Federal AI and Health Policy: What Boards Should Know in October 2026

In November 2024, I set out 14 areas where I expected federal health policy to shift. Two years later, the direction was mostly right and the mechanism was often wrong, which is the best argument I know for governing by instrument rather than by forecast.

In Brief

The Problem. Federal policy on health care and artificial intelligence (AI) has moved in several directions at once since January 2025: lighter review for some software, faster drug pathways, new federal uses of AI in payment, a stricter security rule still pending, and coverage and trade changes that press margins.

Why It Persists. Boards are asked to plan against forecasts, and forecasts about policy mechanisms are usually wrong even when they are right about direction. Deregulation is also easy to read as permission, when it actually moves the burden of evidence from the regulator to the organization.

What Boards Should Do. Separate what is in force from what is proposed and what is in litigation; attach conditions to every AI approval that hold under each outcome; and keep the board at oversight, with the inventory, the named accountable executive, and the deliberation recorded in the minutes.

What My 2024 Forecast Got Right, and What It Missed

In November 2024, I drafted an assessment for boards and chief executives of 14 areas where I expected federal statutes, regulations, guidance, and agency leadership to change. The areas ran from the Food and Drug Administration (FDA) to coverage, payment, public health, and data privacy. For each one I set out risks, opportunities, implications, and mitigation steps. I am revisiting it now because two years of evidence are a better teacher than any forecast.

The record is mixed in an instructive way. I expected faster FDA pathways, and they came. I expected Medicaid block grants, and Congress chose work requirements and provider-tax limits instead. I expected the Health Insurance Portability and Accountability Act (HIPAA) rules to loosen, and the pending Security Rule overhaul is stricter. I wrote almost nothing about AI, and AI is now the thread that runs through most of the federal changes that matter to a board.

My argument in this briefing is simple. Boards should not govern by forecast. They should govern by instrument: know which executive order, statute, rule, guidance, or court decision is in force, which is only proposed, and which is being litigated, and require oversight that holds whichever way each one settles. Where federal review recedes, the organization's own records become the evidence. This article covers the federal instruments. Our companion briefing, State Law and Private Enforcement: The 2027 Compliance Calendar for Health and Life Sciences Boards, covers the areas where states, courts, and private plaintiffs now set the rules: state and private enforcement, reproductive and gender-affirming care, controlled substances, health equity, and state health data privacy.

Four Channels of Federal Change

My 2024 draft organized change into four channels. The framework has held up, and each channel now has concrete examples.

• Statutes and legislation. The One Big Beautiful Bill Act, signed on July 4, 2025, rewrote Medicaid financing and eligibility (Association of State and Territorial Health Officials [ASTHO], 2025). The Consolidated Appropriations Act, 2026, signed on February 3, 2026, extended Medicare telehealth flexibilities through December 31, 2027 (Kaveney and Thonse, 2026).
• Regulations and guidance. FDA replaced its clinical decision support (CDS) and general wellness guidance on January 6, 2026 (King and Spalding, 2026), and the health IT certification program faces the proposed HTI-5 rule (Covington and Burling, 2026).
• Leadership appointments and agency structure. The Department of Health and Human Services (HHS) announced a consolidation from 28 divisions to 15 and a reduction from 82,000 to 62,000 full-time staff (U.S. Department of Health and Human Services [HHS], 2025a). HHS also removed all 17 members of the Advisory Committee on Immunization Practices (ACIP) in June 2025 (Franco, 2025).
• General policy. Executive Order 14365 of December 11, 2025, directed the Attorney General to establish a task force to challenge state AI laws (Exec. Order No. 14365, 2025), and a Section 232 proclamation of April 2, 2026, placed duties on patented pharmaceuticals (Polsinelli, 2026).

The channels matter because they move at different speeds and carry different weight. Guidance can change overnight and without comment. A statute binds until Congress acts again. An executive order directs the executive branch but does not itself overturn state law (Paul Hastings, 2025). A board that knows which channel produced a change knows how durable it is.

The Scorecard: Fourteen Areas, Two Years Later

The table compares what my November 2024 draft expected with what had happened by October 21, 2026. Each entry is sourced in the section that discusses it, in this article or in the companion briefing.

Area	Expected in November 2024	What Happened by October 21, 2026	Assessment
FDA overhaul and expedited approvals	Faster pathways, looser standards	Priority voucher program with one-to-two-month reviews; lighter CDS and wellness guidance; AI drug guidance still in draft	Borne out
Federal oversight and state and private enforcement	Less federal enforcement; more state and private action	States legislated on AI; private AI coverage suits advanced; the federal government moved to challenge state AI laws	Direction right; preemption push missed (companion briefing)
Reproductive and gender-affirming care	Restrictions	Supreme Court upheld a state ban for minors; CMS ended federal Medicaid funding for minors; HIPAA reproductive privacy rule vacated	Borne out (companion briefing)
Marijuana and controlled substances	Possible reversal of rescheduling	Certain medical marijuana moved to Schedule III; broader hearing completed	Wrong (companion briefing)
Supply chain and localization	Tariffs and domestic incentives	Default 100 percent duty on listed patented pharmaceuticals, with exemptions for onshoring agreements	Borne out, and larger than expected
Vaccines and novel therapies	More vaccine scrutiny; openness to novel therapies	ACIP reconstituted; narrower COVID-19 vaccine framework; new pathways for individualized therapies	Borne out
Over-the-counter (OTC) expansion	More prescription-to-OTC switches	The enabling rule was finalized in December 2024, before the transition	Pathway exists; outcome not yet measurable
Digital health	Lighter oversight; telehealth expansion	Telehealth extended through 2027; CDS guidance loosened; AI transparency rule proposed for removal	Borne out
Coverage and insurance markets	ACA repeal or modification	No repeal; enhanced tax credits expired; individual market enrollment fell 18 percent	Mechanism differed; effect real
Medicare and Medicaid	Block grants and funding caps	Work requirements, provider-tax limits, and a USD 50 billion rural fund instead	Direction right; mechanism wrong
Value-based care	Less support	New strategy requiring downside risk in all models; AI-assisted prior authorization in traditional Medicare	Partly wrong; AI not anticipated
Public health funding	Cuts	HHS restructuring; withdrawal from the World Health Organization	Borne out
Health equity and access	Coverage losses; rule changes	Projected coverage losses; public charge rule rescinded; anti-discrimination enforcement uncertain	Borne out in direction (companion briefing)
Data privacy and information exchange	HIPAA relaxed; fewer audits	Stricter Security Rule pending for July 2027; one privacy rule vacated by a court	Mostly wrong

Three lessons stand out. The forecasts about direction were usually right. The forecasts about mechanism were wrong often enough that a plan built on them would have needed rework. And the one subject I treated as peripheral, AI, now runs through the federal changes in FDA review, health IT certification, Medicare payment, and agency operations.

FDA: Faster Pathways, Lighter Software Review, and Draft AI Guidance

I expected an FDA overhaul that would speed approvals, rely more on real-world evidence, and widen access to experimental treatment. Much of that came. On June 17, 2025, the Commissioner announced the Commissioner's National Priority Voucher program, which shortens review from approximately 10 to 12 months to one to two months for products that meet stated national priorities, including domestic manufacturing (FDA, 2025c). The program is producing approvals: on March 19, 2026, FDA approved its fourth product under the program, a higher dose of semaglutide, 54 days after filing (FDA, 2026b). On February 23, 2026, FDA issued draft guidance on a "plausible mechanism" framework for individualized therapies that allows a single externally controlled study, supported by natural history data, with post-approval confirmatory evidence (Peay et al., 2026). The Right to Try Act, signed on May 30, 2018, remains the route for eligible patients to seek investigational drugs outside trials (Trickett Wendler, Frank Mongiello, Jordan McLinn, and Matthew Bellina Right to Try Act of 2017, 2018), and FDA does not review or approve those requests (U.S. Food and Drug Administration [FDA], n.d.).

For software, the change is larger than I anticipated. FDA's January 6, 2026 guidance means software that offers a clinician a single recommendation no longer fails the CDS criteria automatically, and certain non-invasive wearables that estimate physiological values can qualify for enforcement discretion (King and Spalding, 2026). More AI-enabled tools may now reach clinicians without FDA review. For drug and biologic sponsors, FDA's January 2025 draft guidance on using AI to support regulatory decision-making remains a draft (FDA, 2025a). On January 14, 2026, FDA published ten guiding principles of good AI practice in drug development, developed with the European Medicines Agency (EMA) (FDA, 2026a). FDA also uses AI itself: it introduced the generative AI tool Elsa on June 2, 2025, to accelerate clinical protocol reviews and summarize adverse event reports (FDA, 2025b), and announced agentic AI tools for staff, including for premarket review and inspections, on December 1, 2025 (FDA, 2025d).

The risk I described in 2024 still holds. Faster approvals and lighter software review shorten time to market and lower development cost, but they shift more of the safety and efficacy burden to the period after launch, when recalls, liability, and lost trust are more expensive. The opportunity also holds: a sponsor that adapts quickly to new pathways can gain a lead. The board's role is to make sure the organization does not treat a lower external bar as its own standard.

In 2024 I suggested that boards create regulatory committees. I would now put it differently, because the board should not run compliance. The board should assign oversight of regulatory change to a named committee in its charter, and it should ask management for four things: scenario plans that model both expedited and traditional pathways; post-market surveillance and pharmacovigilance capable of detecting safety signals early; quality systems that hold to Good Manufacturing Practice and Good Clinical Practice whether or not the external requirement relaxes; and, for AI tools, a record of who validated each tool, against which population, and where the record sits. Life sciences sponsors should also assume that FDA reviewers will use AI to read their submissions, and should ask how their own documentation of model credibility would withstand that review.

Over-the-Counter Expansion: The ACNU Pathway

I expected the administration to expand the over-the-counter market. In fact the enabling rule came first, from the prior administration. FDA finalized the rule on nonprescription drug products with an additional condition for nonprescription use (ACNU) in December 2024, effective January 27, 2025 (Kimbrell and Menack, 2025). (My 2024 draft called this "ACSU," which was an error.) The rule allows a drug that would otherwise require a prescription to be sold without one if the consumer meets an added condition, such as completing a digital questionnaire that supports appropriate self-selection (Kimbrell and Menack, 2025).

The risks and opportunities I listed in 2024 remain. A switch can extend a product's commercial life near patent expiry, widen access, and lower cost for consumers. It can also expose the company to misuse without clinical supervision, to added studies to show that consumers can select and use the product safely, and to competition from store brands. What I did not see in 2024 is that the condition itself may be software. A digital questionnaire that decides whether a consumer may buy a drug is a gatekeeping tool, and the board should oversee it as one.

A board considering a switch should ask management which products qualify on safety profile and consumer self-management, how the self-selection tool was validated and how its performance will be monitored after launch, whether pharmacovigilance is ready for consumer use, and whether marketing and sales comply with state rules such as age restrictions. Distribution readiness, brand differentiation, and pricing are management's work; the board's work is to confirm that each has an owner and a measure.

Digital Health: Telehealth Extended, Transparency Rules Narrowed

I expected favorable federal conditions for digital health, including lighter oversight of low-risk software, broader telehealth, and support for data exchange. That has largely happened, with interruptions. Medicare telehealth flexibilities lapsed in early 2026 during a partial government shutdown (Miller, 2026). The Consolidated Appropriations Act, 2026, signed on February 3, 2026, extended them through December 31, 2027, and extended the Acute Hospital Care at Home waivers through September 30, 2030 (Kaveney and Thonse, 2026). The lapse is itself a lesson: a service line built on a temporary authority needs a plan for the day the authority expires.

On transparency, the direction is lighter. On December 29, 2025, the Assistant Secretary for Technology Policy and Office of the National Coordinator for Health Information Technology (ASTP/ONC) proposed the HTI-5 rule. It would remove the requirement that certified health IT developers supply source-attribute information, often called model cards, for predictive decision support tools, and would remove related risk management requirements (Covington and Burling, 2026). ASTP/ONC continues to describe HTI-5 as a proposed rule (ASTP/ONC, 2025). If it is finalized, the electronic health record vendor will no longer have to give the provider a standard description of each predictive model. The board can still require one by contract. That is a governance choice, not a regulatory default.

Private standards are filling some of the space. On June 1, 2026, the Joint Commission launched a voluntary Responsible Use of AI in Healthcare certification for hospitals and health systems, covering governance, data management, risk and bias reduction, monitoring and validation of safety performance, and transparency, education, and training (Guerra, 2026). It recognizes organizations, not products (Guerra, 2026).

The risks I listed in 2024 are the ones boards now face: weaker privacy and cybersecurity safeguards, uneven product quality when oversight recedes, and crowded markets. The opportunities are also real: faster market entry, telehealth reach into rural and underserved areas, and efficiency gains. The board should ask whether data security investment keeps pace with digital expansion, whether ethical data practices are written policy, whether incident response plans and cyber insurance cover the new tools, and whether vendor contracts require the model documentation that HTI-5 may no longer require.

Vaccines and Novel Therapies

I expected more scrutiny of vaccines and more openness to novel therapies. Both happened. On June 9, 2025, HHS removed all 17 sitting members of ACIP (HHS, 2025b), ahead of the committee's June 25 to 27 meeting (Franco, 2025). The change matters commercially as well as clinically, because private plans must cover ACIP-recommended vaccines without cost-sharing, and ACIP recommendations shape the Vaccines for Children program (Franco, 2025). On May 20, 2025, FDA leaders published a framework that limits COVID-19 vaccine availability to adults 65 and older and to people with risk factors, and calls for randomized trials before approval for others (American Hospital Association [AHA], 2025).

For novel therapies, the priority voucher program and the plausible mechanism framework described above lower the time and evidence needed for certain products. The risk for a vaccine sponsor is longer timelines, higher development cost, and lower uptake. The opportunity for a sponsor of individualized or rare disease therapies is a faster, more flexible route. Both raise the same board question: does our evidence package exceed the minimum, so that it holds if the policy turns again?

I would keep the 2024 mitigation steps, with the board's role made explicit. The board should see whether clinical development programs exceed baseline requirements, whether management engages regulators on evolving standards, how the company supports public understanding of the evidence for its products, and how management assesses any change in liability exposure. Decisions to diversify into new therapeutic areas belong to management, and the board should test them against the company's expertise and risk tolerance.

Supply Chain and Tariffs

I expected tariffs and incentives for domestic manufacturing. The result was larger than I anticipated. A Section 232 proclamation on April 2, 2026, set a default 100 percent duty on listed patented pharmaceuticals and active pharmaceutical ingredients (Polsinelli, 2026). Products from the European Union, Japan, South Korea, and Switzerland carry 15 percent, and companies with executed pricing and onshoring agreements may qualify for zero duty (Polsinelli, 2026). Generics and biosimilars are excluded for now, and the duties took effect on July 31 or September 29, 2026, depending on the company (Polsinelli, 2026).

The trade-off I described in 2024 is now a live decision. Imported inputs cost more, which presses margins and prices. Moving production home requires capital, time, and new supplier relationships, and it may not scale quickly enough to meet demand. Reducing reliance on a single foreign source improves security of supply. The tariff schedule turns these considerations into a calculation, because an onshoring agreement can change the duty from 100 percent to zero.

The board should oversee a current map of supply dependencies and the risks attached to each; review the financial case for domestic capacity, joint ventures, or supplier diversification; confirm that contingency plans exist for critical components; and ask whether management is using available government programs. Cost management practices are management's work. One question belongs to the board: AI investments in manufacturing or supply planning approved before 2026 were built on a cost base that no longer exists, and they should be tested against the new one.

Coverage and Insurance Markets

I expected repeal or major modification of the Affordable Care Act (ACA). The ACA was not repealed. The change came through expiration instead. Enhanced premium tax credits for Marketplace coverage expired on December 31, 2025; the House passed a three-year extension on January 8, 2026, but no extension was enacted (Jones, 2026). Individual market enrollment fell 18 percent between June 2025 and June 2026, from 25.2 million to 20.5 million people (KFF, 2026). The One Big Beautiful Bill Act also limited premium tax credits to certain lawfully present immigrants and allowed bronze and catastrophic plans to offer health savings accounts (ASTHO, 2025).

The implications I described in 2024 have arrived. Providers see shifts in volume and payer mix and more uncompensated care. Insurers redesign products and pricing. Margins were already thin: the median calendar year-to-date hospital operating margin, including allocations, was 1.9 percent in February 2026 (Dyrda, 2026).

Margin pressure is also the most common reason management brings AI proposals to the board, usually with a savings estimate attached. The 2024 mitigation steps still apply: monitor coverage policy and model its effect on operations, keep business models flexible, support patients facing coverage gaps, and look for other revenue sources. I would add one condition. Each AI proposal justified by margin should arrive with measures the board can track, a named owner, and a point at which the board will review whether the savings appeared.

Medicare and Medicaid

I expected block grants and funding caps for Medicaid. Congress chose a different mechanism. The One Big Beautiful Bill Act requires adults aged 19 to 64 to work or complete other qualifying activities for 80 hours a month, with state implementation by December 31, 2026 (ASTHO, 2025). It freezes new or increased provider taxes and lowers the threshold in expansion states by 0.5 percentage points a year from fiscal year 2028 until it reaches 3.5 percent (ASTHO, 2025). It caps state-directed payments, allows cost sharing of up to USD 35 per service for some expansion adults from October 1, 2028, and creates a Rural Health Transformation Program of USD 10 billion a year for fiscal years 2026 through 2030, or USD 50 billion in total (ASTHO, 2025). The Congressional Budget Office (CBO) estimated that the law will increase the number of uninsured people by 10 million in 2034 (Center for Children and Families, 2025).

The direction I expected was right: less federal money, more state discretion, more administrative burden. The mechanism was wrong, and a plan built around block grants would have modeled the wrong variables. Organizations that depend on Medicaid face lower revenue, more administrative work, and pressure on staffing and services, and some markets may see providers exit or consolidate. The rural fund is a real offset for organizations that qualify.

The 2024 mitigation steps hold, with the board's part named. The board should oversee financial modeling of the law's dates and effects on revenue, margin, and cash; review service line profitability and strategic value; and ask how management works with state Medicaid agencies on implementation, waivers, and the rural fund. Operational efficiency and payer mix diversification are management's work. Where management proposes AI to absorb the new administrative load, the board should ask what happens to patients when an automated process makes an error in eligibility or verification, and who reviews it.

Value-Based Care and the Federal Use of AI in Payment

I expected less federal support for value-based care. That proved partly wrong. On May 13, 2025, the CMS Innovation Center published a strategy built on evidence-based prevention, patient empowerment, and choice and competition, and it stated that all models must carry downside financial risk (Centers for Medicare and Medicaid Services [CMS], 2025). The federal government did not abandon value-based payment. It asked providers to carry more of the risk.

What I did not anticipate is the federal government as a user of AI in payment. On December 4, 2025, HHS released an AI strategy that unifies AI infrastructure across its divisions, including CMS, FDA, and the National Institutes of Health (HHS, 2025c). The Wasteful and Inappropriate Service Reduction (WISeR) model began on January 15, 2026, in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington (Patil, 2026). It applies AI-assisted prior authorization to selected services in traditional Medicare, with clinician review before a denial is final (Dinsmore and Shohl, 2025). On May 12, 2026, the Government Accountability Office (GAO) found that WISeR is a rule under the Administrative Procedure Act, and resolutions to repeal it under the Congressional Review Act were introduced on May 20, 2026 (Patil, 2026).

Commercial payers moved at the same time. Under commitments made in June 2025 with HHS and CMS, health plans report 11 percent fewer prior authorizations, and 15 percent fewer in Medicare Advantage; their 2027 priorities include standardized electronic prior authorization and more real-time responses (MedCity News, 2026).

The 2024 mitigation steps remain sound: evaluate the performance of existing value-based arrangements under alternative scenarios, keep contracting flexible between fee-for-service and risk, invest in the data and analytics that any payment model rewards, and stay focused on quality. Provider boards in the six WISeR states should also ask whether management tracks WISeR denials, overturn rates, and the staff time spent on appeals. Payer boards should ask how their own AI-assisted utilization management is reviewed, because the same questions are now being asked of the federal program.

Public Health Funding and Agency Capacity

I expected reductions in federal public health funding and capacity. The direction proved right. On March 27, 2025, HHS announced a restructuring that cut about 10,000 full-time positions, reduced total staff from 82,000 to 62,000 when combined with earlier departures, consolidated 28 divisions into 15, and created an Administration for a Healthy America from five existing agencies (HHS, 2025a). The United States withdrew from the World Health Organization effective January 22, 2026, under Executive Order 14155 of January 20, 2025 (HHS, 2026).

The implications I described remain. Reduced public health capacity can slow outbreak detection and response, raise the burden of preventable disease, and push more patients into emergency departments, which strains staff and finances. It can also widen disparities in communities that rely most on public programs. The opportunities I listed are still available to organizations that choose them: partnerships with community groups, philanthropy, and local government; technology-enabled outreach; and clearer priorities among programs.

A board does not run public health programs. It should ask management which of the organization's programs depend on federal public health funding, what the plan is if that funding ends, which partnerships sustain community health commitments, and whether alternative funding is being pursued. Where a nonprofit health system has made community health commitments, the board should see whether those commitments still have the resources to meet them.

Data Privacy and Health Information Exchange: Stricter, Not Looser

I expected HIPAA to be relaxed, with fewer audits, lower fines, and broader data sharing. That forecast was mostly wrong. In January 2025, HHS proposed the first major overhaul of the HIPAA Security Rule in two decades, and the federal regulatory agenda has moved the target for final action from May 2026 to July 2027, about 14 months later than planned (Landi, 2026). The pending rule is stricter, not looser.

One privacy rule did fall, through a court rather than through deregulation. On June 18, 2025, the U.S. District Court for the Northern District of Texas vacated the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy in Purl v. HHS (Hartsfield and Bourque, 2025). Amendments on Notices of Privacy Practices for substance use disorder records remain, with updates due by February 16, 2026 (Hartsfield and Bourque, 2025). The companion briefing covers the state health data laws that now govern much of this space.

Every AI deployment adds vendors, data flows, and system connections that the new Security Rule is likely to reach. The scale of vendor exposure is no longer hypothetical: Change Healthcare, a UnitedHealth Group company that filed its breach report with HHS in July 2024, reported on July 31, 2025, that approximately 192.7 million individuals had been affected (Office for Civil Rights, 2025). A board that approves AI tools in 2026 is approving obligations that will be measured against the 2027 rule. The 2024 mitigation steps fit that reality better than they fit my forecast: maintain privacy and security standards above the federal minimum, monitor federal and state changes, invest in security assessments and safeguards, build compliance that meets the strictest applicable standard, explain privacy practices to patients, oversee the security practices of vendors through contract, and keep incident response plans current.

The Strongest Objection: Less Federal Regulation Means Less Board Work

A director could reasonably argue the opposite of my thesis. If FDA reviews less software, if ASTP/ONC drops the model card requirement, and if Washington is challenging state AI laws, then the board can spend less time on AI compliance and let management move faster. Speed has value, and a board that adds process where the law has removed it can put its organization at a disadvantage.

The answer is that the board's duty does not come from the regulator. Under In re Caremark International Inc. Derivative Litigation, a director's obligation "includes a duty to attempt in good faith to assure that a corporate information and reporting system" exists and is adequate (In re Caremark, 1996). In Marchand v. Barnhill (2019), the Delaware Supreme Court rejected the argument that government inspections made board-level monitoring of food safety unnecessary, because nominal regulatory compliance did not show that the board had a monitoring system of its own (Marchand v. Barnhill, 2019). In September 2025, the Court of Chancery applied the same duty to FDA compliance, allowing an oversight claim to proceed against directors of the drug maker Teligent, whose board "had no committee charged with overseeing it" (Giuliano v. Grenfell-Gardner, 2025). For a health system or payer, clinical and coverage AI is close to the center of the business.

Private litigation shows where the evidence will be sought. In Estate of Lokken v. UnitedHealth Group, a magistrate judge ordered discovery that includes materials of the insurer's internal AI review board and the identities of its members (Greenberg et al., 2026). The allegations in that case are contested. The point for directors is that governance records are now discoverable evidence. Less federal regulation does not reduce that exposure; it removes one of the external records the organization could otherwise rely on.

What This Means for Oversight

Three principles hold whichever way federal policy moves. First, deregulation is not permission: where federal review recedes, the organization's own validation, monitoring, and minutes become the evidence. Second, comply with the rules in force today, including state law, and keep a plan that updates when a proposal is finalized, withdrawn, or struck down. Third, keep the board at oversight. The board asks for the AI inventory, the named accountable executive, and the conditions on each approval, and it records its deliberation in the minutes. It does not run the program.

My 2024 draft ended with a call for resilience and agility. I would now state it more plainly. Directors and executives need continuing education on the instruments that affect the organization, a habit of asking which channel produced each change, a focus on the patients, members, employees, and partners affected, and ethical leadership that holds standards when the external requirement relaxes.

For the Board

• Which of our AI tools now reach clinicians, patients, or consumers without FDA review, and who validated each one, against which population?
• Which federal instruments that affect us are in force, which are proposed, and which are in litigation, and who in management tracks each one?
• Do our vendor contracts require model documentation even if HTI-5 removes the federal requirement?
• Has each AI vendor been mapped against the HIPAA Security Rule requirements now expected in July 2027?
• Do our AI approvals justified by margin pressure carry measures, a named owner, and a review date, or only a savings estimate?
• For life sciences boards: how do we document the credibility of AI used in regulatory submissions while FDA guidance remains in draft, and have we tested our supply chain AI against the 2026 tariff schedule?

For a board-level briefing on these federal developments, book a conversation with Avancer.

References

American Hospital Association. (2025, May 20). FDA to limit COVID-19 vaccine to people over 65, others at high risk for serious illness. AHA News. https://www.aha.org/news/headline/2025-05-20-fda-limit-covid-19-vaccine-people-over-65-others-high-risk-serious-illness

Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology. (2025, December 30). HTI-5 proposed rule chart. Retrieved October 21, 2026, from https://healthit.gov/resources/hti-5-proposed-rule-chart/

Association of State and Territorial Health Officials. (2025, July 9). One Big Beautiful Bill law summary. https://astho.org/advocacy/federal-government-affairs/leg-alerts/2025/one-big-beautiful-bill-law-summary

Center for Children and Families. (2025, August 14). New CBO health coverage estimates of budget reconciliation law. Georgetown University McCourt School of Public Policy. https://ccf.georgetown.edu/2025/08/14/new-cbo-health-coverage-estimates-of-budget-reconciliation-law/

Centers for Medicare and Medicaid Services. (2025, May 13). Strategic direction: CMS Innovation Center 2025 strategy to make America healthy again. Retrieved October 21, 2026, from https://www.cms.gov/priorities/innovation/about/strategic-direction

Covington and Burling. (2026, January 15). HHS proposes changes to the health IT certification program and information blocking regulations in HTI-5 proposed rule. https://www.covingtonblogs.com/2026/01/15/hhs-proposes-changes-to-the-health-it-certification-program-and-information-blocking-regulations-in-hti-5-proposed-rule/

Dinsmore and Shohl. (2025, December 22). Is AI WISeR? CMS models AI-based prior authorization process in six states. https://www.dinsmore.com/publications/is-ai-wiser-cms-models-ai-based-prior-authorization-process-in-six-states/

Dyrda, L. (2026, May 11). Hospital profitability: 20 things to know in 2026. Becker's Hospital Review. https://www.beckershospitalreview.com/finance/hospital-profitability-20-things-to-know-in-2026/

Exec. Order No. 14365. (2025, December 11). Ensuring a national policy framework for artificial intelligence. Daily Compilation of Presidential Documents, DCPD-202501186. https://www.govinfo.gov/content/pkg/DCPD-202501186/html/DCPD-202501186.htm

Franco, M. A. (2025, June 12). HHS Secretary Kennedy dismisses entire CDC vaccine advisory panel. Holland and Knight Healthcare Blog. https://www.hklaw.com/en/insights/publications/2025/06/hhs-secretary-kennedy-dismisses-entire-cdc-vaccine-advisory-panel

Giuliano v. Grenfell-Gardner, C.A. No. 2021-0452-KSJM (Del. Ch. Sept. 2, 2025) (mem. op.). https://courts.delaware.gov/Opinions/Download.aspx?id=384430

Greenberg, D. S., Heilman, K., and Shlaferman, H. Z. (2026, April 23). Federal court orders broad discovery against UHC in AI coverage denial lawsuit. ArentFox Schiff. https://www.afslaw.com/perspectives/alerts/federal-court-orders-broad-discovery-against-uhc-ai-coverage-denial-lawsuit

Guerra, A. (2026, June 1). Joint Commission launches AI certification as adoption outpaces oversight. healthsystemCIO. https://healthsystemcio.com/2026/06/01/joint-commission-ai-certification/

Hartsfield, S. B., and Bourque, D. (2025, June 20). HIPAA's reproductive health rule is vacated nationally. Holland and Knight. https://www.hklaw.com/en/insights/publications/2025/06/hipaas-reproductive-health-rule-is-vacated-nationally

In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996). https://bpb-us-e1.wpmucdn.com/wp.nyu.edu/dist/4/3828/files/2016/12/INRECAREMARKINTERNATIONALINCDERIVATIVELITIGATION.pdf

Jones, C. (2026, January 20). ACA enhanced premium tax credits: Legislative developments in 2025 and 2026. Association of State and Territorial Health Officials. https://www.astho.org/communications/blog/2026/aca-enhanced-premium-tax-credits-legislative-developments-2025-2026/

Kaveney, J. W., and Thonse, S. (2026, February 12). Medicare telehealth flexibilities extended through 2027. Greenbaum, Rowe, Smith and Davis. https://www.greenbaumlaw.com/insights-alerts-Medicare-Telehealth-Flexibilities-Extended-Through-2027-Telehealth-Gets-a-Two-Year-Lifeline-in-Fiscal-Year-2026-Spending-Package.html

KFF. (2026, October 14). Individual market enrollment continues to fall through mid-2026. https://www.kff.org/affordable-care-act/individual-market-enrollment-continues-to-fall-through-mid-2026/

Kimbrell, M. L., and Menack, S. (2025, January 7). Balancing safety and accessibility: FDA broadens approval pathway for nonprescription drugs by finalizing the "ACNU" rule. Morgan Lewis. https://www.morganlewis.com/blogs/asprescribed/2025/01/balancing-safety-and-accessibility-fda-broadens-approval-pathway-for-nonprescription-drugs-by-finalizing-the-acnu-rule

King and Spalding. (2026). FDA updates general wellness and clinical decision support guidance documents. https://www.kslaw.com/insights/articles/fda-updates-general-wellness-and-clinical-decision-support-guidance-documents

Landi, H. (2026, July 10). Feds push back HIPAA security rule overhaul to July 2027. Fierce Healthcare. https://www.fiercehealthcare.com/health-tech/feds-push-back-hipaa-security-rule-overhaul-july-2027

Marchand v. Barnhill, 212 A.3d 805 (Del. 2019). https://www.leagle.com/decision/indeco20190619048

MedCity News. (2026, April). Insurers have cut prior auth by 11% following commitments. https://medcitynews.com/2026/04/insurers-have-cut-prior-auth-by-11-following-commitments/

Miller, M. (2026, January 29). Medicare telehealth flexibilities: Countdown to January 30, 2026 (and what comes next). Foley and Lardner. https://www.foley.com/insights/publications/2026/01/medicare-telehealth-flexibilities-countdown-to-january-30-2026-and-what-comes/

Office for Civil Rights. (2025, August 13). Change Healthcare cybersecurity incident frequently asked questions. U.S. Department of Health and Human Services. Retrieved October 21, 2026, from https://www.hhs.gov/hipaa/for-professionals/special-topics/change-healthcare-cybersecurity-incident-frequently-asked-questions/index.html

Patil, N. (2026, June 10). CMS's WISeR model faces potential repeal following GAO determination. Georgetown University Medicare Policy Initiative. https://medicare.chir.georgetown.edu/?p=985

Paul Hastings. (2025, December 16). President Trump signs executive order challenging state AI laws. https://www.paulhastings.com/insights/client-alerts/president-trump-signs-executive-order-challenging-state-ai-laws

Peay, H. L., Manetto, N. P., and Tenbarge, B. J. (2026, February 25). FDA publishes long-awaited draft guidance on "plausible mechanism framework" to spur the development of new individualized medicines. Faegre Drinker. https://www.faegredrinker.com/en/insights/publications/2026/2/fda-publishes-long-awaited-draft-guidance-on-plausible-mechanism-framework-to-spur-the-development-of-new-individualized-medicines

Polsinelli. (2026, April 3). Trump administration expands Section 232 tariffs to patented pharmaceuticals and APIs. https://www.polsinelli.com/international/publications/trump-administration-expands-section-232-tariffs-to-patented-pharmaceuticals-and-apis

Trickett Wendler, Frank Mongiello, Jordan McLinn, and Matthew Bellina Right to Try Act of 2017, Pub. L. No. 115-176 (2018). https://www.govinfo.gov/app/details/PLAW-115publ176

U.S. Department of Health and Human Services. (2025a, March 27). HHS announces transformation to make America healthy again [Press release]. https://www.hhs.gov/press-room/hhs-restructuring-doge.html

U.S. Department of Health and Human Services. (2025b, June 9). HHS takes bold step to restore public trust in vaccines by reconstituting ACIP [Press release]. https://www.hhs.gov/press-room/hhs-restore-public-trust-vaccines-acip.html

U.S. Department of Health and Human Services. (2025c, December 4). HHS unveils AI strategy to transform agency operations [Press release]. https://www.hhs.gov/press-room/hhs-unveils-ai-strategy-to-transform-agency-operations.html

U.S. Department of Health and Human Services. (2026, January 23). Fact sheet: U.S. withdrawal from the World Health Organization. https://www.hhs.gov/press-room/fact-sheet-us-withdrawal-from-the-world-health-organization.html

U.S. Food and Drug Administration. (n.d.). Right to Try. Retrieved October 21, 2026, from https://www.fda.gov/patients/learn-about-expanded-access-and-other-treatment-options/right-try

U.S. Food and Drug Administration. (2025a, January). Considerations for the use of artificial intelligence to support regulatory decision-making for drug and biological products (Draft guidance). Retrieved October 21, 2026, from https://www.fda.gov/regulatory-information/search-fda-guidance-documents/considerations-use-artificial-intelligence-support-regulatory-decision-making-drug-and-biological

U.S. Food and Drug Administration. (2025b, June 2). FDA launches agency-wide AI tool to optimize performance for the American people [Press release]. https://www.fda.gov/news-events/press-announcements/fda-launches-agency-wide-ai-tool-optimize-performance-american-people

U.S. Food and Drug Administration. (2025c, June 17). FDA to issue new Commissioner's National Priority Vouchers to companies supporting U.S. national interests [Press release]. https://www.fda.gov/news-events/press-announcements/fda-issue-new-commissioners-national-priority-vouchers-companies-supporting-us-national-interests

U.S. Food and Drug Administration. (2025d, December 1). FDA expands artificial intelligence capabilities with agentic AI deployment [Press release]. https://www.fda.gov/news-events/press-announcements/fda-expands-artificial-intelligence-capabilities-agentic-ai-deployment

U.S. Food and Drug Administration. (2026a, January 14). Guiding principles of good AI practice in drug development. https://www.fda.gov/about-fda/artificial-intelligence-drug-development/guiding-principles-good-ai-practice-drug-development

U.S. Food and Drug Administration. (2026b, March 19). FDA approves fourth product under National Priority Voucher program, higher dose semaglutide [Press release]. https://www.fda.gov/news-events/press-announcements/fda-approves-fourth-product-under-national-priority-voucher-program-higher-dose-semaglutide