Tuesday, October 6, 2026

1. Signal of the Day · Regulation & Policy Surfaced late · published September 30

   Senate passes bill directing HHS to require MFA, encryption and penetration testing for all HIPAA entities

   What happenedThe Senate passed S. 3315, which would direct HHS to require multifactor authentication, PHI encryption and penetration testing, effective 36 months after enactment.

   Why it mattersSNFs, other covered entities and vendors would face a statutory HIPAA security floor, with the NIST AI Risk Management Framework listed as an eligible basis.

   For leadersWatch House Energy and Commerce action, and map multifactor, encryption and penetration-testing coverage across facilities and vendors before any deadline exists.

   HighBy GovInfo (GPO)Read at source ↗

2. Regulation & Policy

   White House names intelligence director to lead a Super Intelligence Force with 120 days to report on AI risks

   What happenedThe President named DNI Jay Clayton to chair a task force with 120 days to report on AI risks and opportunities, per GovExec; the FTC chairman is a vice chair.

   Why it mattersNothing binds SNF or AL/SL operators yet, but the charter's breach-notification work and the FTC chair's role could later shape health-data rules.

   For leadersWatch the 120-day report for breach-notification or consumer-protection proposals that would reach resident data and AI vendors.

   LowBy David DiMolfetta · GovExecRead at source ↗

3. SNF / Post-Acute Surfaced late · published October 2

   CMS posts draft MDS 3.0 item sets version 1.21.1, effective October 1, 2027

   What happenedCMS posted draft MDS item sets v1.21.1, effective October 1, 2027; per the draft and current item matrices, item O0350 (COVID-19 vaccination status) is dropped.

   Why it mattersNo AI content; it runs because it changes what SNF assessments must capture, giving MDS vendors and coordinators a year of notice.

   For leadersAsk MDS software vendors when draft v1.21.1 changes reach test environments and how removed items flow through quality reporting.

   LowBy CMSRead at source ↗

4. Security & AI Risk

   CISA sends final cyber incident reporting rule to White House review; 72-hour reporting would add to HIPAA duties

   What happenedCISA's final CIRCIA rule is under White House review, per HIPAA Journal: substantial cyber incidents reported within 72 hours, ransom payments within 24, publication expected by year-end.

   Why it mattersThe proposed scope covered health-sector entities above SBA size standards, which could put larger SNF and AL/SL operators on a second federal reporting clock.

   For leadersConfirm whether the organization exceeds SBA size standards, and plan incident response for parallel CISA and HIPAA reporting.

   MedBy Steve Alder · HIPAA JournalRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS