Updates to the HIPAA Security Rule Delayed
The anticipated updates to the HIPAA Security Rule are delayed until July 2027
This decision is according to the Office of Information and Regulatory Affairs (reginfo.gov).
The proposed rule, introduced on January 6, 2025 through the Notice of Proposed Rulemaking (NPRM), HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, was originally anticipated for final action in May 2026. If finalized, the proposal would represent the first major update to the HIPAA Security Rule since 2013 and would establish more prescriptive cybersecurity requirements for regulated entities.
The delay provides healthcare organizations additional time to prepare for potential new compliance obligations and strengthen cybersecurity programs.
Proposed Changes Outlined in the NPRM:
• Comprehensive and accurate technology asset inventory and network map showing where electronic protected health information (ePHI) is created, stored, processed, and transmitted
• New and expanded requirements for implementing encryption
• Multifactor authentication
• Network segmentation
• Anti-malware protection
• Annual penetration tests
• Vulnerability scans every 6 months
• Annual audits of Security Rule compliance
• Annual risk analyses
• Additional data backup and recovery controls and testing requirements
• Revised business associate agreements and annual written verification that business associates deploy certain technical safeguards
• Extensive documentation requirements
• Treat all implementation specifications as mandatory, eliminating the distinction between “required” and “addressable” implementation specifications
While the delay may offer some breathing room, it should not be viewed as a reason to pause security efforts.
Healthcare organizations should continue conducting annual Security Risk Assessments (SRAs), addressing identified vulnerabilities, strengthening technical safeguards, and maintaining compliance with the current HIPAA Security Rule requirements. Cyber threats continue to evolve, and proactive risk management remains essential for protecting (ePHI) and supporting patient care.
Have Questions?
Our trusted advisors at the Kentucky REC assist healthcare organizations with strengthening HIPAA Security compliance and cybersecurity readiness by offering specialized services to help organizations identify vulnerabilities, address compliance gaps, and prepare for future regulatory requirements.
Contact YOUR experts at Kentucky REC if you have any questions or need assistance with HIPAA security risk assessments, internal vulnerability network scanning, and project management support. We’re here to help: 859-323-3090.
Webinar August 27 – CMS Proposes Significant Reforms to The Quality Payment Program
Don’t Miss Our Aug 27 Webinar:
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
The Centers for Medicaid and Medicare Services (CMS) issued the notice for proposed rule-making for the 2027 Physician Fee Schedule and Quality Payment Program (QPP) on Tuesday, August 14th, 2026.
CMS is proposing transformational changes to several programs within this rule, including:
- the sunset date for the MIPS track of the QPP
- a further increase in available MIPS Value Pathways (MVPs)
- significant APM incentive payment reforms
- expansion of the Medicare Shared Savings Program
- further clarification of the new Ambulatory Specialty Model
- the introduction of core measures and other substantial changes to QPP performance categories
Stay in the know with the Kentucky REC – Register today and be prepared for 2027 and beyond!
2027 CMS NOTICE OF PROPOSED RULE-MAKING: QPP and BEYOND
THURSDAY AUG 27 12:00 – 1:00 PM ET
CMS encourages providers, healthcare organizations, vendors, and professional organizations to submit comments on the proposed rule.
How to comment:
The proposed rule includes directions for submitting comments within the 60-day comment period. CMS must receive comments by Monday, September 14, 2026.
When commenting, refer to file code: CMS-1848-P.
CMS does NOT accept FAX transmissions.
Use 1 of the 3 following ways to officially submit your comments:
• Electronically: www.regulations.gov
• Regular mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, P.O. Box 8016, Baltimore, MD 21244-8016.
• Express or overnight mail: Centers for Medicare & Medicaid Services, Department of Health and Human Services, Attention: CMS-1848-P, Mail Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
Kentucky REC Annual Conference Oct 29: Maximizing the HIPAA Security Rule
Maximizing the HIPAA Security Rule for Practice Success
Speaker: Amy Daley, Kentucky REC
Significant revisions to the HIPAA Security Rule are expected to be finalized and announced next year. Applying the new revisions to everyday operations in your practice is the key to maximizing and strengthening your overall compliance program. Our advisors will provide an overview of everything that is changing about the rule as well as timelines for expected compliance.
About Amy Daley
Amy Daley, CHPS, has been a Health IT Advisor for Kentucky Regional Extension Center since 2014 and is the HIPAA Team Lead. She specializes in HIPAA Security guidance for healthcare organizations across the state of Kentucky. Amy obtained her B.S. in Computer Information Systems from the University of Louisville. Amy has been a guest speaker at various conferences in Kentucky presenting on topics related to HIPAA Security and Promoting Interoperability. Her background includes expertise in the areas of implementation, training and management of EHR systems.
Questions? Contact us at Kentucky REC or call us at 859-323-3090.
Webinar July 30: Understanding CMS’s Mandatory Ambulatory Specialty Model
Don’t Miss Our July 30 Webinar: Understanding CMS’s Mandatory Ambulatory Specialty Model (ASM)
Does your practice treat 20 or more Medicare patients with heart failure or low back pain each year? If so, CMS’s new Ambulatory Specialty Model (ASM) may directly impact your organization.
Unlike many value-based care initiatives, the ASM is a mandatory payment model for selected specialists billing under Medicare Part B who treat these conditions. Beginning in 2027, the model is designed to increase specialist accountability for chronic disease management, reduce low-value care, and strengthen coordination between specialists and primary care providers.
CMS has released the preliminary list of participating providers, with an update coming later this year. You can check your status by clicking this link.
With financial risk increasing through 2033, now is the time to understand the model and begin preparing your practice.
Join us for our webinar on Thursday, July 30, where we will provide a practical overview of:
• Core-Based Statistical Area (CBSA) selection methodology
• Participant eligibility requirements
• Cohort-specific quality measures
• Financial implications and risk timelines
• Recommended steps to prepare your organization
Whether you are a practice administrator, physician leader, or quality improvement professional, this session will equip you with the insights and action steps needed to prepare for one of the most significant mandatory specialty payment models introduced by CMS.
Register today and get ahead of the changes!
UNDERSTANDING CMS’S MANDATORY AMBULATORY SPECIALTY MODEL
THURSDAY JULY 30 12:00 – 1:00 PM ET
Contact YOUR experts at Kentucky REC with all your CMS QPP, MIPS/MVP, and APM Track questions. We’re here to help: 859-323-3090.
CMS Ambulatory Specialty Model – Informational Video
What is the CMS Ambulatory Specialty Model (ASM)?
If you are a specialist managing patients with heart failure or low back pain, the time to understand your obligations is now.
The ASM is a long-term commitment to value-based care, requiring participants to navigate escalating financial stakes.
Duration:
Five years, beginning January 1, 2027, and concluding December 31, 2031.
Escalating Risk:
Participants will face a dual-sided risk profile starting at 9% and increasing to 12% over the life of the model.
The Bottom Line:
The ASM represents a move toward granular accountability. Specialists are no longer on the sidelines of value-based care—they are now a vital part of it.
In this mini presentation, Kentucky REC expert advisors introduce the CMS Ambulatory Specialty Models, sharing the information you need to be prepared for this program.
Questions about eligibility and practice impacts from this new MANDATORY payment model? Contact YOUR Experts at the Kentucky REC for all your ASM questions. Call us at 859-323-3090 or email us kyrec@uky.edu.
May is Asthma & Allergy Awareness Month
May is Asthma & Allergy Awareness Month
Over 27.8 million adults and 4.8 million children in the U.S. are living with asthma.
The Kentucky REC, in partnership with KDPH’s Kentucky Asthma Management Program (KAMP) are raising awareness about the importance of asthma control, helping patients, caregiver, and healthcare professionals build knowledge and skills needed for effective daily management.
Many learning opportunities are available this month to support individuals and families in living well with asthma.
The American Lung Association (ALA) and the Asthma & Allergy Foundation of America (AAFA) are providing FREE RESOURCES to help your healthcare organization increase awareness and access to resources within your communities.
AAFA: CLICK HERE for Pediatric Asthma Social Media Toolkit
ALA: CLICK HERE for Asthma Awareness Month | American Lung Association Resources
KAMP: CLICK HERE for Asthma Management Program – Cabinet for Health and Family Services Resources
Patient and Clinical Education Opportunities:
May 5: Webinar: 2026 Clean Air School Symposium, 11am – 2:30pm EST REGISTER HERE
May 8: Webinar: Building Clinical Linkages with Asthma Care Partners, 12 – 1pm EST REGISTER HERE
May 15: Webinar: Asthma Medication in Schools: Back to the Basics,12 – 1pm EST REGISTER HERE
May 22: Webinar: Treating Persistent Asthma: Putting your Patient on the Right Therapy Using the Stepwise Charts, 12 – 1pm EST REGISTER HERE
May 29: Webinar: Asthma Action Plans, 12- 1pm EST REGISTER HERE
Kentucky REC Annual Conference Oct 29 – Keynote Speaker Cameron Mills
Hybrid Event with Special Guest Speakers – In Person and Online
Oct. 29 2026, Lexington Kentucky, The Campbell House
This year’s conference will feature timely sessions on quality initiatives, HIPAA and security updates, hospital promoting interoperability, AI in healthcare, and emerging topics shaping healthcare.
Keynote Speaker: CAMERON MILLS, LHC Group, CAMERON MILLS MINISTRIES
The Most Rarely Discussed Job in Health Care
Kentucky native Cameron Mills lived out a childhood dream by following in his father’s footsteps to play basketball at the University of Kentucky during one of the programs most successful eras. From 1994-1998, he helped lead the Wildcats to three NCAA Final Fours and three NCAA National Championship appearances. The team won two Championships, defeating Syracuse in 1996 and Utah in 1998.
Following his time at UK, Cameron founded Cameron Mills Ministries. He is a sought after speaker at conferences and events, sharing insights on the power of influence. His message focuses on everyday opportunities we have to impact others through actions, not just words.
At the same time, Cameron has also built a career in the health care industry. He has been with LHC Group since 2004, a national leader in home health and hospice services, which serves patients in 38 states. In 2019, he became Vice President and Chief Culture Officer. In this role, he encourages and supports frontline caregivers, individuals he considers heroes long before the Covid-19 pandemic brought them into the spotlight.
Cameron lives in Lexington, KY with his wife, Susan, and their son Alex. Susan is a children’s book author and illustrator. She is known for her series about a world of dinosaurs with special needs.
Keynote Speaker: CAMERON MILLS, LHC Group, CAMERON MILLS MINISTRIES
TEAMWORK – You can’t do it alone
Kentucky native Cameron Mills lived out a childhood dream by following in his father’s footsteps to play basketball at the University of Kentucky during one of the programs most successful eras. From 1994-1998, he helped lead the Wildcats to three NCAA Final Fours and three NCAA National Championship appearances. The team won two Championships, defeating Syracuse in 1996 and Utah in 1998.
Following his time at UK, Cameron founded Cameron Mills Ministries. He is a sought after speaker at conferences and events, sharing insights on the power of influence. His message focuses on everyday opportunities we have to impact others through actions, not just words.
At the same time, Cameron has also built a career in the health care industry. He has been with LHC Group since 2004, a national leader in home health and hospice services, which serves patients in 38 states. In 2019, he became Vice President and Chief Culture Officer. In this role, he encourages and supports frontline caregivers, individuals he considers heroes long before the Covid-19 pandemic brought them into the spotlight.
Cameron lives in Lexington, KY with his wife, Susan, and their son Alex. Susan is a children’s book author and illustrator. She is known for her series about a world of dinosaurs with special needs.
Save the Date! Kentucky REC Annual Conference Oct 29!
Details and Registration Coming Soon!
During our day together we’ll discuss Quality Initiatives, HIPAA, Artificial Intelligence, and more to ensure that clinicians, hospital and ambulatory administrators, and clinic staff are well prepared for the challenges of modern healthcare.
Lexington, Kentucky – Join Us in Person or Online
Need to Know Facts: CMS’s New Mandatory Ambulatory Specialty Model
CMS’s New Mandatory Ambulatory Specialty Model
The Center for Medicare & Medicaid Services (CMS) recently released the participant list for the new Ambulatory Specialty Model (ASM). This payment model gauges individual clinician-level performance around high-cost chronic conditions.
Included in this MANDATORY model is a dual-sided risk component designed to increase specialty provider accountability through the co-management of Medicare beneficiary’s care.
Important facts about this model and it’s potential impact:
- This is a MANDATORY dual-sided risk model: ASM participants will see escalating risk from 9-12% over the life of the model impacting ALL Medicare Part B claims reimbursement.
- Model performance begins on January 1, 2027 and runs through December 31, 2031.
- ASM participants are assessed at the individual provider level, not the tax ID, and participation is limited to certain clinician types. Selected clinicians will participate in one of two cohorts: Low Back Pain or Heart Failure
- Mandatory participation is based on several factors: these are related to claims billed; medical specialty type; episode thresholds; and geographic area criteria for model selection.
- Impacted Kentucky core-based statistical areas (CBSAs): Cincinnati/Northern Kentucky, Glasgow, Louisville Metro, Lexington-Fayette, Paducah, Pikeville, and Richmond/Berea.
- The framework of this model is based on a composite of the Quality Payment Program’s MVP and APP Tracks with components of Advanced APMs. Mandatory selection for this model may impact your individual clinical level reporting requirements for the QPP program.
Several Kentucky healthcare providers have been selected to participate in this MANDATORY model.
A list of selected providers can be found on the CMS Model website. Visit this link to determine if you are a required participant in the ASM
If you are a specialist managing patients with heart failure or low back pain, the time to understand your obligations is now.
Click this link to visit CMS’s Ambulatory Specialty Model website to learn more or contact your Kentucky REC advisor at 859-323-3090 to learn about our ASM operational and strategic support services.
Questions about eligibility and practice impacts from this new MANDATORY payment model? Contact YOUR Experts at the Kentucky REC for all your ASM questions. Call us at 859-323-3090 or email us kyrec@uky.edu.
The New CMS Ambulatory Specialty Model: Is Your Practice Prepared?
CMS’s New Mandatory Ambulatory Specialty Model: Initial Participation List Announced
The Centers for Medicare & Medicaid Services (CMS) recently released the Initial Participation list for clinicians required to take part in the newly finalized Ambulatory Specialty Model (ASM) — a significant shift in how specialty care is delivered and reimbursed in Traditional Medicare.
Several Kentucky healthcare providers have been selected to participate in this MANDATORY model. Visit this link to determine if you are a required participant in the ASM
If you are a participant in this model, you have certain action items due by February 17th, 2026.
These impact registration and limit access to critical information through the ASM Participant Portal. Here is the ASM Participant Contact Information Form.
If you are a specialist managing patients with heart failure or low back pain, the time to understand your obligations is now.
Click this link to visit CMS’s Ambulatory Specialty Model website to learn more or contact your Kentucky REC advisor at 859-323-3090 to learn about our ASM operational and strategic support services.
What is the ASM?
The ASM is designed to improve the co-management of Traditional Medicare beneficiaries while driving down costs within defined clinical episodes. Unlike many prior payment models, this is an individual provider-level model. It places the responsibility for cost and quality directly on the MDs and DOs who manage high-cost chronic conditions.
Are You Required to Participate?
Participation is mandatory for providers who meet four specific criteria:
- Billing: You must bill claims under the Medicare Physician Fee Schedule
- Specialty Focus: You are identified by your TIN/NPI in one of two primary cohorts:
- Heart Failure Cohort:Cardiology
- Low Back Pain Cohort: Anesthesiology, Orthopedics, Orthopedic Surgery, Interventional Pain Management, Pain Management, Physical Medicine and Rehabilitation, and Neurosurgery
- Volume Threshold: You must meet a minimum of 20 episodes for your respective cohort
- Geography: You must be located in one of the CMS-identified mandatory geographic areas
Key Timeline and Risk Structure
The ASM is a long-term commitment to value-based care, requiring participants to navigate escalating financial stakes.
Duration: Five years, beginning January 1, 2027, and concluding December 31, 2031.
Escalating Risk: Participants will face a dual-sided risk profile starting at 9% and increasing to 12% over the life of the model.
The Bottom Line: The ASM represents a move toward granular accountability. Specialists are no longer on the sidelines of value-based care—they are now a vital part of it.
Questions about eligibility and practice impacts from this new MANDATORY payment model? Contact YOUR Experts at the Kentucky REC for all your ASM questions. Call us at 859-323-3090 or email us kyrec@uky.edu.
