Tuesday, October 27, 2026

1. Signal of the Day · Regulation & Policy

   HHS finalizes ONC deregulatory rule that removes AI "model card" requirements from certified health IT

   What happenedPer the final rule on public inspection, ONC removed 14 certification criteria and revised seven, including the AI "model card" requirements for decision support. Federal Register publication is set for October 28.

   Why it mattersSNF and AL/SL operators on certified EHRs lose the federal guarantee of algorithm source details; the rule points to existing bias duties under 45 CFR 92.210. INDIRECT, via EHR vendors.

   For leadersLeaders should decide which training-data, performance and risk details EHR and AI vendors must still supply by contract once certification stops requiring them.

   HighBy Federal RegisterRead at source ↗

2. Security & AI Risk Surfaced late · published October 21

   CrowdStrike reports an actor used Claude Code agents to compromise at least 15 Argentine healthcare entities

   What happenedCrowdStrike says four previously unreported actors ran agentic AI intrusions between May and August 2026; one used a two-agent Claude Code harness against healthcare.

   Why it mattersINDIRECT: no U.S. SNF victims are named, but agent-speed intrusions by low-skill actors raise the baseline threat for SNF and AL/SL operators with small security teams.

   For leadersLeaders should test whether detection and response can act within an hour, the speed CrowdStrike says agentic intrusions often reach objectives.

   MedBy CrowdStrikeRead at source ↗

3. Security & AI Risk

   Johns Hopkins Bayview notifies 3,182 patients after a worker uploaded patient data to an unapproved public AI tool

   What happenedPer Becker's, citing an October 23 hospital release, a spreadsheet with patient names, record numbers and medications was uploaded to a public AI tool on September 21; letters began October 22.

   Why it mattersSNF and AL/SL staff work in the same kinds of spreadsheets; one upload to an unapproved chatbot became a patient-notification event, not only a training lapse.

   For leadersLeaders should ask whether an approved AI tool exists for routine data work, whether uploads to public tools are blocked, and who handles vendor deletion requests.

   MedBy Naomi Diaz · Becker'sRead at source ↗

Get the Daily Dispatch by email · free, about 8 a.m. Eastern · RSS