Medicaid & Reimbursement
- Nearly $12 billion in Medicaid supplemental funding to Texas hospitals will be restored, ending a year-long impasse between Texas and the federal government. Gov. Greg Abbott announced the restoration on September 17, 2026, and said the funding covers hospitals, physicians, rural clinics, nursing facilities, and behavioral health providers. The Centers for Medicare and Medicaid Services halted the funds on September 1, the start of the state fiscal year, the first stoppage since the supplemental funding began in 2014, and Texas hospitals were slated to lose $27 million a day. The dispute began late last year over how Texas raises more than $4.2 billion in taxes to draw the federal funds, which close the gap between Medicaid reimbursement and hospitals’ costs of treating low-income patients. It was not immediately clear when the funds would be transferred. Source: The Texas Tribune
Fraud & Abuse Enforcement
- Veloxis Pharmaceuticals agreed to pay more than $46 million to resolve criminal and civil allegations that it paid kickbacks to health care professionals to drive prescriptions of a brand-name immunosuppression drug over a generic. The settlement includes a $1.55 million civil penalty for knowingly failing to report payments to health care professionals under the federal Open Payments Program, the largest penalty imposed under the Physician Payments Sunshine Act. The Department of Justice alleged Veloxis provided meals, alcohol, gifts, flights, and hotel stays at resorts to transplant surgeons, nephrologists, pharmacists, a hospital administrator, and spouses in exchange for recommending or prescribing Envarsus XR, and made payments under consulting agreements for work that was not performed. The government further alleged Veloxis violated the civil False Claims Act by causing hospitals and pharmacies to submit claims tainted by the kickbacks, and falsified records to avoid its Sunshine Act reporting obligations. A knowing failure to report carries a penalty of up to $140,674 per instance in 2026, capped at $1,406,728, while an unintentional failure carries up to $14,067 per instance, capped at $211,008. Source: Epstein Becker Green
- A Willis, Texas clinic owner was sentenced to 30 months in federal prison and ordered to pay more than $49 million in restitution for conspiring to pay and receive health care kickbacks. Henry Allen Gonzales, 53, owned Option 1 Pain & Rehab Clinic, formerly Direct Medical Clinic, and received more than $2 million in kickbacks from Rayford ACP Pharmacy in exchange for referring prescriptions for compounded medications. He admitted paying marketers to refer Department of Labor Office of Workers’ Compensation Programs claimants to his clinic and bribing physicians to sign prescriptions for those medications. After the Rayford ACP arrangement ended he opened Farmacia and continued billing DOL-OWCP; from 2015 to 2018 the two pharmacies received approximately $49,014,183 in DOL-OWCP claims involving medically unnecessary compounded medications. Chief U.S. District Judge Charles Eskridge imposed the sentence, to be followed by one year of supervised release, and ordered restitution to DOL-OWCP; Gonzales pleaded guilty on June 30, 2022, and remains on bond pending voluntary surrender. Source: U.S. Department of Justice
Medicare Program Integrity
- HHS-OIG found that gaps in the screening of out-of-network durable medical equipment suppliers expose the Medicare Advantage program to fraud, and recommended that CMS require every DMEPOS supplier billing Medicare Advantage to enroll in Medicare. OIG examined six MA organizations covering roughly two-thirds of MA enrollees and managing more than 21,000 durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) suppliers, about 8,000 of which billed in-network and 13,000 of which always billed out-of-network. MA organizations must verify that in-network suppliers hold any required state license, are accredited or meet the organization’s standards, and are not on the CMS Preclusion List or excluded by OIG, while out-of-network suppliers need only be checked against the Preclusion List; three of the six organizations said they check state licensure for out-of-network suppliers. The average amount billed per enrollee for orthotics was $210 for in-network suppliers and $1,399 for out-of-network suppliers not enrolled in Medicare, and CMS staff reported that a supplier can incorporate and obtain a National Provider Identifier within days and begin billing MA organizations almost immediately. OIG recommended that MA organizations strengthen their checks of out-of-network suppliers and their use of the Preclusion List, and that CMS seek statutory authority to require Medicare enrollment if current law does not permit it; CMS concurred with all recommendations. Source: The HIPAA Journal
- An OIG audit estimated that Methodist Hospital received at least $12.4 million in net Medicare overpayments for inpatient and outpatient services during calendar years 2020 and 2021. OIG reviewed 100 inpatient and outpatient claims totaling $1,426,020 and found that the hospital complied with Medicare billing requirements on 73, with the remaining 27 producing net overpayments of $256,926. The $12.4 million figure extrapolates from that sample against the $62 million Medicare paid the hospital for the selected high-risk service types during the audit period. OIG attributed the errors primarily to the hospital’s failure to follow its own written policies and procedures for preventing incorrect billing in the risk areas at issue. OIG recommended that the hospital refund the $12.4 million, conduct internal audits of claims after the audit period, and provide additional billing training; the hospital did not concur with the first two recommendations and said it is willing to conduct education. Source: HHS Office of Inspector General
Compounded Drugs & Product Safety
- Centric Compounding recalled six lots of injectable Glutathione, Myer’s Cocktail, and Tri-Immune Boost to the consumer level after the products were compounded with a Glutathione active pharmaceutical ingredient containing elevated endotoxin levels. The Houston compounder announced the nationwide recall on September 9, 2026, and FDA published it on September 13, 2026. Injectable products with elevated endotoxin levels carry a reasonable probability of causing fevers, hypotension, inflammatory reactions, anaphylactic shock, and death, and the company has received nine reports of fever, chills, chest pain, nausea or vomiting, headache, or malaise. The recalled products are 30 mL multidose vials marketed to support immunity, fatigue, and general wellness, distributed nationwide to patients by home delivery and to prescribers. Centric Compounding is notifying distributors and customers by email and arranging replacement, and consumers holding affected vials should stop using them and discard them. Source: FDA
HIPAA & Data Breaches
- zHealth, a cloud-based practice management and electronic health records software provider, disclosed a breach affecting 118,563 individuals. The company learned that information may have been copied around June 15, 2026, and its investigation confirmed that an unauthorized third party accessed its network between January 20 and January 21, 2026; the data review finished September 3, 2026, and the affected information may include names, medical information, and health insurance information. Bridgeway Benefit Technologies, a third-party health plan administrator, notified the HHS Office for Civil Rights of a breach affecting 9,268 individuals after an employee email account was accessed between March 5 and May 19, 2026, exposing data that includes Social Security numbers. Longview ER Operations, doing business as Hospitality Health ER, identified suspicious network activity on July 22, 2026, and confirmed that an unauthorized third party copied files from its Longview, Texas network; its Tyler and Galveston facilities were unaffected, and it reported an estimate of at least 501 individuals to OCR. HealthStream notified the Massachusetts Attorney General of an incident that its July 29, 2026 Form 8-K describes as unauthorized access to corporate file servers involving employee data, customer and vendor billing data, and legal information, affecting around 75 credentialing customers and not protected health information. Source: The HIPAA Journal
Transactions & Private Equity
- Private equity sponsors may exit physician practice management platforms by selling regional clusters to health systems rather than selling the platform as a whole. Around 2010 private equity built regional and national urgent care platforms through acquisition, and several were later sold in pieces: in 2025 Ardent Health acquired 18 NextCare centers across Oklahoma and New Mexico, and Bon Secours Mercy Health absorbed 10 Greater Midwest Urgent Care locations in Ohio. Health systems buy where assets strengthen existing service areas, fill network or geographic gaps, or keep competitors out, so a practice inside a system’s own market carries more value to that buyer than the same practice does as one component of a national platform. Site-based, referral-driven, density-sensitive practices separate into regional lots most readily, while platforms built around shared ancillaries, ambulatory surgery center economics, or hospital call coverage lose value when divided. Disentangling a regional cluster from an existing professional corporation/management services organization (PC-MSO) structure raises questions about payer contracts and non-competes, and corporate-practice-of-medicine restrictions add constraints for nonprofit health system buyers. Source: VMG Health
