Saturday, September 5, 2026

1. Signal of the Day · SNF / Post-Acute Surfaced late · published September 1

   CMS Widens the SNF Data Surface: All-Payer MDS Reporting, a Faster QRP Clock, and an Open RFI on Case-Mix Upcoding

   The FY2027 SNF PPS final rule (CMS-1843-F) compresses the Quality Reporting Program submission window from 4.5 months to the fifteenth day of the second month after each quarter beginning with the FY2029 QRP, requires MDS submission for every resident admitted or readmitted for covered skilled care regardless of payer for admissions on or after October 1, 2029, and carries an open Request for Information on addressing case-mix upcoding under PDPM with no adjustment finalized this year. Read alongside QSO-26-14-NH, where a failed MDS audit is an independently disqualifying criterion for the risk-based survey, the practical lesson for skilled nursing and post-acute operators is that the highest-consequence automated scoring they face runs on their own submitted data — which an AI governance program scoped only to clinical AI would never touch. Two corrections against the CMS primary are worth carrying forward: the requirement covers residents receiving covered skilled care rather than every payer and every resident, and the $203.60 million figure is the SNF Value-Based Purchasing net payment reduction rather than a wage-index effect.

   HighBy Zahida Siddiqi · Skilled Nursing NewsRead at source ↗

2. AI Tech & Frameworks

   Separation of Duties Arrives for the Most Irreversible Action in a Compliance Platform

   Microsoft Purview's priority cleanup, the mechanism that expedites permanent deletion of sensitive or redundant content ahead of its retention schedule, now requires three separate approvers: a priority cleanup administrator, a retention manager and an eDiscovery administrator. Separately, Purview role-group assignments can now carry an expiration date, bringing time-bound access to roles that sit outside privileged identity management without additional licensing. Both are small changes with a transferable principle for any AI and information governance program: the platform's single most irreversible action should require more than one role to authorize, and standing administrative access should expire by default rather than persist until someone remembers to remove it.

   LowBy Albert Hoitingh · Albert HoitinghRead at source ↗

3. Security & AI Risk Surfaced late · page updated August 31

   Microsoft Sets Out Where an AI Prompt Control Actually Belongs: Three Enforcement Layers, Not One

   Microsoft's Purview blog sets out a layered data-protection model in which endpoint, browser and network controls are complementary rather than interchangeable: endpoint data loss prevention carries the deepest classification support and works offline, browser data security is described as the most precise layer for AI prompts, and network data security handles traffic that never touches a browser and supports inbound classification of content returning from cloud and AI applications. Microsoft states plainly that enforcing on the managed endpoint alone leaves unmanaged devices and browser-based egress uncovered. This is the concrete control architecture for exposures that have no vendor contract, no procurement review and no device-management footprint — staff using consumer AI tools, unmanaged agent extensions, and sensitive content pasted into unsanctioned services. Several capabilities remain in preview or consumption-billed, and preview features should stay bounded pilots rather than be represented as operating controls.

   MedBy Microsoft Purview BlogRead at source ↗

4. Regulation & Policy

   Two Nursing-Home Residents' Rights Memos Carried as Rescinded — A Reminder That Governance Also Moves Backwards

   The CMS policy-memo listing carries QSO-21-02-NH and QSO-24-21-NH, both addressing compliance with residents' rights requirements related to nursing home residents' right to vote, as rescinded effective July 20, 2026. Neither memo has AI content and this is context rather than breaking news, but it illustrates a blind spot common to AI and health-policy monitoring: coverage organized around new rules systematically misses rules being withdrawn, narrowed, delayed or preempted. For healthcare technology and compliance leaders, tracking rescissions and moratoria alongside new issuances is the only way to see which direction a regulatory regime is actually moving.

   LowBy CMSRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS