KFF investigation reveals private CMS channel for AI health-app lobbying

Health-app companies have had a private route to federal officials discussing how to promote their products and access patients’ medical records. An October 9 KFF Health News investigation reveals those conversations inside a government-run Slack workspace—and raises questions about whether a group described as technical collaboration should face public advisory-committee oversight.

KFF reviewed thousands of Slack messages, meeting transcripts and video recordings. The Health Technology Ecosystem workspace began in August 2025 and grew to about 1,700 members over the following year. Participants included technology companies and investors, but only a handful of patient advocates, doctors and hospital representatives.

Technical collaboration or policy advice?

The workspace’s code of conduct says it does not constitute an advisory committee and will not be used to obtain advice or recommendations for federal health officials. It also says federal employees are prohibited from endorsing products, services or enterprises.

Joseph Daval, a former Food and Drug Administration lawyer now working at Harvard Medical School, sees a different picture. After reviewing messages at KFF’s request, he said members appeared to interact and build consensus on preferred actions. That resembles a federal advisory committee, he said, which would face public-visibility, independence and fair-balance requirements.

CMS did not answer KFF’s questions about the workspace’s legality. In an emailed response, Amy Gleason, CMS’s chief product officer for its Office of Health Technology and Products, described the ecosystem as an “open, voluntary technical collaboration.” She said the agency is working with patients, providers, payers and technology organizations to make health information more accessible and useful.

A government directory with commercial value

The public initiative predates this investigation. CMS launched its first wave of HealthTech Ecosystem tools on April 9, 2026, including the Medicare App Library and patient-facing applications. Its official announcement emphasized patients’ ability to access, share and use their health information, and said more than 700 organizations had pledged support.

Behind the scenes, officials also described a commercial opportunity. In a February video meeting reviewed by KFF, Jacob Shiff, the chief AI and technology officer at CMS’s Innovation Center, said he hoped the agency’s work would become a “sales engine” for health apps.

If medicare.gov is promoting it, for lack of a better word, then yeah, it would be an app that I would trust and explore

CMS senior policy adviser Morgan Taylor, describing an enrollee’s perspective during an April 7 meeting, according to a transcript reviewed by KFF Health News.

KFF found roughly two dozen commercial apps in the library. Officials suggested during at least two meetings that listed apps would be prioritized for a program reimbursing companies for some AI chatbot advice or wearable-device tracking. CMS did not answer questions about how it selects apps for the library or why employees had promised to promote them.

Patient access versus continuing app access

The workspace also hosted arguments over medical-record access. Vendors sought a “frictionless pathway” allowing apps to keep retrieving records after a verified user consented once. The records would come through the Trusted Exchange Framework and Common Agreement, or TEFCA, a national network through which healthcare providers exchange medical records electronically.

Healthcare consultant Ryan Howells argued that apps must undergo third-party vetting and agree to a code of conduct. He sits on the board of one vetting organization and lobbies for the CARIN Alliance, which developed the code. In the same Slack thread, b.well CEO Kristen Valdes argued against protecting patients “from themselves.” She later told KFF she was criticizing barriers to patients obtaining their own records, while acknowledging there would be good and bad apps.

Not everyone in the workspace agreed. One startup founder warned that privacy and security systems must account for malicious actors, especially if access expands to thousands of apps. That objection came from inside the industry discussion itself.