Insights

In its first healthcare proposed regulation, the Trump Administration, through the Centers for Medicare & Medicaid Services (CMS), displayed on March 10, 2025, a proposed rule titled, “2025 Marketplace Integrity and Affordability Proposed Rule” (the Proposed Rule), which proposes policy changes for the Health Insurance Marketplaces that impact health plans and insurers offering Affordable Care Act (ACA) coverage to consumers. Specifically, the Proposed Rule shortens the Annual Open Enrollment Period (OEP) for all individual market coverage; proposes standards related to income verification for Health Insurance Marketplaces (Marketplaces); modifies eligibility redetermination procedures; and eliminates eligibility for “Deferred Action for Childhood Arrivals” (DACA) recipients, among other provisions.  

Digital health companies, investors, and other healthcare organizations should follow policy developments with a strategic lens towards their market opportunities for key potential growth and risk mitigation. On a quarterly basis, we provide relevant legislative and regulatory updates on artificial intelligence (AI) and digital health policy developments.

On Monday, July 15, New Jersey Attorney General Matthew J. Platkin and the New Jersey Division of Consumer Affairs released proposed rules (the “Proposed Rules”) which require certain New Jersey healthcare providers (i.e., physician assistants, physicians, nurses, and midwives) who provide perinatal treatment and care to pregnant persons to undergo bias training. The training is designed to root out prejudices and stereotypes that may negatively impact the quality of care delivered by these providers to patients during pregnancy, labor, delivery, postpartum, and neonatal periods.  The Proposed Rules were promulgated in an effort “to address pronounced racial disparities in maternal and infant health outcomes in New Jersey.”

Digital health companies, investors, and other healthcare organizations should follow policy developments with a strategic lens towards their market opportunities for key potential growth and risk mitigation. On a quarterly basis, we provide relevant legislative and regulatory updates on artificial intelligence (AI) and digital health policy developments.

On January 17, 2024, the Centers for Medicare & Medicaid Services (CMS) issued the Interoperability and Prior Authorization Final Rule (Final Rule), which establishes requirements applicable to certain impacted payers which are intended to improve the electronic exchange of health information and prior authorization processes. The application programming interface (API) requirements will take effect January 1, 2027, while the operational provisions will take effect January 1, 2026. CMS has issued a helpful slide deck summarizing the Final Rule.

On December 13, 2023, the U.S. Department of Health and Human Services' (HHS) Office of the National Coordinator for Health Information Technology (ONC) released the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing (HTI-1) Final Rule. The effective date of the HTI-1 Final Rule is updated and is now March 11, 2024.

On November 1, 2023, the Centers for Medicare & Medicaid Services (CMS) and Office of the National Coordinator for Health Information Technology (ONC) at the Department of Health and Human Services (HHS) issued the “21st Century Cures Act: Establishment of Disincentives for Health Care Providers That Have Committed Information Blocking” proposed rule (Proposed Rule). Comments are due by January 2, 2024.

On November 2, 2023, the Centers for Medicare & Medicaid Services (“CMS”) released the calendar year (“CY”) 2024 Hospital Outpatient Prospective Payment and Ambulatory Surgical Center Payment Systems Final Rule (“CY 2024 OPPS/ASC Final Rule”). The final rule with comment period finalizes payment rates and policy changes affecting Medicare services furnished in hospital outpatient and ambulatory surgical center (“ASC”) settings for CY 2024.

On October 30, President Joe Biden signed an Executive Order (“EO”) 14110 entitled, “Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence,” which establishes a policy framework to manage the risks of artificial intelligence (“AI”), to direct agency action to regulate the use of health AI systems and tools, and to guide AI innovation across all sectors, including in the health and human services sectors. OMB simultaneously released a draft memorandum that would specifically direct department and agency action by establishing new agency requirements in AI governance, innovation, and risk management and adopting specific minimum risk management practices for uses of AI. OMB is seeking public comment on the memorandum by December 5, 2023, which includes a list of questions requesting feedback on specific issues.

Last week, Ranking Member Bill Cassidy (R-LA) of the Senate Committee on Health, Education, Labor and Pensions (“HELP”) issued two separate requests for information (“RFIs”) asking for stakeholder feedback on artificial intelligence (“AI”) and health data privacy policy issues to identify current challenges and receive recommendations to inform potential legislation.  With deadlines set for the end of September, each RFI provides a short window for organizations to submit comments.

On June 27, 2023, the Department of Health and Human Services (“HHS”) Office of Inspector General (“OIG”) issued a final rule (“OIG Final Rule”) that implements statutory provisions for its enforcement of the information blocking penalties created by the 21stCentury Cures Act (“Cures Act”) and assessment of civil money penalties (“CMPs”) of up to $1 million per violation of information blocking for certain individuals or entities subject to the information blocking requirements.

On April 11, 2023, the U.S. Department of Health and Human Services' (“HHS”) Office of the National Coordinator for Health Information Technology (“ONC”) released the Health Data, Technology, and Interoperability: Certification Program Updates, Algorithm Transparency, and Information Sharing Proposed Rule (“HTI-1 Proposed Rule”) to implement key provisions in the 21st Century Cures Act (“Cures Act”) governing health information technology (“health IT”) certification and information blocking, and other issues, as set forth further below.

On December 29, President Joe Biden signed into law the Consolidated Appropriations Act, 2023 (P.L. 117-164) (the “Act”)—an approximately $1.7 trillion spending package, which consists of all 12 fiscal year (FY) 2023 appropriations bills and funds the federal government through September 30, 2023, provides additional assistance to Ukraine, and makes numerous health care policy changes.  

On January 4, in its most recent effort to expand federal support for addressing health-related social needs (HRSNs), the Centers for Medicare & Medicaid Services (CMS) issued guidance to clarify an existing option for states to address HRSNs through the use of “in lieu of” services and settings policies in Medicaid managed care. This option is designed to help states offer alternative benefits that take aim at a range of unmet HRSNs, such as housing instability and food insecurity, and to help enrollees maintain their coverage and improve health outcomes. 

On December 6, 2022, the Centers for Medicare & Medicaid Services (CMS) issued a Proposed Rule that would (i) further enhance health data exchange by establishing data exchange standards for certain payers, (ii) improve patient and provider access to health information, and (iii) streamline processes related to prior authorization for medical items and services. The regulations impact CMS-regulated payers and provide incentives for providers and hospitals that participate in the Medicare Promoting Interoperability Program and the Merit-based Incentive Payment System (MIPS).

The Office for Civil Rights (OCR) at the Department of Health and Human Services (HHS) recently issued a bulletin to highlight the obligations of Health Insurance Portability and Accountability Act of 1996 (HIPAA) on regulated entities under the HIPAA Privacy, Security, and Breach Notification Rules when using online tracking technologies. The bulletin defines tracking technologies, provides examples of potential impermissible disclosures of electronic protected health information (ePHI) by HIPAA regulated entities to online technology tracking vendors, and outlines procedures regulated entities must take to protect ePHI when using tracking technologies in order to comply with HIPAA rules.

Crowell & Moring and Crowell Health Solutions hosted a HealthTech roundtable with discussions focused on value-based care, health equity, data privacy, artificial intelligence, and other trends in health care technology in the Washington, D.C. office on October 27. The sessions featured numerous experts from health technology companies, advocacy organizations, and trade associations, all of whom have extensive experience advising on health care policy and business issues. Policy makers, thought leaders, health care innovators, and business executives also joined the conversation.