Wade’s Health Law Highlights for September 8, 2026

Medicaid & Federal Funding

• Texas hospitals began losing $27 million a day in Medicaid funding on September 1 after CMS withheld approval of about $9.8 billion tied to the Comprehensive Hospital Increase Reimbursement Program. CHIRP matches roughly $4 billion a year in local hospital taxes with federal dollars to cover the gap between Medicaid rates and the cost of care, and CMS is questioning how Texas jurisdictions calculate those taxes. Harris Health estimates a loss of at least $258 million, the Houston region as much as $1.4 billion, and the state projects the 2027 shortfall could reach $12 billion. Gov. Greg Abbott wrote HHS Secretary Robert F. Kennedy Jr. on August 7 stating that the tax structure complies with federal law and that Texas would not restructure it without a guarantee against future penalties. The Texas Hospital Association said even a prompt approval would leave a claims backlog taking at least 90 days to clear. Source: The Texas Tribune
• A Boston University study estimates 20% of Medicaid-eligible adults in expansion states, as many as 10 million people, are at risk of losing coverage under the national work requirements that take effect January 1. The study, published in JAMA Health Forum, analyzed 2023 to 2025 Current Population Survey data on adults ages 18 to 65. About two-thirds of applicable enrollees were in the labor force, and 85% of those working averaged more than 35 hours a week. Still, 13.6% of eligible recipients sat close to the 80-hour monthly threshold and 7.6% had inconsistent hours, driven by low-wage jobs in retail, hospitality, food service, health care, and agriculture. Women had a 22% higher chance of insufficient or inconsistent hours than men, and married couples an 18% lower risk than unmarried individuals. Source: Fierce Healthcare
• The Trump administration announced Medicaid most-favored-nation drug pricing agreements with nine midsize drugmakers bringing the total to 26 companies. Alcon, Astellas, BeOne Medicines, BridgeBio, CSL, Kyowa Kirin, Sun Pharma, Teva, and UCB agreed to charge state Medicaid programs the same prices for certain outpatient drugs that they charge foreign countries, and to list the drugs on the TrumpRx website. In exchange the companies are exempt from most-favored-nation pricing in Medicare and receive protection from pharmaceutical tariffs, and the White House said they committed at least $19.6 billion to U.S. manufacturing. The administration projects $64.3 billion in federal and state savings over ten years, though the agreement terms remain confidential and Medicaid already receives the lowest price offered to any commercial payer. No drug has yet launched in the U.S. under a most-favored-nation agreement. Source: The Hill

Fraud & Abuse & Qui Tam Enforcement

• The Eleventh Circuit reversed the only federal ruling striking down the False Claims Act’s qui tam provisions, holding that relators are not “officers of the United States” under the Appointments Clause. In United States ex rel. Zafirov v. Florida Medical Associates, LLC, No. 24-13581, the court found that a relator does not occupy a “continuing position established by law” because the role is personal to one case, ends when the suit ends, and carries no government salary, only a contingent share of any recovery. The panel rejected the district court’s characterization of an “office of the relator” created by the statute. The case returns to the Middle District of Florida to address the defendants’ remaining Vesting Clause and Take Care Clause arguments, which the district court never reached. A related appeal is pending in the First Circuit, two Fifth Circuit judges have urged reconsideration of the qui tam mechanism. Source: Ropes & Gray

Data Breaches & Cybersecurity

• McKesson confirmed a cybersecurity incident involving third-party applications after the extortion group ShinyHunters claimed to have taken data on more than 284 million patient records. In an SEC filing the company said it discovered the incident on August 25, and in a later update confirmed hackers exfiltrated data tied to a subset of customers in its Oncology & Multispecialty and Medical-Surgical business units. McKesson said distribution centers remain operational and that it has “reasonable assurance” of no ongoing unauthorized activity, but it has not identified the data types, the number of people affected, or the attacker. ShinyHunters claims the data includes names, addresses, Social Security numbers, patient IDs, diagnoses, prescriptions, and billing records, and is demanding about $55 million with a September 1 deadline. The company said it will offer credit monitoring and identity protection to affected patients. Source: Fierce Healthcare
• Resource Center of Dallas is notifying 12,490 people that an unauthorized party accessed its network between February 4 and February 12, 2026, and removed files containing personal and protected health information. The LGBTQIA+ health and advocacy provider completed its data review around July 2 and found names, dates of birth, medical information, health insurance information, financial account information, and for some individuals Social Security numbers. Integrative Emergency Services, a Dallas emergency medicine group, separately notified 2,009 patients that an employee email account was accessed for four hours on June 16. Houston-based Psychiatry of Texas, doing business as PsychPlus, reported a March 31 intrusion affecting 4,565 patients whose files included Social Security numbers, diagnoses, passwords, and parents’ premarital surnames. Kern Psychiatric Health and Wellness Center in California and Philadelphia’s The Asthma Center announced breaches in the same period. Source: The HIPAA Journal

HIPAA & Data Privacy

• State consumer health data laws now reach entities and data outside HIPAA, and Texas is among the states that exempt covered entities and business associates at the entity level. Washington’s My Health My Data Act, Nevada’s SB 370, and California’s CMIA and CCPA/CPRA regulate consumer health data from apps, wearables, and wellness platforms, and Washington’s law includes a private right of action and geofencing limits around health facilities. Nineteen states, including Texas, treat health data as sensitive data under comprehensive privacy laws, with Alabama, Louisiana, Oklahoma, and Vermont laws taking effect in 2027 and 2028. Most of those states, Texas included, require opt-in consent before processing health data, while Iowa and Utah require only notice and an opt-out. Seven states, including California, Colorado, and Oregon, exempt only PHI itself rather than the covered entity, so a hospital’s marketing website or wellness app data remains subject to state law there. Source: Nixon Peabody
• A Pew Research Center survey of almost 5,000 U.S. adults found 72% consider it extremely or very important that their health care providers disclose when AI tools are used in their care. Concern was highest for AI making diagnostic decisions (81%), analyzing medical scans (81%), explaining test results (80%), and taking notes during appointments (72%), and a majority also wanted disclosure of AI handling prescription refills (64%) and scheduling (56%). Forty-six percent of respondents did not know whether their providers use AI, and only 16% said a doctor had told them AI was used in their care. Thirty-three percent believed their providers do not use AI, while ONC data show 71% of hospitals used AI tools in 2024. More than half (53%) said they have no say or not much say in how AI is used, and 63% want more. Source: The HIPAA Journal

FDA & Drugs

• CMS said 600,000 seniors enrolled in GLP-1 weight loss medications during the first two months of the Medicare Bridge program. The program launched in July and makes obesity medications available to qualifying older Americans for $50 a month. Oz announced the figure on August 31. Source: Reuters
• Novo Nordisk expects an FDA decision on CagriSema in the fourth quarter of 2026, and Eli Lilly plans to submit retatrutide for approval in the first quarter of 2027. CagriSema combines semaglutide with cagrilintide, an amylin analog, and Novo filed for obesity approval in December 2025 after trial results showed it outperformed semaglutide alone in diabetic patients but fell short of Zepbound for weight loss. Retatrutide activates GLP-1, GIP, and glucagon receptors, and Phase 3 data show patients on the highest dose lost an average of 28.3% of body weight over 80 weeks. Lilly intends to classify retatrutide as a biologic, which would bar compounders from making copies, and has already sued six companies compounding the unapproved drug, though FDA has disagreed with Lilly on whether it meets the biologic definition. Novo’s Wegovy pill recorded 137,000 prescriptions in its eighteenth week on the market against just under 39,000 for Lilly’s Foundayo pill at the same point. Source: Healthcare Brew
• FDA said it may refuse clinical trial data it cannot inspect and is expanding foreign Bioresearch Monitoring inspections, including of Phase 1 and early-stage trials. The heads of CDER, CBER, CDRH, and the Oncology Center of Excellence wrote that the agency has been denied access to some foreign trial sites or told inspections would require agreements limiting their scope or attesting to unrelated geopolitical principles. Under 21 CFR 312.120, foreign studies not conducted under an IND or IDE may support a U.S. application only if conducted under Good Clinical Practice with independent ethics review and informed consent. The agency will update its risk-based site selection criteria to reflect country-specific compliance risk, communicate to sponsors and the public when sites were unavailable for inspection, and train reviewers to flag consent and data integrity concerns. Where falsified or duplicated data are found, FDA said it can exclude the data and deny, withhold, or rescind a marketing authorization. Source: FDA
• Northern District of Texas court stayed the Texas and Florida lawsuit seeking to revoke FDA’s 2000 approval of mifepristone until December 1 or the end of FDA’s safety review, whichever comes first. The Department of Justice requested the delay and both states agreed. The suit argues FDA did not properly evaluate the drug’s safety and effectiveness and invokes the Comstock Act of 1873 against mailing abortion medication. In the same order O’Connor denied a motion to dismiss by generic manufacturer GenBioPro and distributor Danco Labs. Two other cases are pending: the Fifth Circuit hears argument September 9 in Louisiana’s challenge to telehealth and mail prescribing of mifepristone, and Missouri, Kansas, and Idaho are seeking in the Eastern District of Missouri to restore the pre-2016 seven-week limit and in-person visit requirements. Source: The Hill
• The FDA warned four peptide sellers that a “research use only” label does not keep semaglutide, tirzepatide, and retatrutide off the unapproved new drug list. CDER’s Office of Unapproved Drugs and Labeling Compliance reviewed the websites of TXP Innovations dba Tex Peptides, Royal Peptides, NuScience Peptides, and Peptide Partners in July 2026 and found product pages describing weight loss, glucose control, mitochondrial repair, and sexual function. Those claims make the products drugs under section 201(g)(1) of the FD&C Act, and because none is generally recognized as safe and effective, selling them violates sections 301(d) and 505(a). FDA also classified the bacteriostatic water each firm sold as a drug, reasoning that offering a solvent alongside injectable peptides shows the seller intends the combination for injection, and it cited dosing calculators and peptide guides as further evidence of intended human use. Each firm has fifteen business days to respond, and FDA identified seizure and injunction as available next steps. Source: FDA

Transactions & Corporate Practice

• Private equity hold periods for physician practice management platforms are stretching past the three-to-five-year model as sponsor-to-sponsor exits become harder to execute. VMG Health attributes the shift to state and federal scrutiny of transactions involving management services organizations, including expanded pre-close notice and review in New York and Minnesota and California’s January 2026 oversight of private equity in medicine, along with interest rates that remain above the 2020 to 2021 levels. Sponsors are turning to alternative liquidity structures that return capital while extending the hold, and to strategic buyers in three categories: distributors and supply chain acquirers, payers and payer-aligned platforms, and health systems. VMG points to urgent care, where private equity built regional platforms and health systems became the strategic buyer, as the likely template for physician practice exits. Source: VMG Health
• Cash-pay medical spas remain subject to corporate practice of medicine, fee-splitting, medical board supervision, anti-kickback, HIPAA, pharmacy, and TCPA rules, and private equity buyers price compliance gaps into deals. Violating a state corporate practice doctrine can void contracts, cost the collaborating physician a license, and carry civil or criminal liability, and management fees set as a percentage of revenue or compensation tied to procedure volume can violate state fee-splitting laws. State boards treat a rented physician license, where the doctor rarely visits, as an enforcement target, and a Botox injection by an RN without proper oversight can constitute unlicensed practice in some states. The federal Anti-Kickback Statute applies if any federal program patient is treated, and Ohio and Illinois have all-payor kickback statutes. Investors examine whether the professional entity model is compliant in every state, whether management services agreements reflect fair market value, and whether medical director involvement is documented in chart reviews and supervision protocols. Source: Benesch