Quietly, and without much ceremony, CMS has created a new Office of Health Technology Products — one office consolidating its technology functions, with a mandate that covers AI, interoperability, and digital health tools across CMS programs, including policy for responsible AI adoption. Eight named components sit under it, from a Standards and Interoperability Group to an in-house Digital Service unit meant to bring private-sector product discipline into federal healthcare programs.
It would be easy to file this under bureaucratic reshuffling. Do not. For vendors selling into Medicare and Medicaid, there is now a single regulatory interlocutor. For health systems, it means AI tools that touch federal programs are getting a defined review pathway — the procurement question shifts from “does it work” to “will it clear review.”
Here is the part worth reading twice. The same month CMS stood up the office, the House Appropriations Committee amended the fiscal year 2027 budget to state that no funds will go to the WISeR model — the six-state experiment we wrote about last week, which put technology vendors in charge of prior-authorization reviews on Original Medicare.
Hold those two facts together and the direction is unmistakable. Washington is not pro-AI or anti-AI. It is building the governance layer first and pulling funding from automation that ran ahead of it. Govern first, automate second. That is also, not coincidentally, the correct order of operations inside your own four walls.
From the Playbook
The Compliance & Regulatory Management playbook in our series is built around one asset most organizations still do not have: the model inventory — an enterprise register of every algorithm in production that touches patients, employees, claims, or compliance itself.
The first honest draft is always a shock, because algorithms arrive embedded: sepsis scores and no-show predictors inside the EHR, scoring models inside the revenue-cycle stack, screening logic inside HR tools nobody classified as AI. Six fields per model, no exceptions: identity, a named accountable owner, the input schema (with a flag for anything measuring or proxying a protected category), validation on your population, oversight design, and regulatory classification.
This is not preparation for some future rule. Section 1557’s § 92.210 already imposes an affirmative, ongoing duty not to discriminate through patient care decision support tools — defined broadly enough to cover everything from flowcharts to machine learning. A model that is accurate on average and wrong for one subgroup is the exact artifact the rule exists to catch. When the new CMS office publishes its review expectations, organizations holding a live inventory will adapt in weeks. Everyone else will be doing archaeology.
One number to anchor it: six. If you cannot fill six fields for a model that is scoring your patients today, that model is running your operation unsupervised.
What we are watching
Canary Speech’s ambient platform is now listed on the Zoom App Marketplace — vocal biomarker screening that evaluates more than 2,500 acoustic and linguistic features per telehealth visit to flag patterns associated with depression, anxiety, and cognitive decline. For systems already running virtual care on Zoom, the deployment barrier is close to zero. Which is exactly the point: a tool that flags possible cognitive decline from a patient’s voice is a patient-care decision-support tool under any reading of § 92.210, and near-zero deployment friction is how algorithms end up in production without ever passing through governance. Marketplace convenience is not a substitute for a validation file.
One thing to try this week
Open one spreadsheet. List every algorithm you know is running — EHR-embedded scores count, vendor black boxes count, the scheduling model counts. Fill the six fields for each. Do not fix anything yet. The number of rows you cannot complete is your governance backlog, and it is the first thing a reviewer will ask for.
The Operations Edge is published by the Healthcare AI Institute — practical, vendor-neutral playbooks for the people who run healthcare operations. Fix the operation before you automate it.
The full series and toolkits: Book 0 — The Primary Care Operations Playbook. Book 1 — AI for Healthcare Scheduling & Patient Access. Toolkits and templates on Gumroad.