The US pays for diagnostic software before knowing how to measure it, and drops the transparency it required of algorithms

By JD Supra (BakerHostetler analysis) · November 10, 2026.

U.S. federal policy is beginning to adapt to clinical AI, and it is moving in two directions at once. According to an analysis by BakerHostetler attorneys Justin Chavez and Vimala Devassy, Medicare is opening payment pathways for diagnostic software while another agency is withdrawing transparency requirements for algorithms.

First, the money. In the 2027 final rule for hospital outpatient payments (OPPS), the Centers for Medicare & Medicaid Services (CMS) coins the term “Software as a Medical Service” (SaMS). It refers to software that supports clinical decisions through algorithmic analysis: clinical decision support, risk models and computer-aided detection in diagnostic imaging. This sets it apart from generic cloud-based software as a service.

CMS is assigning these services, on an interim basis, to “New Technology APCs,” temporary payment categories for services without sufficient cost data. It is also creating a status indicator, O1, for SaMS eligible for separate payment. According to the rule itself, this does not guarantee payment for every AI tool: it depends on the service and how it is coded.

There is also a specific pathway for algorithmic analyses of laboratory results already performed, including secondary analyses of genomic sequencing. These will be paid as “other diagnostic tests,” with rates aligned with 2026 laboratory fees. This matters for genomic analytics companies: it recognizes that diagnostic value can lie in the downstream analysis of data that already exists.

In the physician fee schedule rule (MPFS), CMS does not create a specific payment for AI, but it does issue a request for information on technology-enabled primary care. It provides adoption data: according to CMS, ambient scribes (tools that document the visit) have reached about 25% of U.S. physicians, and OpenEvidence, which answers clinical questions based on peer-reviewed literature, has reportedly been used by more than 40%, based on physicians' self-reporting. CMS estimates that AI care agents are not yet widespread. Many commenters asked that any paid AI be required to demonstrate clinical value.

On the annual wellness visit, CMS acknowledges that AI can administer questionnaires, reconcile medications or draft a preventive plan, always subject to clinician review. It says it does not know how to use AI for cognitive assessment.

An improvement activity is also being created in MIPS (the quality incentive program): it gives credit to those who maintain internal policies to evaluate, deploy and monitor AI tools, including fairness, validity and risk escalation. It does not require the use of AI.

Here is where the contradiction appears. The HTI-5 rule from the Office of the National Coordinator for Health IT (ONC) eliminates certification requirements that obliged developers to provide standardized “model cards”: development, intended use, limitations, training data and performance. It also scales back requirements for risk analysis and mitigation. According to the article, a large majority of comments opposed the change. ONC responded that most clinical users lack the time and technical capacity to use that information and that it found no publications showing they relied on it.

Our take. The pattern is consistent, if uncomfortable: the government is funding AI's entry and delegating the job of overseeing it to each hospital. ONC's argument has some truth to it (a card no one reads protects no one), but the conclusion does not follow: if physicians cannot audit the model, the remedy is better transparency, not less. Withdrawing it will shift the burden to health systems' procurement and legal departments, and large centers will be better able to afford that than small ones. Organizations with governance capacity win; rural providers and small clinics lose.

This connects to a trend we are seeing in other sectors: deployment is moving much faster than the learning of how to govern it. In healthcare, the cost of getting it wrong is measured in patients, not clicks.

The article adds that the American Medical Association (AMA) liability framework would apportion blame among clinicians, developers and organizations according to their ability to control the risk, and rejects the idea that keeping a physician “in the loop” automatically shifts liability. This is the most promising part: if it takes hold, it will force developers and hospitals to document what is now left to good faith. It also mentions pending legislation (the PATIENT AI Act and the Doctors Not AI Act), though the excerpt does not detail their content.

The short term will bring friction: more complex contracts, uncertainty over who is liable and provisional payments. But in the long run, a reimbursement pathway for diagnostic AI is a necessary condition for it to reach all patients, not just those who pay out of pocket. Earlier detection, with genome and imaging analysis, is the path toward medicine that prevents more than it repairs. Getting there well requires exactly what is now being cut: evidence and transparency. The available excerpt cuts off before the end of the section on OCR cybersecurity, so we do not assess it.