Federal Court Blocks CMS’s Proposed Definition of “Medically Frail” under Medicaid Work Requirements 

On October 29, 2026, the U.S. District Court for the District of Massachusetts struck down CMS’s methodology for determining whether a Medicaid enrollee meets the “medically frail” exception to Medicaid work requirements under the One Big Beautiful Bill Act (the Act). 

Background

In June 2026, CMS published an interim final rule (IFR) directing states on implementation of the work requirements Congress enacted under the Act in July 2025. Effective January 1, 2027, the Act requires certain Medicaid enrollees in states that expanded Medicaid to complete 80 hours of work, school, or volunteering a month as a condition of coverage, unless they qualify for an exception, such as the “medically frail” exemption. This provision excepts from the work requirements Medicaid enrollees who have one of five categories of conditions: (1) blind or disabled; (2) substance use disorders; (3) disabling mental disorders; (4) physical, intellectual, or developmental disabilities; and (5) serious or complex medical conditions. In the IFR, CMS adopted a more restrictive definition of medically frail, requiring states to determine whether Medicaid beneficiaries with one of the five listed conditions have demonstrated that the condition significantly impairs their ability to consistently work or participate in community engagement activities. 

On June 29, 2026, twenty-five states and the District of Columbia brought a lawsuit in the U.S. District Court for the District of Massachusetts, challenging the IFR implementing the Medicaid work requirements. The complaint alleged that the rule strays too far from the text of the Act and “creates new requirements that constrain who is exempt due to their medically frail status” beyond what Congress intended. Plaintiffs argued that if implemented, the IFR would be “profoundly harmful to Plaintiff States and their residents” by imposing significant administrative burden on states that would lead to disenrollment of otherwise eligible Medicaid beneficiaries. The plaintiffs alleged that CMS’s IFR is contrary to law, arbitrary and capricious under the Administrative Procedure Act (APA) and exceeds constitutional limits on Congress’s spending authority.

The Court’s Decision

On October 29, 2026, Judge Richard Stearns held that CMS lacks the authority to narrow the definition of “medically frail” established in the Act by requiring states to determine whether a beneficiary’s medical condition significantly impairs his or her ability to meet the work requirements. Judge Stearns also granted a 6-month stay of enforcement on medical frailty determinations. However, Judge Stearns held that the 12-month lookback period for claims and encounter data used to verify medical frailty in CMS’s IFR is not arbitrary and capricious under the APA. The remainder of the work requirement rule stands, and the January 1, 2027 start date remains unchanged.

The case is captioned Commonwealth of Massachusetts, et al. v. Mehmet Oz, No. 1:26-cv-12962-RGS (D. Mass. Oct. 29, 2026), and the complaint can be found here.

Reporter, Rebecca Hsu, Atlanta, GA, +1 404 572 3339, rhsu@kslaw.com

Departments Issue Guidance on Batched and Bundled Disputes Under the Federal IDR Operations Final Rule

On October 29, 2026, the Departments of Labor, Health and Human Services, the Treasury, and the Office of Personnel Management (collectively, the Departments) released Federal Independent Dispute Resolution (IDR) Guidance for Certified IDR Entities and Disputing Parties (Guidance). The Guidance follows the June 4, 2026, publication of the Federal IDR Operations Final Rule (the Final Rule), which seeks to improve the functioning of the federal IDR process established under the No Surprises Act (NSA). Among other reforms, the Final Rule significantly revised the batching criteria that govern when multiple items and services can be grouped into a single dispute. The Guidance explains how the Departments will operationalize these finalized batching requirements. 

Background on the Final Rule’s Batching Rules

Under the Final Rule, a certified IDR entity may consider up to 50 items and services together in a single payment determination if the items and services: 

For additional background on the other significant reforms in the Final Rule, see King & Spalding’s summary here.

Summary of Relevant Guidance

The Guidance explains how the batching and bundling rules in the Final Rule will work in practice. Specifically, it addresses when the rules apply, how to determine whether the items or services were billed by the same provider and are payable by the same payor, when items or services relate to the treatment of a similar condition, the CPT code ranges for specialty batching, the treatment of modifiers and add-on codes, the cooling off period, and the end of the resubmission option. 

Applicability 

The new batching rules will apply to items and services for which the open negotiation period begins on or after November 1, 2026. The Final Rule’s bundling provisions, including the revised definition of “bundled payment arrangement,” have been in effect since August 3, 2026. 

Same Provider, Same Payer

The Guidance reiterates that, to be included in a batch, all qualified IDR items and services must be billed under the same NPI and TIN. It also distinguishes between self-insured plans and fully insured plans. For self-insured group health plans, items and services may be batched only if the same self-insured group health plan is responsible for payment; claims payable by different self-insured plans cannot be batched, even if the same TPA administrators those plans. For fully insured group health plans, items and services may be batched if the same health insurance issuer, determined at the state level, is required to make payment.

Relatedness Criteria 

The Guidance provides examples of situations that satisfy each of the three relatedness criteria used to determine whether items and services relate to the treatment of a similar condition. It clarifies that the same or comparable code requirement applies to the primary service codes, and does not apply to modifiers or to anesthesia qualifying circumstances add-on codes, which function as modifiers. The Guidance also offers several examples of comparable codes across HCPCS and CPT coding systems. 

The Guidance includes tables listing the anesthesiology, radiology, pathology, and laboratory code ranges within Category I CPT codes that may be batched. The initiating party may batch items and services within a single code range but may not batch items and services across different code ranges. The Departments indicate that they will review the code ranges annually as the AMA updates the CPT code manual, but they do not expect to issue frequent updates.

Modifier and Anesthesia Qualifying Circumstances Add-On Guidance 

The Guidance clarifies that modifiers do not count toward the 50-line-item limit. The four anesthesia qualifying circumstances add-on codes (99100, 99116, 99135 and 99140) function like modifiers and must be submitted with the primary anesthesia code for the same date of service. If the payer bundled the add-on code with the primary code, the dispute is filed as a bundle; if the payer paid the add-on code separately, only the primary codes are batched, and the add-on code is reflected in the offer and supporting documentation for the primary code. Batching eligibility turns on the primary anesthesia code rather than the add-on code, and, like modifiers, these add-on codes do not count toward the 50-line-item limit.

The Guidance includes several examples illustrating these requirements in greater detail. 

Timing and Cooling Off Period Guidance

Generally, batched items and services must be furnished within 30 business days of the first item or service in the batch. Each item or service must also have completed a 30-business-day open negotiation period that ended within four business days before IDR initiation, unless a cooling off period applies. After a payment determination, the initiating party may not initiate a new dispute against the same party for the same service code (regardless of any modifiers or anesthesia qualifying circumstances add-on codes) until the cooling off period ends. The cooling off period begins on the date of the determination and lasts 90 calendar days following a single dispute and 30 business days following a batched dispute. 

According to the Guidance, once a cooling off period ends, the provider must initiate the dispute within 30 business days following a single-dispute cooling off period and within four business days following a batched dispute cooling off period. Because each determination triggers its own cooling off period, periods may overlap, and the last period to end controls the filing window. When filing a batch after a cooling off period, providers should enter the start date of the open negotiation period for the first claim and attach evidence each open negotiation period in the batch. Any item or service submitted while a cooling off period remains in effect will be deemed ineligible.

The Guidance includes multiple examples walking through the timelines established by the Final Rule and the Guidance. 

Guidance Related to Resubmission

Beginning 120 days after the IDR registry provisions become applicable, providers will no longer be permitted to resubmit an incorrectly batched dispute. The IDR registry provisions will become applicable 90 business days after the Departments issue additional guidance on the functionality supporting the registry. Under the Guidance, certified IDR entities that determine a dispute was improperly batched are directed to proceed with payment determinations for the items or services that were properly batched.

Key Takeaways

For disputes with open negotiation periods beginning on or after November 1, 2026, items and services may be batched only if they involve the same provider and the same payer, relate to the treatment of a similar condition, do not exceed 50-line items, and are submitted within the applicable timeframes. The Guidance operationalizing the Final Rule sets out the specialty CPT code ranges and expands on the rules governing modifiers, add-on codes, and cooling off calculations. Because the opportunity to resubmit an improperly batched dispute is being phased out, providers should prioritize batching correctly the first time. 

The full Guidance is available here. 

Reporter, Morgan Cronin, Atlanta, GA, + 1 404-572-2795, mcronin@kslaw.com

CMS Finalizes Revisions to Organ Procurement Organization Conditions for Coverage

On October 30, 2026, CMS made available for public inspection its final rule revising the Conditions for Coverage (CfCs) for Organ Procurement Organizations (OPOs) (the Final Rule). The Final Rule provides additional details in CMS’s overhaul of the OPO outcome measures and performance ranking that it first announced in its December 2020 final rule. Among other changes, the Final Rule revises several definitions, explains CMS’s process to certify new OPOs, establishes the framework for a single OPO to serve multiple donation service areas (DSAs), clarifies when a DSA is open for competition, and overhauls the appeals process. Notably, the Final Rule does not change the outcome measures or the three-tier structure used for recertification and decertification as requested by many commenters. 

Background

OPOs are the nonprofit organizations responsible for procuring and preserving transplantable organs and directing them to hospital transplant centers. There are currently fifty-four federally certified OPOs in the United States, each with its own DSA. Through agreements with the health care facilities in their service areas, OPOs work closely with donor hospitals and certified transplant centers to facilitate organ donation and transplantation. CMS surveys and recertifies OPOs every four years based on regulatory conditions for coverage.

In December 2020, CMS issued a rule creating OPO performance measures focusing on organ donation rate and organ transplantation rate. 85 Fed. Reg. 77,898 (Dec. 2, 2020) (the 2020 Framework). Under a tiering system, OPOs ranked in the top 25 percent on both measures are designated Tier 1 and automatically recertified, while Tier 3 OPOs—those with one or both measures below the median—face decertification. Tier 2 OPOs are required to recompete against other OPO bids for their DSA. CMS chose not to risk-adjust these outcome measures for demographic factors.

CMS issued a proposed rule in January 2026 (the Proposed Rule) to significantly revise the OPO CfCs. CMS received 129 timely comments on the Proposed Rule. Among other points, commenters renewed longstanding concerns about the outcome measures adopted in the 2020 rule. Commenters argued the measures are biased against large OPOs, ignore demographic differences and rely on flawed data. Comments also raised concerns regarding the destabilizing effect on the organ donation and transplant system resulting from the upcoming Tier 3 decertifications and called for delays in decertification. 

The following provides an overview of key sections of the Final Rule.

The Final Rule

In response to commenters’ requests to revise the outcome measures, CMS called those objections outside the scope of the rule and did not alter its 2020 Framework. CMS also rejected the concern that de-certifying underperforming OPOs would destabilize the system, stating that “such stability led to stagnation in performance.”

To facilitate the certification of new OPOs under the 2020 Framework, CMS finalized its proposal to remove 42 C.F.R. § 486.303(e), which conditioned certification on an entity having been re-certified as an OPO from 2002 through 2005. Several commenters argued that CMS lacks statutory authority to certify new OPOs and that any such change should come from Congress. Indeed, CMS had historically read Section 371(b)(1)(D) of the Public Health Service Act to bar the Secretary from certifying new OPOs outside of that timeframe, but now concludes that this was not the “best reading of the statute,” citing Executive Order 14219 and the Supreme Court’s landmark decision in Loper Bright Enterprises v. Raimondo. 

The Final Rule specifies that a DSA is open for competition when: (1) the DSA is assigned to tier 3 in the final assessment period and all administrative appeals are exhausted; (2) the DSA is assigned to tier 2 in the final assessment period; (3) the OPO is out of compliance with the process performance measures, all appeals are exhausted, and the OPO is pending de-certification; or (4) the OPO voluntarily terminates its agreement, other than in connection with a merger with another OPO.

Where there is insufficient time to conduct a competition, CMS may designate a successor OPO without a competition, and CMS modified its proposal to allow the CMS-designated successor OPO to retain the designation for the remainder of the recertification cycle. To avoid disadvantaging OPOs that are assigned a new DSA without a competition, the DSA will not be opened for competition again at the end of that re-certification cycle if the CMS-designated OPO’s performance qualifies for tier 2 in the final assessment period.

To facilitate an OPO acquiring more than one DSA through competition, consolidation, or other scenarios, the Final Rule permits an OPO to be designated to more than one DSA. An OPO may consolidate the DSAs or maintain them separately. Where DSAs are maintained separately, CMS will evaluate outcome measures separately for each DSA, while process performance measures will be evaluated for the OPO as a single entity. For instance, an OPO with a tier 3 DSA will lose its designation to that DSA but will not be de-certified if it has another DSA that is in tier 1 or tier 2, or that is pending evaluation.

The Final Rule also distinguishes “non-renewal” from “de-certification.” For instance, an OPO that meets tier 2 standards but loses its DSA to competition may be recertified, but its agreement with CMS to operate the DSA will not be renewed. That OPO may continue to compete for open DSAs during the next cycle. However, if it does not obtain a DSA by the end of that cycle, it will be decertified. Over the objections of many commenters, CMS confirmed that an OPO will not have appeal rights for losing a competition, reasoning that allowing appeals of competition results “would be unwieldy and would create uncertainty.”

For OPOs that acquire a new DSA through competition or CMS assignment after January 1 of the first year of the agreement cycle, CMS finalized its proposal that outcome measure accountability would begin once twelve calendar months of data are available. For recertification purposes, accountability would begin in the final assessment period of the following recertification cycle.

The Final Rule left unchanged the 2020 Framework by which an OPO with a tier 1 DSA retains that DSA for another agreement period, an OPO with a tier 2 DSA must compete to retain it, and an OPO loses its designation to any tier 3 DSA. However, CMS stated that it will not apply the tiering information “rigidly” when OPOs compete for an open DSA, and that it will treat small performance differences between competitors as relatively insignificant. This scenario, for example, may be key when a Tier 2 OPO is recompeting for its DSA against a Tier 1 OPO.

CMS finalized proposed changes to the appeals process for decertified OPOs. Under the Final Rule:

CMS finalized its proposal to revise the definition of “organ” so that pancreata procured for islet cell research, but not transplanted, will no longer count toward the transplantation rate outcome measure beginning with the 2027 assessment period, although pancreata will continue to count toward the donation rate. CMS also finalized a new definition of “unsound medical practices,” meaning failures by OPOs that create an imminent threat to patient health and safety or pose a risk to patients or the public, and confirmed that a single event can meet this standard and support immediate decertification for urgent need. Finally, CMS retained the existing definition of “adverse event” but moved its illustrative examples into the QAPI requirements, expanding them from three to six categories and clarifying that the list is non-exhaustive. 

CMS declined to adopt its proposed definitions of a “medically complex donor” and a “medically complex organ” based on a lack of consensus among interested parties and commenters.

The Final Rule is scheduled to be published in the Federal Register on November 3, 2026, and will take effect 60 days after publication (on or about January 2, 2027). The public inspection version of the Final Rule is available here.

Reporter, Michael L. LaBattaglia, Washington, D.C., +1 202 626 5579, mlabattaglia@kslaw.com

ONC Finalizes HTI-5, Cutting 14 Health IT Certification Criteria and Scaling Back Developer Reporting

On October 26, 2026, HHS announced the Office of the National Coordinator for Health Information Technology’s (ONC) “Health Data, Technology, and Interoperability: ONC Deregulatory Actions To Unleash Prosperity” final rule (HTI-5), which was published in the Federal Register on October 28. HTI-5 removes 14 of the 60 certification criteria in the ONC Health IT Certification Program (Certification Program), revises seven others, and pares back developers’ ongoing testing and reporting obligations. Among the revisions, ONC eliminated its “model card” transparency requirements for predictive decision support tools. Because CMS requires the use of certified electronic health record (EHR) technology in several Medicare programs, the changes affect providers as well as developers. Most changes take effect December 28, 2026, or January 1, 2027, but ONC delayed its main changes to the transitions of care criterion until 2030. 

How the Certification Program Works

The Certification Program sets the capabilities that health IT products, such as EHR systems, must have in order to be certified. Each certification criterion describes one capability, such as sending a patient’s care summary to another provider, along with any technical standards the product must use. Two criteria, covering quality management systems and accessibility-centered design, apply to every certified product.

Although providers are not required to participate in the Certification Program directly, CMS requires eligible hospitals, critical access hospitals, and eligible clinicians to use certified EHR technology in certain Medicare programs, including the Medicare Promoting Interoperability Program. CMS’s definitions of certified EHR technology incorporate ONC’s “Base EHR” definition, a core set of criteria that includes order entry, transitions of care, and the standardized application programming interface (API) criterion, plus other criteria CMS selects. Developers of certified products must also meet ongoing conditions of certification established under the 21st Century Cures Act of 2016.

Criteria Removed

ONC will stop testing and certifying the functions covered by the 14 removed criteria. ONC said the removals reflect its shift toward Fast Healthcare Interoperability Resources (FHIR), a standard for exchanging health data through APIs.

On December 28, 2026, ONC will remove the two criteria for exchanging patient summary records tagged as restricted from redisclosure and the two criteria for exchanging records through Direct, a secure messaging standard. It will also remove the care plan criterion, a supplemental criterion that tested whether a product correctly creates Consolidated Clinical Document Architecture documents, and the clinical decision support criterion, which expired on January 1, 2025.

The remaining seven will be removed on January 1, 2027. They include the criteria for generating reports on which patients count toward Promoting Interoperability measures, calculating those measures, and filtering quality measure results by common variables, as well as the two criteria that let outside applications identify a patient and request all of that patient’s data. The other two cover capturing family health history in a standardized coded format and adding patient-supplied information to the record.

Of the 14 removed criteria, the two Direct criteria and the two criteria for outside application access to patient data were part of the Base EHR definition. Others, including the criteria for adding patient-supplied information and calculating Promoting Interoperability measure results, were included in CMS’s definitions of certified EHR technology.

Criteria Revised

ONC’s December 2025 proposed rule would have removed 34 criteria and revised seven. HTI-5 removes 14 of the 34 and retains the remaining 20, two of them in revised form. Together with five of the seven revisions ONC originally proposed, HTI-5 revises seven criteria in total.

The two criteria ONC kept but revised cover reconciliation and safety-enhanced design. The reconciliation criterion, which covers merging a patient’s medication, allergy, and problem lists, no longer requires specific document exchange standards or side-by-side display of data from multiple sources. The safety-enhanced design criterion moves to an attestation. Developers must still apply and identify a user-centered design process, but they no longer need to conduct formal usability testing or submit the results.

The transitions of care criterion covers creating, sending, and receiving care summaries when patients move between providers. ONC had proposed removing the requirements to create those summaries and to send and receive them over Direct. Many commenters objected that both remain core exchange tools, particularly for post-acute, behavioral health, small, and rural providers, and ONC delayed those changes to January 1, 2030.

The decision support interventions criterion covers tools in certified health IT that help clinicians make decisions, including predictive tools that rely on algorithms. Previously, developers had to provide information about each tool, which ONC called “source attributes.” For predictive tools, that information served as a “model card” describing how the tool was trained, its intended use and limitations, and how it performs across patient groups. Effective December 28, 2026, HTI-5 removes those requirements, along with requirements that developers manage the risks of their predictive tools. Certified products must still let users select which tools to use.

HTI-5 also drops the requirement that the patient-facing view, download, and transmit criterion conform to the Web Content Accessibility Guidelines, a standard for making web content accessible to people with disabilities.

Finally, HTI-5 removes the required reporting standard from the antimicrobial use and resistance reporting criterion and deletes expired transition language from the quality measure reporting criterion.

Conditions of Certification: Real World Testing and Insights

HTI-5 narrows two conditions of certification: real world testing and Insights.

Real world testing requires developers to test their products each year in the settings where they are marketed to confirm that the products can exchange information with other systems. If that testing shows a product does not meet a certification criterion, the developer must report the problem to its certification body within 30 days. Starting with the attestation period that begins January 1, 2027, HTI-5 eliminates annual real world testing plans and limits real world testing results reporting to products certified to ONC’s API criteria, although developers must still test the other covered criteria. 

The Insights condition requires developers to report data on how their products perform in use. HTI-5 cuts the required Insights measures from seven to two. One tracks how often apps retrieve data through FHIR-based APIs, and the other tracks bulk data requests.

A copy of HTI-5 is available here.

Reporter, William Mavity, Los Angeles, +1 213 218 4043, wmavity@kslaw.com

CMS Finalizes CY 2027 End-Stage Renal Disease Prospective Payment System Rule

On October 30, 2026, CMS published its calendar year (CY) 2027 final rule for the End-Stage Renal Disease (ESRD) Prospective Payment System (PPS). The rule also updates the payment rate for acute kidney injury (AKI) dialysis and revises the ESRD Quality Incentive Program (QIP). It will take effect on January 1, 2027. CMS projects a 2.7% overall increase in ESRD PPS payments, about $240 million including beneficiary coinsurance, for both hospital-based and freestanding facilities, which is well above the 1.1% increase CMS projected in the proposed rule.

Payment Rates

The CY 2027 base rate is $297.52 per treatment, up from $281.71 in CY 2026. This is a change from CMS’s initial proposal of $299.55; the final rate is lower despite a higher market basket update because of a smaller phosphate binder add-on. The figure reflects a 1.9% market basket update (up from the proposed 1.6%, based on more recent forecast data), a permanent $12.85 add-on for phosphate binders, a wage index budget neutrality factor of 1.00260, and a 0.98864 budget neutrality factor for the adjustment changes described below. CMS also rebases the ESRD Bundled market basket to a 2024 base year and finalizes the proposed 63.5% labor-related share. The AKI dialysis rate equals the base rate ($297.52), and CMS projects a 5.4% increase in AKI payments.

Key Policy Changes

ESRD Quality Incentive Program (QIP) (Payment Year 2029)

Starting with payment year 2029, CMS makes four changes to the ESRD QIP measure set, plus a related change to scoring. CMS replaces the Hypercalcemia reporting measure with a Hyperphosphatemia clinical measure and updates the bloodstream infection measure from the National Healthcare Safety Network (NHSN) to use a 2023 national baseline instead of 2014. CMS also removes the Medication Reconciliation and COVID-19 Vaccination Coverage Among Healthcare Personnel reporting measures. Finally, CMS eliminates the reporting measure domain and reweights the categories to account for this change. In the proposed rule, CMS also requested information on possibly adding the Dialysis Facility Discussion of Patient Life Goals patient-reported outcome measure to the QIP. After commenter feedback, CMS declines to adopt the measure in this rule and will consider the feedback in future rulemaking. 

CMS estimates that about 37% of facilities will receive a reduction in payment year 2029, projected to total about $18.7 million. Together with $114.5 million in estimated reporting costs, CMS puts the total payment year 2029 QIP impact for facilities at about $133.2 million.

A copy of the rule is available here.

Reporter, Marcia Foti, Washington, D.C., +1 202 626 9543, mfoti@kslaw.com

Editors: Chris Kenny and Ahsin Azim

Issue Editors: Alana Broe and Olivia Haimerl