Tuesday, August 18, 2026

1. Signal of the Day · Security & AI Risk

   Shareholder derivative suit reframes algorithmic and cyber risk as a board oversight failure

   An amended derivative complaint filed August 7 in Minnesota federal court accuses twelve current and former UnitedHealth directors and officers of "corporate governance failures on a historic scale," and asks the court to order improved governance, Medicare Advantage compliance programs, cybersecurity controls meeting industry standards, and bars on serving as officers or directors. It is not an AI lawsuit — the care-denial strand sits inside an omnibus allegation alongside Medicare billing, the Change Healthcare breach, and earnings management. The theory is what healthcare technology leaders should note: plaintiffs argue internal warnings, government reports, and press coverage "created actual knowledge or constituted red flags putting the Board on notice," making inaction itself the wrong. The defensible answer to that theory is documentary — a board-visible AI and vendor inventory, written escalation thresholds, and minutes showing red flags were received and acted on.

   HighBy Jill Hughes · Healthcare DiveRead at source ↗

2. Regulation & Policy Surfaced late · published July 29

   FDA's new Division of Artificial Intelligence sits in the drug center, not the device center

   FDA's Statement of Organization, Functions, and Delegations of Authority (FR Doc 2026-15297, 91 FR 47835, published July 29, 2026) establishes, under the Center for Drug Evaluation and Research's Office of Medical Policy and its Office of Innovation and Clinical Trial Modernization, a standing Division of Artificial Intelligence alongside a Division of Real-World Evidence Analytics. A headline reading "FDA creates AI division" will be mistaken for device-regulatory news; it is not CDRH, not software-as-a-medical-device, and imposes no obligation on care providers. It matters because standing organizational units outlast guidance documents, and this is now where durable FDA doctrine on AI in drug review and real-world evidence will be produced. The AI substance is buried in an org chart — the kind of item keyword news search never surfaces.

   LowBy Federal RegisterRead at source ↗

3. Regulation & Policy Surfaced late · published July 16

   DOJ's algorithmic-pricing consent decree targets the software's user, not the software — and it settles a landlord, not RealPage

   FR Doc 2026-14345 (91 FR 43774, published July 16, 2026) is a Tunney Act notice in United States et al. v. RealPage, Inc., et al., Civil Action No. 1:24-cv-00710 (M.D.N.C.). Widely described as the RealPage settlement, it in fact resolves the case against landlord co-defendant Willow Bridge Property Company, LLC; the proposed Final Judgment filed July 6, 2026 bars Willow Bridge from licensing or using revenue management software that relies on competitively sensitive data, prohibits sharing competitively sensitive information with other landlords, requires an antitrust compliance policy, and requires continued cooperation against the remaining defendants. The remedy is the notable part: not a fix or an explanation of the algorithm, but a prohibition on the use of a model fed by pooled competitor data. Applicability is indirect — rental housing, not healthcare — but it is the closest live U.S. precedent to the liability theory circling payer algorithmic decision-making. Comments are invited within 60 days of the notice; the notice itself prints no calendar deadline.

   MedBy Federal RegisterRead at source ↗

4. Security & AI Risk Surfaced late · published August 13

   Change Healthcare witnesses describe rushed integration and missing MFA as a governance failure, not a technical one

   Two confidential witnesses who held leadership roles at Change Healthcare allege the post-acquisition integration was deliberately rushed while a government appeal was pending, leaving the acquirer unable to assess the acquired risk profile; the complaint cites a deficient firewall, improper access controls including missing multifactor authentication, and management declining to fund remediation. The 2024 ransomware attack that followed exposed data on 190 million people and cost more than $2 billion. For a consolidating post-acute and senior living sector, this is the clearest public articulation of integration speed as a governance failure: an AI governance program layered onto an unremediated acquired estate inherits that estate's blast radius, and the controls at issue are unglamorous and pre-AI.

   MedBy John Tozzi and David Voreacos · Claims JournalRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS