A discussion draft circulating on the Senate HELP Committee would create the first explicit Medicare payment pathway for AI tools used in care, and would rework how federal agencies review them.
The Patient AI Act, from committee chair Senator Bill Cassidy, a Louisiana Republican and physician, asks HHS to contract a nonprofit to examine liability questions for AI applications in clinical settings, and asks the Comptroller General for a report on transparency and explainability measures covering development, validation and deployment. It directs the HHS CIO to build datasets supporting AI research.
For device oversight, the draft assigns FDA responsibility for reviewing integrated and software-based devices, third-party certification, postmarket surveillance, and applying product liability law to software, along with a rolling review process for AI software. ONC would expand certified health IT to include clinical research technology and AI tools that fall outside FDA device regulation. The HHS Secretary would write a coverage framework and payment methodologies, including for tools that deliver care autonomously.
The security dimension sits inside that last piece. Anything that gets reimbursed becomes documented, and anything documented lands in a system of record that a breach exposes. Hospitals already running ambient documentation and triage models should expect procurement questionnaires on model provenance, training data governance and access logging to harden as payment attaches. Liability allocation, which the bill sends out for study, is the open question a CISO will be asked about first.
