Aug 28, 2026
CMS recently finalized several changes to the Medicare Promoting Interoperability Program that hospitals should be aware of as they plan for upcoming reporting years.*
The Centers for Medicare & Medicaid Services (CMS) issued the FY 2027 Hospital Inpatient Prospective Payment System (IPPS) and Long-Term Care Hospital (LTCH) Prospective Payment System final rule on July 31, 2026, which was published in the Federal Register on August 4, 2026.
The final rule includes changes across several hospital quality programs, including the Medicare Promoting Interoperability (PI) Program for eligible hospitals and critical access hospitals (CAHs). You can view and download the final rule and related documents at the CMS webpage below.
Visit the CMS 2027 IPPS Final Rule Home Page Here
What Hospitals Should Know
CMS finalized several changes that will affect future Medicare PI reporting periods, including:
• Removal of the ONC Direct Review and ONC-ACB Surveillance attestations beginning with the CY 2026 EHR reporting period
• Changes to the Electronic Prior Authorization measure, including its transition to a mandatory measure beginning with CY 2028
• Addition of a Unique Device Identifier (UDI) measure beginning with the CY 2027 EHR reporting period
• Changes to the electronic referral loop measures, with their removal delayed until CY 2029
• Updates to the Medicare PI eCQM measure set beginning with the FY 2030 payment determination
While some of these changes are still a few years away, hospitals should begin considering how they may affect their EHR capabilities, workflows, reporting processes, and overall Medicare PI strategy.
Don’t Wait Until the Next Reporting Period
The Medicare Promoting Interoperability Program continues to evolve, making it increasingly important for hospitals to understand not only their current requirements, but also what is coming next.
With changes to measures, certification requirements, electronic exchange, and eCQMs, now is a good time for hospitals to review their current PI processes and identify areas that may require attention before future requirements take effect.
Not sure what these changes mean for your hospital?
KENTUCKY REC Can Help
The Kentucky Regional Extension Center (KY REC) works directly with Kentucky hospitals and CAHs to help them understand and successfully navigate the Medicare Promoting Interoperability Program.
Our team can help your hospital:
• Understand current and upcoming Medicare PI requirements
• Identify potential compliance gaps
• Prepare for changes to future reporting periods
• Review your hospital’s PI performance and reporting strategy
• Navigate CMS and ONC requirements
Don’t navigate the changing Medicare Promoting Interoperability requirements alone.
Contact our Kentucky REC team today to learn how we can help your hospital prepare for current and future Medicare PI requirements. Call us at 859-323-3090.
*This article provides a high-level overview of finalized CMS policies and is intended for educational purposes. Hospitals should review official CMS guidance and program specifications when determining their specific Medicare Promoting Interoperability Program requirements.
Aug 24, 2026
Hybrid Event with Special Guest Speakers – In Person and Online
Oct. 29 2026, Lexington Kentucky, The Campbell House
The New KHIE Portal: Features, Functionality & What’s Ahead
Speaker: Rachael Roehrig, Deputy executive Director – division of the kentucky health information exchange (KHIE) & the division of telehealth services
Join Rachael Roehrig for an exciting look into the future of healthcare data in Kentucky. Rachael will showcase the powerful new features and tools now available to providers. Discover how KHIE’s new partnership with CRISP Shared Services (CSS) is upgrading the state’s digital medical network to make patient care more connected and efficient.
About Rachael Roehrig
Rachael Roehrig is Executive Director of the Kentucky Health Information Exchange (KHIE) and Deputy Executive Director within the Kentucky Office of Inspector General, where she leads statewide efforts to advance interoperability and strengthen health data infrastructure. With more than a decade of experience in Kentucky state government, she brings deep expertise in healthcare policy, data analytics, and program operations.
Rachael is known for driving data-informed decision-making and fostering collaboration across government agencies, providers, and technology partners to improve healthcare delivery. As a speaker, she offers practical insights on connecting systems, leveraging data, and enhancing care through statewide health information exchange.
Questions? Contact us at Kentucky REC or call us at 859-323-3090.
Jul 28, 2026
The anticipated updates to the HIPAA Security Rule are delayed until July 2027
This decision is according to the Office of Information and Regulatory Affairs (reginfo.gov).
The proposed rule, introduced on January 6, 2025 through the Notice of Proposed Rulemaking (NPRM), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, was originally anticipated for final action in May 2026. If finalized, the proposal would represent the first major update to the HIPAA Security Rule since 2013 and would establish more prescriptive cybersecurity requirements for regulated entities.
The delay provides healthcare organizations additional time to prepare for potential new compliance obligations and strengthen cybersecurity programs.
Proposed Changes Outlined in the NPRM:
• Comprehensive and accurate technology asset inventory and network map showing where electronic protected health information (ePHI) is created, stored, processed, and transmitted
• New and expanded requirements for implementing encryption
• Multifactor authentication
• Network segmentation
• Anti-malware protection
• Annual penetration tests
• Vulnerability scans every 6 months
• Annual audits of Security Rule compliance
• Annual risk analyses
• Additional data backup and recovery controls and testing requirements
• Revised business associate agreements and annual written verification that business associates deploy certain technical safeguards
• Extensive documentation requirements
• Treat all implementation specifications as mandatory, eliminating the distinction between “required” and “addressable” implementation specifications
While the delay may offer some breathing room, it should not be viewed as a reason to pause security efforts.
Healthcare organizations should continue conducting annual Security Risk Assessments (SRAs), addressing identified vulnerabilities, strengthening technical safeguards, and maintaining compliance with the current HIPAA Security Rule requirements. Cyber threats continue to evolve, and proactive risk management remains essential for protecting (ePHI) and supporting patient care.
Have Questions?
Our trusted advisors at the Kentucky REC assist healthcare organizations with strengthening HIPAA Security compliance and cybersecurity readiness by offering specialized services to help organizations identify vulnerabilities, address compliance gaps, and prepare for future regulatory requirements.
Contact YOUR experts at Kentucky REC if you have any questions or need assistance with HIPAA security risk assessments, internal vulnerability network scanning, and project management support. We’re here to help: 859-323-3090.
Jul 27, 2026
Hybrid Event with Special Guest Speakers – In Person and Online
Oct. 29 2026, Lexington Kentucky, The Campbell House
Connecting Care Through Interoperability: What Hospitals Need to Know for Medicare PI
Speaker: Kristina Stolitca, Kentucky REC
Kentucky REC Hospital team lead Kristina Stolitca will provide an overview of the Medicare Promoting Interoperability (PI) Program for Eligible Hospitals and Critical Access Hospitals and explore how interoperability requirements continue to shape care delivery across the healthcare community. This session will review 2026 program requirements, including reporting periods, objectives, and measures, while highlighting key updates from the FY 2027 Inpatient Prospective Payment System (IPPS) Final Rule. Attendees will gain practical insight into evolving compliance expectations and the growing role of interoperability, public health reporting, and data exchange in supporting coordinated care and healthcare connectivity.
About Kristina Stolitca
Kristina Stolitca is a Health Information Technology Advisor at the Kentucky Regional Extension Center (KY REC), where she has served for 15 years. In this role, she supports hospitals across Kentucky participating in the Medicare Promoting Interoperability (PI) Program, providing expert guidance on regulatory compliance, EHR reporting, and program attestation. Kristina partners with hospital leaders and staff to assess performance, identify compliance gaps, and promote successful program participation. She develops tools and resources to help organizations navigate evolving CMS requirements, translating complex federal mandates into clear, actionable guidance. Her long-standing work at KY REC reflects a deep commitment to supporting Kentucky hospitals and advancing health information technology across the Commonwealth.
Questions? Contact us at Kentucky REC or call us at 859-323-3090.
Jul 21, 2026
Don’t Miss Our Aug 27 Webinar:
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
The Centers for Medicaid and Medicare Services (CMS) issued the notice for proposed rule-making for the 2027 Physician Fee Schedule and Quality Payment Program (QPP) on Tuesday, August 14th, 2026.
CMS is proposing transformational changes to several programs within this rule, including:
- the sunset date for the MIPS track of the QPP
- a further increase in available MIPS Value Pathways (MVPs)
- significant APM incentive payment reforms
- expansion of the Medicare Shared Savings Program
- further clarification of the new Ambulatory Specialty Model
- the introduction of core measures and other substantial changes to QPP performance categories
Stay in the know with the Kentucky REC – Register today and be prepared for 2027 and beyond!
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
THURSDAY AUG 27 12:00 – 1:00 PM ET
CMS encourages providers, healthcare organizations, vendors, and professional organizations to submit comments on the proposed rule.
How to comment:
The proposed rule includes directions for submitting comments within the 60-day comment period. CMS must receive comments by Monday, September 14, 2026.
When commenting, refer to file code: CMS-1848-P.
CMS does NOT accept FAX transmissions.
Use 1 of the 3 following ways to officially submit your comments:
• Electronically: www.regulations.gov
• Regular mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, P.O. Box 8016, Baltimore, MD 21244-8016.
• Express or overnight mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
Jul 3, 2026
Don’t Miss Our July 30 Webinar: Understanding CMS’s Mandatory Ambulatory Specialty Model (ASM)
Does your practice treat 20 or more Medicare patients with heart failure or low back pain each year? If so, CMS’s new Ambulatory Specialty Model (ASM) may directly impact your organization.
Unlike many value-based care initiatives, the ASM is a mandatory payment model for selected specialists billing under Medicare Part B who treat these conditions. Beginning in 2027, the model is designed to increase specialist accountability for chronic disease management, reduce low-value care, and strengthen coordination between specialists and primary care providers.
CMS has released the preliminary list of participating providers, with an update coming later this year. You can check your status by clicking this link.
With financial risk increasing through 2033, now is the time to understand the model and begin preparing your practice.
Join us for our webinar on Thursday, July 30, where we will provide a practical overview of:
• Core-Based Statistical Area (CBSA) selection methodology
• Participant eligibility requirements
• Cohort-specific quality measures
• Financial implications and risk timelines
• Recommended steps to prepare your organization
Whether you are a practice administrator, physician leader, or quality improvement professional, this session will equip you with the insights and action steps needed to prepare for one of the most significant mandatory specialty payment models introduced by CMS.
Register today and get ahead of the changes!
UNDERSTANDING CMS’S MANDATORY AMBULATORY SPECIALTY MODEL
THURSDAY JULY 30 12:00 – 1:00 PM ET
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
