Every system should answer two questions: how do we know, and who decides? Here, "how we know" is linked below: the source text itself. And who decides is not us: the enacted text decides, and it belongs to you. The law that governs your clinic, your claim, your care doesn't require a law degree to read. It requires knowing where to look. This room is meant to help with that.
If this site says something a primary source doesn't support, tell us: contact@5qhealth.ai. We'll check it against the text, and if you're right, we'll correct it, with a dated note. Corrections are welcome; they make the work better.
How this room works
Each entry is one primary source: what it is, where it officially lives, and where to look inside it. Every link points to the source's official home (the Federal Register, the Illinois General Assembly, CMS), not a mirror or summary. Our analyses interpret; these documents decide. When the two disagree, the document wins, and we correct the analysis, dated and noted.
Links verified working: July 15, 2026. Entries marked “added September 26, 2026” were verified on that date.
Federal rulemaking — AI & health IT
90 FR 60970, published December 29, 2025; comments closed February 27, 2026. The AI "model card" removal is in the discussion of 45 CFR § 170.315(b)(11); the privacy/security criterion at § 170.315(d)(1) and the information-blocking exception changes each have their own sections. Read it on federalregister.gov →
Companions: the ASTP/ONC fact sheet, the HHS press release, and the Unified Agenda entry (RIN 0955-AA09), where a final-rule date would first appear. · Our analysis
The certification criteria HTI-5 proposes to change, in force now. Section 170.315 holds the full list: (b)(11) is decision support, (d) is privacy and security. Read it on ecfr.gov →
Medicare payment & suppliers
Published December 2, 2025. The annual accreditation requirement, unannounced surveys, and supplier enrollment changes are in the DMEPOS provisions — search the document for "accreditation" to land in the right sections. Read it on federalregister.gov →
Companion: CMS DMEPOS accreditation guidance (PDF) · Our analysis
The model bringing algorithm-assisted prior authorization review to Original Medicare. CMS's own model page carries the participation details, timelines, and FAQs. Read it on cms.gov →
Illinois enacted law
The first state law requiring annual independent audits of the largest AI developers. The bill status page links the full enacted text; the covered-developer definitions and the audit mandate are the heart of the act. Read it on ilga.gov →
Restricts AI in therapy and psychotherapy services to clients in Illinois. The permitted-use definitions (administrative vs. supplementary support) and the licensed-professional requirement are the operative core. Read the Public Act on ilga.gov →
Prohibits discriminatory use of AI in recruitment, hiring, promotion, discipline, and discharge, and specifically bans zip codes as a proxy for protected classes. Short act; the amendments to Section 2-102 carry the substance. Read the Public Act on ilga.gov →
Covered in our Illinois deployer analysis
Frameworks & standards
The vocabulary behind "GOVERN, MAP, MEASURE, MANAGE" wherever it appears on this site. The framework document and its playbook are free at NIST. Read it at nist.gov →
The certifiable AI management-system standard. Note: unlike everything else in this room, ISO sells the full text; the official page carries the free overview and scope. See it at iso.org →
The Joint Commission's voluntary certification for healthcare AI governance, developed with the Coalition for Health AI. The certification page carries the program requirements and guidance documents. Read it at jointcommission.org →
Self-assess against it with our free RUAIH Readiness Scorecard
The health-AI governance playbooks referenced in 5Q engagements, used under Creative Commons BY-NC-ND 4.0 and cited explicitly wherever they appear. Read it at governance.chai.org →
Medicaid, SNAP & North Carolina law (added September 26, 2026)
Section 71119 adds subsection (xx) to Section 1902 of the Social Security Act: who must show 80 hours of community engagement, and who is excused — including the medically frail. Read the enrolled text at govinfo.gov →
How states must verify compliance and exemptions: ex parte data checks first, medical-frailty documentation, and self-attestation limits. Read the CMS fact sheet → · Our analysis
The budget that funds GDAC analytics for SNAP, Medicaid, tax, child welfare, and statewide identity; extends the DME rate floor to June 30, 2029 (§ 9E.23); and resets PHP contracts for December 1, 2029 (§ 9E.21). Read it at ncleg.gov → · GDAC Watch
North Carolina’s layer on top of the federal rule: no self-attestation as the only evidence of eligibility (October 1, 2026), and 3-month and 3-of-6-month lookbacks (January 1, 2027). Read it at ncleg.gov →
The rules as NC Medicaid explains them to members: hours, income, exemptions, lookbacks, and appeals. Read it at medicaid.ncdhhs.gov → · Coverage Keeper
Foundational resources
The four questions this firm is built on: Is it legal? Is it ethical? Is it a good idea? How do we know, and who decides? The fifth question is ours. Read it at aisp.upenn.edu →