinical decision and chatbot limits).
Government-wide AI policy
Executive orders, OMB memoranda and federal strategies that reach AI in health care, including preemption of state AI laws.
Executive Order 14179, Removing Barriers to American Leadership in Artificial Intelligence, 90 FR 8741 (Jan. 31, 2025)
Sets a policy to sustain and enhance U.S. global AI dominance, directs an immediate review of actions taken under the revoked Executive Order 14110 so agencies can suspend, revise or rescind those that conflict with that policy, orders an AI action plan within 180 days, and directs OMB to revise its AI memoranda M-24-10 and M-24-18 within 60 days.
Physician read. It places no duty on physicians. It led to America's AI Action Plan and to OMB's April 2025 memoranda on federal agencies' own use and acquisition of AI, including at HHS.
Notes: Executive Order 14110 of Oct. 30, 2023 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence) was revoked by Executive Order 14148 on Jan. 20, 2025 (90 FR 8237).
Winning the Race: America's AI Action Plan (White House, July 2025)
Identifies more than 90 federal policy actions across three pillars (accelerating innovation, building American AI infrastructure, and leading in international diplomacy and security), including a recommendation that agencies with AI-related discretionary funding consider a state's AI regulatory climate in funding decisions.
Physician read. It places no duty on physicians. It names health care among sectors slow to adopt AI and recommends regulatory sandboxes or AI Centers of Excellence enabled by agencies such as FDA, and NIST-led standards work in fields including health care.
Notes: Released July 23, 2025 under Executive Order 14179, according to the White House announcement, which calls it 'Winning the AI Race: America's AI Action Plan'; the plan's cover reads 'Winning the Race: America's AI Action Plan.' Its health care references are in the section on AI adoption.
Executive Order 14355, Unlocking Cures for Pediatric Cancer With Artificial Intelligence, 90 FR 48153 (Oct. 7, 2025)
Directs the MAHA Commission, with HHS and others, to find ways to use AI to improve pediatric cancer data infrastructure, data analysis and clinical trial design, access and outcomes and to identify and carry out strategies to increase investment from existing federal funds in the Childhood Cancer Data Initiative, and directs HHS to work to integrate AI into its interoperability work while ensuring that patients and parents control their health information and to work to finalize interoperability standards for patient data used with AI.
Physician read. It places no duty on physicians.
Notes: The order sets no deadlines.
HHS Artificial Intelligence (AI) Strategy, version 1.0 (issued Sept. 30, 2025)
Sets five pillars for HHS's use of AI (governance and risk management for public trust; infrastructure and platforms; workforce development and burden reduction; health research and reproducibility; and modernization of care and public health delivery) and, under the governance pillar, calls for standardized minimum risk practices for high-impact AI, in line with OMB memoranda M-25-21 and M-25-22.
Physician read. It places no duty on physicians. It commits HHS to promote AI tools for uses such as clinical decision support, early warning, risk stratification and proactive outreach.
Notes: The document says it was issued Sept. 30, 2025, by Deputy Secretary Jim O'Neill; HHS's strategy page (content last reviewed Dec. 3, 2025) also links HHS's 2025 AI compliance plan. The date HHS first posted the strategy could not be confirmed.
Executive Order 14365, Ensuring a National Policy Framework for Artificial Intelligence, 90 FR 58499 (Dec. 16, 2025)
Directs the attorney general to set up within 30 days an AI Litigation Task Force to challenge state AI laws inconsistent with the order's policy; the Commerce Department to publish within 90 days an evaluation identifying onerous state AI laws, whose states become ineligible for BEAD non-deployment funds to the extent federal law allows; an FCC proceeding on a federal reporting and disclosure standard; an FTC policy statement on how the FTC Act's ban on unfair and deceptive practices applies to AI; and a legislative recommendation for a federal framework preempting conflicting state AI laws.
Physician read. It places no duty on physicians. The topics it says the proposed federal preemption should not reach (child safety protections, AI compute and data center infrastructure, state procurement and use of AI, and other topics to be determined) do not name health care.
Notes: The FTC proposed the policy statement called for by section 7 on July 1, 2026 (separate entry). A Federal Register search for documents citing the order found no Commerce Department evaluation of state AI laws, BEAD policy notice or FCC proceeding; whether those steps and the Justice Department's task force were carried out elsewhere was not confirmed.
OMB Memorandum M-25-21, Accelerating Federal Use of AI through Innovation, Governance, and Public Trust (April 3, 2025)
Rescinds and replaces M-24-10 and requires agencies to designate chief AI officers, publish AI strategies and compliance plans, and, within 365 days, document minimum risk management practices for high-impact AI, which is presumed to include AI serving as a principal basis for agency decisions on the medically relevant functions of medical devices; patient diagnosis, risk assessment or treatment; allocation of care in public insurance; and control of health insurance costs and underwriting.
Physician read. It places no duty on physicians. HHS agencies' own AI uses that serve as a principal basis for decisions on patient diagnosis or treatment or the allocation of care in public insurance are presumed high-impact and require practices including pre-deployment testing, impact assessments, ongoing monitoring, human oversight and remedies or appeals.
Notes: Signed by OMB Director Russell T. Vought. Agencies had 365 days from issuance to document their minimum practices for high-impact AI and must stop using a noncompliant high-impact use; the effective date shown is that deadline. A companion memo, M-25-22, Driving Efficient Acquisition of Artificial Intelligence in Government (April 3, 2025), replaced M-24-18 and governs agencies' purchases of AI; it does not mention health care.
FTC, Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems (proposed), 91 FR 41638 (July 7, 2026)
Proposes that the FTC treat as deceptive the marketing of AI systems as accurate while steering their outputs toward objectives other than those set or reasonably expected by users, and says state law is impliedly preempted to the extent it conflicts with section 5 of the FTC Act, including a state law that requires an AI firm to deceive its consumers; comments closed July 31, 2026.
Physician read. It places no duty on physicians and is still a proposal. It is the policy statement Executive Order 14365 directed the FTC to issue.
Notes: Posted by the FTC July 1, 2026, after a 2-0 Commission vote, and published in the Federal Register July 7, 2026. It discusses Colorado's AI Act as a state law that may require altering AI outputs and notes that clinicians and patients increasingly use AI to help diagnose illness. No final statement was found in the Federal Register.
Most recently checked Sept 29, 2026. General information, not legal advice. How the map works, and the data.