A Discussion Draft, Not Yet a Bill
The chairman of the Senate Health, Education, Labor and Pensions Committee, Senator Bill Cassidy of Louisiana, has published a discussion draft that would begin to write rules for artificial intelligence in American health care. The measure, called the Protecting Americans Through Intelligent, Ethical, and Transparent Artificial Intelligence in Health Care Act, or the PATIENT AI Act, was released on 29 October and reported in detail on 2 November. It is important to be precise about what that means. A discussion draft is a preliminary version of a potential bill, published to gather feedback and frame debate. It has not been introduced as a bill, it has not been voted on in committee, and it does not change any law on its own. Cassidy is seeking comments from stakeholders by 1 December, and the shape of any future bill will depend in part on what those comments say.
Cassidy, a physician as well as a senator, has framed the draft as an attempt to expand access to health-care AI tools in a safe and responsible way. His office has described the goal as building a more predictable and consistent framework for reviewing and paying for AI-based technologies, removing barriers to useful products while strengthening oversight to protect patient safety. In a statement accompanying the draft, Cassidy argued that artificial intelligence is transforming how care is delivered, and that implementing it in health care must be done responsibly and to the benefit of patients, innovators and consumers. That combination, wider access plus clearer guardrails, is the draft’s central promise, and it is also the source of the hardest questions it will face, because access and safety can pull in opposite directions when a tool makes clinical decisions.
The draft arrives in the final weeks of Cassidy’s time in the Senate, which adds a practical complication that readers should understand. Reporting on the draft notes that Cassidy lost his Republican primary in May and that his term ends in early January, so any formal bill based on this draft would likely need a new sponsor or reintroduction in the next Congress. That does not make the draft meaningless. Discussion drafts often shape later legislation, and the ideas in this one, on regulation, privacy and payment, could be picked up by other lawmakers. But it does mean that the PATIENT AI Act, as published, should be read as an opening proposal and a record of one committee chairman’s approach, not as legislation on a clear path to passage. When Congress returns on November 9, the draft will be one item among many competing for attention in a short session.
PATIENT AI Act: Clarifying Whether the FDA or ONC Is in Charge
The draft’s first major task is to answer a question that currently confuses developers, hospitals and regulators alike: which federal agency oversees a given health-care AI tool? Under the draft, a future bill would specify whether a particular AI-based technology is subject to oversight by the Food and Drug Administration, which regulates medical devices, or by the Office of the National Coordinator for Health Information Technology, known as ONC, which oversees certified health information technology. The aim, according to Cassidy’s office, is regulatory clarity and consistency, so that technologies receive appropriately robust review without being trapped between two regulators or slipping through a gap between them.
That distinction matters because not all health AI is the same kind of product. Some tools function as medical devices, for example by analysing scans or recommending a diagnosis, while others are embedded in electronic health records or administrative systems and support, rather than replace, clinical judgement. Under the draft, AI applications that do not qualify as FDA-regulated devices would be added to the definition of ONC’s certified health IT, bringing them into a certification system that reaches hospitals and clinics through their record vendors. The draft would also extend existing federal preemption of state product-liability laws to integrated and software-based devices, a provision that could limit state lawsuits over such products and that is likely to draw close attention from consumer advocates and state officials during the comment period.
The draft would also give the Food and Drug Administration new authority to review changes to software on a rolling basis, rather than only at fixed approval points. That idea reflects how AI tools actually develop: unlike a traditional device that is finished when it is approved, software can be updated frequently, and its performance can change as it learns from new data. A rolling review model would let regulators examine those changes as they happen, but it also raises practical questions that the draft leaves open, including how often review would occur, what would trigger a new review, and how much burden it would place on smaller developers. Those details are exactly the kind of issue Cassidy is asking commenters to address before 1 December.
Privacy, Guidance and the Department’s Own Use of AI
Beyond the question of which agency is in charge, the draft would direct the Department of Health and Human Services to make greater use of AI in its own internal processes and to issue guidance ensuring that AI deployment protects patient privacy and security. That guidance would matter well beyond federal offices, because hospitals, nursing facilities and other care providers look to federal privacy guidance when they decide how to use new tools without breaching health privacy law. Reporting on the draft notes that operators of care facilities would be particularly interested in guidance on using AI in compliance with privacy rules, and in how the draft treats liability, since those questions determine whether a facility feels safe adopting a tool at all.
The draft sits alongside Cassidy’s recent health-technology work, which may help explain its approach. The Health Care Cybersecurity and Resiliency Act, a Cassidy bill, was passed by the Senate last month, and the bipartisan Health Information Privacy Reform Act cleared the HELP Committee in July. Both measures reflect the same pairing found in the PATIENT AI Act: encouraging new technology while tightening the rules around privacy and security. Supporters of that approach argue that clear federal rules are what allow hospitals to adopt AI with confidence, because without them, each provider must guess at its legal exposure. Critics of rapid AI adoption, by contrast, are likely to argue that guidance alone is not enough, and that strong enforcement, clear liability rules and patient consent protections must come before wider deployment, a debate the comment period is designed to surface.
One of the draft’s most closely watched provisions concerns payment, because a tool that cannot be paid for will not be widely used, however accurate it is. The draft would direct the Department to build a coverage evaluation framework for AI-based services, propose payment methods for them, and establish a process for using Healthcare Common Procedure Coding System Level II codes, the codes used to bill for many services and supplies. In practical terms, that would create a route for AI services to be recognised in the payment system, rather than being squeezed into codes designed for human-delivered care. The draft does not, however, set payment rates, list which conditions or tasks would be covered, or say how much patients would pay out of pocket. Those gaps are not oversights to be glossed over. They are the central economic questions, and they will determine whether the payment pathway helps patients or mainly helps vendors.
Testing Medicare Payment for AI That Acts on Its Own
The draft’s most ambitious payment idea is a five-year test, run by the CMS Innovation Center, of paying for AI applications capable of performing a clinical function autonomously, meaning tools that carry out a clinical task without a clinician performing each step. Under the draft, the model would begin no later than 24 months after any future law is enacted and would run for five years. Reporting on the draft notes that it includes patient notice and appeal protections, so that patients would be told when an autonomous tool is involved and have a route to challenge decisions. That protection is significant, because autonomous clinical tools raise questions that ordinary software does not: who is responsible if the tool is wrong, how a patient can seek review, and what happens when a tool’s recommendation conflicts with a clinician’s judgement.
At the same time, the draft does not define the word autonomously, and that omission could prove decisive. A tool that drafts a note for a clinician to approve, a tool that triages patients before a clinician sees them, and a tool that adjusts a treatment plan on its own all involve different levels of independence, and they carry different risks. Without a definition, the scope of the payment model, and of any future regulation built on it, will remain uncertain until regulators or a later bill fill the gap. The draft also leaves open how the model would measure whether autonomous tools improve care, reduce costs or create new harms, and how quickly a tool that performs poorly would be removed from the model. Those are the questions that clinicians, patient groups, insurers and developers are most likely to raise in comments, and their answers will shape whether the model is seen as a careful experiment or as a premature endorsement.
What to Watch Before 1 December
If the comment period goes as Cassidy intends, the next month will produce a detailed record of where the health-care industry, patient advocates and regulators agree and disagree. The most consequential comments are likely to focus on the questions the draft leaves open: the boundary between FDA and ONC oversight, the scope of federal preemption, the treatment of privacy and liability, and the design of the payment pathway. Commenters will also be asked, in effect, to weigh the draft’s central trade-off. A framework that is too light may allow useful tools to reach patients quickly but leave patients exposed if a tool fails. A framework that is too heavy may protect patients but slow the adoption of tools that could help them, particularly in underserved areas where clinicians are scarce.
The draft also leaves open a question about its own future. Because Cassidy will leave the Senate in January, the PATIENT AI Act will need a new champion if it is to become a bill in the next Congress, and that champion may revise its provisions. The ideas in the draft, however, are not tied to one senator alone. The problems it tries to solve, unclear oversight, uncertain payment and uneven privacy guidance, will remain whatever happens to the draft itself, and they are likely to return in future proposals from either party. For readers following health AI, the value of this draft is therefore not only in what it proposes, but in what it reveals about the choices Congress will have to make: how to regulate tools that act on their own, how to pay for them, and how to protect patients while still allowing innovation to reach them.
Sources: USN reviewed the PATIENT AI Act discussion draft and summary. Read more from Healthcare IT News, Becker’s Hospital Review and Bloomberg Government.