Tuesday, September 22, 2026

1. Signal of the Day · Regulation & Policy

   CDC opens comment on data intermediaries, asking how AI changes their governance role

   What happenedCDC and HHS opened a request for information on public-health data intermediaries, asking how AI changes their role and what attestation they need; comments close November 20, 2026.

   Why it mattersSNF and senior-living data rarely travels direct: EHR vendors, HIEs, submission pipelines and state agencies are all intermediaries a future duty could reach.

   For leadersAn RFI imposes no obligation; watch for conformance-testing, certification or attestation requirements in what follows.

   HighBy Centers for Disease Control and Prevention · Federal RegisterRead at source ↗

2. Security & AI Risk Living page · read September 22

   No new ICS-medical advisory since September 9

   What happenedCISA has published no new ICS-medical advisory since September 9, when it flagged Orthanc DICOM Server and NextGen Mirth Connect.

   Why it mattersThe medical-device advisory channel was checked, not assumed quiet; the September 9 advisories remain the latest to patch against.

   For leadersConfirm whether any interface engine or imaging system in use runs the affected Orthanc or Mirth Connect versions.

   LowBy CISARead at source ↗

3. Security & AI Risk

   At OCR's own HIPAA security conference, the agency kept returning to a requirement that is not in the proposed rule

   What happenedA compliance attorney's account of the NIST/OCR HIPAA Security Conference reports OCR stressing that a gap analysis does not satisfy the HIPAA risk-analysis requirement.

   Why it mattersOCR framed risk to ePHI where it is created, where it moves and where it leaves — and every ambient scribe, predictive model or copilot adds all three.

   For leadersRedo the HIPAA risk analysis for each AI tool that touches resident data; one written before those tools does not cover them.

   HighBy Jake Dewberry, JD · The HIPAA JournalRead at source ↗

4. SNF / Post-Acute Surfaced late · published September 13

   Senior-living fall-prediction vendor Inspiren raised $70M, and the governance detail is where inference runs

   What happenedInspiren raised $70 million for AUGi, a wall-mounted fall-prediction camera the company says is in more than 500 senior-living communities.

   Why it mattersIn-room cameras are scaling faster than resident-consent practice, and the claim that video is processed on the device is the vendor's own.

   On the floorStaff are alerted before a fall rather than after it, which changes response expectations and training.

   For leadersAsk any in-room vision vendor where frames are processed, how long they are kept and who can replay them.

   MedBy Katie Adams · MedCity NewsRead at source ↗

5. Regulation & Policy

   FDA writes "computer modeling" into its definition of a nonclinical test, and says the scope is unchanged

   What happenedFDA's direct final rule swaps "nonclinical" for "animal" in its drug regulations and lists "computer modeling" as a nonclinical method; comments close December 7, 2026.

   Why it mattersIt is drug development under Part 312, touching no post-acute setting or device pathway; the text never mentions AI, and FDA says scope is unchanged.

   For leadersTreat claims that FDA now endorses AI evidence as overstated; this is a terminology amendment.

   LowBy Food and Drug Administration · Federal RegisterRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS