Friday, September 11, 2026

1. Signal of the Day · Regulation & Policy

   FDA codifies the evidence standard for a machine-learning device — three years after it started binding sponsors

   A final order effective September 11, 2026 adds 21 CFR 870.2380, publishing the special controls for cardiovascular machine learning-based notification software — controls that have bound sponsors since the underlying De Novo order of August 3, 2023 and already govern ten product codes listed under 870.2380 in FDA's product classification database as of September 15. Nothing new is required today; what changed is that buyers can finally read the standard their vendors were measured against. The codified text is an unusually usable procurement yardstick: validation on a test dataset independent of training data, a minimum of three geographically diverse sites separate from training sites, subgroup performance by site and demographic group, a described ground-truth adjudication process, human-factors assessment of misinterpretation risk, and labeling that states the expected minimum performance and the subpopulations where the device may underperform. Healthcare technology leaders should put that same list to AI vendors selling software that is not a regulated device, where no one supplies those answers unless asked. (Corrected September 15; see Standards & Corrections.)

   HighBy Federal RegisterRead at source ↗

2. AI Tech & Frameworks

   Rural providers push back on AI as the answer to Medicaid cuts: time saved is not money saved

   Reporting from Maine and Louisiana, STAT finds rural systems facing roughly a trillion dollars in Medicaid cuts over the coming decade being pointed toward artificial intelligence, with CMS Administrator Mehmet Oz saying the best way to help rural communities is AI-based avatars and a fifty billion dollar rural health transformation fund attached to the same cuts. Providers disagree on the record. Penobscot Community Health Care chief executive Lori Dwyer says ambient scribes offloaded administrative burden and cut documentation time, but that does not reduce costs — "I don't think it's going to save us." The piece names the preconditions that decide whether any of it works: broadband, faxed and handwritten forms, and data that is not reliably digestible by AI systems. It converges with recent emergency-department scribe research on the same finding, and under-resourced long-term and post-acute operators face identical arithmetic.

   MedBy Daniel Payne · STATRead at source ↗

3. AI Tech & Frameworks

   FDA grants a rare De Novo to an EKG algorithm for heart attack triage

   FDA authorized Powerful Medical's Queen of Hearts algorithm, which aims to help triage patients to the right care during chest pain, through De Novo classification — a pathway fewer than ten devices receive each year and which typically requires more clinical evidence than the 510(k) route most AI devices travel. Two FDA machine-learning cardiology actions surfaced in the same news cycle and they are not the same event: the classification codified in the Federal Register this week belongs to Viz.ai's Viz HCM, decided in August 2023 for hypertrophic cardiomyopathy screening. They cannot be the same action, because a device fitting the already-established classification would travel by 510(k) rather than De Novo. Worth separating carefully before either is cited in a governance discussion.

   LowBy Katie Palmer · STATRead at source ↗

4. Security & AI Risk

   A 4.1 million record breach at a home medical equipment provider ran on stored credentials for connected systems

   HHS Office for Civil Rights has been informed that the electronic protected health information of 4,115,802 individuals was compromised at AdaptHealth, which supplies home medical equipment, diabetes supplies and sleep therapy to the same population moving through post-acute care. Per the company's own notice and securities filing as reported, the attack occurred June 5, 2026, the entry point was a social engineering attack on a third-party contractor whose credentials were obtained, and the attacker then took a stored password file tied to insurance billing along with access to external electronic health record portals. Read alongside the Mirth Connect advisory published the same week, the pattern is the one to govern: the credential store that vendors and integration tooling hold is the actual blast radius, not the application that gets named in the headline.

   MedBy HIPAA JournalRead at source ↗

5. Security & AI Risk

   CISA advisory hits the interface engine that brokers much of healthcare's integration traffic

   ICSMA-26-253-01, released September 10, covers NextGen Healthcare Mirth Connect version 4.7.1 and earlier: three vulnerabilities at CVSS v3 8.3 comprising SQL injection and XML External Entity flaws, which CISA says could allow an attacker to exfiltrate data or cause denial of service. No known public exploitation has been reported to CISA at this time. The AI tie is nil, and that is the point worth making. Mirth is where HL7 and CCD traffic is brokered between an EHR and everything bolted onto it, so its configuration store holds credentials for downstream systems — the same layer every new AI feature rides on, and the layer that appears in no AI risk assessment. CISA released a second medical advisory the same day covering Orthanc DICOM Server.

   MedBy CISARead at source ↗

6. Regulation & Policy Standing item · proposed rule published December 29, 2025

   The ONC deregulatory rule that would delete AI model-card transparency is still unfinalized — and is routinely miscited

   The ASTP/ONC proposed rule that would fully remove the artificial intelligence model-card requirements from certified health IT published December 29, 2025 at 90 FR 60970 under RIN 0955-AA09 — not December 22, which was the public-inspection filing date. The widely used shorthand HTI-5 appears nowhere in the document. Verified this week: a Federal Register query on the RIN returns only the proposed rule, and 45 CFR 170.315(b)(11)(v) source attribute access and modification remains live in the eCFR, so the model-card requirements have not been removed. Comments closed February 27, 2026. Two lessons for anyone citing federal rules to a compliance audience: public inspection is not publication, and a rule's nickname is not its identifier.

   MedBy Federal RegisterRead at source ↗

7. Regulation & Policy

   Executive order mandates AI tools in veterans' benefits access within 180 days, with no AI-specific safeguard

   Executive Order 14426, signed September 8 and published September 11 at 91 FR 58003, directs the Secretaries of War and Veterans Affairs to create and deploy new digital tools using artificial intelligence to streamline veterans' applications for and access to benefits within 180 days. A full read of the operative text finds no accuracy standard, no human-review requirement, no appeal right, no testing or evaluation provision, and no AI-disclosure duty in Sections 1 through 4. The records-sharing subsection is expressly qualified by the Privacy Act and federal records statutes; the AI subsection carries no comparable qualifier. A separate provision gives agencies 120 days to add interoperability requirements to existing and future health IT contracts, in consultation with ONC. The pattern is worth watching independent of the agency: a federal AI deployment in benefits adjudication on a hard clock and without an evaluation gate, while Congress separately debates disclosure duties for payer AI denials.

   HighBy Federal RegisterRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS