Today's briefing covers two Federal Register actions that change how regulated health data is produced, shared, and published, plus a CMS funding announcement that puts new health-information infrastructure into rural hospitals. Final rules from Treasury, Labor, and HHS restructure the machine-readable price-transparency files that health plans must post, and a CMS proposed rule would amend the Clinical Laboratory Improvement Amendments (CLIA) regulations to allow virtual access to laboratory data and digital images for gynecologic cytology proficiency testing.
The Treasury Department (Internal Revenue Service), the Labor Department (Employee Benefits Security Administration), and the Department of Health and Human Services published final rules (FR Doc. 2026-20447, 2026-10-06) amending the price transparency reporting requirements under the Public Health Service Act, the Employee Retirement Income Security Act of 1974, and the Internal Revenue Code for non-grandfathered group health plans and health insurance issuers offering non-grandfathered group and individual coverage. The stated purpose, aligned with Executive Order 14221, is to improve the standardization, accuracy, and accessibility of public pricing disclosures. For the In-network Rate and out-of-network Allowed Amount machine-readable files, the rules add new contextual files and additional data elements such as product type, provider network name, and provider network identifier; change the reporting level for aggregation of data; remove in-network rates for unlikely provider-to-service mappings; increase the reporting period and lower the claims threshold for out-of-network historical data; and reduce the reporting cadence. The rules also aim to improve the findability of all publicly disclosed machine-readable files.
These files are public by design, but the out-of-network Allowed Amount file is derived from claims, and the rule changes the aggregation level and lowers the claims threshold for that historical data, which changes which populations and providers become visible in a public artifact. Compliance and privacy teams at plans and issuers should treat the new specification as a data-pipeline change rather than a formatting update: re-run small-cell and re-identification review against the new aggregation level and threshold, confirm that the new provider network identifiers and contextual files disclose only what the rule requires, and move publication to the reduced cadence without letting stale files linger. Teams building analytics or AI products on these files should expect a schema change and plan ingestion for the new contextual files.
The CMS proposed rule (FR Doc. 2026-20613, 2026-10-08) would amend the CLIA regulations to allow virtual access under the CLIA certificate of the primary testing laboratory that generated the data, with the exception of the subspecialty of cytology, and to permit the use of digital images for gynecologic cytology proficiency testing. The proposal also includes changes to personnel qualification requirements and further changes to SARS-CoV-2 reporting requirements, certificate requirements, test reporting requirements, enforcement requirements, public consultation requirements, and editorial and technical updates. CMS frames the package as strengthening federal oversight of clinical laboratories and ensuring accurate and reliable patient test results while adapting to modern technological capabilities and industry needs, including workforce shortages.
Virtual access means laboratory data generated under one certificate will be reviewed and acted on from locations that are not the laboratory, and digital proficiency-testing images are regulated clinical material moving through imaging, storage, and transfer systems. For covered entities and their business associates, both changes expand the set of systems, networks, and remote endpoints that handle protected health information under the certificate holder's responsibility. Laboratory compliance, privacy, and security officers should read the proposal with attention to how remote access will be authenticated and logged, how digital images are stored and transmitted, and how the revised test-reporting and SARS-CoV-2 reporting requirements alter data flows to public health authorities. The rule is at the proposed stage, so this is the window to comment on technical safeguards.
CMS announced on 2026-10-09 a $209 million federal investment in rural Iowa. According to the release, the funding will bring advanced surgical capabilities to rural hospitals, connect patients with maternal specialists through telehealth, and modernize health information sharing across the state, with cancer prevention also named among the program's aims.
Two of the three named uses, maternal telehealth and health-information-sharing modernization, are health-data infrastructure projects, and each introduces new platforms, vendors, and network connections that will handle protected health information. Organizations receiving these funds should budget for the HIPAA Security Rule work that comes with them, including an updated risk analysis, business associate agreements with telehealth and exchange vendors, and access controls on the new connections, rather than treating the award as clinical-only spend.
