Trey Rawles

A consumer health company's marketing campaign performs exactly as designed. Registrations climb. Attribution looks clean. And it may have just committed a reportable federal data breach. Here is why that is happening across the industry right now. The FTC's Health Breach Notification Rule covers fertility, medication, mental health, fitness, and sleep apps operating entirely outside HIPAA. Amended in July 2024, it treats unauthorized advertising disclosures as potential breaches even when no attacker is involved. GoodRx: $1.5M penalty. Premom: $100K federal penalty. Hims and Hers: active litigation filed July 2026. The disclosure hides in the plumbing, not the labeled fields. A hashed email looks anonymous internally. But if the ad platform hashes its own emails the same way, it matches outputs without reversing anything. Context and audience membership carry health meaning even when no diagnosis field is present. Browser scans miss backend jobs that fire six hours later. The full paid deep-dive covers the technical investigation framework, consent enforcement at the code level, vendor governance specifics, state law interactions (including Washington's My Health My Data Act), sixty-day notification mechanics, investment case modeling, and the build vs. buy breakdown for privacy software companies in this space. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/when-con…

Amazon, Google, Meta and others signed a prior auth pledge for self-funded plans. The employers did not commit to reducing prior authorization. They said changes would be considered against fiduciary duties. That gap is where the business opportunity lives. The existing vendor market is already busy. Availity, Cohere, Surescripts, SamaCare all automate substantial parts of this process. A startup claiming to have discovered automated submissions will have a short investor meeting. The real opening: an employer can now ask its administrator to prove the benefit rules it purchased are the rules actually running. Successfully connecting to an admin system does not prove the employer's selected rules are being applied. The article maps five specific venture archetypes - plan verification, workflow measurement, authorization retirement, specialty continuity, and payment reconciliation - and works through the revenue arithmetic and investment conditions for each. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/venture-…

CMS published the first Rural Health Transformation obligation report. Ten billion in state awards. Only about four billion reported as obligated through July 2026. Florida: under 1% obligated. Georgia: 100%. The geographic spread is real but misleading. A fully obligated state may still have downstream vendor purchasing ahead. A state at zero may have advanced substantially since the July cutoff. The report names specific categories: revenue cycle, credentialing, ambient AI deployment, health information exchange, remote monitoring, documentation tools. Those are actual purchasing signals, not vague priorities. The real investment question is not whether rural customers can access the funding. It is whether they will still pay when the grant is no longer the source of the invoice. That is where most decks go quiet. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/private-…

Ohio just hosted a federal event pushing CHOICE arrangements (individual coverage health reimbursement arrangements). The press conference is the least interesting part of the story. The market: 20,000+ employers offering some version of this model, 500,000+ covered lives, and 34% year-over-year growth among larger employers. Real numbers with real caveats. The trap: predictable employer spending and cheaper healthcare for workers are two different outcomes. Fixing a contribution can shift every future premium increase onto employees. Spreadsheets are good at hiding that. The opportunity: compliance rules, payment reconciliation, clinical coverage matching, and broker distribution all need purpose-built software. None of it is solved by a polished enrollment interface. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/ohios-ch…

The American healthcare industry spends about $19.7B a year fighting payer denials. Roughly 54% of denied claims eventually get overturned. The industry pays close to twenty billion dollars annually to be told it was right all along. AI is now pointed directly at this. But AI is not killing healthcare services broadly. It is deleting minutes from specific, rules-heavy, documented tasks - typing, routing, status checks, first-draft appeal letters, coding suggestions. Those happen to be exactly what vendors have billed by the FTE, the page, the case, for 30 years. The asymmetry is what makes this dangerous for vendors. When AI cuts handle time in half, the buyer captures the first dollar of savings - then asks for a lower price, insources, or buys the workflow from the EHR vendor that is already in the building. Revenue falls before anyone decides if the vendor is still useful. The ambient scribing market shows how this plays out. Kaiser logged ~2.5 million encounters in year one and estimated 15,800+ hours saved. One adjusted pilot found per-appointment savings at a fraction of a minute. The technology may help clinicians. The per-line scribe contract is threatened either way. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/why-ai-h…

The federal government just put $1.5M behind a clinical AI agent that answers to the patient, not the hospital, not the EHR vendor, not the payer. Here is why that design choice matters. ONC's LEAP program has made 20 awards since 2018. Its 2018 award for bulk Fast Healthcare Interoperability Resources data export became a federal certification requirement two years later. This program tends to predict regulation. The 2026 round hands agentic AI its biggest check. The winning project from MedStar is called the Sovereign Execution Bridge. Three components: durable long-running workflows, patient-controlled data pods on the Solid protocol, and cryptographically verifiable routing with tamper-evident certificates. Clinical follow-up is the target workflow for a reason. A review of 19 US ambulatory studies found 7 to 62 percent of lab results had no documented follow-up. The agent books the appointment, nudges the patient, and leaves a verifiable trail, all gated on patient permission.

The 2027 Medicare Advantage Star Ratings dropped Oct 8. The headline barely moved. Everything underneath it did. A thread on what that means for health plans and the companies that sell them stars. Of 508 rated contracts, only 188 hit 4 stars or better. That is 37%, down from 44% last year. Five-star contracts fell from 22 to 15. Smaller plans slipped while the giants held. The mid-size plans that fell are the most exposed and the least equipped to fix it internally. What is a half-star worth? For a plan with 50k members, crossing from 3.5 to 4 stars is worth $25M to $40M per year, every year it holds. About 6.9M members are currently parked in 3.5-star contracts. That is $3.5B to $5.5B in annual bonus revenue sitting one half-star below the line. The measures that drove this year's damage are the exact ones where outreach and data infrastructure matter most. Diabetes medication adherence fell to 2.7 average. Follow-up after emergency visits sits at 2.5, the lowest on the entire Part C list. This is an operational problem with a nine-figure price tag.

A 338-page federal rule just quietly reshuffled the health data startup market. Here is what actually happened with the Transparency in Coverage final rule and where the real opportunities landed. The monthly in-network machine-readable file corpus has been running over 1 petabyte. The rule is expected to cut that by roughly 70%. Full-copy storage drops from ~$22K/month to under $7K. The petabyte problem that justified Series A rounds is becoming a line item. But look at what the rule DIDN'T do: no change-log file, no enrollment totals, no retention requirement, no network ID registry, no API. The government drafted all of those, took comments, and declined to ship them. That list is a product roadmap. Three new file types land: a Taxonomy File (adjudication logic), a Utilization File (who got paid for what by NPI and TIN), and a Text File in the web root. Plus cost-sharing estimates by phone for plan years starting January 2027. Fifteen hundred filers now have new checklists.

An anonymous post claimed 80 of 82 Rochester General residents are visa holders. The Dept of Labor inspector general amplified it within 72 hours. A senator called it structural rigging. A state senator called it racist. All of that happened in one weekend. Here is what the 2026 Match data actually shows: US medical seniors matched at 93.5%, same as the prior two years. Roughly 590 US seniors finished unmatched - mostly people who aimed at ortho or derm and missed, not community hospital seats lost to visa holders. Family medicine left 899 seats unfilled when the algorithm ran. Only about 1,750 US seniors ranked even one FM program out of nearly 21,000 in the match. The empty chairs are in the specialties American grads pass on. The exam integrity story is real but separate. 832 USMLE scores were invalidated from one Nepal testing center in January 2024. That is a credential infrastructure problem. The clinical skills exam was cut in 2021. These are not the same issue as seat math.

Alibaba's RADAR just outperformed 23 of 26 radiologists on abdominal CT across 146 findings. Mean AUC 0.913. Published in Science. Read times dropped ~30% with AI assist. So why is US imaging AI still stuck in pilot? There are 1,164 FDA-authorized radiology AI devices in the US right now. There are 2 Category 1 billing codes for newer imaging AI. Two. Without a clear payment path, there is no clear buyer. That math does not change because the model is impressive. The FDA evaluates AI devices finding by finding. RADAR covers 146 findings. Bringing its full scope to an American reading room is not one clearance. It is potentially 146 of them, each requiring US clinical validation data that mostly does not exist yet. And the liability angle almost never makes the conference slides. Research on jury behavior shows physicians get assigned meaningfully higher fault in malpractice cases when AI was available and missed something. Using AI raises the standard of care in the jury's mind.

Three federal health care fraud stories broke in one week in September 2026. Social media merged them into one. That merge is doing real damage to how people understand what was actually proven. DOJ's new National Fraud Enforcement Division charged 455 defendants in June over $6.5B in alleged false claims. That sounds enormous. But nearly $3.5B traces to a single catheter scheme. Strip that out and the average case is under $2M. Volume and state coordination are the real story here. The telemedicine sentences landing right now involve conduct from 2017 to 2020. A Georgia nurse practitioner got 10 years for a brace-order mill that ran from 2017 to 2019. The pandemic-era cases have barely reached courtrooms. That 6 to 9 year lag matters for anyone watching where enforcement goes next. The viral 35 percent zero-claims stat is the most important number to be careful about. Enrollment duration alone gets you to a 28 percent zero-claims rate with no fraud at all. Confirmed improper enrollment sits around 4 percent. The gap between 4 and 35 is not a rounding error.

The inventor of the transistor didn't collect most of the value it created. The inventor of the transformer didn't either. The money went to whoever owned the scarce thing next door once the primitive got cheap. This is the report card theory: the biggest companies get built when a basic building block of human life (a school subject or a survival need) becomes something machines can do for near zero cost. Language went first. Arithmetic went decades earlier. Biology's reading layer (genome sequencing) is basically done. GLP-1s cracked appetite. Shelter failed because the constraint was zoning, not physics. Four tests sort the order: does the corpus exist, can the machine grade its own work, where does the margin migrate when cost collapses, and who controls the permission layer. Healthcare fails the permission test hardest of all.

In 1968, the NYSE closed Wednesdays because back offices couldn't move paper fast enough. The fix was a neutral clearing utility that nobody thinks about today. Healthcare has the same problem. It has never built the fix. The largest clearinghouse in the country is owned by the largest health insurer in the country. In Feb 2024 a ransomware attack took it dark for weeks. 9+ billion in emergency provider advances. 2.2 billion in direct costs. 190 million records exposed. That is a structural problem, not an IT problem. A JAMA waste analysis estimated that simplifying administration could save roughly 265 billion dollars a year. That estimate is 7 years old. The intervention still does not exist. Both sides are spending that money fighting each other instead. Federal rules generally require prior auth programming interfaces live by January 2027 for Medicare Advantage, Medicaid, and qualified health plans. The data standard exists. The neutral network does not. That is the gap a venture-built clearing utility could fill. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link in onhealthcare.tech/p/the-vc-b…

Approval without affordability is how the denial happens invisibly now. The prior auth cleared, so the insurer gets to call it coverage. But the $862 is coming from somewhere specific: a deductible that resets annually, indexed to the same healthcare inflation that drives premiums, with a legal ceiling (the ACA out-of-pocket max) that hits $21,200 for families in 2026. That ceiling is supposed to protect her. What it actually does is tell her exactly how much she can legally be made to pay before insurance functions at all. The worker contribution to the average family plan is $6,850 annually. The maximum she can be made to pay out of pocket before coverage kicks in fully is $21,200. Those two numbers in the same sentence should end the conversation about whether this is insurance in any actuarial sense. What makes the front desk moment so telling is the 42.4% patient collection rate sitting behind it. Providers know most of this won't get paid, they collect what they can upfront, she faces the full sticker price before anyone blinks. The approval just moved the denial to a different desk. (The cruel part is that "approved" is now the marketing, the actual financial exposure is the product.) The math on how this compounds: onhealthcare.tech/p/the-unde…

The post cuts off before making its full argument, but the setup is pointing at the same gap I've been tracking: that discovering or validating a new editing modality is increasingly the shorter leg of the race. What I found when I mapped CASGEVY's commercial performance against its eligible patient population is that the bottleneck is almost entirely downstream of the science. Roughly 60,000 patients across approved geographies, a $2.2M list price, $43M in Q1 2026 revenue, and 500+ initiations globally. That math doesn't describe a therapy with a science problem. It describes a therapy that arrives at a healthcare operating system that was never designed to handle a multi-month coordinated services bundle priced as a one-time cure, financed through Medicaid, and delivered through transplant center capacity that isn't managed as a scalable service line. The part that tends to get skipped in these conversations is what has to exist before a patient gets treated: apheresis coordination, conditioning chemotherapy, engraftment and inpatient stay, fertility preservation, years of follow-up data collection for payers and reinsurers, and outcomes-based contract mechanics that Medicaid programs structurally cannot execute without actuarial infrastructure that doesn't yet exist. None of that is a science question. (The Anthropic angle is interesting here because if AI is compressing the modality discovery timeline even further, the infrastructure deficit becomes proportionally more urgent, not less.) The next cycle of returns in this space probably belongs to the companies building patient activation, registry systems, reinsurance products for curative therapies, and NGS safety assessment labs, not to additional editor platforms. More on all of this here: onhealthcare.tech/p/gene-edi…

Three companies all claim to lead clinical AI in US hospitals. Viz.ai, RapidAI, and Aidoc each report roughly 2,000 hospital relationships. At least two of them are wrong. Here is what the race actually looks like in 2026. The original competition was about stroke detection algorithms. That race is basically over - all three are good enough. The new competition is about who becomes the software layer between hospital imaging infrastructure and every AI tool a health system ever buys. Whoever owns that layer owns the category. Viz.ai pioneered the first Medicare-reimbursed clinical AI product. Now it is doing something its competitors have not replicated: getting pharmaceutical companies to fund disease detection programs. Fourteen life sciences partners and counting. Novel revenue model, real risk, real money. RapidAI has 700-plus published clinical studies behind its platform. Aidoc cleared a double-digit number of indications in a single FDA submission and has raised more than half a billion dollars total. The proposed 2027 Medicare rules creating a Software as a Medical Service payment category could decide which of these advantages actually wins. Subscribe to onhealthcare.tech for free and paid articles, podcasts, and more. For a further deep dive on the topic from today's video teaser, see the podcast and article link onhealthcare.tech/p/who-is-w…

Oregon's 2029 compliance deadline for pre-existing MSO arrangements is the number to watch, not the enactment date, because that is when we will actually learn whether platforms restructure, sell, or exit. But the bill's operative language is ownership-structure-agnostic, and that creates a targeting problem the Oregon framing obscures. The 82 percent of US physicians now employed by hospitals or corporate entities as of January 2026 is dominated by hospitals, with PE sitting in the high single digits overall, which means the legal exposure lands most heavily on Optum and vertically integrated payers, not on the PE roll-ups driving the political narrative. And those platforms have already confessed the control element in their own SEC filings: ASC 810 VIE accounting requires them to assert in their 10-Ks that the MSO has power over and absorbs residual returns of the professional corporation, which is precisely what plaintiffs would need to prove under the private right of action. The treble damages calculation runs against the entire management fee stream across all professional corporations times the statute of limitations, largely uninsurable through reps and warranties policies. Plaintiffs' counsel would need a 10-K and a highlighter. onhealthcare.tech/p/warrens-…

The KFF finding tracks, but the burden framing actually understates the structural problem. When only 1-in-10 Medicare Advantage denials ever get appealed, and payers overturn their own decisions more than 80% of the time when they do, the math stops being about clinical disagreement and starts being about attrition engineering. The denial layer doesn't need to be accurate, it needs to be exhausting enough that appeal rates stay negligible. The "check" framing is where I'd push back hardest. A check implies symmetric accountability, but ERISA preemption caps plan liability at the value of the denied benefit for two-thirds of insured workers. There's no penalty for being wrong, so the overturn rate on appeal is economically irrelevant to the plan's incentive structure. A 90% wrongful denial rate on a given service line is still profitable if fewer than 10% of patients fight it. What makes this durable isn't bad actors, it's a rational equilibrium. The denial apparatus is calibrated to produce exactly this outcome given the liability structure, the appeal attrition rate, and the automation asymmetry between what payers run and what providers and patients can run back at them. The closest thing to a real lever in the near term is CMS-0057-F's mandatory public reporting of denial and overturn rates, not because it changes the economics directly, but because denial-rate league tables will reach employer procurement conversations in ways that timeline mandates never will. onhealthcare.tech/p/how-non-…