The federal Women's Health and Cancer Rights Act (1998) requires health plans covering mastectomies to also cover breast reconstruction, prosthetics, and lymphedema treatment — but the law is frozen at 1998 clinical standards and has significant structural exemptions. H.R. 5813 (119th Congress) is the first proposed federal update in 27 years: it expands coverage to lumpectomy reconstruction, mandates all recognized modalities including DIEP flap, and requires in-network access to each. In parallel, Arkansas and Oregon enacted landmark state expansions effective January 2026, with ASPS actively pushing 10–15 more states.

The 2026 Medicare Physician Fee Schedule (CMS-1807-F) delivers a 5.1% conversion factor increase to $33.4009 — the first meaningful CF increase in years, driven by the OBBBA temporary boost and a 2.5% wRVU efficiency adjustment. However, a skin substitute reclassification effective January 1, 2026 creates immediate revenue risk for derm and plastics practices by collapsing per-unit pricing into a $127.28/sq cm flat bundled rate. The OBBBA CF boost is temporary — without Congressional action, the 2027 conversion factor reverts, creating a cliff. ICD-11 has no active US adoption timeline.

HHS OCR published the first substantive HIPAA Security Rule rewrite since 2003 on January 6, 2025. The NPRM eliminates the "addressable vs. required" flexibility and mandates MFA, encryption, annual documented risk assessments (8 required components), 72-hour data restoration, biannual vulnerability scans, and annual penetration testing — for every covered entity regardless of size. Over 4,750 comments demanded rescission; AMA, MGMA, and 100+ hospitals called the rule disconnected from small-practice reality. Despite a deregulatory White House, OCR kept the final rule on its May 2026 regulatory agenda. More urgent: OCR's Risk Analysis Initiative is settling enforcement actions against small practices today under existing law — including a solo MRI center ($5K) and a neurology practice ($25K).

Every commercial payer must publish monthly machine-readable files (MRFs) containing actual negotiated rates for every provider, CPT code, and plan under the Transparency in Coverage rule. This is simultaneously a compliance obligation (payers must publish, schema v2.0 enforcement began Feb. 2, 2026) and an untapped strategy weapon for OON providers: in-network MRF rates constitute legally permissible "credible information" in NSA IDR arbitration. Providers who anchored offers to in-network rates won 85% of IDR determinations in 2024. The catch: an estimated 91.8% of listed rates are "ghost rates" — inflated by payers to deflate QPA medians. CMS-9882-P (proposed Dec. 2025) will eliminate ghost rates and add utilization data by 2027.