Digital Health Blog

While CMS finalized a number of telehealth policies in the 2026 Medicare Physician Fee Schedule (PFS) (see below), it did not include a prior telehealth provider enrollment flexibility that is set to expire December 31, 2025.

Previously, in the 2024 and 2025 PFS final rules, CMS stated that through CY 2025 it would permit a distant site practitioner to use their currently enrolled practice location instead of their home address when providing telehealth services from their home. In the most recent CY 2026 PFS, however, CMS did not include language extending this flexibility for practitioners. This change has been estimated by an industry association to “result in up to a fortyfold increase in the number of billing addresses tracked and reported to CMS by a health system,” and may add significant operational costs.

In response to privacy concerns raised by commenters, CMS noted that it has provided information on how to suppress street address details as providers. In addition, the agency noted that any updates related to the policy will be issued via subregulatory guidance. We’ll continue to monitor and provide updates.

On October 31, 2025, CMS released the 2026 Medicare Physician Fee Schedule (PFS) which sets payment policies for the upcoming year. CMS is finalizing the following telehealth policies:

• Permanently removing frequently limitations for subsequent inpatient visits, subsequent nursing facility visits, and critical care consultations;
• Permanently adopting a definition of direct supervision that allows physicians/supervising practitioner to provide supervision via real-time audio and visual interactive telecommunications;
• Permanently allowing teaching physicians to have a virtual presence in teaching settings in clinical instances;
• Adding several services to the Medicare Telehealth Services List, such as multiple-family group psychotherapy; and
• Modifying the process to add services to the Medicare Telehealth Services List

CMS is also finalizing other digital health policies, including expanding access to digital mental health treatment (DMHT) devices to include payment for devices used in the treatment of Attention Deficit Hyperactivity Disorder (ADHD). Additionally, CMS is reviewing responses on comment solicitation regarding separate coding and payment for services describing digital tools used by practitioners as part of a mental health treatment plan of care.

A new study published in Health Affairs found that primary care practices using Remote Physiologic Monitoring (RPM) experienced a 20% increase in Medicare revenue, along with a rise in outpatient visits. These findings reinforce RPM’s value in chronic care management and its potential to improve patient outcomes through more consistent engagement.

As RPM adoption accelerates, providers and RPM companies face increasing regulatory scrutiny, particularly around billing practices, documentation standards, and fraud and abuse risks. Legal counsel can support stakeholders in developing compliant RPM strategies, structuring contractual relationships, and ensuring operational alignment with Medicare requirements.

Effective January 1, 2026, UnitedHealthcare will limit reimbursement for remote patient monitoring (RPM) to two conditions: chronic heart failure and hypertensive disorders during pregnancy. The policy applies across Medicare Advantage, commercial, and Medicaid plans, and will exclude coverage of RPM for commonly monitored conditions like type 2 diabetes, COPD, and general hypertension.

UnitedHealthcare cites a lack of sufficient clinical evidence for RPM’s effectiveness outside the two covered conditions. However, critics argue that the policy overlooks well-established data, may disrupt care for millions of patients currently using RPM for chronic disease management, and raises legal questions under the Medicare Advantage statute.

OpenAI recently updated its usage policy to prohibit individuals from using ChatGPT and other OpenAI platforms to provide medical advice, reinforcing the distinction between AI-generated health information and licensed clinical guidance. The policy, announced on October 29, 2025, reflects growing industry and regulatory concern about the use of generative AI in health care settings, particularly where users may misinterpret outputs as diagnostic or treatment recommendations. The policy changes came just days before seven lawsuits were filed in California state courts alleging wrongful death, assisted suicide, involuntary manslaughter, and a variety of product liability, consumer protection, and negligence claims against OpenAI.

Companies integrating LLMs into patient facing platforms should increase their diligence to ensure that product messaging, user interfaces, and disclosures align with both platform policies and applicable health care regulations, including whether the platform is engaged in the practice of medicine.

Earlier this month, Senator Bill Cassidy introduced the Health Information Privacy Reform Act (S. 3097), which would significantly expand federal oversight of health information and reshape the HIPAA right of access provisions. As proposed, the bill would authorize HHS, in consultation with the FTC, to regulate individually identifiable health information held by “regulated entities” and “service providers” that currently fall outside HIPAA’s scope – including many health apps, consumer-facing wellness platforms, and data intermediaries. The bill would also narrow HIPAA’s right of access provisions by requiring patients to provide a valid authorization whenever they direct copies of their records be sent to a third party for reasons other than treatment, payment, or health care operations, and it would allow states to set fees for such third-party transmissions.

On October 21, CMS instructed all MACs to lift the hold on claims with dates of service on and after October 1, 2025 for certain services impacted by select expired Medicare legislative provisions, including claims paid under the Medicare Physician Fee Schedule and telehealth claims that CMS can confirm are for behavioral and mental health services. CMS continues to direct MACs to temporarily hold claims for non-behavioral/mental health telehealth services and for acute Hospital Care at Home claims.

The Centers for Medicare & Medicaid Services (CMS) released an updated telehealth Frequently Asked Questions (FAQ) which addresses how the federal government shutdown impacts rendering these services to Medicare beneficiaries. The FAQs address where Medicare beneficiaries need to be to receive telehealth services, which practitioners can furnish these services, whether audio-only visits are allowed, among other questions.

The American Medical Association (AMA) announced the launch of its Center for Digital Health and Artificial Intelligence (AI). The Center will focus on putting physicians in a leadership role to shape policy, digital tools, educate and collaborate with others to build partnerships across the government and healthcare, technology, research sectors.

On September 25, 2025, the Massachusetts Senate unanimously passed the Massachusetts Data Privacy Act (“MDPA”), originally introduced as SB 2608 and now refiled as SB 2619. The bill proposes sweeping reforms to consumer data protection, including bans on the sale of sensitive data (such as biometric, health, and geolocation information), enhanced data privacy rights for minors, and strict limits on data collection practices. The Senate referred the bill to the Massachusetts House of Representatives.

On October 16, Massachusetts joined growing number of states taking legislative action on the use of artificial intelligence in healthcare. SB 2632 sets clear boundaries around AI’s role in behavioral and mental health services, as well as in healthcare decision-making and utilization review. Under SB 2632, artificial intelligence cannot be used to make independent therapeutic decisions in a mental or behavior health setting. All treatment plans and patient interactions involving AI must be reviewed by a licensed professional. The bill also mandates transparency: patients must be informed when AI is used in their care and must provide explicit consent. The legislation further restricts how insurance carriers use AI in utilization review and other administrative functions. Specifically, it prohibits AI from replacing human decision-making or being used in ways that could result in discrimination against insured individuals.

As state legislatures gear up for the 2026 session, more proposals addressing artificial intelligence in healthcare and data privacy issues are likely. These developments reflect growing public and policymaker concern over the ethical, legal, and social implications of emerging technologies. However, states are taking varied approaches to regulation and enforcement, signaling an evolving and diverse policy landscape.