Discussion draft released October 29, 2026; stakeholder feedback due December 1, 2026
PATIENT AI Act Discussion Draft Would Split Healthcare AI Oversight Between FDA and ONC and Order HIPAA Guidance for AI Use
Senator Bill Cassidy, chair of the Senate Health, Education, Labor and Pensions Committee, released a discussion draft of the PATIENT AI Act on October 29. The full name is the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care Act. The draft proposes to clarify whether the FDA or the Office of the National Coordinator for Health Information Technology oversees healthcare AI tools: AI applications that do not qualify as FDA-regulated devices would be added to the definition of ONC certified health IT. The FDA would get a risk-based review process for software-based devices, including authority to accept premarket software changes and review updates on a rolling basis, and HHS would certify third-party bodies to review low to moderate risk software. The draft also applies existing federal preemption of state product liability laws to integrated and software-based devices. On payment, HHS would build a coverage evaluation framework for AI-based services, propose payment methodologies, establish a process to use Healthcare Common Procedure Coding System Level II codes for them, and the Center for Medicare and Medicaid Innovation would test a payment model for AI applications that deliver care autonomously. Two provisions speak directly to governance: HHS would issue HIPAA compliance guidance for AI use, and would commission a nonprofit to recommend approaches to AI liability. This is a discussion draft, not introduced legislation, and nothing in it binds any organization today. Senator Cassidy is accepting stakeholder feedback through December 1.
Executives
Healthcare AI adoption has been running ahead of a basic question: which regulator owns which tool. This draft is the clearest federal attempt so far to draw that line, device software toward the FDA, non-device applications toward ONC certification through the EHR channel, with a payment pathway attached so adoption and oversight arrive together. Because it is a discussion draft with a December 1 comment window, organizations with strong views on the HIPAA guidance or the liability study have a short, dated opportunity to shape both.
CIO / CISO
Map your current healthcare AI inventory against the draft two lanes now, while the mapping is cheap: which tools could be regulated devices, and which would land in certified health IT through your EHR vendor. Note where your HIPAA compliance story for AI use rests on your own interpretation today, because the draft promises HHS guidance that could confirm or unsettle it, and record that dependency in the AI governance register under the NIST AI RMF Govern function. If your organization comments, the HIPAA guidance scope and the liability recommendations are the two items with direct security and privacy consequences.
Engineers
Expect the practical effect, if this direction holds, to arrive through vendor paperwork: ONC certification criteria for non-device AI would reach most providers as EHR vendor documentation and transparency disclosures. Keep your own model and tool records in a form you can hand over, intended use, data flows involving protected health information, update cadence, and human review points, because both lanes of the draft assume that evidence exists.
Everyone (non-IT)
Nothing changes for patients or staff today: this is a draft released for comment, not a law. Its practical meaning is that the rules for how AI tools in healthcare are checked, paid for, and kept within HIPAA are being written now, and December 1 is the date by which hospitals, vendors and patient groups can send their views to the Senate committee.