Medicare just put GLP-1s within reach of your population, $50 at a time
The headlineOn July 1, with far less fanfare than the numbers deserve, CMS launched the Medicare GLP-1 Bridge: a demonstration running through December 31, 2027 that lets Part D enrollees who do not otherwise qualify for GLP-1 coverage — chiefly beneficiaries who would take the drugs for weight management alone — fill them at a flat $50 monthly copay. The mechanics live deliberately outside the normal Part D machinery: no deductible applies, the copay does not accrue toward true out-of-pocket costs, and no low-income subsidy attaches, so the $50 is the $50 for everyone who qualifies. Prescribers work through a dedicated prior-authorization form, and CMS has published implementation resources for prescribers and pharmacies alongside a beneficiary eligibility checker at Medicare.gov.
The backstory matters as much as the mechanics. The Bridge exists because BALANCE — the Innovation Center's planned test of anti-obesity drug coverage inside Part D proper — did not launch for 2027. The demonstration stands in for it, and CMS says plainly that the utilization data it collects will inform whether anti-obesity coverage lands in Part D for good. In other words, this is not a benefit tweak; it is the data-gathering phase of what could become permanent Medicare coverage of the most consequential drug class of the decade, pointed at the same obese, prediabetic, and cardiometabolic population that fills an ACO's chronic-disease registries — and the same conditions the ACCESS Model started paying on this month.
The drug dollars sit in Part D, outside your Parts A and B benchmark, and the reflex is to file this under "not our spend." Resist it, because three things land squarely on you. First, demand: the moment a $50 GLP-1 reaches the evening news, your participants' phones ring, and the prior-authorization workflow becomes your prescribers' problem. Second, the clinical and risk picture: GLP-1 uptake at scale changes the trajectory of obesity, prediabetes, and cardiometabolic disease across your attributed panel — documentation and HCC capture follow treatment, and the downstream Part A and B utilization, in both directions, flows straight into your benchmark math even though the drug itself does not. Third, the cliff: the demonstration ends December 31, 2027, so a beneficiary who starts this fall faces a coverage question in about eighteen months, and continuity planning for that cohort is a care-management problem you can start scoping now. Watch BALANCE — if the data pushes CMS toward permanent Part D coverage, this population-level experiment becomes population-level policy.
The Bridge cohort is a queryable population. If you cannot see who in your attributed panel started a GLP-1 this quarter, you cannot see your 2027 risk and utilization picture forming — and that visibility, joining pharmacy signals to your claims and quality data, is exactly the kind of question we build for the ACOs on our platform.
REACH signs off with $2.5 billion, and the LEAD clock is already running
The headlineOn July 9, CMS released the PY2024 financial and quality results for ACO REACH, the model's last full report card before it sunsets December 31. They are strong. The 115 participating REACH ACOs generated $2.5 billion in gross savings, with $988.3 million in net savings to CMS after $1.5 billion in shared savings — a 4.2 percent savings rate — flowed back to the ACOs. Ninety-six of the 115, 83 percent, earned savings; 19 took losses; 49 organizations qualified for the high performance pool. Quality held up alongside the economics: Standard and New Entrant ACOs averaged an 80.4 percent quality score, and the 14 High Needs Population ACOs averaged 86.2 percent across roughly 2.5 million beneficiaries served. Set beside the MSSP's record PY2024, NAACOS counts more than $9 billion in combined accountable-care savings for a single performance year.
The industry framing arrived with the numbers: NAACOS and Accountable for Health both cast the results as validation of the model's design, particularly its high-needs focus, and as the argument for carrying those design features into LEAD. Which matters, because LEAD is no longer an abstraction. First-cohort acceptance notices have not been made public, but the operational calendar is live and it runs through the same ACO-MS cycle you already know: participant TINs are due August 5 at noon ET, the deadline to drop a TIN is September 8, the no-risk Implementation Period opens September 15, the financial guarantee has to be in place by December 31, and Performance Year 1 starts January 1, 2027 on a ten-year run to 2036.
If you are finishing out REACH, the wind-down and the LEAD transition are now the same project: your PY2025 performance still counts, but the reporting infrastructure, network decisions, and beneficiary outreach that determine how you start 2027 get built between September and December. If you applied to LEAD, treat the Implementation Period as real work, not orientation — we said it in Issue #1 and the deadline math has only tightened. And if you are a pure MSSP ACO, the $9 billion combined-savings figure is your talking point too. It is the political capital the whole accountable-care enterprise carries into the CY2027 PFS rulemaking that is about to start, at a moment when CMS leadership has said plainly it wants less unmanaged fee-for-service, not more.
The September-to-December implementation window is exactly when aligned-cohort reporting gets underestimated. If your ACO is entering LEAD, the time to pressure-test whether you can filter quality data to a CMS-supplied beneficiary list across every participant practice is before the risk turns on, not after.
The House votes to hold your quality-reporting rules still through 2029
The headlineOn June 29, the House passed H.R. 5347, the Health Care Efficiency Through Flexibility Act, by voice vote under suspension of the rules — the fast track reserved for bills with no meaningful opposition — after a 43–0 vote in Ways and Means. The bill does two things ACO quality leaders should read together. First, it locks in current ACO quality measure reporting methods through 2029, a legislative pause on the forced march toward all-eCQM reporting that has dominated quality planning conversations for three years. Second, it directs CMS to pilot digital quality measures that pull data directly from EHRs rather than requiring manual submission. Supporters cite estimates that direct-from-EHR reporting could cut reporting costs by roughly 95 percent and save up to $14 billion nationally; treat those as advocates' numbers, but the direction is unambiguous. NAACOS applauded the passage the same day.
The bill now waits on the Senate, and nothing changes until it acts. But the signal value is real: reporting burden is one of the few health-policy topics moving through the House without a fight in 2026, and the pairing — stability now, digital pilot next — tells you where the eventual landing zone is.
Plan on the APP Plus stack you have. The measures, methods, and submission mechanics you built for PY2026 are the safest planning assumption through the end of the decade if this becomes law, and CMS's own FHIR-based dQM work is still pre-rulemaking. What this is not is permission to stop the digital work. The dQM pilot language means direct-from-EHR reporting is still the destination; the freeze changes the timetable, not the direction. The practical read: keep maturing your eCQM data pipelines at your own pace instead of CMS's, and watch two things this summer — Senate movement on the bill, and whether the CY2027 PFS proposed rule writes a different quality-reporting future that this legislation would then override.
We report through whatever method the rules require, so our stake here is yours: stability through 2029 protects the APP Plus investment our ACOs have already made. The dQM pilot is the part we are watching closest, because a registry that already speaks FHIR is how you get the 95 percent burden reduction without betting your shared savings on an unproven pipeline.
A billion records through TEFCA, while the July 4 milestone passes quietly
The headlineTwo interoperability stories crossed in this window, and the contrast between them is the story. On June 26, HHS announced that TEFCA has now moved more than one billion clinical records, up from roughly ten million in January 2025 — a hundred-fold jump in eighteen months, across a QHIN roster that has grown to nearly a dozen with the additions of eClinicalWorks, Netsmart, Oracle Health, and Surescripts. The growth came with new teeth: ONC awarded a compliance-verification contract worth $1.3 million now and potentially $5.6 million through 2031, plus expanded compliance reviews of the QHINs themselves. Meanwhile, the July 4 CMS Aligned Networks milestone we covered last issue — the date by which the first wave of networks was to expose patient data through FHIR APIs and stand up a record locator — came and went without a public scorecard. As of this writing, CMS has published no launch announcement and no list of who actually went live. The venue to watch is the CMS + HL7 FHIR Connectathon running July 14–16, where the operationalization work is expected to be on display.
Against the milestone optimism, keep the adoption baseline in view. The most recent federal data, from ONC's survey of 2024, shows 70 percent of hospitals using FHIR APIs for patient access but only about half integrating outside data through standards-based APIs for any clinical purpose — and most hospital-to-third-party exchange still runs over non-standard connections. KLAS's latest interoperability report lands harder: just 49 percent of clinicians say data from outside EHRs integrates into their workflow as expected. That number was 45 percent in 2018. A decade of infrastructure, one billion records, four points of perceived progress at the point of care.
The pipes are being laid much faster than the water is flowing, and an ACO should plan for both truths. The record volume and the oversight contract mean TEFCA is becoming real infrastructure, and ASTP's guidance to health systems has been to run "two lanes" — TEFCA and the CMS Aligned Networks — rather than pick a winner. The concrete move this quarter is unchanged from last issue but now has a date attached: find out which of your networks, payers, and vendors are actually live, not pledged, once the Connectathon showcase clarifies who shipped. And mark January 1, 2027, when the CMS-0057-F payer APIs come due — the Provider Access API with bulk FHIR export is the mechanism that lets you pull claim-linked clinical data for your attributed panel from payers directly, which is the payoff all this plumbing has been promising value-based care all along.
The KLAS number is the one we would put on the wall. Connectivity is not integration: getting the feed is the start, and turning it into gap closure and defensible quality data is the actual work. Ask any data partner, us included, which of the two lanes they are live on today and what they will demonstrate at the Connectathon, not what they have pledged.
The Security Rule overhaul slips to 2027; the attackers kept their schedule
The headlineThe stall we described last issue is now official policy. In the updated regulatory agenda posted the week of July 6, HHS pushed the final HIPAA Security Rule amendments from May 2026 to July 2027, reclassified the rulemaking as a "long term action," and removed it from the 2026 rule list. Note what did not happen: despite a coalition of more than a hundred provider groups asking HHS to withdraw the proposal outright, it was delayed, not killed. The proposal drew roughly 5,000 comments, most opposed, against HHS's own estimate of $9 billion in first-year compliance costs, and analysts expect whatever finalizes in 2027 to keep only the less controversial provisions. One adjacent date worth marking: the same agenda targets final HIPAA Privacy Rule amendments for August 2026, and that rule is at OMB now.
The threat environment did not take the year off. Medtronic began mailing notification letters the week of July 5 to about 3.8 million people whose data — names, dates of birth, Social Security numbers, health information — was taken in an April intrusion claimed by the ShinyHunters group. Days earlier, AdaptHealth, the publicly traded home-medical-equipment supplier, told the SEC that attackers had social-engineered credentials out of a third-party contractor and used them to reach cloud systems including patient management platforms; ShinyHunters again, patient count still unknown. And OCR keeps enforcing the rule that exists: its June 18 settlement with a self-insured health plan sponsor — $450,000 over a ransomware breach traced to an inadequate risk analysis — was its twentieth ransomware enforcement action and fourteenth under the Risk Analysis Initiative.
Read the delay as breathing room on the compliance project, not on the security posture. The enforceable bar today is unchanged — the current Security Rule, your risk analysis, and the documented follow-through OCR's initiative keeps citing — and the two breaches in this window both walked in through the vendor layer, which is where an ACO's exposure concentrates anyway. The AdaptHealth case adds a specific question to your vendor diligence: it is no longer enough to ask whether a vendor's employees have MFA; ask how their contractors' access is provisioned, verified, and monitored, because a social-engineered contractor credential defeated a cloud platform's front door. And put the August Privacy Rule target on your radar — after a year of the Security Rule soaking up attention, the first HIPAA rule to actually change may be the other one.
We hold PHI for the ACOs on our platform, and contractor access is part of our own risk analysis, so we will say what we would want to hear from any vendor: every credential that can touch ePHI gets MFA and least-privilege scoping, employee or not, and we can show you the access review that proves it.
What we're tracking next
- The CY2027 PFS proposed rule is the last domino. CMS released the CY2027 OPPS and Home Health proposed rules July 1–2, and as of this writing the PFS rule — the one carrying the MSSP methodology proposals — is still unpublished; last year's landed July 14. When it drops, we read the benchmarking section first, as promised: the ACPT's fate, prepaid shared savings friction, a possible skin-substitute spending fix NAACOS has campaigned for, and the conversion-factor math, where the statutory +0.75/+0.25 percent APM split minus the expiring one-year 2.5 percent boost nets out, per MedPAC estimates, to cuts of roughly 1.7 to 2.2 percent unless Congress intervenes. Full breakdown next issue.
- ACCESS is live. The chronic-care model we profiled in Issue #2 launched July 5 with 150-plus participating organizations and rolling start dates next on August 17 and October 1. New for your clinicians: co-management payments of $30 per service (plus a $10 one-time onboarding add-on) through new G-codes for referring and coordinating with ACCESS participants — no enrollment required. The 2028 line still holds: ACCESS payments stay out of your MSSP benchmark math for 2026 and 2027, then flow in.
- MAHA ELEVATE Cohort 1 launches in October, per CMS — a correction to the September date that had circulated — with awardee announcements still pending. If chronic-disease funding is in your 2027 plan, Cohort 2's application cycle is the one you can still act on.