Healthcare Empowered

Fraud & Abuse / Enforcement

• Ruthia He, founder and former CEO of digital mental health company Done Global Inc., was sentenced to six years in prison and a $1 million fine for a scheme that distributed more than 37 million Adderall pills and defrauded insurers of over $12 million Co-defendant David Brody, Done’s former clinical president, was sentenced to two years in prison and a $1 million fine. Court documents described a subscription-based platform, management incentives, and clinical protocols that paid up to $60,000 per month to clinicians who signed Adderall prescriptions every 30 seconds and used an auto-refill feature that generated prescriptions with minimal follow-up, in some cases continuing after patients were placed on psychiatric holds or had died. He and Brody submitted false prior authorization requests claiming Done followed DSM-5 criteria and used urine drug screens, causing Medicare, Medicaid, and commercial insurers to pay approximately $12.3 million. He also moved operations and assets to China, used encrypted and disappearing messages, deleted documents, and researched non-extradition countries to obstruct the investigation; both defendants were convicted in November 2025. Source: U.S. Department of Justice
• The HHS Office of Inspector General concluded that a home health agency’s payment of subscription fees for preferential access to a digital referral management platform could violate the Anti-Kickback Statute Advisory Opinion 26-15 addressed a platform hospitals use during discharge planning to transmit referral requests electronically to subscribing providers, who could review and respond before non-subscribers relying on fax, email, or phone. OIG found the arrangement did not satisfy the safe harbor for referral services and gave paying providers a competitive advantage in obtaining federal healthcare program beneficiaries rather than an advantage based on quality of services. The agency identified risks of patient steering, unfair competition, and overutilization, noting that providers incurring participation costs may increase utilization of reimbursable services to recover them. OIG advised providers and technology vendors to evaluate whether platform payments represent fair-market-value services or payment for referral opportunities. Source: Clark Hill
• The Texas Supreme Court holds that omissions claims under the Texas Health Care Program Fraud Prevention Act require proof of materiality, even though Section 36.002(2) does not use the word “material.” Reading the Act against common-law fraud principles, the Court concluded that omitted information must have mattered to the government’s payment decision, reversing a court of appeals decision that had revived claims against a laboratory testing company accused of failing to offer Texas Medicaid the same pricing and discounts extended to other payors. A defendant may negate materiality at summary judgment by presenting competent evidence of undisputed facts incompatible with materiality, shifting the burden to the State to create a genuine issue, and a regulatory violation alone does not establish materiality. Citing Universal Health Services, Inc. v. United States ex rel. Escobar, the Court stated that the government’s continued payment despite knowledge of an alleged violation is strong evidence of immateriality, and here the defendant disclosed the conduct, provided billing data, and kept receiving payment without objection while the State offered no explanation for continuing to pay. Chief Justice Blacklock, joined by Justice Busby, dissented, arguing that the provision requires causation rather than materiality and that the Court added an element the Legislature omitted. Source: False Claims Act Blog

Reimbursement & Payment

• CMS proposed paying for 340B-acquired drugs at Average Sales Price minus 33.4% for calendar year 2027, a reduction estimated to cut Original Medicare drug payments by $4.55 billion and beneficiary drug payments by $1.15 billion in the first year The Hospital Outpatient Prospective Payment System and Ambulatory Surgical Center proposed rule, issued July 2, 2026, would raise OPPS and ASC payment rates by 2.4%, based on a 3.2% market basket increase reduced by a 0.8 percentage point productivity adjustment. Because the 340B change must be budget neutral, CMS would increase payments for non-drug services by an equivalent amount, and it separately proposed raising the annual conversion factor offset for the prior 340B remedy from 0.5% to 3%, projecting recovery of $7.8 billion by CY 2029. The rule would extend site-neutral payment to imaging-without-contrast services in excepted off-campus provider-based departments, continue the three-year phase-out of the Inpatient Only list by removing 638 services, and add prior authorization for eight botulinum toxin injection codes. CMS also included a request for information on strengthening hospital price transparency data. Source: VMG Health

HIPAA & Data Privacy

• The projected publication date for the final HIPAA Security Rule has moved to July 2027, according to the federal government’s Reginfo.gov regulatory site In January 2025, the HHS Office for Civil Rights published a proposed rule to strengthen the Security Rule in response to increases in data breaches affecting 500 or more individuals reported between 2018 and 2023. Although OCR characterized the proposal as primarily adding detail to existing requirements, it marked changes from the original rule and drew criticism from provider organizations and other stakeholders. It is unclear how the current administration will respond to those criticisms. Source: Holland & Knight
• The Texas Hearing Institute notified at least 29,498 individuals of a March 2026 cyberattack that exposed names, Social Security numbers, financial information, and medical records The Houston pediatric hearing center identified unauthorized network access on March 20, 2026, and confirmed the data exposure on April 22; the Interlock ransomware group listed the institute on its dark web leak site, claiming 540 gigabytes of stolen data. The same roundup reported that Family Health Centers of Southern Indiana disclosed a January 2026 intrusion affecting 7,037 residents, with a threat group claiming roughly 250 gigabytes exfiltrated. A breach at third-party billing vendor MCBS, LLC exposed patient data of Stephen W. Brown & Radiology Associates of Augusta between September 22 and 26, 2025. The Wisconsin Department of Health Services reported that benefit-increase letters for 8,157 Medicaid recipients were mailed to outdated addresses. Source: HIPAA Journal

Healthcare AI & Digital Health

• UpDoc Inc. received FDA clearance for what it describes as the first Software as a Medical Device that uses a patient-facing large language model The company announced on June 25, 2026, that its type 2 diabetes medication management software, issued a 510(k) clearance letter on December 23, 2025, uses a conversational module allowing patients to enter data by voice or chat and receive treatment plan instructions specified by a provider. Future clearances will depend on each product’s intended functions, safety, and efficacy, and clinical AI will likely continue to serve as a support tool for clinicians rather than make independent diagnostic or treatment decisions because of human-in-the-loop and state practice-of-medicine requirements. Developers should assess the applicable clearance pathway — 510(k), De Novo, or PMA — and monitor FDA expectations for post-market surveillance, labeling, cybersecurity, and predetermined change control plans. LLMs with access to patient data also raise HIPAA, privacy, consent, and data governance concerns that require vetting vendors and imposing data use and redisclosure limitations. Source: McGuireWoods
• Healthcare AI startups most often fail security diligence through application-layer and AI-specific gaps rather than cloud infrastructure A HIPAA-eligible cloud provider secures infrastructure but leaves the startup responsible for how protected health information flows through prompts, logs, vector databases, and third-party API calls. Fine-tuning models on patient data or pulling unredacted notes into logged prompts can cause a system to reproduce protected health information to other users, so data should be de-identified before entering embedding or fine-tuning pipelines. Agents that can submit prior authorizations or update records should have permissions scoped to the minimum action needed, with human approval required for irreversible steps, reflecting the risk OWASP tracks as excessive agency. Every subprocessor that touches protected health information needs a signed business associate agreement and documented data flow, and a HIPAA risk analysis should precede the first pilot; IBM’s 2025 report put the average healthcare breach at $7.42 million. Source: HackerNoon
• AI chatbots can widen access to mental health care but face limits in treatment Dr. Ryan Raimi’s research examines why some users perceive AI systems as more judgmental than human providers, identifying the agents’ lack of real-world experience and their absence of social and emotional understanding as primary factors. He noted that many people seeking mental health care want to be heard rather than given a solution, which chatbots struggle to provide because empathizing with a client remains difficult. Raimi sees stronger use cases in triage and screening, which follow a straightforward structure, operate around the clock at negligible cost, and could help clinics facing staffing shortages. He said screening applications are approaching global deployment. Source: KERA News

Pharmacy Benefit Managers

• Express Scripts filed a declaratory judgment action against Texas Attorney General Ken Paxton seeking to block release of an unredacted contract with the Texas A&M University System After a public information request, Express Scripts proposed redactions to shield trade secrets, pricing, and personal information, but the Texas Office of the Attorney General ruled on June 2, 2026, that the contract must be released in full because state agencies are required to post vendor contracts and the statutory trade secret exemptions do not apply. Express Scripts argues the interpretation renders the disclosure exceptions meaningless and that the commercial information qualifies as protected trade secrets under Texas case law. The Texas posting requirement applies only to state agencies and institutions of higher education, not school districts, municipalities, or counties. Mintz advised PBMs and health plans contracting with public entities to label and segregate confidential information, draft trade secret language tracking the applicable statute, and require prompt notice of public records requests. Source: Mintz

Healthcare Costs & Affordability

• Rising employer health insurance costs have prompted leaders in both chambers of the Texas Legislature to charge lawmakers with drafting solutions ahead of the session beginning in January A Business Group on Health report projected business health costs would rise 9% nationally in 2026, and KFF put average annual premiums for employer-sponsored family coverage just under $27,000. Employers and experts attribute rising premiums to consolidation among hospitals and intermediaries such as pharmacy benefit managers, and to a lack of price transparency that impedes negotiation. State Rep. James Frank, chair of the House Select Committee on Affordable Healthcare, filed a lawsuit in May against Blue Cross Blue Shield of Texas alleging the insurer concealed prescription drug rebates to inflate employer costs. The Texas Hospital Association countered that consolidation keeps financially struggling rural hospitals open, noting 14 rural Texas hospitals have closed since 2015. Source: The Texas Tribune

Fraud & Abuse and Enforcement

• OIG Advisory Opinion No. 26-15 concludes that a home health agency’s payment of subscription fees to a vendor for online referral management software would generate prohibited remuneration under the Federal anti-kickback statute if the requisite intent were present. The Requestor, which operates home health agencies (HHAs) serving Federal health care program beneficiaries, pays the vendor a per-hospital subscription fee enabling it to electronically receive and accept hospital discharge referrals, while non-subscribing HHAs must rely on slower methods such as fax, email, or phone. The Arrangement does not qualify for the referral services safe harbor because, among other failures, subscription fees are not assessed uniformly against all participants and vary based on geography and volume-based discounts rather than the vendor’s cost of operating the service. OIG found the Arrangement poses a risk of inappropriate steering and unfair competition, since hospitals refer on a first-come, first-served basis and paying HHAs gain a decisive speed advantage that can effectively exclude non-subscribers regardless of care quality. OIG also identified a risk of overutilization, as subscribing HHAs may face pressure to recoup subscription costs by billing for medically unnecessary services, exposing the Arrangement to sanctions under sections 1128A(a)(7) and 1128(b)(7) of the Act. Source: OIG Advisory Opinion No. 26-15
• The 2026 National Health Care Fraud Takedown charged 455 defendants, including more than 90 licensed medical professionals, in connection with over $6.5 billion in health care fraud and opioid claims. The enforcement action spanned 56 federal districts, 45 states and territories, and 50 state Medicaid Fraud Control Units, and the DOJ seized more than $182 million in cash, vehicles, jewelry, and other assets. Prosecutors relied on data analytics and artificial intelligence tools, including the first criminal prosecution developed through the Data Fusion Center, which identified a $67 million Illinois behavioral health scheme in which a defendant billed more than 500 hours of services a day. CMS suspended 1,079 providers and revoked billing privileges for 1,403 others, while HHS-OIG actions sought more than $10 billion for the Medicare Trust Fund. The DOJ highlighted wound care and hospice fraud, noting Medicare billing for wound care rose from $3.4 billion in 2023 to $14.4 billion in 2025, driven by kickback and fraud schemes rather than medical necessity. Source: HIPAA Journal
• AstraZeneca agreed to pay nearly $34 million to settle Texas Attorney General Ken Paxton’s claims that it operated an illegal kickback scheme tied to prescriptions paid by Texas Medicaid. Paxton sued under the Texas Health Care Program Fraud Prevention Act, alleging AstraZeneca provided free nursing services and reimbursement support to prescribers and paid third parties to deploy nurses and other professionals to recommend its drugs under the guise of non-branded counseling. The company will pay Texas $33,998,000 to resolve the claims and reimburse Medicaid funds the state alleged were improperly influenced. AstraZeneca denied the claims, stating it believes its programs are lawful and ethical and address an area of unmet need for patients. The Attorney General’s office has filed similar lawsuits against Sanofi-Aventis and Eli Lilly as part of a broader effort against health care fraud in Texas. Source: Texas Scorecard

FDA & Drug Regulation

• HHS Secretary Robert F. Kennedy Jr. added nine members to the FDA’s Pharmacy Compounding Advisory Committee, most of whom promote peptide use or have financial ties to wellness clinics offering peptide treatments. The additions bring the committee to 13 members ahead of meetings on July 23 and 24 to consider whether compounding pharmacies may produce seven unproven peptides, including BPC-157, TB-500, and epitalon, for human use. FDA scientists reaffirmed in briefing documents that there is insufficient evidence of safety and efficacy to justify expanding access, consistent with a 2023 determination. The FDA currently bars compounding pharmacies from making the peptides for human use, though the drugs may be sold for research. A further meeting before the end of February 2027 will address five additional peptides. Source: Ars Technica

Artificial Intelligence in Health Care

• University Health and Houston Methodist are complying with Texas’s new clinical AI disclosure law by embedding required disclosures into their existing patient consent processes. The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), effective January 1, requires health care providers to give patients or their representatives conspicuous written disclosure whenever an AI system is used in diagnosis or treatment, before or at the time of the clinical interaction, with a narrow emergency exception. University Health delivers disclosures verbally when AI meaningfully informs a care decision and through standardized language in general consent forms, applying a standard based on what a reasonable patient would consider AI-generated or AI-assisted. Houston Methodist enhanced its consent for treatment to reflect AI use and focuses on transparency at or before interactions such as AI-enabled calls and ambient listening. A December 16 Manatt Health analysis found at least four states have enacted laws governing how health systems must disclose or limit clinical AI use, with states expected to remain the primary regulators of health care AI in 2026. Source: Becker’s Hospital Review
• Physicians who enter protected health information into consumer AI tools such as ChatGPT or Gemini without a business associate agreement commit a breach of the HIPAA Privacy and Security Rules. By 2024, 66% of U.S. physicians reported using some form of AI in practice, but consumer platforms do not sign BAAs, and under 45 CFR §164.502 a covered entity may not disclose PHI to a third party without patient authorization or a valid BAA. Liability for unauthorized disclosure rests with the practice as the covered entity and does not transfer to the AI vendor. Any AI tool that processes PHI must be covered by a BAA before first use and, under 45 CFR §164.308, preceded by a documented security risk analysis. Recommended safeguards include inventorying current AI use, verifying BAA status, conducting risk analyses, adopting written acceptable-use policies, and providing AI-specific training. Source: Medical Economics
• HHS outlined plans to accelerate AI adoption in clinical care after receiving more than 7,000 comments on using AI to lower health care costs. Issued under the Make America Healthy Again initiative, the RFI sought input on how digital health regulatory frameworks should evolve, whether reimbursement structures could better support deflationary technologies, and how research investment could strengthen implementation. HHS leaders reported broad consensus for better coordination across HHS agencies, support in creating governance structures, and guidance on identifying effective AI tools. U.S. health care spending rose 7.3% to a record $5.7 trillion in 2025 and is projected to exceed 20.5% of GDP by 2034. HHS cited steps already underway, including development of AI agents to manage cardiovascular disease care and FDA work to clarify regulation of autonomous AI-enabled medical technologies proportionate to their risk. Source: HIPAA Journal

HIPAA & Data Security

• HIPAA Security Rule compliance requires an ongoing security program rather than a one-time project, and health care companies that treat it as complete accumulate risk and enforcement exposure. The Security Rule requires accurate, thorough, and periodic analysis of risks to the confidentiality, integrity, and availability of electronic protected health information, with a new or focused analysis whenever a material change occurs, such as new technology, new vendors handling ePHI, workforce restructuring, or a security incident. Following each analysis, entities must maintain a risk management plan that prioritizes remediation, assigns ownership, and sets timelines, supported by continuous monitoring including log reviews, vulnerability scanning, access control auditing, and vendor security monitoring. The 2026 BakerHostetler Data Security Incident Response Report found threat actors increasingly move from initial access to data exfiltration without deploying encryption, making ransomware-style detection insufficient. OCR’s Risk Analysis Initiative penalizes companies that have not performed adequate risk analyses, and multiple state attorneys general launched investigations into health care companies in 2025, often concurrent with or following closed OCR investigations. Source: Baker Data Counsel

Reimbursement & Coding Compliance

• The Texas Medical Association is urging federal regulators and lawmakers to strengthen enforcement of No Surprises Act payment protections against health plans that delay, underpay, or ignore independent dispute resolution awards. TMA co-signed two American Medical Association letters, sent April 27 and May 11, asserting that some health plans fail to pay physicians within the statutory 30-day timeframe after an IDR determination, pay only partially, or shift additional cost-sharing onto patients when awards exceed the insurer’s initial offer. Fort Worth radiologist Tilden Childs III, MD, noted that Radiology Associates of North Texas prevailed in roughly 95% of federal IDR disputes yet has more than $3.5 million in awarded balances unpaid by a Texas health plan. Organized medicine is backing the proposed NSA Enforcement Act, which would impose congressional reporting requirements, mandate insurer notification to HHS of required payments, and authorize penalties for parties that miss IDR payment timelines. TMA is also awaiting a decision in a pending federal lawsuit after the Fifth Circuit granted it a rehearing held in September 2025. Source: Texas Medicine
• VMG Health built an urgent care risk model into its Compliance Risk Analyzer platform that benchmarks urgent care coding against all-payer urgent care data rather than primary care or Medicare-only norms. The model treats urgent care as a distinct compliance category because its all-payer, all-age patient mix drives evaluation and management coding toward higher-level codes that generic benchmarks flag as high-risk. It blends Medicare-derived benchmarks with all-payer claims data to build an urgent care reference distribution and evaluates E/M distribution, relative value unit intensity, modifier use, and time-based coding at the provider level against urgent care peers. Risk scores are calibrated by severity, ranging from documentation-driven E/M variance flagged for education to place-of-service mismatches with revenue impact flagged for immediate review. The module operates entirely on claims data without chart review and integrates into existing Compliance Risk Analyzer dashboards and the Code Trakker secondary-review workflow. Source: VMG Health

Telehealth & Pharmacy

• The Texas State Board of Pharmacy proposed a rule that would, for the first time, impose informed consent, documentation, and record retention requirements on pharmacist-provided telehealth services. Proposed 22 Texas Administrative Code §291.13 would require a pharmacist to obtain informed consent, in writing or verbally, from the patient or a legally authorized decision-maker before providing a telehealth service. The documentation must reflect patient agreement on three areas: treatment, collection of data, and sharing of data. The rule applies whether the interaction occurs through video conferencing or audio-only telephone communication, meaning a clinical phone consultation could trigger the same obligations as a dedicated telehealth platform. Consent documentation must remain at the licensed pharmacy, be retained for at least two years, and be produced within 72 hours of a request by an authorized Board representative. Source: Buchanan Ingersoll & Rooney

Transactions & the ASC Market

• Texas’s ambulatory surgery center market is expanding through new facility development, health system joint ventures, and consolidation, alongside continued False Claims Act enforcement. Texas operates one of the largest ASC markets in the country, with no certificate-of-need law and population growth driving development. Austin-based Advanced Pain Care and its founder Mark Malone, MD, agreed to pay $13.6 million to resolve False Claims Act allegations tied to improper billing and referral arrangements. Methodist Richardson Medical Center and Austin Regional Clinic opened new facilities in early 2026, while Southlake-based Solara Surgical Partners is pivoting toward de novo development and physician-led projects as acquisition inventory thins amid aggressive buying by United Surgical Partners International, SCA Health, and Surgery Partners. Texas recorded four new ASC openings in 2025, among the most active development states in the South after North Carolina and California. Source: Becker’s ASC Review

Healthcare Workforce

• The Texas Workforce Commission appointed 13 members to a new Healthcare Workforce Advisory Board, which held its first meeting on June 25 to address health care workforce shortages. The 89th Texas Legislature established the board to enhance collaboration between health care providers and higher education institutions. Appointees represent two- and four-year institutions, local workforce development boards, statewide hospital and healthcare professional organizations, and community health center organizations, including representatives from the Texas Medical Association, Christus Health, and the Texas Organization of Rural & Community Hospitals. The board will develop a collaboration toolkit and resource guide to facilitate local partnerships among providers, workforce boards, and higher education. The final guide must be submitted to the Texas Legislature no later than November 1, 2026. Source: Texas Workforce Commission
• A Texas Doula Association survey of 156 active doulas found that most earn less than $10,000 annually from doula services, raising concerns about the profession’s financial sustainability. Conducted between May and June 2025, the Texas Doula Workforce Survey reported an average annual doula income of approximately $19,000, with 55% of respondents earning under $10,000 from doula services in 2024. Respondents averaged about six years of practice, with most identifying as birth doulas (84%) and many also providing postpartum (58%), full-spectrum (35%), and loss (23%) care. Doulas reported working across a wider range of Texas counties than they live in, with the highest concentrations in Central Texas. The association, which advocates for fair wages and Medicaid reimbursement, said the findings show doulas struggle to sustain the work financially despite family demand. Source: National Law Review

Litigation & Premises Liability

• A Houston veterinary technician sued the Texas Medical Center for more than $10 million, alleging that preventable security failures led to a violent attack in a public parking garage. According to the petition, Baleigh Burmaster was attacked around 6:30 a.m. on May 11 moments after exiting her vehicle in Texas Medical Center Public Parking Garage 1, where the assailant repeatedly stabbed her and forced her back into the car during an ordeal attorneys estimate lasted 10 to 15 minutes. The lawsuit alleges the garage had no operational surveillance cameras or on-site security personnel, and that the suspect entered hours earlier and remained undetected. Attorneys argue the attack was foreseeable, citing at least four violent crimes reported in and around the medical center in a two-week span, and note the suspect was identified using Houston METRO surveillance video rather than garage cameras. The filing points to security improvements made after the incident, including increased patrols and additional signage, as evidence stronger protections were available. Source: KPRC Click2Houston

Fraud & Abuse Enforcement

• The Justice Department charged 455 defendants, including 90 doctors and licensed medical professionals, in the 2026 National Health Care Fraud Takedown tied to more than $6.5 billion in false claims. The action spanned 56 federal districts and 45 states and territories, with 50 state Medicaid Fraud Control Units participating and 295 defendants charged in over $518 million of Medicaid fraud, both Department records. Authorities seized more than $182 million in cash, vehicles, jewelry, and other assets, while CMS suspended 1,079 providers and revoked billing privileges for 1,403, and the DEA pursued 928 administrative cases since October 1, 2025. International cooperation produced arrests abroad, including Ibrahim Hilmi in Kyrenia over a $3.7 billion catheter scheme, two defendants extradited from Estonia, and Herb Kimble apprehended in the Philippines in a $1.2 billion telemedicine scheme. Individual cases included a Texas nurse practitioner charged in a $906 million wound-allograft scheme and a Florida cardiovascular practice director charged in an $89 million scheme in which a student athlete died after his abnormal heart test was approved as normal. Source: United States Department of Justice
• Thirteen defendants in the Northern District of Texas face charges across seven cases tied to more than $365 million in fraudulent billing submitted to Medicare, TRICARE, and other federally funded programs. The charges form part of the 2026 National Health Care Fraud Takedown, which produced charges against 455 defendants nationwide, including 90 doctors and licensed medical professionals, over schemes involving more than $6.5 billion in false claims. Michael McMillan of Las Vegas accounts for the largest local case, charged over approximately $268 million in claims for wound care products through kickbacks disguised as rebates, with about $35 million in assets seized. Other defendants face charges spanning a $73 million COVID-19 test kit kickback scheme, a $65 million laboratory testing scheme, a $26.8 million TRICARE billing scheme for transcranial magnetic stimulation, a $25 million EEG testing conspiracy, a $3.1 million hospice scheme, and a $2.3 million durable medical equipment scheme. The government seized over $35 million in cash, luxury vehicles, and other assets locally, and all defendants are presumed innocent until proven guilty. Source: United States Department of Justice

Anti-Kickback & Physician Contracting

• The HHS Office of Inspector General reiterated that an arrangement may violate the Anti-Kickback Statute even when the compensation is fair market value. The guidance states that fair market value is not a dispositive defense and notes that the statute does not use the term “fair market value.” The firm expects the Commercial Reasonableness and Bona Fide Business Purpose tests to play a larger role in analyzing arrangements that fall outside safe harbors. Under the One Purpose Rule, if one purpose of a payment is to induce referrals, the entire arrangement is illegal regardless of other legitimate purposes. The firm also anticipates greater scrutiny of percentage-based fees that fluctuate with the volume or value of referrals. Source: Spencer Fane
• A federal court in Tennessee has refused to dismiss False Claims Act allegations against Erlanger Health System, allowing claims that its physician compensation arrangements violated the Stark Law to proceed. Erlanger’s former Chief Compliance Officer and former Chief Financial Officer brought the qui tam action, and the United States partially intervened on claims that Erlanger submitted Medicare claims for services referred by physicians whose employment terms breached the Stark Law. The Department of Justice alleges Erlanger paid certain physicians two to three times the median salary for their specialties, tolerated losses exceeding professional collections, and based compensation on tracked downstream revenue reaching as high as $21 million for a single physician, while independent fair market value analyses omitted physicians’ actual total pay. Additional allegations include inflated E/M coding that increased uncapped wRVU productivity bonuses, undocumented medical director and academic stipends, pass-through payments through a medical school to fund non-employed physician salaries, payments for nonexistent call coverage, and the elimination of the Chief Compliance Officer position after a Corporate Integrity Agreement expired. Hospitals should evaluate total compensation holistically, separate referral analytics from pay decisions, audit compensation and coding accuracy against benchmarks, document services performed, scrutinize indirect arrangements, maintain independent compliance governance with board reporting, and act on red flags including self-disclosure and refund obligations under the 60-day repayment rule. Source: Akerman LLP

Reimbursement & Payment

• A final rule overhauls the No Surprises Act Federal Independent Dispute Resolution process with staggered applicability dates. The administrative fee per party drops from $115 to $15 for disputes initiated on or after June 11, 2026. The rule formalizes the open negotiation process with required written notices through the Federal portal and mandates standardized claim adjustment reason codes and remittance advice remark codes so providers can identify which claims are subject to the Act. It replaces the “same or similar item or services” batching standard with a broader “treatment of a similar condition” test and caps batched determinations at 50 items. Self-insured group health plans, FEHB carriers, and issuers must register with a new IDR registry and obtain a designated registration number. Source: Holland & Hart Health Law Blog
• Express Scripts sued Texas Attorney General Ken Paxton seeking a declaratory judgment to prevent the Texas A&M University System from releasing an unredacted version of its contract. The company had proposed redactions to shield trade secrets and confidential commercial information, including pricing and programmatic details, along with personal information such as signatures. The Texas Office of the Attorney General concluded that the contract must be released in its entirety, citing a state law requiring agencies and institutions of higher education to post vendor contracts. Express Scripts argues the ruling renders statutory disclosure exceptions meaningless and that the commercial information qualifies as protected trade secrets. The authors advise pharmacy benefit managers and health plans contracting with public entities to segregate and label confidential information and to secure prompt notice of public records requests. Source: Mintz

HIPAA, Privacy & AI Vendor Compliance

• A product marketed as “HIPAA compliant” carries no government endorsement, because there is no federal HIPAA certification, seal, or registry and the Office for Civil Rights does not certify products. A vendor’s claim is a self-assessment, and the Federal Trade Commission has treated such representations as deceptive under Section 5 of the FTC Act. A signed business associate agreement does not authorize a vendor to train its own commercial model on protected health information, and protected health information passing to downstream model providers requires a business associate agreement with each. Attestations such as SOC 2 Type II or HITRUST are not determinations of HIPAA compliance, and the regulated entity retains direct liability, contractual exposure, and its own FTC exposure if it repeats unverified claims. The firm recommends inventorying AI tools that touch protected health information, making the business associate agreement control over vendor terms, and documenting each tool in the Security Rule risk analysis. Source: Fisher Phillips
• Blue Fish Pediatrics notified 41,485 Texas residents of a July 2025 cyberattack that exposed personal and protected health information. The Houston-based pediatric network identified unauthorized access to its systems on or around July 17, 2025, and a forensic investigation confirmed a threat actor had access to files between July 11 and July 17, 2025. Exposed data included names, dates of birth, driver’s license or state ID numbers, Social Security numbers, medical record numbers, diagnoses, lab results, medications, and claims information. The company began mailing notification letters and offered credit monitoring to individuals whose Social Security numbers were exposed. The incident was reported to the Texas Attorney General, and the total number of affected individuals nationwide has not been disclosed. Source: The HIPAA Journal
• Employers that sponsor self-funded health plans can trigger full HIPAA obligations, because the plan itself is generally a covered entity if it has 50 or more participants or uses an external administrator. Third-party administrators that handle protected health information are classified as business associates and are directly liable for violations, while the plan sponsor manages compliance on the plan’s behalf. Before sharing protected health information, the plan must have a signed business associate agreement specifying permitted uses, security measures, and breach notification within 60 days of discovery. Sponsors that rely solely on a TPA’s systems face legal risk. The authors recommend appointing privacy and security officers, conducting risk analyses, issuing a Notice of Privacy Practices, amending plan documents, and auditing vendors. Source: Constangy

Artificial Intelligence & Health IT

• Defensible AI medical record review requires page-level citations, human review of every output, and a HIPAA-eligible agreement before any protected health information is processed. The software ingests medical records, billing files, independent medical examination reports, and correspondence, then sorts, deduplicates, and summarizes them into a chronology that links each entry to its source page. General-purpose models such as ChatGPT lack source attribution, are not HIPAA-eligible by default, and can misread long, co-mingled records. The article states that Wisedocs is trained on more than 100 million documents across 1,500 medical record types and applies human review to each output. It reports that one property and casualty carrier cut review cost from 60 cents to 20 cents per page and turnaround from 14 days to 2 days. Source: Claims Journal
• AI-powered geomapping can identify areas without nearby maternal care services and locate where high-risk mothers live. Researchers at the University of Texas at Arlington are using the technology to determine where in-person maternal care is realistic and where telehealth can best serve patients in maternal care deserts. Source: Healthcare IT News

Transactions, Valuation & Strategy

• Value-based care valuations have moved away from membership-growth multiples toward performance and execution as the market recalibrates. Following the Affordable Care Act, investment in accountable care organizations, risk-bearing groups, and Medicare Advantage drove a surge of growth in the early 2020s in which “lives” and revenue multiples set valuations regardless of demonstrated capability. Aggregators have since struggled to show sustainable profitability, compressing earnings and valuation multiples. In January 2026, Optum shifted from membership growth toward margin recovery and network optimization, while VillageMD, Walgreens Boots Alliance, and Agilon Health pursued restructuring and divestitures. Humana’s CenterWell and Privia Health have maintained steadier performance through measured, asset-light strategies, and the article concludes that success in value-based care will depend on execution, selective participation, and cost savings rather than scale. Source: VMG Health
• The migration of cardiovascular procedures from hospitals to ambulatory surgery centers is reshaping cardiology investment and M&A strategy. Industry leaders expect up to 80% of cardiology services currently performed in hospitals to move to outpatient settings by 2030, a shift that accelerated after Medicare expanded the cardiovascular procedures eligible for ASC payment, including coronary interventions and, in January 2026, new electrophysiology procedures. Because most cardiology volume has historically been hospital-based, the migration adds new procedural volume to ASCs rather than redistributing existing activity. The article notes that the hybrid office-based laboratory and ASC model is expected to decline as ASC reimbursement converges with or exceeds OBL rates. Cardiology consolidation remains harder than in other specialties because most cardiologists are employed by hospitals, leading some operators to develop ASCs physically aligned with hospitals. Source: VMG Health
• VMG Health combined Community Link Consulting and Burrows Consulting into a single FQHC and Community Health Optimization Practice for federally qualified health centers and community health centers. Community Link Consulting, founded in 1999, serves more than 190 clients and provides revenue cycle, financial management, FQHC compliance, HRSA site visit preparation, and interim leadership services. Burrows Consulting brings 19 years of FQHC experience and has secured more than $600 million in grant awards across more than 930 proposals, along with 340B consulting and Look-Alike designation work. The combined teams have created 28 Look-Alike systems with 400 service delivery sites and currently support more than 85 Look-Alikes. The practice adds VMG Health valuation, transaction advisory, and analytics resources. Source: VMG Health

Fraud, Abuse & Enforcement

• OIG Advisory Opinion No. 26-14 grants a favorable determination to a pharmaceutical manufacturer sponsoring free antibody testing to identify patients potentially eligible for its drug. Under the Arrangement, the Requestor contracts with a third-party laboratory to provide no-cost antibody tests to patients in all 50 states who present with symptoms of an ultra-rare condition or who have cancer warranting paraneoplastic screening, with no billing to patients or payors including Federal health care programs. OIG concluded the Arrangement implicates the Federal anti-kickback statute because it confers remuneration on patients and providers, but declined to impose sanctions based on safeguards including the 1.6 percent positivity rate, prohibitions on sales representatives discussing the Product in connection with the testing, restrictions on data sharing to aggregate de-identified figures, and the absence of provider payments tied to prescribing. OIG further determined the Arrangement satisfies the Promotes Access to Care Exception to the Beneficiary Inducements CMP because the Test removes a diagnostic barrier for an under-recognized condition, is unlikely to skew clinical decision-making or drive overutilization, and enhances patient safety. Source: OIG Advisory Opinion No. 26-14
• A Texas nurse practitioner practicing in Louisiana, received a sentence of 87 months in prison, three years of supervised release, and a restitution order of $1,508,868.25 for causing more than $12 million in false claims to Medicare. Working as an independent contractor for a telehealth company from October 2018 to October 2019, Scharmaine Lawson Baker signed hundreds of orders for cancer genetic tests after phone calls lasting under 30 seconds and without examining patients, accepting kickbacks she later omitted from her bankruptcy petition. She ordered ovarian and cervical cancer tests for male patients and never reviewed test results, including those showing patients carried variants predisposing them to cancer. The scheme generated over $12.1 million in claims to Medicare, with laboratories receiving more than $1.5 million in reimbursements. A federal jury in the Eastern District of Louisiana convicted her on six counts of health care fraud following a three-day trial in July 2025. Source: United States Department of Justice

Physician Compensation & Stark Law

• The U.S. Court of Appeals for the Fourth Circuit ruled that productivity-based physician compensation tied to work relative value units does not constitute payment based on the volume or value of referrals under the Stark law, affirming dismissal of a False Claims Act lawsuit against Thomas Health System. The court held that compensation is considered referral-based only when a physician’s referrals are a variable in the compensation formula, a threshold that a standard wRVU model does not meet. The court also declined to treat hospital subsidies to affiliated physician groups or compensation at or above the 90th percentile as evidence of fraud, noting that 10% of physicians will always exceed that threshold by definition. Applying Rule 9(b)’s heightened pleading standard, the court found that the complaint identified only routine business practices rather than a specific fraudulent act, requiring that a complaint “identify the fire” rather than point to smoke. Source: Becker’s ASC
• Standard percentile-based compensation benchmarks fail to reflect the workforce realities facing rural healthcare markets, where roughly 20% of Americans live but only 9% of physicians practice. As of 2025, Primary Care Health Professional Shortage Areas serve approximately 92 million people, and projections point to a nationwide shortfall of 141,160 FTE physicians by 2038, with non-metropolitan areas bearing a disproportionate share. Rural providers routinely carry expanded scopes of practice, heavier call burdens, and sole-source specialist responsibilities that survey data — which is retrospective and standardized — does not capture. Relying exclusively on benchmark frameworks risks producing compensation structures that are neither competitive nor sustainable, accelerating burnout and turnover that trigger service disruptions, coverage gaps, and higher operational costs. Compensation in rural settings must be evaluated holistically — across salary, productivity incentives, call coverage, and administrative duties — and assessed through the lens of commercial reasonableness, with regular market analysis and proactive retention initiatives to preserve community access to care. Source: VMG Health

Federal Regulatory & Reimbursement

• CMS has issued two Medicaid regulations implementing H.R. 1, the One Big Beautiful Bill Act that alter provider payments and condition coverage on community engagement. A proposed payment rule would cap certain state directed payment rates at 100 percent of published Medicare rates in expansion states and 110 percent in non-expansion states, extending Medicare-based caps to all such arrangements for rating periods on or after January 1, 2029, with comments due July 21, 2026. An Interim Final Rule, which states must begin implementing by January 1, 2027, requires states to verify compliance using Medicaid claims, encounter data, eligibility files, SNAP records, and unemployment wage data before requesting documentation from patients, who may lose coverage over missed notices, lack of internet access, limited English proficiency, or homelessness. To claim the medical frailty exemption, a patient’s serious or complex condition must significantly impair the ability to meet engagement requirements, and states must keep documentation supporting each determination, prompting reliance on treating clinicians to verify functional limitations and treatment needs. Beginning in 2028, repeated self-attestation will be limited, increasing patients’ dependence on provider or data-system records to retain exemptions. Source: Association of Clinicians for the Underserved
• FDA’s November 2023 proposed rule to create new device classifications for hundreds of antimicrobial wound dressings and washes drew opposition from 95 percent of commenters, yet a withdrawal notice has not appeared. The proposal targets products incorporating ingredients such as hypochlorous acid and silver, with FDA citing antimicrobial resistance concerns and regulatory clarity as its rationales. Of 76 unique comments submitted to docket FDA-2023-N-3392, 58 strongly opposed the rule, 14 opposed it in part, two supported it, and two could not be classified, with opponents including physicians, researchers, medical societies, device companies, and the Alliance for Wound Care Stakeholders, which requested withdrawal. Commenters raised concerns about disruptions to care for vulnerable patients and inadequate economic analyses required under the Regulatory Flexibility Act. The final rule was scheduled for May 2026, and with the comment period closed, stakeholders can keep the matter before decisionmakers by contacting the FDA Commissioner’s Office, the Office of Management and Budget, Congress, or submitting deregulation suggestions through Regulations.gov. Source: Epstein Becker Green

AI in Healthcare

• AI-driven drug discovery is outpacing the legal frameworks that govern intellectual property ownership, creating ambiguities that derail deals during due diligence and acquisition. When a university researcher uses a commercial AI platform to analyze a health system’s patient data and identifies a new drug indication, ownership fractures across the vendor’s algorithm, the health system’s data, and the researcher’s validation, because U.S. law bars algorithms from being named inventors and patent law requires natural-person conception. Most licensing agreements predate AI integration and fail to specify whether licensing a model conveys ownership of its outputs, allowing vendors holding irrevocable or transferable output licenses to compete with licensees or train improved models for competitors. Models trained on protected health information create HIPAA and state privacy exposure under California’s CPRA and Washington’s My Health My Data Act, particularly because genomic data can re-identify individuals from de-identified datasets, while FDA’s January 2025 draft guidance covers AI for data analysis but not AI-driven target discovery or repurposing. In university spin-outs, AI platforms may account for 30 to 40% of the underlying innovation, and granting vendors 10 to 15% equity alongside the university’s 5 to 10% stake dilutes founders before institutional investors arrive, prompting term sheets to require explicit ownership allocation, model audit and version-control rights, performance warranties on accuracy and lawful data sourcing, regulatory cooperation including FDA pre-IND attendance, and broad indemnification against infringement, data breach, validation failure, and algorithmic bias claims. Source: Healthcare Law Insights
• Infusion providers adopting AI tools face regulatory and liability exposure under HIPAA, the False Claims Act, and state AI laws when they deploy these systems without governance frameworks. Independent and regional infusion centers use AI for prior authorization, clinical documentation, revenue cycle optimization, and patient scheduling, with 46% of healthcare organizations now implementing generative AI. The FDA framework classifies AI that replaces clinician judgment as a potential medical device requiring clearance, while every AI vendor accessing protected health information must execute a Business Associate Agreement that restricts use of patient data for model training without authorization. AI-generated documentation errors that affect large claim volumes create aggregate False Claims Act liability, and the AI origin of an error provides no defense. Texas (SB 815), Arizona (H.B. 2175), Maryland (H.B. 820), and Nebraska (LB 77) passed 2025 laws barring AI as the sole basis for medical necessity denials, California’s Assembly Bill 489 (signed October 11, 2025) prohibits patient-facing AI from implying its advice comes from a licensed professional, and the Colorado AI Act takes effect in January 2027. Source: Benesch Law
• A January 2026 data breach at the clinician network behind AI telehealth company Medvi exposed names, addresses, email addresses, dates of birth and medical information for 716,000 people. HIPAA and business associate agreements prohibit a technology vendor from reusing a provider’s patient data to train its AI products or exposing that data to other entities, even when a BAA is in place. The compliant approach trains classification models only on anonymized data scrubbed of all 18 HIPAA identifiers, then generates synthetic documents in a data factory to refine accuracy. Each customer receives a custom model with no data crossover with other clients, built from samples of anonymized and redacted documents the provider supplies. Deploying general-purpose tools such as ChatGPT, Claude or Gemini against a health care function leaves the operator unable to identify what data are used and where they go, defeating PHI protection. Source: Medical Economics

Privacy, Security & HIPAA Compliance

• The employee health plan of Spencer’s Gifts paid $450,000 to settle HIPAA violations stemming from a November 2021 ransomware attack by the Conti gang that compromised the personal and health data of 10,023 plan members. The breach was discovered when employees reported being unable to connect to the company’s VPN; investigators found an unauthorized actor had accessed the network, encrypted data on servers storing protected health information, and demanded a ransom. HHS Office for Civil Rights determined that prior to the breach, the health plan had failed to conduct a security risk analysis and failed to implement policies and procedures required under HIPAA’s privacy and security rules. Under a two-year corrective action plan, Spencer’s must complete a risk analysis, revise its HIPAA policies and procedures, and train its workforce accordingly. The settlement is HHS OCR’s 20th ransomware enforcement action and its 14th citing security risk analysis failures, and the agency has signaled that penalty size is driven by compliance program quality, not breach volume. Source: Bank Info Security
• Medical spas that qualify as HIPAA-covered entities must provide documented HIPAA training to every member of their workforce — including part-time employees, temporary staff, and volunteers — with records retained for a minimum of six years. The requirement is set out at 45 CFR §164.530(b) and 45 CFR §164.308(a)(5) and cannot be waived; failure to comply is a standalone violation, as demonstrated in 2023 when St. Joseph’s Medical Center paid an $80,000 OCR penalty tied in part to a lack of Privacy Rule training. Most medical spas employ fewer than ten staff, creating compliance risks particular to small facilities — including multitasking in reception areas where PHI is routinely exposed, and credential sharing that corrupts audit trails and can result in sanctions against employees who did not personally commit the underlying violation. Training must cover the minimum necessary standard, unique login credential requirements, breach escalation procedures, and the range of consequences for non-compliance, which extend to criminal penalties under Section 1177 of the Social Security Act for violations committed for personal gain. Medical spas in Texas and California face additional obligations under, respectively, the Texas Medical Records Privacy Act as amended by HB 300 and the Confidentiality of Medical Information Act, both of which impose requirements beyond the federal HIPAA baseline. Source: HIPAA Journal

Healthcare Transactions & Investment

• Women’s health companies are consolidating fertility, menopause, hormone therapy, GLP-1 programs, and behavioral health into single longitudinal platforms rather than operating discrete service lines. Danish research found that women spend an average of nine years in poor health, wait longer for diagnoses, and face these challenges near midlife while working and caring for children and aging parents. Integrated platforms allow a patient’s clinical history, reproductive stage, and medication use to follow her across services, producing higher retention, recurring revenue, and stronger employer and payor relationships, while some operators now run hybrid models that pair direct-to-consumer offerings with covered benefits and cash-pay services. Expansion into prescribing, pharmacy fulfillment, lab testing, and diagnostics triggers obligations under anti-kickback and beneficiary inducement rules, fee-splitting restrictions, corporate practice of medicine limits, state telehealth laws, and pharmacy rules, and broadens exposure to HIPAA, state consumer health data laws, and FTC risk across sensitive reproductive, genetic, and biometric data. Investors should confirm that platform growth rests on scalable clinical protocols covering patient selection, informed consent, medication management, adverse event response, and provider supervision, and should test whether each revenue channel is compliant and whether the target can expand into priority states without altering its clinical or operational model. Source: Katten

Employment & Labor

• An exempt employee may perform additional hourly, non-exempt work for the same employer without losing exempt status, the U.S. Department of Labor concluded in an FLSA opinion letter. The matter arose at an academic medical center where salaried, exempt nursing professional development specialists worked about 40 hours weekly in their exempt role and occasionally picked up one or two 12-hour staff nurse shifts on weekends paid at an hourly rate. The arrangement preserved the exemption because the specialists spent the majority of their time on exempt duties involving autonomy, judgment, designing educational programs, onboarding staff, and conducting competency processes, and because the employer met the salary basis and salary level requirements. FLSA regulations permit an exempt employee to receive extra compensation, including hourly pay, for work beyond the normal workweek as long as the guaranteed salary remains. If combined work shows the primary duty has become non-exempt, the employer loses the exemption and must calculate overtime on combined hours and total compensation, so employers should confirm the duties test, pay the required salary threshold, document the secondary role and its pay, and periodically review whether the work has shifted toward non-exempt duties. Source: Parker Poe

Consumer Protection & TCPA

• Text messages qualify as “telephone calls” under Section 227(c) of the TCPA, a magistrate judge in the Western District of Texas recommended in Callier v. American Auto Group LLC. Brandon Callier alleged that American Auto Group, a California LLC doing business as All American Auto Care, sent two unsolicited texts on May 4 and May 20, 2025, marketing vehicle service contracts while his number was on the National Do Not Call Registry, and the defendant defaulted after service through the California Secretary of State. Adopting the majority position over the contrary view in Jones v. Blackstone Medical Services, LLC, the court held that texts count as calls under Section 227(c) and that Callier adequately pleaded a Section 227(c)(5) claim, with the coextensive Texas Business and Commerce Code Section 305.053 claim following but yielding no additional damages under the no-double-recovery rule. The court recommended denying judgment on the Chapter 302 claim because that statute did not define “telephone solicitation” to include text messages until an amendment took effect September 1, 2025, after both texts. The court recommended $1,000 in damages—the statutory $500 per violation for the two texts—with no willfulness enhancement and no stacking, and denied a permanent injunction because Callier alleged no contact since May 2025. Source: TCPAWorld

Reimbursement & Payment

• CMS has proposed a rule that would cut $774.8 billion in state and federal Medicaid spending over 10 years by capping State Directed Payments (SDPs), far exceeding the $72 billion in cuts anticipated under the One Big Beautiful Bill Act, which the rule purports to implement. Beginning with rating periods on or after July 4, 2025, SDPs for inpatient and outpatient hospitals, nursing facilities, and academic medical center practitioners would be capped at 100% of Medicare rates in Medicaid expansion states and 110% in non-expansion states, with those caps extended to all SDPs for all services and territories starting January 1, 2029. New or renewed uniform increase SDPs would be prohibited beginning January 1, 2028, and grandfathered SDPs approved by December 31, 2025 must phase down by 10% annually starting in 2028. On the fee-for-service side, the rule would shift from aggregate to individual payment limits, capping targeted Medicaid payments — those directed at a subset of providers — at the same Medicare-based thresholds, though disproportionate share hospital payments are excluded. Comments are due July 21, 2026. Source: Morgan Lewis Health Law Scan
• Federal agencies overhauled the No Surprises Act’s independent dispute resolution process to address a backlog of more than 5.1 million dispute submissions since 2022. The rule, published June 4, 2026, cuts the per-party administrative fee from $115 to $15 effective June 11, 2026, and raises the cap on batched claims per dispute from 25 to 50, provided the claims share the same payor, a similar condition, and fall within the same 30-business-day window. Payors must now register with the Departments and obtain a unique federal IDR registration number, and must include standardized claim adjustment reason codes and identifying information — such as their legal name and Federal Employees Health Benefits carrier code — on remittances to out-of-network providers, with an implementation date to be set by December 4, 2026. Eligibility timelines tighten under the rule: non-initiating parties have three business days to raise objections after IDR initiation, and IDR entities must issue eligibility determinations within five business days of arbitrator selection. The rule does not alter payment methodology, which remains under separate rulemaking and subject to enforcement discretion following litigation by the Texas Medical Association. Source: Goodwin

Fraud & Abuse

• The OIG issued a favorable advisory opinion permitting a pharmaceutical manufacturer to provide free preservative-free artificial tears to patients prescribed its product to mitigate REMS-identified ocular toxicity. Advisory Opinion 26-13 replaces AO 21-19 and covers a 60-day supply of single-use eye drop vials (retailing between $108 and $145) distributed through a manufacturer-sponsored Hub to all enrolled patients, including Federal health care program beneficiaries, regardless of prescriber or insurer. Although the free eye drops constitute remuneration under the Federal anti-kickback statute, the OIG declined to impose sanctions because the items are low-cost, non-prescription, and unlikely to drive overutilization of the underlying product, particularly given that patients still bear other treatment costs. The OIG also emphasized that the FDA-approved label, Medication Guide, and REMS Patient Guide all recommend eye drop use at least four times daily, so the arrangement mitigates a known safety risk and helps preserve continuity of therapy. The OIG further concluded that the Beneficiary Inducements CMP is not implicated because the manufacturer is not a provider, practitioner, or supplier, the Hub operates independently of prescribers, and enrollment materials disclose the manufacturer’s sponsorship. Source: OIG Advisory Opinion No. 26-13
• Static valuation formulas and internally prepared analyses in physician and ambulatory surgery center transactions carry significant legal and financial risk under federal fraud enforcement frameworks. Civil fraud recoveries reached record levels in 2025, driven by healthcare qui tam lawsuits, with Community Health Network paying $345 million to settle False Claims Act allegations tied to unsupportable fair market value conclusions in referral relationships. In U.S. ex rel. Simmons v. Meridian Surgical Partners, a former ASC employee alleged that Meridian paid above FMV to acquire physician-owners’ controlling stakes, then sold ownership interests to physician-investors below FMV as referral inducements — a disparity between control and non-control valuations that drove the qui tam action to settlement. ASC control-level EBITDA multiples currently range from 6x–7x, with one to two turns of expansion in certain specialties and markets due to health system and private equity demand, meaning any formula fixed at an earlier multiple will produce conclusions disconnected from current pricing. Internal valuations involving referring physicians face heightened scrutiny because proximity to the transaction can introduce bias, even unintentionally, and EBITDA-based formulas omit capital expenditure requirements, regulatory overhangs, and physician concentration risk that materially affect go-forward value. Source: VMG Health

FDA & Product Regulation

• The FDA issued a draft guidance overhauling the rules governing drug and device manufacturer communications with payors, formulary committees, and similar entities, incorporating two statutory changes from the Consolidated Appropriations Act, 2023. The draft extends the healthcare economic information (HCEI) safe harbor under FDCA 502(a) expressly to medical devices — previously covered only by FDA policy — and adds a new statutory safe harbor under FDCA 502(gg) protecting communications about investigational products from misbranding liability, provided manufacturers include disclosures on approval status, development stage, study design, labeling, and material updates. The draft also broadens the prohibition on misrepresentation by removing the “misleadingly” qualifier, meaning any representation that off-label clinical assumptions have been found safe and effective by FDA is prohibited regardless of context, and shifts the risk disclosure standard from “varies from” to “materially different” from approved labeling. Three previously optional recommendations — updating payors when communicated information becomes materially outdated, describing study methodology and limitations, and presenting both positive and negative findings — are now mandatory requirements. Public comments on the draft are due August 3, 2026. Source: Sheppard

Privacy, HIPAA & Data Security

• HIPAA was never designed as a health privacy law—its coverage gaps are a direct consequence of its origins as a 1996 labor-mobility statute aimed at letting workers with pre-existing conditions carry employer-sponsored insurance between jobs. Privacy entered the law as a third-layer add-on to administrative simplification provisions, and when Congress failed to enact substantive privacy rules within its self-imposed three-year deadline, it delegated rulemaking to HHS, which wrote the Privacy Rule (45 C.F.R. Parts 160 and 164) from scratch—constrained only by the statute’s pre-existing definition of covered entities: health plans, healthcare providers submitting standard electronic transactions, and clearinghouses. That definition excludes pharmaceutical companies, life insurers, disability and workers’ compensation carriers, employers, and most consumer health apps, none of which fit the portability or electronic-transaction framework, despite holding extensive personal health data. The employer-plan firewall that HHS created to prevent termination of workers with costly conditions is structurally weak in practice because most companies lack the organizational separation to keep group health plan data away from HR functions. Layered on top of HIPAA, roughly 22 to 23 states have enacted general consumer privacy laws, California and Texas have HIPAA-parallel health statutes, and Washington’s My Health My Data Act (Wash. Rev. Code § 70.372, 2023) has become the template for legislation targeting the entities HIPAA does not reach—producing overlapping, inconsistent obligations that risk impairing the functioning of the healthcare system itself. Source: UC Berkeley Law – BCLT
• The HIPAA Privacy Rule defines protected health information far more broadly than most patients or practitioners assume, extending full protection to any personally identifying information a covered entity holds about a person because they are a patient or insured—including health insurance enrollment forms containing nothing more than a name, address, and list of dependents. HHS deliberately eliminated the patient consent requirement for treatment, payment, and healthcare operations, concluding that genuine consent rights in those contexts would paralyze the healthcare system, while requiring signed, specific, individual authorization for any use outside those categories or the rule’s enumerated national priority purposes such as public health reporting. Two statutory carve-outs create real-world disparities: student health clinic records fall under FERPA rather than HIPAA, allowing universities to obtain those records in litigation—a protection that disappears if the student sought care at an off-campus hospital—and employment records held by a covered entity in its employer capacity, including FMLA and workers’ compensation documentation, are excluded entirely. HHS extended the rule’s reach to vendors through the business associate framework, requiring covered entities to impose HIPAA obligations by contract on any service provider whose work involves PHI, a model that remained purely contractual for the rule’s first decade until the HITECH Act and 2013 regulations made business associates directly subject to government enforcement; a cloud-storage firm hosting only encrypted patient records it cannot access is still a business associate because the service involves PHI. Once data meets HIPAA’s low-risk-of-re-identification de-identification standard the rule no longer applies and the patient is deemed to retain no privacy interest, a conclusion the Seventh Circuit rejected in quashing a DOJ subpoena for redacted abortion-procedure records, holding that “even if there were no possibility that a patient’s identity might be learned from a redacted medical record, there would be an invasion of privacy.” Source: UC Berkeley Law
• Bayside Dental experienced a cybersecurity incident that potentially compromised the protected health information of up to 10,216 patients. Unauthorized network access was identified on January 5, 2026, at the practice, which has locations in Rowlett, Texas, and Anacortes, Washington. A forensic investigation confirmed on March 13, 2026, that files containing names, dates of birth, Social Security numbers, medical and insurance information, and other data were accessed. The Sinobi ransomware group claimed responsibility for the attack and stated it stole 580 gigabytes of data. Bayside Dental has offered affected patients 12 months of credit monitoring services. Source: HIPAA Journal
• Healthcare’s vendor compliance certifications, like SOC 2, HITRUST, and Business Associate Agreements, do not verify that security controls are actually working, they only reflect what a vendor claims. Compliance automation startup Delve, valued at $300 million, was accused of systematically fabricating audit reports for hundreds of clients; a leaked internal spreadsheet revealed 494 nearly identical SOC 2 reports with pre-written auditor conclusions inserted before clients submitted any evidence. Healthcare organizations that relied on those fabricated documents face HIPAA willful neglect penalties of up to $50,000 per violation and potential criminal liability. The 2013 HIPAA Omnibus rule extended liability to every downstream vendor and subcontractor, yet most health systems cannot confirm how protected health information is handled beyond their direct vendors, a gap the Change Healthcare attack exposed at scale. SOC 2, HITRUST, and BAAs should be treated as starting points, and vendor risk decisions should rest on direct, verifiable evidence that controls are functioning — not on the existence of documentation. Source: MedCity News

Artificial Intelligence

• Health care AI adoption hit 85 percent by end of 2024, but 63 percent of organizations have no governance policies in place, shadow AI is present in 40 percent of hospitals, and only 29 percent of providers are aware of their organization’s main AI policies. The governance gap has produced litigation — including class actions over AI ambient scribes recording patients without consent — and Pennsylvania filed the first state enforcement action against Character.AI after a chatbot falsely claimed to be a licensed psychiatrist. In September 2025, the Coalition for Health AI and The Joint Commission published the Responsible Use of AI in Healthcare framework, the first formal AI governance standard from a U.S. health care accreditation body, followed by CHAI governance playbooks in May 2026; The Joint Commission also launched a voluntary certification program that provides third-party-validated evidence of responsible AI practices. Forty-five states have introduced AI legislation as of early 2026, with enacted laws in multiple states requiring clinician oversight of AI outputs, patient disclosure of AI use, human review before prior-authorization denials, and consent before ambient-listening tools are deployed. The FDA has authorized more than 1,400 AI-enabled medical devices, and the bipartisan AI LEAD Act and the March 2026 Trump America AI Act discussion draft would impose products-liability frameworks on AI developers — including health systems that substantially modify or fine-tune AI tools for clinical use. Source: Baker Donelson
• Heartflow, Inc. filed a 180-page patent infringement lawsuit in the U.S. District Court for the Eastern District of Texas in April 2026, alleging that a former consultant who signed a nondisclosure and invention assignment agreement with Heartflow in 2010, secretly founded rival company Cleerly, Inc. in 2016 while still bound by confidentiality, non-compete, and assignment obligations. Heartflow claims Min used its confidential information to develop Cleerly’s competing products and that Cleerly also hired Heartflow’s former chief commercial officer, who was likewise bound by confidentiality obligations. The suit alleges direct and induced infringement of six patents covering AI-powered cardiac imaging analysis — including methods for anatomic segmentation, blood flow estimation, plaque vulnerability prediction, and vessel evaluation — out of a portfolio of more than 600 patents, and notes that Cleerly cited Heartflow’s patents in its own patent filings. Heartflow seeks lost profits, injunctive relief, treble damages, and attorneys’ fees; Cleerly has called the suit an attempt to limit competition and its answer is due July 8, 2026. Source: Epstein Becker Green

Healthcare Transactions & M&A

• AI-driven diligence tools are reshaping home health and hospice M&A by enabling buyers to analyze entire populations of clinical, billing, and operational records rather than limited samples, causing issues to surface shortly after LOI that previously escaped detection altogether. Documentation practices that appear acceptable across a small sample can look materially different when reviewed across thousands of records, and branch-level performance inconsistencies that once went unnoticed are now visible before definitive agreements are signed. When findings emerge after management has already presented growth trends and margin performance, the consequences include re-trades, expanded diligence requests, pressure on pricing, and delayed closings. To counter this, sellers are conducting internal operational and compliance reviews before going to market — examining denial trends, coding practices, reimbursement support, and branch-level reporting — and some are deploying technology-assisted review to identify gaps before buyers do. Sellers that reconcile operational data, organize diligence materials, and understand where diligence pressure is likely to concentrate before launch are better positioned to maintain negotiating leverage once the process accelerates. Source: Arnall Golden Gregory LLP
• DSO consolidation has shifted from a growth-at-all-costs model to one where operational discipline, compliance, and infrastructure determine whether a deal gets done and at what terms. Buyers are now placing greater weight on sustainable profitability and scalable systems than on top-line expansion, and organizations that pursued rapid growth are restructuring portfolios or seeking new strategic paths. Platforms operating across fragmented practice management systems, revenue cycle workflows, and compensation structures have struggled to achieve projected synergies. During diligence, compliance gaps, inconsistent financial reporting, unresolved governance questions, and limited operational visibility across acquired practices erode buyer confidence and weaken transaction terms. Sellers that can demonstrate aligned leadership, clean financials, and a defined integration and liquidity plan are better positioned to command stronger valuations and move through transactions efficiently. Source: VMG Health

Antitrust & Competition

• A federal court’s decision blocking Edwards Lifesciences’ acquisition of two pre-commercial medical device companies signals that antitrust agencies can challenge mergers involving products not yet approved or sold. In Edwards/JenaValve, the district court accepted the FTC’s theory of a “TAVR-AR device market” even though no such device had received FDA premarket approval, blocking Edwards from acquiring both JenaValve Technology and JC Medical, which were each in clinical trials for catheter-based aortic valve replacement devices. The FTC has also elevated scrutiny of the “failing firm” defense in healthcare mergers, with FTC staff now independently contacting potential alternative buyers early in the Second Request process—and frequently finding that third parties were unaware the asset was available—and Duke Health’s subsequent acquisition of Lake Norman Regional Hospital after Novant abandoned its deal is viewed as evidence that the original seller’s buyer search was inadequate. Roughly half of all U.S. hospital mergers involve hospitals in separate geographic markets, and while neither the FTC nor DOJ has yet brought an enforcement action on a cross-market theory, California has imposed price and conduct conditions on three hospital mergers since 2020 on that basis, and Oregon recently conducted a review of a healthcare transaction with no in-state overlaps. Healthcare companies face antitrust scrutiny even without traditional geographic overlap or a commercially available product. Source: Axinn, Veltrop & Harkrider LLP
• Texas ranks second in the nation for ASC count, with 497 facilities, and operates without a certificate-of-need law, giving it one of the least restrictive development environments in the country. States without CON regulation posted compound annual growth rates of 2% to 4% in Medicare-certified ASC development between 2019 and 2023, according to L.E.K. Consulting’s 2024 ASC Insights Study. The FTC sued U.S. Anesthesia Partners and private equity backer Welsh, Carson, Anderson and Stowe in September 2023, alleging the firms bought up nearly every large anesthesia practice in Texas to establish a dominant provider capable of extracting higher prices; Welsh Carson settled in January 2025, and USAP reached an agreement in principle with the FTC in April 2026, with a federal court staying the case in May while USAP implements required relief over 180 days. The FTC also required Ascension to divest seven AmSurg ASCs—including one in Waco—before closing its $3.9 billion acquisition, identifying those Texas markets as areas where the deal would substantially reduce competition. Texas is one of six states included in CMS’ WISeR prior authorization pilot, which took effect January 1 and runs through 2031, requiring prior authorization for procedures including epidural steroid injections, nerve stimulator implants, and image-guided lumbar decompression. Source: Becker’s ASC

Clinical Laboratories

• Clinical laboratories face insolvency from converging pressures of more than $4 billion in Medicare payment cuts over three years, AI-driven payer audits, rising labor and supply costs, and tightening regulatory enforcement that penalizes compliant labs for the fraud of others. Of the more than 320,000 clinical labs in the US, approximately 80% are small businesses with no diversified service lines or reserves, making them acutely vulnerable to payment disruptions; Medicare Part B alone spent $8.4 billion on diagnostic lab tests in 2024. When a lab enters distress, restructuring advisors must triage legal and regulatory exposure first — including False Claims Act risk, Anti-Kickback Statute liability, and CLIA compliance — because unresolved regulatory exposure can render a lab unsalvageable regardless of its financial profile. Revenue cycle management failures, including unworked claim denials, incorrect CPT coding, and claims aging beyond 120 days, are the most common operational drivers of insolvency and must be addressed through a 13-week cash-flow forecast before any restructuring pathway is selected. Depending on the severity of the distress, Chapter 11 reorganization, a § 363 asset sale — where CLIA certification and state licenses carry transferable value that allows buyers to bypass months of administrative setup — or a structured wind-down are the three viable exits, with the correct choice determined by whether regulatory exposure is curable, revenue cycle problems are reversible, and core testing operations remain cash-flow positive. Source: J.S. Held / ABI Journal

Artificial Intelligence in Healthcare

• AI adoption in healthcare has moved from hesitation to integration, with roughly 40% of life sciences organizations reporting AI embedded throughout their operations. The speed of adoption is illustrated by AI scribes reaching 50% penetration across US healthcare systems in 18 months, compared to seven years for electronic medical records, with clinicians adopting the tools on their own initiative rather than through institutional procurement. Between 25% and 75% of healthcare practitioners, depending on jurisdiction, are already using AI to navigate patient histories, clinical questions, and treatment pathways, with the tools gaining traction primarily in workflow automation, scheduling, documentation, and data extraction. A structural barrier remains: approximately 80% of medical data is unstructured, sitting in PDFs, free text, and fragmented systems, creating opportunity for companies that can clean and contextualize that data for downstream AI use. On the investment side, standalone point solutions are losing ground to companies that can offer differentiated datasets, deep system integration, and auditable AI ecosystems, while the EU AI Act’s double layer of regulation on AI as a medical device risks raising costs and deterring innovators before the law is even fully in force. Source: McDermott
• The Health Sector Coordinating Council has released an 87-page framework requiring healthcare organizations to integrate cybersecurity controls across the full AI lifecycle — from procurement and design through decommissioning. The framework covers clinical safety and ethics, privacy controls, generative AI and large language model risks, supply chain and concentration risks, and AI-specific incident response. Without governance structures in place, AI systems risk data leakage, operational disruption, bias, and patient harm. The HSCC recommends that organizations form an AI cyber governance committee composed of program leads, physician leaders, IT and security personnel, legal experts, and patient advocates. The framework is intended to complement, not replace, existing organizational governance activities. Source: TechTarget
• Health care providers using AI face a layered web of state laws even as the federal government moves to assert national control over AI regulation. No comprehensive federal AI law exists, leaving states to apply technology-neutral statutes covering consumer protection, privacy, anti-discrimination, and professional licensing to AI use in clinical, administrative, and operational settings. California’s attorney general issued a legal advisory requiring health care providers to comply with existing state law — including unfair competition, professional licensing, anti-discrimination, and patient privacy laws — when deploying AI. On December 11, 2025, the Trump administration issued Executive Order 14365, directing the federal government to establish a national AI policy framework and to identify and challenge state laws that affect AI. Source: Reuters

Privacy, Cybersecurity & Data Protection

• The California Supreme Court’s ruling in J.M. v. Illuminate Education Inc. narrows who qualifies as a “provider of healthcare” under the Confidentiality of Medical Information Act while lowering the threshold plaintiffs must meet to allege a breach. The court held that Illuminate, a K-12 education technology company whose software was used for educational planning rather than healthcare delivery, is not a provider of healthcare under the CMIA, reversing the Fourth Appellate District’s 2024 expansive interpretation. Under a new standard for Section 56.101, a CMIA violation requires showing a significant risk of unauthorized access or use, with no proof of actual viewing or affirmative disclosure required, though mere loss of possession is not always sufficient. The court also ruled that J.M. lacked standing under the California Customer Records Act because Illuminate’s contract was with the Ventura County Office of Education, rejecting the “intended beneficiary” theory and distinguishing “customer” from “consumer.” The opinion flagged AI-facilitated and automated cybercrime as a basis for declining to require proof of human viewing, and a concurrence indicated that encryption of sensitive data may shield companies from liability. Source: Cooley
• AI PCs shift PHI risk from centralized cloud infrastructure directly onto endpoints, fundamentally restructuring HIPAA compliance obligations for healthcare organizations. Unlike traditional PCs, AI PCs run AI models locally on dedicated hardware, enabling clinical documentation, image analysis and point-of-care workflows without routing data through external systems — eliminating certain cloud-related exposure vectors but making each device a higher-value target. Clinical applications, EHR sessions and folders containing PHI must be explicitly excluded via enterprise policy from on-device features such as screen snapshots, semantic search indexes and ambient transcription, and AI PCs must generate immutable audit logs integrated into SIEM tools to satisfy HIPAA’s accounting of disclosures requirements. Retention policies must automatically purge AI caches and transcripts under minimum necessary principles, and devices must support remote wiping of AI data stores upon loss, theft or employee offboarding. Healthcare organizations should begin deployment with a use-case inventory identifying where local AI processing creates measurable workflow value, then conduct a HIPAA risk analysis specific to AI PC capabilities, while aligning with NIST Cybersecurity Framework 2.0, zero-trust principles and proposed HIPAA Security Rule updates — including multifactor authentication, encryption, network segmentation and continuous monitoring. Source: HealthTech Magazine
• Privacy and data security now rank alongside intellectual property and employment as core diligence requirements in M&A transactions, exposing buyers to regulatory investigations, class actions, and operational disruption when compliance failures go undetected. The US regulatory framework is sector-specific rather than unified, meaning acquirers must map exposure across HIPAA, GLBA, COPPA, state consumer privacy laws, and biometric data statutes — each of which can affect valuation and integration strategy. Privacy policies function as enforceable legal commitments, and the absence of “transfer of assets” language in a target’s policy can block data sharing with a buyer absent additional notices or consent mechanisms. All 50 states and the District of Columbia impose breach notification requirements, and diligence should focus not merely on whether breaches occurred but on whether they were detected promptly, reported as required, and remediated — since gaps in incident response signal broader governance failures. Cross-border transactions face additional constraints under the GDPR and laws in jurisdictions such as China, where outbound data transfers may require regulatory approval, affecting both pre-closing diligence and post-closing data consolidation. Source: Morgan Lewis
• Smart glasses from Meta, Google, and competitors create overlapping legal exposure under wiretap law, HIPAA, biometric statutes, the NLRA, and the ADA because the devices record audio and video without any visible cue that recording is occurring. Thirteen states require all-party consent to record a conversation, and because most smart glasses capture audio by default, wearers in those states cannot rely on implied-consent defenses that depend on a subject’s awareness of the recording. In healthcare settings, a staff member’s consumer smart glasses can constitute an impermissible HIPAA disclosure the moment the device captures a patient’s face, a chart, or a clinical conversation, and Meta does not sign business associate agreements, making its platform categorically incompatible with PHI workflows. Employers who issue blanket no-recording bans risk NLRA violations under the Stericycle standard, but narrowly drawn policies tied to specific confidentiality and safety interests — and confined to work time and work areas — have survived NLRB challenge, as seen in the January 2026 UPS ruling. Smart glasses also qualify as ADA-covered assistive technology for employees and patients with vision, hearing, or cognitive disabilities, meaning a flat refusal to permit their use, without engaging the interactive process or offering a conditioned accommodation, likely violates Title I or Title III. Source: Dickinson Wright Health Law Blog

Fraud & Abuse Enforcement

• A royalty arrangement between an orthopedic medical device company and its physician consultants would violate the Federal Anti-Kickback Statute if the requisite intent were present. The arrangement would have paid physicians a percentage of net sales across an entire product line in exchange for services such as teaching, training, and reviewing clinical outcomes, with exclusions for sales tied to the consultants’ own procedures or facilities. The OIG found the compensation methodology still took into account business generated between the parties because royalty calculations reflected purchases resulting from consultants’ recommendations to other providers, and that teaching and proctoring roles placed consultants in positions to influence peers’ purchasing decisions. The OIG determined the arrangement qualified for no AKS safe harbor and posed risks of patient steering, skewed clinical decision-making, and increased costs to federal health care programs. Royalty and consulting arrangements remain common in the medical device industry and may be structured to satisfy a safe harbor or present low AKS risk, but compensation that varies with product sales will draw regulatory scrutiny. Source: Thompson Coburn LLP
• The former CEO and a sales executive, along with a Texas physician and six marketers, agreed to pay a combined $2 million+ to settle False Claims Act allegations that they ran a kickback scheme disguised as managed service organization (MSO) investment distributions to induce laboratory test referrals billed to Medicare, Medicaid, and TRICARE. Susan Hertzberg, former CEO, and Matthew Theiler, former VP of Sales, each agreed to pay $600,000 to resolve allegations that from 2015 to 2017 they approved and implemented an arrangement in which marketers paid doctors kickbacks — including for medically unnecessary testing — disguised as MSO distributions, and expanded the scheme to a second Texas hospital after being warned to stop. Dr. Frederick Brown of Missouri City, Texas, agreed to pay $309,055 to resolve allegations that he received payments from two MSOs, Ascend MSO of TX LLC and Indus MG LLC, in exchange for ordering laboratory tests from Little River Healthcare and True Health Diagnostics LLC. Six marketers, including Thomas Gray Hardaway, William Todd Hickman, Ginny Jacobs, Scott Jacobs, and their associated entities, agreed to pay a total of $550,000 for their roles in distributing the kickbacks. The civil settlements for Hertzberg, Theiler, Brown, Hickman, and Hardaway are in addition to amounts owed in the related criminal case, United States v. Susan Hertzberg, et al., No. 6:22-CR-3-JDK (E.D. Tex.), bringing the DOJ’s total False Claims Act recoveries from MSO-disguised kickback schemes to over $61 million since 2019. Source: U.S. Department of Justice
• Healthcare companies that self-disclose criminal misconduct to the DOJ under its March 2026 Corporate Enforcement and Voluntary Self-Disclosure Policy can avoid criminal prosecution entirely, but must voluntarily disclose to a DOJ criminal component, fully cooperate, remediate the misconduct, and have no aggravating factors or prior criminal adjudication within the past five years. Companies that fall short of full qualification still receive a 50%–75% fine reduction, while those that do not self-disclose at all receive no more than a 50% reduction. Healthcare entities may also self-disclose under the separate OIG Health Care Fraud Self-Disclosure Protocol, which covers criminal, civil, and administrative violations and yields a lower damages multiplier than OIG’s standard 1.5 times single damages, along with a presumption against integrity agreement obligations and suspended overpayment reporting requirements — but always results in some monetary penalty, unlike a full DOJ declination. Because OIG coordinates with DOJ on self-disclosure matters, conduct reported to OIG may still reach DOJ, and the two programs are not mutually exclusive. With DOJ white-collar prosecutions up more than 10% in 2025, OIG completing over 900 investigations in just six months of that year, and the Trump administration establishing a Task Force to Eliminate Fraud and a National Fraud Enforcement Division in early 2026, healthcare entities that fail to self-disclose face both the loss of these benefits and negative signaling to federal enforcers. Source: McDermott Will & Emery

Medicare Payment & CMS Programs

• CMS confirmed that DMEPOS suppliers bidding in the Round 2028 Nationwide Remote Item Delivery competitive bidding area may use multiple locations collectively to satisfy state and local licensure requirements, so long as at least one included location holds any license required for a given state or area. Round 2028 will cover a nationwide competitive bidding area under a Remote Item Delivery model encompassing Class II continuous glucose monitors, insulin pumps, urological supplies, ostomy supplies, hydrophilic urinary catheters, and off-the-shelf back, knee, and upper-extremity braces. Small suppliers that cannot independently meet all state licensure requirements may form a network under 42 C.F.R. § 414.418, with contract eligibility based on the network’s collective compliance with enrollment, accreditation, and licensing requirements. CMS will screen all bids — for both lead and non-lead items — to verify they are bona fide, and may request narratives and documentation such as manufacturer invoices, price lists, letters of intent, or signed quotes showing that bidders accounted for all costs, overhead, and desired profit. Bidder registration and the bid window are targeted for late summer or early fall 2026, contract awards for late summer or early fall 2027, and the program is set to begin no later than January 1, 2028. Source: Foley & Lardner
• CMS overhauled its Increasing Organ Transplant Access (IOTA) Model on June 1, 2026, with changes to participation rules, payment structures, and patient notification requirements taking effect July 1, 2026. The mandatory participation threshold rises from 11 to 15 kidney transplants per baseline year, and military and VA medical facilities are now excluded from eligibility. Payment calculations will now include Medicare Advantage patients alongside Medicare Fee-for-Service beneficiaries, with the maximum upside risk payment holding at $15,000. The composite graft survival rate will apply a risk-adjustment methodology adapted from the Scientific Registry of Transplant Recipients framework and will exclude dual-organ transplants other than kidney/pancreas combinations. Transplant hospitals must now notify Medicare beneficiary waitlist patients within 10 days when their status changes to ineligible for organ offers, including the reason, reactivation information, and notification to the patient’s dialysis facility and managing clinician. Source: CMS

Employment & Benefits

• An overtime-exempt employee who occasionally performs nonexempt work retains exempt status under the FLSA so long as the employee’s primary duty remains exempt work. The U.S. Department of Labor’s Wage and Hour Division confirmed this in one of four opinion letters issued May 29, 2026, addressing a scenario in which hospital specialists took up to two nonexempt staff nurse shifts per week on weekends while receiving additional hourly pay — a practice DOL said does not violate the FLSA’s salary-basis requirement. A second letter held that a quarterly bonus calculated as a percentage of each employee’s total earnings — including both straight-time and overtime earnings — satisfies FLSA requirements, provided the bonus does not include amounts previously excluded from the employee’s regular rate and does not dilute the overtime portion of the ratio. The two remaining letters addressed compensability of off-site travel during meal periods and pre-shift activities and waiting time. The letters are part of DOL’s opinion letter program, relaunched in mid-2025, which is open to employers, employees, labor unions, and HR professionals. Source: HR Dive
• The Departments of Labor, Treasury, and Health and Human Services have proposed a rule that would create a new category of limited excepted benefit for fertility services, allowing employers to offer standalone fertility coverage outside their major medical plans. Like dental and vision excepted benefits, fertility benefits structured under the proposal would be exempt from many ACA and HIPAA market reform requirements. To qualify, a plan must direct substantially all benefits toward diagnosis or treatment of infertility, cap lifetime benefits at $120,000 per participant, be offered separately from the primary group health plan, and include a written notice of limitations. Employees could enroll in the fertility benefit even if they decline other employer-sponsored coverage, and employers must make non-excepted group health coverage available. The rule is open for public comment, and if finalized, would take effect for plan years beginning on or after January 1, 2027. Source: Benefits Law Advisor

Pharmaceutical Patent Litigation

• The U.S. Supreme Court unanimously held in Hikma Pharmaceuticals USA Inc. v. Amarin Pharma, Inc., that routine generic drug marketing activities do not constitute active inducement of patent infringement under 35 U.S.C. § 271(b). Justice Ketanji Brown Jackson, writing for the Court, replaced the Federal Circuit’s “could be read” standard with a requirement that the defendant “actively encouraged” infringing uses through “affirmative” steps. The case involved Hikma’s generic icosapent ethyl, approved under a skinny label covering only the unpatented severe hypertriglyceridemia indication, with Amarin’s patented cardiovascular-risk-reduction use carved out. The Court rejected each category of Hikma’s communications — including its label, press releases, website and patient information leaflet — as either compliance with law, omissions or statements too vague to constitute inducement. The Court noted that inducement need not be express but must be “clear” and “affirmative,” and it did not foreclose the possibility that other facts could satisfy the standard. Source: McGuireWoods

Facility Operations

• Ambulatory surgery centers are taking on higher-acuity patients faster than their operational infrastructure can keep pace, driven by advances in anesthesia and minimally invasive techniques and pressure from payers to shift care to lower-cost settings. ASC patients increasingly present with comorbidities including cardiac and pulmonary conditions, diabetes, renal disease, obstructive sleep apnea, and obesity, creating greater anesthesia risk and postoperative monitoring demands. Clinical capability to perform a procedure does not equal operational readiness to manage every patient associated with it, and gaps frequently exist in emergency preparedness, pre-admission testing, staffing competency validation, medication management, and patient selection criteria. Accrediting organizations and regulatory surveyors are giving increased scrutiny to operational alignment as outpatient acuity rises, and centers that do not proactively assess readiness face elevated risks to patient safety, staffing performance, and regulatory compliance. ASCs that align clinical expansion with infrastructure investments — including updated policies, transfer and escalation protocols, and leadership engagement in daily operations — are better positioned for long-term growth. Source: VMG Health

Fraud & Abuse: OIG Advisory Opinions

• OIG has approved an orthopedic surgery provider’s proposed warranty program that refunds concierge fees to patients requiring revision surgery within two years of their initial procedure. In Advisory Opinion No. 26-12, the Requestor offers a voluntary Concierge Program, covering items such as wellness coaching, nutritional supplements, app-based health monitoring, leg elevators, and compression garments, for one year following surgery, with fees paid out-of-pocket at fair market value and not reimbursed by any Federal health care program. Under the Warranty, if a patient who substantially complies with the program nonetheless requires revision surgery within two years, the Requestor refunds the concierge fees paid in connection with the initial surgery, with no requirement that the patient return to the Requestor for the revision and no conditioning on exclusive or minimum purchases. OIG found that the arrangement satisfies the applicable elements of the warranty safe harbor at 42 C.F.R. § 1001.952(g), including written undertaking, accurate reporting of refunds on patient invoices, and the patient’s contractual obligation to provide information to the Secretary or State agency upon request. Accordingly, OIG concluded the Proposed Arrangement would not generate prohibited remuneration under the Federal anti-kickback statute or the Beneficiary Inducements CMP, and it would not impose administrative sanctions. Source: OIG Advisory Opinion No. 26-12
• The OIG issued an advisory opinion on May 13, 2026, that an orthopedic medical device company’s plan to pay physician consultants royalties tied to product line revenue violates the Anti-Kickback Statute’s personal services safe harbor because the payments track the volume or value of referrals. Under the arrangement, physicians who met minimum hours and quality standards would receive a percentage of revenue from all products in a line they advised on, rather than a flat hourly rate, creating a financial incentive to recommend those products to other providers through teaching, training, and proctoring activities. The OIG characterized the structure as a potential payment-for-referrals scheme and cited studies showing physicians are more likely to order products from companies that compensate them, raising risks of patient steering, inappropriate utilization, and increased costs to Medicare and Medicaid. The OIG distinguished compliant arrangements, noting that fixed fair market value fees for documented services, IP royalties not tied to ongoing referrals, and compensation structures that carve out the consultant’s own procedures and affiliated facilities present lower fraud and abuse risk. Device companies should structure physician consulting agreements to satisfy an applicable Anti-Kickback Statute safe harbor and exclude consultants from any position to influence utilization of the products generating their pay. Source: Nixon Peabody LLP

HIPAA Security Rule Developments

• NIST certifications, HITRUST credentials, and third-party “HIPAA compliant” attestations do not satisfy the HIPAA Security Rule’s risk management requirement, and OCR is now expanding its enforcement to verify compliance with that requirement directly. In April 2026, OCR released a YouTube presentation clarifying that covered entities and business associates must not only identify risks to electronic protected health information (ePHI) through a security risk analysis, but must also implement safeguards that reduce those risks to a reasonable and appropriate level — and document that they have done so. Framework exercises such as NIST mappings or ISO reviews may inform compliance efforts and can mitigate penalties during an investigation, but none independently establishes Security Rule compliance. OCR treats risk management as a continuing governance function, not a one-time deliverable, requiring organizations to prioritize risks by likelihood and impact, tie remediation decisions to that prioritization, and update the risk management plan as technologies and threats evolve. Regulated entities should ground their security risk analysis in a full ePHI asset inventory and ensure their risk management plan documents remediation decisions, implementation status, and reviews of safeguard effectiveness over time. Source: Baker Data Counsel
• A proposed update to the HIPAA Security Rule eliminates the longstanding “addressable” classification for encryption, making it a baseline requirement for all entities that create, receive, store, or transmit electronic protected health information (ePHI). The rule extends compliance obligations beyond traditional healthcare providers to include insurers, clearinghouses, business associates, SaaS platforms, analytics providers, and cloud operators handling ePHI. Covered entities have approximately 180 days from final rule publication to comply, a timeline regulators consider sufficient given that encryption is widely available and affordable. Encryption alone does not satisfy the rule’s expectations; regulators require documented proof of key lifecycle management, activity monitoring, tamper-resistant audit logs, and centralized policy enforcement across databases, file systems, cloud workloads, endpoints, and backups. Organizations that cannot demonstrate uniform, governed encryption across all environments face heightened enforcement exposure, legal liability, and breach costs. Source: Security Boulevard

HIPAA Privacy: Breach Notification & Patient Consent

• HIPAA’s Breach Notification Rule effectively requires data mining in large-scale incidents because the law places the burden of proof on covered entities to rebut a presumption that any impermissible access constitutes a reportable breach. Under 45 C.F.R. § 164.402, any acquisition, access, use, or disclosure of protected health information that is not permitted under the Privacy Rule is presumed to be a breach unless the covered entity can demonstrate a low probability of compromise. To rebut that presumption, the entity must conduct a risk assessment addressing at least four enumerated factors, including what data was involved, whether it was accessed, and the likelihood of harm to affected individuals. Failure to conduct or adequately document that assessment leaves the presumption intact, triggering notification obligations to affected individuals, the Secretary of Health and Human Services, and, in incidents, the media. Source: IAPP
• Electronic health privacy forms routinely use dark patterns to block patients from opting out of data sharing, even when the forms explicitly state that patients have the right to do so. At a Virginia telehealth clinic using Privia Health’s system, patients were presented with an “I accept” button as the only option to proceed through registration, with no visible way to decline data sharing through health information exchanges, despite the privacy notice describing an opt-out right — a design that University of Chicago law professor Lior Strahilevitz identified as both “obstruction” and “visual interference” dark patterns. HIPAA does not require patients to sign a notice of privacy practices, only to acknowledge receipt, and HHS has confirmed that providers are not prohibited from requiring acceptance as a condition of check-in — a gap that legal experts say was never anticipated when the rules were written. State law varies considerably: Florida and New York require explicit patient consent before data can be shared through health information exchanges, while Arizona, Maryland, and Virginia permit sharing by default with opt-out options. HHS is currently working to finalize a rule that would remove the written acknowledgment requirement, though privacy law experts are calling for stronger intervention — including a requirement that any notice describing an opt-out right must include a direct, working link to exercise it. Source: CalMatters

AI in Clinical Practice: Compliance & Litigation

• AI transcription tools in health care create legal exposure under HIPAA, state privacy laws, and the False Claims Act that requires governance treatment equal to any other high-risk clinical process. A single patient encounter can generate multiple PHI-containing records—audio files, transcripts, summaries, draft notes, and system logs—each subject to distinct access, retention, and disclosure obligations that must be addressed in Business Associate Agreements with transcription vendors. Because these tools lack clinical judgment, errors in captured medication names, diagnoses, or dosages can corrupt the medical record and, if incorporated into billing submissions without human review, generate overpayment liability and False Claims Act scrutiny. Some states now require licensed professionals to obtain both oral and written patient consent before using AI tools to record or transcribe therapy sessions, and organizations must audit applicable state recording and confidentiality laws before deployment, particularly in behavioral health settings. Employees who bypass approved systems and use consumer-grade transcription tools—so-called “shadow AI”—can move PHI outside monitored environments and convert a routine compliance gap into a regulatory investigation by the HHS Office for Civil Rights or a state attorney general. Source: Foley & Lardner
• Health care organizations face mounting litigation risk from AI tools that capture or process patient communications without consent. A class action filed in the Northern District of California targets a third-party “ambient AI” clinical documentation tool, with plaintiffs alleging that physician-patient conversations were recorded, transmitted, and processed without informed consent, in violation of the California Invasion of Privacy Act, the Confidentiality of Medical Information Act, the Unfair Competition Law, common law intrusion upon seclusion, and the federal Wiretap Act. Legal exposure extends beyond how an AI tool functions to how it is implemented, disclosed, governed, and monitored, and a single use case can implicate privacy, consent, data governance, cybersecurity, vendor management, professional liability, and consumer protection law simultaneously. Using a third-party platform does not transfer legal responsibility, so organizations must conduct vendor due diligence, track how data flows through AI systems, and ensure patient notices and authorizations align with actual data practices. Governance frameworks should include an inventory of AI use cases classified by patient impact and data sensitivity, pre-deployment assessments of privacy and clinical risk, human oversight of AI-informed decisions, and clear patient communication about what the technology does and how information is protected. Source: FBT Gibbons

Federal Enforcement & AI-Driven Audits

• HHS launched AERO on May 21, 2026, using AI to re-score five or more years of Single Audit Act compliance data for every entity receiving $1 million or more in annual federal funds. Hospitals receiving Medicaid DSH payments, Graduate Medical Education funding, NIH and HRSA grants, or COVID and ARPA relief funds fall within scope, and findings against a state Medicaid agency can flow downstream to hospital subrecipients that had no involvement in the underlying audit deficiency. AERO findings can trigger payment withholding, cost disallowances, suspension or termination of awards, and debarment proceedings under 2 CFR Part 180. HHS announced AERO through a press release and letters to governors rather than through notice-and-comment rulemaking as required by the Administrative Procedure Act, and HHS’s own Trustworthy AI Playbook requires bias testing, human oversight, transparency, and OMB pre-clearance before deploying rights-impacting AI — none of which HHS has publicly documented for AERO. Hospitals should file a FOIA request before responding to any AERO correspondence, demanding the AI methodology, training data, validation studies, bias assessments, and OMB M-24-10 pre-clearance documentation, as courts in AI enforcement challenges have used FOIA-obtained records as the evidentiary foundation for invalidating agency actions. Source: Polsinelli

Telehealth & Workforce Compliance

• Telehealth is projected to account for up to 30% of U.S. medical visits in 2026, and the distributed workforce supporting it, like coders, billing specialists, contractors, and offshore workers, cannot be secured through legacy device-based controls. HIPAA requires safeguards preventing unauthorized access to electronic protected health information (ePHI), and those obligations extend to all personnel who touch that data, regardless of employment status or device ownership. With 73% of healthcare leaders expecting half their workforce to be hybrid in 2026, shipping corporate laptops or deploying virtual desktops is too slow and complex to keep pace with staffing demands. The security model must shift from locking down hardware to isolating ePHI and healthcare applications directly on the endpoint — inside a protected workspace separated from personal activity — regardless of who owns the machine. That approach enables onboarding in minutes rather than days, allows instant access revocation without equipment retrieval, and keeps compliance intact across geographies and device types. Source: Healthcare IT Today

Payer Disputes & No Surprises Act

• A Texas federal court dismissed with prejudice Blue Cross Blue Shield of Texas’s lawsuit against HaloMD, a provider-side independent dispute resolution company, on May 22. BCBS Texas, operating under Health Care Service Corp., had alleged HaloMD submitted ineligible claims under the No Surprises Act and Texas state law to exploit the arbitration process. The court held that BCBS Texas’s claimed damages constituted an impermissible collateral attack on IDR awards, that an injunction was not an independent cause of action, and that IDR awards are not subject to judicial review. BCBS Texas has filed an appeal, while HaloMD contends HCSC owes tens of millions of dollars in legally binding IDR awards to providers for care already rendered. HaloMD faces a pattern of similar insurer challenges, including a dismissed suit brought by Elevance Health in California, which also intends to appeal. Source: Becker’s Payer Issues

Fraud, Abuse & Enforcement

• CMS has imposed six-month, nationwide moratoria on new Medicare enrollment for hospices and home health agencies, blocking both initial enrollment applications and certain changes in majority ownership. The moratoria do not affect existing providers, who may continue serving Medicare beneficiaries. CMS has already suspended payments to approximately 800 hospices and home health agencies in Los Angeles suspected of fraud — providers responsible for $1.4 billion in Medicare spending last year — with $70 million in payments suspended to date. The action marks the third such moratorium CMS has imposed, following a similar measure earlier this year targeting durable medical equipment, prosthetics, orthotics, and supplies companies. CMS has also launched a public hospice scoring system, expanded pre- and post-claim review of home health claims in six states, and imposed heightened oversight of newly enrolled hospice providers in Arizona, California, Georgia, Nevada, Ohio, and Texas. Source: CMS
• Texas Children’s Hospital agreed to pay more than $10 million and overhaul its operations to settle DOJ and Texas Attorney General allegations that it violated a state ban on gender-affirming care for minors and submitted false claims to federal and private payers. The DOJ and Texas AG alleged that TCH used false diagnosis codes to conceal puberty blocker and cross-sex hormone treatments in violation of Texas Senate Bill 14 (2023), which prohibits healthcare providers from facilitating gender-affirming care for minors. Under the settlement, TCH must cease administering puberty blockers and cross-sex hormones to minors, terminate five physicians who provided the care, and establish the nation’s first detransition clinic offering services at no cost for five years. The settlement is the first of its kind under Executive Order 14187, signed January 28, 2025, which directed federal agencies to investigate fraud related to gender-affirming care for minors. Acting Attorney General Todd Blanche stated the DOJ would “use every weapon at its disposal” to end the practice. Source: Vedder
• Dental billing fraud enforcement is intensifying as regulators deploy AI and data analytics to identify outliers across Medicaid-heavy practices. Dental practices face False Claims Act and overpayment liability not only from intentional misconduct but from documentation errors that repeat across high-volume services like imaging and routine cleanings, where a single miscoded procedure aggregates into material exposure over time. State attorneys general in Connecticut and Texas have pursued enforcement actions against dental providers for kickback arrangements and referral schemes that violate state Medicaid laws, regardless of whether the practices billed Medicare. Multiple dental entities paid $540,000 to resolve claims that services were billed under the national provider identifiers of credentialed dentists who did not perform the work. Dental service organizations face additional scrutiny under corporate practice of medicine doctrines, fee-splitting prohibitions, and the federal Anti-Kickback Statute, particularly where management compensation structures may influence clinical utilization. Source: McDermott Will & Emery
• OIG Advisory Opinion No. 26-10 concludes that an orthopedic device company’s proposed Product Line royalty arrangement with physician consultants would generate prohibited remuneration under the Federal AKS. The Requestor, a manufacturer of hip, knee, shoulder, spine, and sports medicine implants, proposed paying certain Consultants a “royalty”—calculated as a percentage of net invoice price for all Products sold within a Product Line—in exchange for teaching, training, proctoring, design feedback, and clinical evaluation services, provided the Consultant met minimum hour requirements and received a “royalty-eligible” rating from an Evaluation Panel. OIG determined the arrangement would not fit within the safe harbor for personal services and management contracts because the payment methodology would take into account the volume or value of referrals and other business generated between the parties, particularly since the Requestor could not certify that the Product Line Services would not contribute to revenue generation. OIG identified risks of skewed clinical decision-making, patient steering, unfair competition, inappropriate utilization, and increased costs to Federal health care programs, noting that the payments could financially motivate Consultants to recommend the Products over competitors even when a competitor’s product might be more clinically appropriate. Source: Advisory Opinion 26-10
• OIG Advisory Opinion No. 26-11 declines to impose sanctions on a precision oncology company that provides consenting patients a free supplemental multi-cancer detection report in connection with its FDA-approved blood-based colorectal cancer screening test. The Requestor performs the CRC Screening Test—the first FDA-approved blood-based biomarker test for primary colorectal cancer screening, covered by Medicare once every three years—in its CLIA-certified laboratory, and runs a Breakthrough Device-designated algorithm on the same blood sample to generate a Supplemental Report identifying potential signals for bladder, breast, CRC, esophageal, gastric, liver, lung, ovarian, pancreatic, and prostate cancers. To receive the Supplemental Report, a patient must have a valid CRC Screening Test order from an independent, unaffiliated physician who opts in to the additional results, and must sign a consent authorizing release of medical information up to four times over five years to support FDA approval and future payor coverage of the MCD Test. OIG concluded the risk of fraud and abuse is low because the MCD Test is not separately reimbursable and adds no cost to Federal health care programs, physicians receive no compensation for ordering the test or opting in, the Requestor’s laboratory is the only laboratory performing the CRC Screening Test, six of the detected cancers have no USPSTF-recommended screening alternative, and the Requestor refrains from direct-to-consumer advertising or targeted marketing of the Supplemental Report. Source: Advisory Opinion 26-11

Antitrust & Competition

• The FTC and DOJ Antitrust Division closed public comments for new guidelines governing competitor collaborations, replacing the 2000 Antitrust Guidelines for Collaborations Among Competitors, which the agencies withdrew in December 2024 as obsolete. The incoming guidelines are expected to address vertical integration, roll-ups, joint licensing, algorithmic pricing, data sharing, and labor collaborations. The agencies had originally set an April 24 deadline for comments but extended it to May 21 to allow more time for input. Healthcare companies face particular exposure, as the 2000 Guidelines had established a safety zone for R&D collaborations that no longer exists, leaving businesses without clear guidance until new rules are issued. Companies should consult antitrust counsel before entering competitor collaborations while the agencies review public comments and draft the replacement framework. Source: Williams Mullen
• The FTC and DOJ pursued an broad range of healthcare antitrust enforcement actions in the first quarter of 2026, spanning merger challenges, civil lawsuits, criminal prosecutions, and new policy initiatives. The FTC launched a Healthcare Task Force on March 20, 2026, and settled with Express Scripts over insulin drug pricing practices that the agency estimated cost patients up to $7 billion over 10 years, while also blocking or triggering the abandonment of three healthcare mergers — Sevita Health’s $835 million acquisition of BrightSpring’s community living business, Edwards Lifesciences’ $945 million acquisition of JenaValve Technology, and Alcon’s $430 million acquisition of LENSAR. DOJ filed civil antitrust suits against OhioHealth and New York-Presbyterian, alleging both hospital systems used payor contract restrictions to block the development of budget-conscious insurance plans, and secured a guilty plea in a bid-rigging scheme involving healthcare supply sales to the U.S. Air Force. In private litigation, a Massachusetts federal court allowed antitrust claims to proceed against Zelis and five major insurers for allegedly conspiring to suppress out-of-network provider reimbursement rates, while the Fifth Circuit dismissed claims against group purchasing organization Vizient after finding the plaintiff defined the relevant market too narrowly. Source: Vinson & Elkins LLP

Coverage & Reimbursement

• Medicare beneficiaries enrolled in Part D will gain access to GLP-1 weight-loss medications for $50 per month starting July 1, 2026, under a program called the Medicare GLP-1 Bridge. The demonstration runs through December 31, 2027, and operates under the Secretary’s authority to test new approaches to care delivery under Medicare. CMS will handle claims adjudication and payments to pharmacies through a centralized process. Beneficiaries should consult their doctor to determine eligibility for a specific GLP-1 medication. Source: CMS
• Texas Senate Bill 2544, which took effect June 20, 2025, requires out-of-network facility providers — including hospitals, ambulatory surgery centers, freestanding emergency rooms, and birthing centers — to request mediation within 180 days of receiving an initial payment or forfeit the right to dispute the claim. The law amends Texas Insurance Code Chapter 1467, which already required completion of Texas Department of Insurance mediation before a facility provider could file a civil lawsuit over a billing dispute with a health benefit plan. Missing the 180-day window bars both mediation and any subsequent civil action to recover the disputed amount. The deadline applies to disputes with TDI-regulated commercial HMOs and PPOs, as well as self-insured ERISA plans that have opted into the Chapter 1467 process, but does not cover Medicare, Medicaid, or ERISA plans that have not opted in. The change mirrors the existing 90-day deadline already imposed on out-of-network non-facility providers such as physicians and physician groups under the same framework. Source: Hendershot Cowart P.C.

Transactions, M&A & Investment

• Private equity consolidation is reshaping the pharmacy sector through vertical integration, selective asset acquisitions, and structural restructurings as drug costs rise and margins compress. U.S. drug spending rose 11.4% in 2024, with oncology, autoimmune, and metabolic therapies projected to sustain increases through 2027, while PBM scrutiny and 340B Program litigation continue to erode margins for specialty pharmacies. CVS Health acquired 63 Rite Aid store locations and more than 600 prescription files across 15 states, and Walgreens Boots Alliance completed a take-private transaction in August 2025—both moves reflecting a shift away from broad ownership toward scale and operational flexibility. CVS Health, OptumRx, and Express Scripts now collectively manage pharmacy benefits for more than 75% of Americans, and Cigna’s Evernorth Health Services made a $3.5 billion investment in Shields Health Solutions to expand specialty dispensing control. Freestanding ambulatory infusion centers are projected to overtake hospital outpatient infusion volume by 2029 at a 30–40% cost advantage, and EBITDA across the pharmaceutical value chain is forecast to reach approximately $114 billion by 2029. Source: VMG Health
• Provable ROI has displaced innovation as the primary criterion for securing capital in health tech, as multiple expansion fades and investors now require mid-teens EBITDA growth to hit target returns. Healthcare IT deal activity hit record volume and value in 2025, but valuations in 2026 are under pressure from AI uncertainty and a more selective buyer pool. Capital is concentrating in infrastructure-layer and tech-enabled services companies embedded in core workflows — revenue cycle, billing, staffing, and care navigation — where inefficiencies are measurable and switching costs are high. Investors evaluate AI on cost reduction (48%) and workflow efficiency gains (34%), not on narrative, and diligence now scrutinizes data usability, workflow integration depth, retention quality, and ROI attribution. Most liquidity is coming through PE-backed M&A and strategic buyers rather than IPOs, with exits bifurcating sharply between companies that can demonstrate repeatable ROI and those that cannot. Source: McDermott Will & Emery

Privacy & HIPAA

• HIPAA privacy protections extend to deceased persons, with disclosure permitted only under specific conditions. Providers may share a decedent’s health information for treatment, payment, or healthcare operations — including treatment of living relatives — without authorization, and may disclose relevant information to family members or others who were involved in the decedent’s care, provided the disclosure does not conflict with the decedent’s prior expressed preferences and is limited to information relevant to that involvement. A personal representative — such as an executor or estate administrator — is entitled to a decedent’s health information regardless of prior involvement in the decedent’s care or the decedent’s own wishes regarding disclosure. Additional exceptions permit disclosure to law enforcement when criminal conduct is suspected, to coroners, medical examiners, and funeral directors, for decedent-only research, and to organ procurement organizations. HIPAA protections expire entirely 50 years after death, though providers must also check state laws and other federal rules, such as 42 CFR Part 2 for substance use disorder records, which may impose stricter requirements. Source: Holland & Hart’s Health Law Blog

AI & Emerging Technology

• AI tools used in clinical trial protocol development and patient recruitment create unresolved compliance risks that sponsors bear alone, even when AI vendors cannot provide validation documentation. Because large language models produce non-deterministic outputs, sponsors cannot reproduce AI-generated inclusion criteria or satisfy ICH E6(R2) requirements for validated computerized systems, and the FDA’s January 2025 draft guidance on AI in drug development does not cover protocol design or drafting, leaving validation standards undefined. The FDA’s own internal AI tool, Elsa, has generated false citations and fabricated studies, illustrating that hallucinations in protocol development can produce incorrect dosing regimens or flawed statistical approaches without human verification. AI-powered recruitment tools, while capable of reducing trial costs by up to 40%, train on historically non-diverse datasets and can systematically exclude racial and ethnic minorities, older adults, children, and patients with comorbidities—contrary to the FDA’s December 2025 guidance requiring enrollment that reflects the intended-use population by age, sex, race, and ethnicity. To address these gaps, sponsors should validate reproducibility before IRB submission, audit recruitment algorithms for bias before enrollment, and require AI vendor contracts to include audit rights over model architecture, version control documentation, cooperation obligations for FDA proceedings, performance warranties, and indemnification for AI-specific harms. Source: Healthcare Law Insights

Hospital & Health System Governance

• Hospital and health system boards are not keeping pace with the governance demands created by cybersecurity risks, AI adoption, workforce shortages, shifting reimbursement models, and compliance requirements. A study from The Governance Institute finds that governance structures and board education have fallen behind today’s healthcare challenges, with trustees now expected to engage on topics ranging from M&A activity and physician alignment to data privacy and quality outcomes. Knowledge gaps are inconsistent across boards — some trustees carry financial expertise but lack grounding in cybersecurity, while others bring community leadership experience but are unfamiliar with reimbursement dynamics or physician compensation structures. Traditional education models, including long board meeting presentations and generic materials, fail to address these gaps or fit the schedules of trustees who carry outside professional responsibilities. Ongoing, tailored board education — rather than annual or compliance-driven training — is now considered necessary for effective oversight, organizational strategy, and patient outcomes. Source: VMG Health

Fraud, Abuse & Enforcement

• CMS has imposed six-month, nationwide moratoria on new Medicare enrollment for hospices and home health agencies (HHAs), blocking initial enrollment applications and certain changes in majority ownership. The moratoria, coordinated with Vice President JD Vance’s Anti-Fraud Task Force, do not affect existing providers, who may continue serving Medicare beneficiaries. CMS has already suspended payments to 773 hospices and 23 HHAs suspected of fraud in Los Angeles alone, representing $70 million in suspended funds. This action follows an earlier moratorium on DMEPOS companies, bringing the total number of active CMS enrollment moratoria to three. Additional enforcement measures include nationwide hospice site visits, fingerprinting-based background checks for HHAs, a public hospice scoring system, and pre- and post-claim review of HHA claims in Florida, Illinois, Oklahoma, Ohio, North Carolina, and Texas. Source: CMS
• Texas Children’s Hospital agreed to pay $10 million to settle healthcare fraud allegations brought by Texas Attorney General stemming from the hospital’s billing of Texas Medicaid for gender-transition procedures using false diagnosis codes. Under the settlement, negotiated in coordination with the U.S. Department of Justice, the hospital must establish the country’s first detransition clinic — a multidisciplinary facility providing care to patients who underwent gender-transition procedures — with all services funded by the hospital and free to patients for the first five years. Five physicians who performed gender-transition interventions will be permanently terminated and barred from future employment or credentialing at the hospital. Texas Children’s also agreed to cease providing gender-transition services, implement compliance and ethics measures, and amend its bylaws to require automatic revocation of privileges for any physician who violates Texas law prohibiting such interventions on minors. Source: Office of the Texas Attorney General
• Federal prosecutors, courts, and regulators are pursuing health care fraud on multiple fronts, with recent actions spanning investor fraud, kickback schemes, and fraudulent export pricing. On May 6, a federal judge sentenced Parmjit Parmar, former CEO of Constellation Healthcare Technologies, to five years in prison and over $125 million in restitution after he pleaded guilty to conspiracy to commit securities fraud in a $212.5 million scheme that fabricated subsidiaries, falsified financial records, and misled investors into a take-private transaction. Modern Nuclear Inc., a mobile PET scan provider, agreed on May 1 to pay $8.3 million to resolve False Claims Act allegations that it paid above-fair-market-value fees to referring cardiologists as kickbacks, and entered into a five-year Corporate Integrity Agreement with HHS-OIG requiring an independent compliance expert. The 11th Circuit upheld wire fraud convictions on May 5 against Byramji Javat and Luis Soto, who between 2014 and 2017 fraudulently obtained medical equipment at export-only prices and resold it domestically, with Javat sentenced to 10 years and Soto to six, plus joint restitution of $29 million. Separately, AbbVie, AstraZeneca, Novartis, and Sanofi petitioned the Ninth Circuit for en banc rehearing to challenge the constitutionality of the FCA’s qui tam provisions, arguing that empowering private parties to sue over conduct the executive branch never deemed unlawful violates Article II. Source: ArentFox Schiff
• Fair market value compensation and Stark Law compliance do not shield healthcare arrangements from liability under the federal Anti-Kickback Statute (AKS). The HHS Office of Inspector General, in updated FAQ guidance, stated that AKS liability turns on a facts-and-circumstances analysis of the parties’ intent, and that fair market value is “not a dispositive defense” under the statute. Satisfying a Stark Law exception also provides no automatic protection, as the two laws exist for different purposes and operate under separate legal frameworks — for example, a hospital providing event tickets to a referral source may violate the AKS even if the underlying financial relationship fits within a Stark exception. Healthcare entities must evaluate arrangements under both laws independently and, because the AKS is intent-based, should maintain documentation of the legitimate business purpose behind any arrangement involving remuneration and referral relationships. Protection from AKS liability requires either full compliance with an applicable safe harbor or a well-documented showing that the arrangement’s facts and circumstances are consistent with the statute. Source: Thompson Coburn LLP

Corporate Practice of Medicine & Private Equity

• California and Oregon have produced the first enforcement actions under state laws barring corporate control of medical practices, resulting in a $2.3 million penalty against Aspen Dental Management and a scrapped hospital staffing deal in Eugene. California Attorney General Rob Bonta found that Aspen Dental — backed by Leonard Green & Partners and Ares Management — exceeded its role as a back-office support organization and participated in managing dental practices, violating the state’s corporate-medicine ban. In Oregon, U.S. District Judge Mustafa Kasubhai ruled that hospital operator PeaceHealth’s plan to bring in Atlanta-based ApolloMD amounted to an end-run around the state’s ban on corporate control of medical practices, after which PeaceHealth agreed to retain the incumbent physician group, Eugene Emergency Physicians. Both states passed their laws last year, aimed at strengthening longstanding corporate-medicine bans — on the books in about 30 states — that had become ineffective through lax enforcement and private-equity workarounds such as the “friendly physician” model and support-organization structures. Vermont’s state Senate advanced similar legislation, and Bonta has signaled intent to go further than the California statute by targeting the friendly-physician model directly. Source: Wall Street Journal
• California’s corporate practice of medicine doctrine is under active judicial and legislative pressure that threatens the continuity agreements at the core of MSO-PC structures used by private equity and telehealth platforms statewide. A trial court ruled in Art Center Holdings, Inc. v. WCE CA Art, LLC that a private equity-backed MSO engaged in the unlicensed practice of medicine by using a continuity agreement to exercise broad discretion over ownership transfers within a physician-owned professional corporation. On appeal, the California Attorney General filed an amicus brief arguing that any contractual mechanism allowing an MSO to effectuate a physician ownership change raises CPOM concerns, regardless of whether clinical decisions are directly affected, while the California Medical Association filed a competing brief on April 15, 2026, urging a facts-and-circumstances standard rather than a categorical prohibition. Two laws effective January 1, 2026 — SB 351, which codifies CPOM prohibitions targeting private equity and hedge fund control over clinical and operational functions, and AB 1415, which requires 90 days’ advance notice to the Office of Health Care Affordability before closing material health care transactions — reinforce the AG’s position at the legislative level. Because many health care organizations structure their agreements to comply with California law as a national baseline, an appellate ruling adopting the AG’s approach would carry compliance consequences well beyond California’s borders. Source: Faegre Drinker Biddle & Reath LLP
• Private equity in healthcare and life sciences is shifting from financial engineering to operational value creation as valuation resets, constrained capital, and higher financing costs force investors to be more disciplined. The market has bifurcated: differentiated assets still command premium prices, while lower-tier assets face wider bid-ask spreads, longer negotiations, and more structural complexity. Investors are sourcing under-the-radar businesses with niche dynamics, diversifying across healthcare segments, and driving portfolio companies through leadership changes, M&A, and pricing improvements rather than relying on multiple expansion. On AI, the most durable assets are seen as those grounded in physical products, specialist infrastructure, and embedded services—such as medical devices and critical care—while AI’s most credible near-term use cases are workflow automation, scheduling, and administrative efficiency rather than platform-level disruption. Continuation vehicles are gaining use as exit pathways remain constrained, but require a track record of performance, a credible path to exit, and clear alignment between general and limited partners. Source: McDermott Will & Emery

AI in Healthcare

• The Pennsylvania State Board of Medicine filed suit against a generative AI company for the unauthorized practice of medicine, alleging that its platform enabled users to create chatbot characters posing as licensed health care professionals. During its investigation, state regulators interacted with a chatbot identified as a “doctor of psychiatry” that had logged over 45,000 user interactions, provided a false medical license number, and offered to conduct a mental health assessment. The Board is seeking an injunction to bar the platform from continuing to operate in this capacity. The action follows a February 2025 Federal Trade Commission injunction against an AI platform marketing itself as a “robot lawyer” for the unauthorized practice of law, and New York legislation introduced in 2025 to prohibit AI chatbots from impersonating licensed professionals. California, Illinois, Nevada, Utah, and Maine are among the states moving toward similar regulatory measures. Source: MG+M The Law Firm
• Healthcare organizations deploying AI must navigate a layered compliance framework that begins with HIPAA but extends well beyond it. PHI — defined as individually identifiable information created, used, or disclosed in the course of treatment, diagnosis, or billing — cannot be processed through publicly available AI models, and any use must either fall within HIPAA’s treatment, payment, or operations exceptions or be covered by a valid authorization under 45 CFR 164.508, which carries technical requirements distinct from a standard consent form. Even when a TPO exception applies, PHI cannot be used to train a general-purpose model without a proprietary closed-loop system, appropriate permissions, and destruction protocols. Business associate agreements with AI vendors must expressly address processing, aggregation, de-identification, and data transmission, and HIPAA functions only as a regulatory floor — states including California, Washington, and Colorado impose additional or more restrictive requirements that organizations operating across state lines must separately evaluate. Ownership of AI training data and model outputs must be allocated by contract, and AI tools providing clinical decision support may also trigger FDA regulation. Source: Morgan Lewis
• All 20 AI scribe vendors approved by the Ontario government for use by healthcare providers produced inaccurate or incomplete medical notes in tests conducted by the province’s auditor general. Nine vendors hallucinated patient information, 12 recorded information incorrectly, and 17 missed details about mental health issues discussed in two simulated patient-doctor conversations. Errors included fabricated referrals for blood tests or therapy, incorrect medication names, and omitted mental health details — findings the auditor general concluded could result in inadequate or harmful treatment plans. Despite these results, the accuracy metric accounted for only 4 percent of a vendor’s approval score, while a metric for domestic presence in Ontario carried 30 percent weight, meaning a vendor could score zero on accuracy and still gain approval. The auditor general recommended that IT departments require physicians to confirm review of AI-generated notes before those notes are entered into patient records. Source: Ars Technica

Prior Authorization & Payer Reform

• CMS regulations and health plan voluntary commitments are reshaping prior authorization through two parallel tracks: process reform and reduction in the number of services requiring authorization. CMS’s 2024 Advancing Interoperability rule imposed requirements on certain health plans covering electronic prior authorization technology, approval timelines, and public reporting, with major provisions taking effect in 2027; a proposed 2026 rule would extend similar requirements to medications covered under a health plan’s medical benefit. In June 2025, AHIP and Blue Cross Blue Shield Association members pledged to approve at least 80% of prior authorization requests in real time when submitted electronically, standardize the submission process, ensure all denials are reviewed by a licensed clinician, and maintain continuity of care across plan changes — commitments that also apply to commercial plans outside CMS’s jurisdiction. On the volume side, health plans have eliminated 11% of prior authorizations since the 2025 pledge, representing 6.5 million fewer authorizations, and at least one national plan has committed to eliminating authorization requirements for 30% of services. Key uncertainties remain around whether providers — particularly those in rural areas or with fewer resources — will be positioned to use the new electronic systems once health plans are required to implement them in 2027. Source: McDermott+

HIPAA, Data Privacy & Cybersecurity

• Healthcare data breaches cost an average of $9.77 million per incident — the highest of any industry for 13 consecutive years — because traditional document systems cannot enforce HIPAA at the architecture level, leaving audit logs editable, records alterable, and access controls subject to drift. HIPAA’s Privacy Rule, Security Rule, and HITECH Act require minimum necessary access, technical safeguards for electronic PHI, and breach notification obligations, with penalties for uncorrected willful neglect reaching $50,000 per violation and $1.9 million per category annually — and any third-party platform handling ePHI must execute a Business Associate Agreement before storing a single record. Blockchain addresses the compliance gap by making records immutable, generating cryptographic hashes that detect any alteration, and enforcing role-based access through smart contracts rather than manual permissions, satisfying all four technical safeguards required by NIST Special Publication 800-66r2. Current applications include patient consent forms recorded with timestamps and non-repudiation, treatment agreements with full version histories, and billing claims linked to verified documents — a structure that targets the $68 billion in annual U.S. healthcare fraud driven largely by billing manipulation. Implementation requires AES-256 encryption before data touches the blockchain, role-scoped access configured to the minimum necessary standard, a Business Associate Agreement executed prior to launch, and quarterly audits covering activity logs, smart contract behavior, and access permissions. Source: Vocal Media

Regulatory Compliance & Accessibility

• HHS has extended its Section 504 digital accessibility compliance deadlines to May 11, 2027, for entities with 15 or more employees, and May 10, 2028, for those with fewer than 15 employees, aligning with DOJ mandates. The rule, published May 9, 2024, covers any entity receiving federal financial assistance from HHS — including hospitals, clinics, insurers, and long-term care providers — and requires that websites, mobile apps, patient portals, third-party platforms, and kiosks conform to WCAG 2.1, Level A and AA standards. Covered entities bear responsibility for third-party digital tools operating on their behalf, such as telehealth platforms, appointment schedulers, and payment portals. Noncompliance can result in loss of federal funding, HHS Office for Civil Rights enforcement, or private litigation under Section 504’s private right of action. Limited exceptions apply to archived content, pre-existing electronic documents not in active use, user-uploaded public forum content, individualized password-protected records, and social media posts predating the compliance deadline. Source: Healthcare Law Insights

Employment & Labor

• ViaQuest Residential Services agreed to pay $975,000 to settle a federal lawsuit alleging it misclassified home health Program Managers as overtime-exempt under the Fair Labor Standards Act. Kenneth Simmons filed suit in January 2023, arguing that Program Managers spent the bulk of their time on direct patient care rather than managerial duties, making them nonexempt regardless of their titles; 106 current and former Program Managers ultimately joined the case. Under the FLSA, white-collar exemptions require that an employee’s primary duty be executive or administrative in nature — job titles and written job descriptions are not dispositive. Healthcare employers face heightened exposure because supervisory employees in that sector routinely perform both managerial and patient-facing tasks, and a misclassification applied uniformly across a role can affect every employee holding that position. Periodic classification reviews measured against the FLSA’s primary duty test, conducted with counsel, can identify misclassification before it produces collective or class action liability. Source: Sheppard

Health Technology & Innovation

• Robotic telesurgery is moving toward mainstream adoption, backed by $41 million in funding and a planned 2027 launch by startup Sovato, which aims to connect urban surgeons with rural patients via remote robotic systems. Sovato, founded in 2022 and backed by Intuitive Surgical and Teladoc Health, plans to deploy its platform through health system partners in early 2027, using AT&T’s Wavelength network to minimize lag and avoid the public internet. A June 2025 roadmap published in the World Journal of Surgery established network, cybersecurity, and infrastructure standards for remote robotic-assisted procedures. A barrier to adoption is cost: rural hospitals would need their own robotic surgical systems, and Intuitive’s da Vinci system runs between $600,000 and $3.1 million, plus $95,000 to $225,000 in annual service fees. Surgeon shortages and burnout further complicate the model, as expanding remote surgical volume adds demands on a workforce already under strain. Source: Healthcare Brew

Fraud, Abuse & False Claims Enforcement

• The Justice Department’s Civil Division launched the FOCUS (Fraud Oversight through Careful Use of Statistics) initiative to formalize its relationship with data miners filing qui tam complaints under the False Claims Act. Qui tam filings have surged in recent years, driven increasingly by data miners — companies or individuals who analyze public government data for fraud signals — rather than traditional insider whistleblowers. Under FOCUS, data miners may request pre-filing meetings with the Civil Fraud Section to present their methodologies and demonstrate how their data signals correlate to fraud, though such meetings are not required before filing. The Department will prioritize cases from data miners who show pre-filing diligence, knowledge of program rules, and legally sound allegations. Source: U.S. Department of Justice
• The HHS Office of Inspector General recently determined that a management services organization owning and operating a clinical laboratory serving affiliated urgent care centers does not violate the federal Anti-Kickback Statute, provided no remuneration flows between the laboratory and referral sources. The arrangement reviewed involved an MSO affiliated with four urgent care centers that proposed to own an offsite laboratory through a separate legal entity, with the laboratory billing payors directly, provider compensation unlinked to test volume, and patients receiving written notice of the affiliation along with the option to use an unaffiliated laboratory. The OIG conditioned its approval on the absence of any direct or indirect remuneration between the laboratory and the urgent care centers and on the EHR system permitting orders to multiple laboratories without preference. The opinion warns that similar arrangements involving payments to referral sources — including sham consulting deals, sham investment opportunities, or free personnel or equipment — would implicate the AKS and “would not be low risk.” Even where AKS risk is avoided, such arrangements may still implicate the Stark Law, state analogues, or the Ending Kickbacks in Recovery Act of 2018, which bars referral payments for laboratory services regardless of payor. Source: McDermott Will & Emery

Medicare Reimbursement & Coverage

• CMS and FDA have created a joint coverage pathway that compresses Medicare national coverage decisions for Breakthrough Devices from over a year to as little as two months after FDA market authorization. The Regulatory Alignment for Predictable and Immediate Device (RAPID) pathway applies to certain FDA-designated Class II and Class III Breakthrough Devices that address unmet medical needs among Medicare beneficiaries, requiring that eligible devices be the subject of an Investigational Device Exemption (IDE) study enrolling Medicare beneficiaries with clinical outcomes agreed upon by both agencies. Under the pathway, CMS will issue a proposed National Coverage Determination (NCD) on the same day an eligible device receives FDA market authorization, triggering a 30-day public comment period. The Transitional Coverage for Emerging Technologies (TCET) pathway will be paused for new candidates while CMS implements RAPID. A proposed procedural notice will be published in the Federal Register with a 60-day public comment period before a final notice takes effect. Source: CMS
• The 2026 Medicare Physician Fee Schedule restructures physician reimbursement through three changes that directly affect how physician productivity is measured and compensated. CMS finalized an efficiency adjustment that reduces work relative value units (wRVUs) for 91% of physician services, targeting non-time-based procedural codes while leaving evaluation and management services unchanged, meaning procedural specialists will see lower reported wRVU productivity even if clinical volume holds steady. CMS also overhauled practice expense methodology by cutting indirect practice expense allocated per wRVU by 50% for facility-based services — rejecting the AMA’s updated survey data on methodological grounds — shifting reimbursement toward office-based settings on a budget-neutral basis to advance site neutrality. For the first time since the MPFS was established in 1992, CMS implemented two separate conversion factors, one for providers participating in Advanced Alternative Payment Models and one for those who are not, requiring organizations with mixed provider populations to maintain separate revenue forecasts and clarify which conversion factor governs percentage-of-Medicare contracts. Compensation rates, productivity thresholds, salary guarantees, and professional services agreements tied to wRVUs should be recalculated to reflect these changes. Source: VMG Health

Privacy, Cybersecurity & Data Breaches

• The HIPAA Security Rule is set for its most significant update in over a decade, with changes expected to be finalized in 2026 and a compliance window as short as 60 days once the rule takes effect. The updates eliminate the longstanding “addressable” safeguard category, converting previously optional measures — including encryption, multi-factor authentication, asset inventories, and network mapping — into requirements. Organizations must document where electronic protected health information (ePHI) exists, who can access it, and how it is protected and recoverable following a breach. The rule applies to all covered entities and business associates regardless of size, placing the same expectations on small and mid-sized practices as on large health systems. To prepare, organizations should conduct a risk analysis, document current policies and safeguards, close gaps in access controls and data protection, and build a compliance roadmap. Source: Healthcare Dive
• Nine of the ten largest publicly traded US health companies have advertising and analytics trackers installed on login and registration pages, transmitting patient data to vendors including Meta, Google, LinkedIn, and TikTok without patients’ knowledge or consent. About 15% of health websites examined could capture exact keystrokes on login pages, exposing Social Security numbers, passwords, appointment times, billing details, and medical diagnoses to third parties. A 2023 joint warning from the Office for Civil Rights and the FTC to roughly 130 hospitals and telehealth providers failed to produce change, and a June 2024 federal court ruling in Texas — which found that HHS had exceeded its authority in extending HIPAA to unauthenticated webpage tracking — further weakened the regulatory path to enforcement. Once patient data leaves a hospital’s domain, the hospital has limited control over it, and the chain of resale through the programmatic advertising ecosystem is opaque enough that even the original tracker vendor cannot fully account for where it ends up. No regulatory action, class-action settlement, or reputational consequence has yet proven sufficient to change standard practice, leaving the use of an ad-blocker and a privacy-focused browser as the default protection for a category of data that federal statute treats as protected. Source: The Next Web
• Phishing accounted for more than one-third of all unauthorized network access incidents in Q1 2026, making it the leading method of network intrusion. State-sponsored and criminal actors are using large language models to develop phishing lures, write malicious scripts, and evade detection — all without writing code. Health care and government sectors are the primary targets of these AI-assisted campaigns. To reduce exposure, organizations should implement properly configured multi-factor authentication, conduct patch management, and establish centralized logging across their environments. Source: Data Privacy + Cybersecurity Insider
• Integrated Pain Associates, a Killeen, Texas-based pain and spine practice, disclosed a data breach involving unauthorized network access on or around February 24, 2026. The incident was identified in February 2026 and announced on April 30, 2026. Data involved includes names, addresses, dates of birth, driver’s license numbers, Social Security numbers, diagnosis and medication information, health insurance information, provider names, treatment information, and financial account information. The organization is offering credit monitoring and identity theft protection services to affected individuals. The breach has not yet appeared on the Office of the Texas Attorney General website or the HHS Office for Civil Rights breach portal. Source: HIPAA Journal

Private Equity & Healthcare Transactions

• A wave of state laws is tightening oversight of private equity investment in healthcare, filling a void left by federal inaction. Oregon’s SB 951, effective June 9, 2025, restricts management services organization (MSO) and PE control of healthcare practices and voids certain restrictive covenants, while California’s AB 1415 and SB 351, effective January 1, 2026, expand transaction notice requirements to include private equity firms and hedge funds and codify corporate practice of medicine limits on unlicensed entity influence over licensed healthcare professionals. Rhode Island enacted a pre-merger notification rule requiring 60 days’ advance notice of material changes in medical practice groups with fines up to $100,000 for noncompliance, and Washington signed legislation on March 25, 2026 expanding reporting and pre- and post-closing notification requirements for healthcare entity control changes. Indiana, New York, Hawaii, Vermont, Pennsylvania, and Illinois have each introduced or advanced legislation in 2026 requiring greater ownership disclosure, post-closing reporting, or advance notice for material healthcare transactions. States are also adopting “mini-HSR” laws requiring Hart-Scott-Rodino filings to be submitted to state attorneys general, broadening antitrust oversight of healthcare-related mergers at the state level. Source: Paul Hastings LLP

Drug & Pharmacy Regulation

• Most compounded peptides being marketed to wellness and chiropractic practices today fall outside the legal pathways that federal law requires for lawful compounding, and practitioners who add them to their service offerings carry the legal risk themselves. Under Section 503A of the Federal Food, Drug, and Cosmetic Act, a bulk drug substance can only be legally compounded if it appears on the final 503A bulks list, holds Category 1 interim status, is a component of an FDA-approved drug, or has a USP or NF monograph — and as of April 2026, none of the popular compounded peptides, including BPC-157, TB-500, CJC-1295, ipamorelin, and melanotan II, meet any of those criteria. The FDA removed twelve of those substances from Category 2 and referred them to the Pharmacy Compounding Advisory Committee on April 15, 2026, but that referral is a procedural step, not an authorization, and pharmacies that compound them remain subject to enforcement. The DOJ reinforced that exposure on April 1, 2026, when it indicted a Utah physician for selling misbranded peptides to more than 200 patients, placing the prescribing provider — not just the pharmacy — inside the criminal liability chain. In Texas, chiropractors face additional layers of risk from turnkey vendor platforms, including fee-splitting violations under the Texas Patient Solicitation Act, unlicensed pharmacy operations if peptides are stored on-site, scope-of-practice violations under the Texas Chiropractic Practice Act, and malpractice coverage gaps because peptide therapy falls outside the scope chiropractic policies are written to cover. Source: Healthcare Empowered
• Rescheduling marijuana from Schedule I to Schedule III eliminates the Section 280E tax penalty for state-licensed medical cannabis operators, cutting effective federal tax rates from over 70% down to the standard 21% corporate rate. Section 280E bars all ordinary business deductions for trafficking in Schedule I or II controlled substances but does not mention Schedule III, so the rescheduling order — effective April 22, 2026 — removes the penalty by its own statutory terms for qualifying medical operators. Treasury’s transition rule treats the relief as applying to the full 2026 calendar year, meaning medical operators can deduct wages, rent, utilities, and all other operating expenses for the entire year without mid-year allocation. Adult-use operators receive no relief; 280E remains fully in effect for recreational marijuana, and a separate rescheduling hearing beginning June 29 is the only near-term path to change that. Retroactive relief for prior tax years (roughly 2022–2025) is unresolved — the DOJ order encourages Treasury to consider it, but Treasury has made no commitment, leaving more than $1.6 billion in disputed 280E positions industry-wide, including approximately $445 million carried by Trulieve alone, in limbo pending further guidance. Source: Budding Trends

Congressional Oversight

• The healthcare sector faces bipartisan congressional investigations that will persist regardless of the 2026 midterm outcomes, with affordability serving as the unifying thread across inquiries into drug pricing, pharmacy benefit managers, group purchasing organizations, hospital consolidation, private equity ownership, Medicare Advantage, and prior authorization practices. Republican committee chairs have already pursued investigations through hearings, information requests, and subpoenas targeting GPOs, PBMs, ACA plans, healthcare fraud, insurance costs, data breaches, and hospital systems. If Democrats gain a majority in either chamber, investigations would expand to include conflicts of interest among Trump Administration appointees, pharmaceutical manufacturer negotiations over most-favored-nation pricing arrangements such as the GLOBE and GUARD models, and AI-driven algorithmic decision-making in care denial. Democratic staff have begun issuing document retention letters and engaging watchdog groups ahead of any majority, signaling that private-sector actors — not just the executive branch — are the near-term focus. Congressional inquiries in healthcare carry compounded risk because they routinely run parallel to state attorney general actions and plaintiffs’ bar litigation. Source: Holland & Knight