⚠️ DEADLINE ALERT: Jan 1 Medicare, HIPAA Minimums, & $51K FTC Fines 🚨

HIPAA's "Minimum Necessary" Standard now applies to AI: New scrutiny on data access

A new wave of compliance guidance is re-emphasizing the "Minimum Necessary" standard, the long-standing HIPAA rule that restricts access to PHI to only what is required to perform a specific job. In the AI era, this means that the AI tools you use, even HIPAA-compliant ones, must only access the minimum amount of patient data needed for their function.

For example: if you use an AI tool to summarize session notes, it should only have access to the notes themselves, not the client's entire billing and intake history. Furthermore, new guidance advises that even anonymized data must follow this standard if it could be re-identified. Vendors are now being pressed to justify why their LLMs need specific data fields.

👉 Action: Before year-end, contact your EHR and practice management software vendors that use built-in AI (e.g., for transcription, note-generation, or scheduling). Ask them: "How is your model enforcing the Minimum Necessary standard for my data? What specific PHI fields are intentionally excluded from the LLM?" Their answer should confirm they limit the data shared with the AI layer. If they cannot answer, pause use of that feature until they provide documentation.

Google December Core Update hits "Unedited AI" therapy blogs

On December 2, Google began rolling out its final Core Update of 2025. Early data from the past week shows a specific penalty pattern: therapy websites with high volumes of generic, unedited AI content are seeing ranking drops of 30-40%. Google’s systems are now better at detecting "consensus content" articles that simply summarize general anxiety or depression symptoms without unique expert insight.

This is not a ban on AI, but a ban on lazy AI. If your blog posts lack personal "I" statements, clinical examples, or local context, they are being de-indexed or pushed to page 3.

👉 Action: Audit your top 5 traffic-driving blog posts this week. Inject "Experience, Expertise, Authoritativeness, and Trustworthiness" (E-E-A-T) by adding 2-3 sentences of personal clinical experience ("In my practice, I often see...") and linking to local resources. Remove any generic stock photos and replace them with real office photos or custom graphics.

Medicare Telehealth 2026: The "Physical Address" requirement returns

Effective January 1, 2026, the temporary waivers allowing therapists to list a home address as "private" while billing Medicare are shifting. CMS released final guidance this week clarifying that while you may use a home office, the "Practice Location" on file in PECOS must be verified as a legitimate site of service if you are to be reimbursed at the non-facility rate.

Confusion regarding PO Boxes persists: CMS reiterated on Friday that a PO Box or virtual mail drop (like a UPS store) is not a valid practice location. Using one may trigger immediate claim denials starting Jan 1.

👉 Action: Log into PECOS before December 15 to verify your address data. If you are fully remote, ensure your home address is listed correctly (it will not be public if you follow the suppression protocols, but it must be in the backend system). If you are using a virtual address, consult a credentialing specialist immediately to avoid a cash-flow freeze in January.

Google Business Profile triggers "Video Verification" wave

Throughout the past week, therapists attempting to update their holiday hours or service areas have been hit with immediate "Re-verification Required" notices. Unlike previous methods (postcard/phone), Google is now defaulting almost exclusively to Video Verification.

You will be required to upload a continuous video showing your street sign, unlocking your office door, and showing your tools of trade. For purely telehealth practices using a home address (hidden profile), this is causing a "loop of death" where verification fails repeatedly because there is no signage.

👉 Action: Do not edit your Name, Address, or Phone Number (NAP) on your profile until January unless absolutely critical. If you are forced to verify via video and work from home, prepare a video showing your home office setup, your professional license on the wall, and your laptop with your practice management software open. Submit this during business hours.

FTC enforces "Click-to-Cancel" for therapy memberships

The FTC's "Click-to-Cancel" rule is now in full enforcement as of this week. This impacts therapy practices that offer recurring subscriptions, such as group therapy memberships, paid newsletters, or monthly "wellness retainers."

If you allow clients to sign up online, you must allow them to cancel online through the same number of steps. Requiring a client to "call the office to cancel" or "email for approval" when they signed up via a web form is now a violation carrying fines up to $51,744 per violation.

👉 Action: Audit your payment portals (Stripe, SimplePractice, Thrizer) today. If you have any recurring billing set up, ensure the client has a "Cancel Subscription" button accessible in their client portal. If they have to talk to a human to stop paying, you are non-compliant.

Quick wins for the week

• Contact your AI vendors to confirm how they enforce HIPAA's "Minimum Necessary" standard.
• Add "In my clinical experience..." paragraphs to your top 3 blog posts to fight the Google Core Update.
• Log into PECOS to ensure your practice location is not listed as a PO Box before Jan 1.
• Pause all non-essential edits to your Google Business Profile to avoid the video verification trap.
• Check your recurring billing settings to ensure clients can "Click-to-Cancel" without calling you.

Final thoughts

This week's news highlights a shift from "adoption" to "governance." The Wild West era of AI and digital practice is closing. HIPAA is scrutinizing data access, Medicare wants verified addresses, and the FTC wants transparent cancellation policies.

The landscape is getting more complex, not simpler. It feels like every tool you use now requires a new policy document or verification step. While one suspended profile or compliance misstep can have serious consequences, you don't need to navigate this alone. This is exactly why Moonraker exists, to handle the complexity so you can focus on clients.

While you're providing therapy, we're monitoring policy changes, protecting your Google presence, and optimizing for AI search. You shouldn't need to become an SEO expert, compliance specialist, and tech strategist on top of being a therapist.