CMS-1850-P · proposed July 7, 2026 · comments close August 31

Medicare is about to pay for clinical AI, per use.
Can you prove each use happened?

The CY2027 outpatient rule proposes the first Medicare payment category for algorithmic services — "Software as a Medical Service" (SaMS), status indicator O1, 36 codes, paid separately to the facility. In the same section, CMS names the problem it hasn't solved: nothing in a per-click claim proves a distinct analysis of a distinct patient study actually occurred. A tamper-evident receipt per billed use closes that gap. You can generate one today, free, without sending us anything.

What CMS proposed — the facts

THE CATEGORY

SaMS, status indicator O1

36 HCPCS codes designated "Software as a Medical Service," paid separately under OPPS via new-technology APCs. Interim for CY2027 while CMS builds a comprehensive methodology. Federal Register, §X.B.

 THE MONEY

Real per-use rates, paid to the facility

AI coronary-plaque quantification (CPT 75577): $950.50 per analysis. Lung-nodule AI: $650.50. The hospital outpatient department bills; the vendor never bills Medicare directly.

 THE OPEN QUESTION

CMS asked how to police it

The rule explicitly requests comment on payment design "while addressing any potential program integrity concerns." The docket is open until August 31, 2026 — the category's rules are being written now.

 THE NEXT PHASE

Outcomes-aligned payment is coming

CMS says the comprehensive methodology "may better align payment with clinical outcomes." Outcome-conditioned AI payment requires knowing which algorithm version analyzed which study — provenance, per claim.

The gap, in CMS's own words

Subscription- or license-based arrangements, as well as per-use or "per-click" fees… raises concerns regarding program integrity. … [T]he current cost-based system often offers only limited transparency into underlying costs and may not effectively constrain pricing. CMS-1850-P, section X.B — Federal Register Vol. 91, No. 128 (July 7, 2026)

The receipt that closes it

Four fields, generated at the moment of the analysis, costing effectively nothing. The content itself never leaves the facility — a SHA-256 fingerprint carries no PHI and cannot be reversed.

  1. Content hash of the analyzed input and the algorithmic output — proves a distinct study was analyzed, per billed unit.
  2. Algorithm identity and version — the substrate outcomes-aligned payment will require.
  3. Timestamp, anchored to a public registry countersigned into Bitcoin daily — verifiable by a MAC, UPIC, or OIG auditor without trusting anyone's logs, including ours.
  4. The reviewing clinician's NPI, where the code descriptor includes interpretation ("…with interpretation and report by a physician") — verifiable against CMS NPPES, per the Five Tests of a Real Review.
Anchor a receipt now — free Verify one The review standard

For engineering teams: one call per analysis

POST https://uhizqukdctkvluluheux.supabase.co/rest/v1/anchored_artifacts
{ "hash": "<sha256 of input+output+algo_version+npi>",
  "label": "O1 use receipt — CPT 75577 — 2027-01-15" }

# later, anyone verifies without trusting you or us:
POST .../rest/v1/rpc/anchor_verify  { "p_hash": "<sha256>" }
→ { "found": true, "anchored_at": "…" }

Full agent documentation in llms.txt. For governed pipelines with a BAA, use the harness.

Honest boundaries. CMS-1850-P is a proposed rule — O1 is not final until ~November 2026 and could change. O1 pays hospital outpatient departments, not vendors and not us; ASC payability is not established. A receipt is evidence that an analysis occurred and what it contained — it is not billing or compliance advice, and it does not by itself make a claim payable. We have drafted a public comment recommending CMS require per-use verifiable records in the comprehensive SaMS methodology; the docket is open to everyone until August 31 — including facilities and vendors who disagree with us.