Sen. Bill Cassidy’s draft would let outside firms review some AI medical software for the FDA and have Medicare test paying for AI that works without a doctor checking its work.
Sen. Bill Cassidy, the Louisiana Republican who chairs the Senate health committee, released a draft bill on how the federal government should regulate and pay for AI used in health care. The draft has not been introduced in Congress.
Under the draft, hospitals, insurers and their AI vendors would get federal guidance on using AI within health privacy and security law. Makers of lower-risk medical software, including AI tools, could have outside reviewers check it for the FDA. Medicare would set rules for covering AI services and test ways to pay for them. The draft would not decide who is liable when AI harms a patient. A nonprofit hired by the Department of Health and Human Services (HHS) would recommend changes to liability law.
Hospitals and insurers would get AI privacy and security guidance
Under the draft, HHS would have one year after the bill becomes law to issue guidance on how to follow HIPAA’s privacy and security rules when using AI. The guidance would apply to hospitals, insurers, contractors that handles hosptial/insurer patient data, and AI developers.
The guidance would explain:
- How much patient data an AI tool may use
- When patients must give consent
- How to stop AI vendors from keeping or reusing patient data without permission
- What to put in contracts with AI vendors
- How to oversee those vendors
- How to include AI in the security risk reviews HIPAA already requires
Outside reviewers could check lower-risk medical software
Under the draft, the FDA would certify at least three outside organizations to review medical software it judges low- or moderate-risk, including AI tools. None could have financial links to a device maker.
A reviewer would recommend to the FDA whether to clear the software. The FDA would have 30 days to accept the recommendation or order more review if the FDA deems it necessary. If the FDA decides not to initially accept the recommendation, it must explain why in writing. Its guidance, due within 180 days, would set out when that can happen.
Medical software companies can already get FDA approval in advance for software updates after their product is cleared. Under the draft, they could also change their software while the FDA is still reviewing it, without restarting the review. The FDA would first have to accept their plan for those changes.
The draft says these FDA changes would not affect the liability of medical software companies.
Medicare couldn’t reject AI just for working without a doctor
Under the draft, Medicare would have 18 months to publish the rules it will use to decide whether to pay for each AI service. Medicare would weigh whether the service works, whether it is safe, and whether it works for different patient groups. Medicare couldn’t refuse to cover an AI service just because a doctor doesn’t review its results. It could still refuse for other reasons.
FDA clearance alone would not be enough for Medicare to cover an AI tool.
HHS would set up billing codes for AI services within a year. It would propose ways to pay for those services within 18 months.
Medicare would also run a five-year test of paying for AI that does clinical work without a doctor. HHS would choose the AI tools and providers in the test. It would try different payment models, such as per service or based on patient results. Providers would have to tell patients that AI is part of their care. They would also have to track the AI’s safety. They would report major incidents and changes in how well the AI performs. HHS would also need a way to suspend an AI tool or a provider from the test when patient safety is at risk.
A nonprofit would recommend who is liable when AI harms a patient
Under the draft, HHS would hire a nonprofit to hold a public meeting within a year. Federal and state officials, industry, medical groups and patient advocates would discuss who should be legally liable when AI used in care harms a patient: the doctor, the hospital, the insurer or the AI developer.
Within 90 days of the meeting, the nonprofit would publish recommendations for federal and state lawmakers. They would cover malpractice, product liability and insurance law.
Comments are due Dec. 1
Cassidy is taking comments on the draft until Dec. 1 at [email protected]. He lost his Louisiana Republican primary in May. He leaves the Senate in January.
