Category: Article

Categories
Article

Before You Add Peptides to Your Practice

Peptide therapy has moved from elite biohacker circles into mainstream wellness offerings, and the marketing pitches arriving in your inbox suggest the legal questions are settled. They are not.

Most of the peptides being sold by wellness clinics today cannot be legally compounded in the United States, and the practitioners who add them to their service menu are taking on more legal risk than they realize.

Vendors like to say their peptides are “on the bulks list.” That phrase is doing a lot of work, and most of what it appears to promise is not actually what it delivers. Federal compounding law treats only a narrow set of bulk drug substances as eligible for legal compounding, and very few of the peptides driving today’s demand  make the cut.

This article walks through three things in order. First, what federal law actually requires before a pharmacy can compound with a bulk peptide, and what the term “bulks list” actually means. Second, how the regulatory status of the popular compounded peptides has shifted in the last few years and where things stand after FDA’s April 15, 2026 actions. Third, what additional state-law and standard-of-care obligations attach even when a peptide can be lawfully compounded, and how those obligations should shape your evaluation of the vendor platforms now being marketed to practitioners.

How federal compounding works

Pharmacy compounding lives under two parallel exemptions in the Federal Food, Drug, and Cosmetic Act. Both were added by the Food and Drug Administration Modernization Act of 1997 and substantively updated by the Drug Quality and Security Act of 2013.

Section 503A is the pathway for traditional compounding pharmacies that prepare drugs for individual patients pursuant to a valid prescription. When the conditions of Section 503A are met, the compounded drug skips three federal requirements that would otherwise apply: premarket approval, current good manufacturing practice (cGMP), and adequate-directions-for-use labeling.

Section 503B is the pathway for “outsourcing facilities” that compound without patient-specific prescriptions and supply provider offices in bulk. Outsourcing facilities have to register with FDA, follow cGMP, report adverse events, and submit to FDA inspection. Section 503B has its own bulk drug substance list, separate from the Section 503A list.

Almost all peptide compounding for outpatient injection runs through Section 503A. The rest of this article focuses on that pathway, although the same logic applies to outsourcing facilities.

The three ways to qualify for legal compounding under 503A

Compounding under Section 503A is permitted only when the bulk drug substance used in the compound clears one of three gates. The gates are hierarchical. The statute lists them in order, and each one is reached only if the prior one is unavailable.

The first gate is a USP or NF monograph. If the substance has a monograph in the United States Pharmacopeia or the National Formulary, the pharmacy must comply with that monograph and with the USP chapter on pharmacy compounding. Few peptides have monographs.

The second gate is the FDA-approved drug pathway. If no monograph exists, the substance can still qualify if it is a component of an FDA-approved drug, even if the brand has been discontinued. Gonadorelin is the textbook example. It was approved as LutrePulse, the brand has been off the market for years, but gonadorelin remains compoundable because it is a component of an approved drug.

The third gate is the 503A bulks list. If no monograph exists and the substance is not a component of an approved drug, the substance has to appear on the FDA-approved 503A bulks list. This is the catch-all, and it is the gate the popular compounded peptides try to use, because the typical compounded peptide has no monograph and is not a component of an approved drug.

A peptide that fails all three gates falls outside Section 503A and cannot be compounded. It is treated like any other unapproved drug under federal law, with all of the misbranding and unapproved-new-drug exposure that goes with that classification.

What “the bulks list” actually means

This is where the marketing language and the legal reality come apart. When a vendor or a pharmacy tells you a peptide is “on the bulks list,” that phrase is covering two very different things, plus a third pipeline that is sometimes mistaken for either of the first two.

The final 503A bulks list

The first list is the real one. FDA develops the final 503A bulks list by regulation, after notice and public comment, under Section 503A’s bulks list authority. Substances on the final list have completed FDA’s review against the statutory criteria and have been formally added through rule-making. Inclusion on the final list is the affirmative legal authorization to compound. As of April 2026, the final list contains only a small number of substances, and none of the popular peptides are on it.

Category 1 of the interim list

The second list is Category 1 of the interim bulks list. While FDA grinds through nominations, the agency has been running an interim system through enforcement-discretion guidance. The framework was first formalized in FDA’s 2017 guidance on bulk drug substances and was updated effective January 7, 2025.

Category 1 lists substances that, after FDA’s preliminary look, “may be eligible for inclusion on the 503A bulks list.” For Category 1 substances, FDA has said it does not intend to take enforcement action against 503A pharmacies that compound with the substance, as long as the other Section 503A conditions are met. That is enforcement discretion, not statutory authorization. It is a regulatory commitment not to prosecute pending the formal review.

This is the point to keep in mind: Lawful compounding under “the bulks list” pathway requires inclusion on either the final list (statutory authority) or Category 1 (enforcement discretion). When a vendor tells you a peptide is “on the bulks list,” that should mean one of those two states. Everything else falls outside the bulks list framework, even if the substance has been nominated, even if it has been considered, and even if its status was different a year ago.

Category 2 and the off-limits substances

Category 2 of the interim list is the opposite of Category 1. These are substances FDA has reviewed and concluded raise significant safety concerns serious enough that compounding with them is not allowed. Pharmacies that compound with a Category 2 substance are compounding illegally, and may receive warning letters, injunctions, product seizures, and referral for criminal prosecution. Category 2 is FDA’s affirmative position that the substance does not belong on the bulks list and that compounding with it should stop.

The PCAC pipeline

The path from Category 1 (or from any other status) onto the final list runs through a defined process. The Pharmacy Compounding Advisory Committee, or PCAC, is the FDA federal advisory committee that evaluates each nominated substance against FDA’s published criteria and makes a recommendation. After the PCAC recommendation, FDA consults with USP, publishes proposed action in the Federal Register, takes public comment, and makes a final determination. Only after that whole process concludes is a substance formally added to the final list.

Here’s where people get confused or intentionally misdirect. Removal from Category 2 and referral to PCAC is a procedural step, not a green light. It signals that FDA is starting the formal review, not that the agency has decided the substance meets the criteria. PCAC review can produce either a positive recommendation followed by inclusion on the final list, or a negative recommendation followed by exclusion. The typical interval between PCAC review and a final FDA determination runs six to twelve months. Pharmacies that compound with substances that have been referred to PCAC but have not been placed on Category 1 or the final list remain exposed to enforcement during that interval.

How we got here

Contributing to the confusion, the status of the popular compounded peptides on the interim list has changed several times since FDA first asked for nominations in 2014. The history matters for two reasons. Vendor marketing routinely conflates regulatory developments at different points in the timeline, and what is or is not compoundable today depends on where a peptide currently sits, not on where it sat earlier in its history.

2014 through 2017: the original framework

The FDA put out its first call for bulks list nominations in late 2013 and early 2014. Trade associations like the Alliance for Pharmacy Compounding and the Professional Compounding Centers of America, plus a number of individual pharmacies, sent in hundreds of nominations covering peptides, hormones, and a wide range of other substances. By mid-2015, FDA had organized the nominations into a working framework and started publishing public dockets.

The 2017 guidance formalized the Category 1 / Category 2 / Category 3 scheme that had been used informally since 2015. The 2017 guidance was the operative framework until it was replaced in January 2025.

2017 through September 2023: the “stable” years

For roughly six years, the interim list was reasonably steady. Category 1 included sermorelin, NAD+, vasoactive intestinal peptide (VIP), gonadorelin acetate (also independently eligible as a component of an approved drug), and others. A larger group of peptides sat in Category 2 because of safety concerns, and many more remained nominated but unreviewed in Category 3.

Compounding pharmacies routinely supplied Category 1 peptides to practitioners, and the legal posture was understood to be relatively stable. The peptide market built itself around that stability, and a lot of the marketing premises that drive present-day vendor pitches are leftovers from the pre-2023 status quo.

September 2023: the freeze

In September 2023, FDA reclassified nineteen peptides from Category 1 to Category 2. The reclassification swept in a substantial portion of the peptides driving practitioner interest, including BPC-157, thymosin beta-4 (TB-500), CJC-1295, ipamorelin, AOD-9604, melanotan II, epitalon, thymosin alpha-1, and GHK-Cu.

FDA cited three categories of concern. Immunogenicity risk: the patient’s immune system might react against the peptide, including the patient’s own naturally occurring version of the molecule. Manufacturing impurities associated with bulk peptide synthesis: truncated chains, residual reagents, and other byproducts that have not been fully characterized in commercially available bulk peptide preparations. And insufficient human safety data: animal studies and small case series instead of the controlled human trials needed to support therapeutic use.

The September 2023 reclassification did not undo any compounding that had already happened under the prior Category 1 status. It did, however, immediately put any pharmacy that kept using the reclassified substances in the agency’s enforcement crosshairs.

September 2024: a partial reversal that wasn’t a reversal

A year later, the FDA partially walked back its position on five of the September 2023 reclassifications. AOD-9604, CJC-1295, ipamorelin acetate, thymosin alpha-1, and selank acetate were removed from Category 2.

The FDA did not put those five substances back on Category 1. Instead, it placed them in a separate published listing called “Other Bulk Drug Substances That May Present Significant Safety Risks.” That listing does not authorize compounding, and it does not provide enforcement discretion. It is a holding designation for substances on which FDA has stepped back from its Category 2 position but has not adopted a Category 1 position.

Pharmacies that compound with substances on that “Other Significant Safety Risks” list are exposed to enforcement on the same statutory grounds that applied during their Category 2 period. The September 2024 action narrowed the agency’s affirmative safety opposition without expanding the lawful compounding pathway.

January 7, 2025: new guidance closes the front door

Then on January 7, 2025, the FDA changed everything. It issued updated guidance that replaced the 2017 framework. The new guidance kept existing categorizations for substances nominated before the effective date, but made three big changes for everything that comes next.

First, FDA will no longer sort newly nominated bulk drug substances into interim categories. The Category 1 enforcement-discretion pathway is, for new nominees, closed.

Second, pharmacies cannot compound with newly nominated substances unless and until the FDA completes the formal review and adds the substance to the final list. The interim safe harbor is no longer available for substances entering the system after January 7, 2025.

Third, the formal review pathway is the only route forward for new nominees. PCAC review, USP consultation, Federal Register notice and comment, and a statutory determination are required steps before any new substance can be lawfully compounded under the bulks list pathway.

Substances categorized before January 7, 2025 keep their existing status. The September 2023 and September 2024 actions remain in effect, the “Other Significant Safety Risks” listing remains in effect, and Category 1 remains a lawful compounding pathway for the substances already on it.

February 2026: an announcement without publication

In February 2026, the Secretary of Health and Human Services announced publicly that approximately fourteen peptides currently in Category 2 would be restored to Category 1. The substances named in the announcement included BPC-157, DSIP, epitalon, GHK-Cu, GHRP-2, GHRP-6, kisspeptin-10, KPV, LL-37, melanotan II, MOTS-c, PEG-MGF, semax, and thymosin beta.

The announcement, however, was not formalized through publication in the Federal Register or through any corresponding action on the FDA’s interim categorization lists. Until publication happens, the announced reclassification has no operative legal effect. The named substances technically remain in Category 2 (or, for the September 2024 group, on the “Other Significant Safety Risks” list), and pharmacies that compound with them continue to be exposed to the same enforcement risk as before the announcement.

This matters because some vendors and pharmacies are unwisely relying on the announcement. An agency announcement that has not been formalized through rulemaking or guidance does not bind the agency, does not displace existing enforcement positions, and does not give a pharmacy or a prescriber a defense if FDA acts. Treating the February 2026 announcement as binding is assuming a level of certainty that the agency has not provided.

April 15, 2026: twelve peptides referred to PCAC

On April 15, 2026, FDA took its first concrete step partially aligned with the February 2026 announcement. The agency removed twelve peptides from Category 2 and referred them to PCAC for evaluation at the meetings scheduled for July 23 and 24, 2026. The twelve substances are BPC-157, TB-500, GHK-Cu, KPV, epithalon, MOTS-c, MK-677, semax, dihexa, DSIP, LL-37, and melanotan II. The matching public comment docket (FDA-2025-N-6895) closes on July 22, 2026, and a second PCAC meeting is scheduled before the end of February 2027 to consider an additional five peptides.

The April 15 action is a procedural step, not an authorization. The twelve substances have not been added to Category 1 or to the final list. PCAC review is the next step in a process that requires PCAC recommendation, FDA evaluation, USP consultation, Federal Register notice and comment, and a final FDA determination before any of these substances can be lawfully compounded under the bulks list pathway. Pharmacies that compound with the referred substances pending PCAC review and final action are still subject to enforcement.

Where the common compounded peptides actually sit

A practitioner evaluating a peptide offering should be able to answer one threshold question. Is the substance currently on the final 503A bulks list, on Category 1 of the interim list, eligible as a component of an approved drug, or recognized in USP or NF? If the answer is no on all four, the compounding is unauthorized.

Applying that test to the peptides commonly marketed into chiropractic and wellness practices:

Lawfully compoundable through the bulks list pathway (Category 1): Sermorelin (also independently eligible as a component of the approved drug Geref); NAD+; vasoactive intestinal peptide (VIP); gonadorelin acetate (also independently eligible as a component of LutrePulse); and GHK-Cu, but Category 1 status is limited to non-injectable routes of administration. Injectable GHK-Cu is not on Category 1.

Lawfully prescribed through other Section 503A pathways: The FDA-approved peptide drugs themselves, including semaglutide, tirzepatide, liraglutide, leuprolide, octreotide, and many others, when sourced through approved channels, prescribed by an authorized prescriber for an approved or off-label use, and dispensed by a licensed pharmacy.

Not lawfully compoundable today:

  • BPC-157, TB-500, MK-677 (ibutamoren), epithalon, MOTS-c, KPV, semax, dihexa, DSIP, LL-37, and melanotan II. These were removed from Category 2 on April 15, 2026 and referred to PCAC, but they are not yet on Category 1 or the final list.
  • CJC-1295, ipamorelin (and ipamorelin acetate), AOD-9604, thymosin alpha-1, and selank acetate. These are on the “Other Bulk Drug Substances That May Present Significant Safety Risks” list following the September 2024 partial reversal. That listing is not an authorization to compound.
  • GHRP-2, GHRP-6, kisspeptin-10, and PEG-MGF. These were named in the February 2026 announcement but were not in the April 15, 2026 PCAC referral. They technically remain in Category 2.
  • PT-141 (bremelanotide) is FDA-approved as Vyleesi, but compounded versions outside the approved indication and formulation are subject to scrutiny under both the unapproved-new-drug analysis and the FDA’s prohibition on compounding copies of commercially available drugs.

The practical universe of legally compoundable peptides currently being marketed is small. Most everything else in the typical vendor catalog is being compounded outside the lawful pathway.

FDA hasn’t stopped enforcing

A common assumption inside the peptide market is that the political signals from HHS leadership translate into a softer enforcement posture on the ground. Two recent actions indicate otherwise.

In September 2025, FDA issued more than fifty warning letters to compounding pharmacies producing GLP-1 receptor agonists, principally compounded semaglutide and tirzepatide. The warning letter wave came after FDA determined that the brand shortages that had previously supported large-scale GLP-1 compounding were over.

On April 1, 2026, the U.S. Department of Justice indicted Dr. Watkins, a Utah-licensed osteopathic physician, for receiving and selling misbranded, non-FDA-approved peptides to more than two hundred patients. The indictment covers both FDA-approved drugs sourced through improper channels (tirzepatide, semaglutide, retatrutide, cagrilintide) and compounded peptides outside the lawful pathway (BPC-157, TB-500, ipamorelin, CJC-1295, GHK, GHK-Cu, NAD+). DOJ’s theory leans in part on FDA’s informal “503A do not compound list,” which identifies bulk drug substances that have been considered for the 503A bulks list but were ultimately excluded.

The Watkins indictment matters for two reasons. It puts the prescribing physician inside the criminal liability chain, not just the compounding pharmacy. And it shows that the federal government is willing to treat compounding and prescribing as criminal misbranding, not just a regulatory issue to be resolved with warning letters.

Even when it’s legal, that’s only step one

Federal compounding law sets the floor. Three additional layers have to be cleared independently before the prescription, dispensing, and administration of a compounded peptide are lawful in Texas.

The compounded product has to be compounded in accordance with USP standards. USP 797 covers sterile compounding, which injectable peptides require. The standards address cleanroom design, environmental monitoring, garbing, beyond-use dating, sterility testing, and potency testing. A pharmacy that cuts corners on any of these is exposed to FDA and state board action, plus civil liability if a patient is harmed by a contaminated, sub-potent, or super-potent product.

Further, the compounding pharmacy itself has to be properly licensed. In Texas, that means a valid Texas pharmacy license under the Texas Pharmacy Act, in addition to whatever federal Section 503A or 503B requirements apply. State pharmacy compliance is independent of federal compliance. A pharmacy that satisfies the federal rules but lacks proper Texas licensure cannot lawfully dispense to Texas patients.

Then, the prescription itself has to satisfy the standard of care. The peptide has to be prescribed by a licensed prescriber based on a valid provider-patient relationship. Only physicians and authorized mid-level providers can write prescriptions.

Standards of medical and nursing care expect a good faith examination, a documented diagnosis, a treatment plan, informed consent that addresses the off-label and non-FDA-approved nature of compounded peptides, and ongoing monitoring of the patient.

Many times, especially with the vendor platforms discussed below, the good faith exam is provided via telehealth. That is lawful as long as it meets the many requirements for telehealth exams in Texas. A telemedicine intake form that a remote physician rubber-stamps without an independent clinical evaluation is not acceptable. The Medical Board has over the last decade disciplined physicians who delegated their clinical judgment to non-medical entities or signed prescriptions on the strength of patient-supplied information alone.

Finally, the peptide has to be administered consistent with the licensing rules of whoever is giving the injection. That requires, at a minimum, that the person administering the injectable be qualified as determined by a supervising physician.

Texas chiropractic scope

The Texas Chiropractic Practice Act sets the outer boundary for chiropractic practice in Texas. The scope of chiropractic practice does not include “the prescription of controlled substances, dangerous drugs, or any other drug that requires a prescription.” Chiropractic Board rules also prohibit chiropractors from using needles for procedures that create an incision, with a narrow exception for diagnostic blood draws.

As a result, a Texas chiropractor cannot prescribe peptide therapy, regardless of delivery method. A Texas chiropractor cannot administer injectable peptides. A chiropractic practice that wants to make peptide therapy available to its patients has to do so through a properly licensed prescriber and a properly licensed administering provider, with the chiropractor outside both functions.

That sounds like a manageable workaround until you look at how many peptide vendor platforms are structured.

The vendor problem

The problem with the turnkey vendor platforms is that they are designed to deliver clinical peptide therapy through a single transactional interface, with the chiropractic practice as the customer-facing party, even though the chiropractor cannot lawfully perform the prescribing or administering functions.

The standard package includes a patient intake system, a remote physician who reviews intake forms and writes prescriptions, an affiliated compounding pharmacy that fills the orders, and a fulfillment process that ships the product to the patient or to the practice. The economic model is a revenue share between the chiropractor and the vendor, but each piece of the package raises a discrete legal issue.

The compounding piece. If the vendor’s affiliated pharmacy compounds with substances outside the bulks list pathway, the underlying compounding violates Section 503A. That violation exposes the pharmacy, the prescriber, the vendor, and any practice that participated in the supply chain, to FDA enforcement. A chiropractic practice does not get a pass by relying on the vendor’s representation that the affiliated pharmacy is compliant.

The prescribing piece. If the remote physician writes prescriptions without a good faith examination, an independent medical judgment, and contemporaneous documentation, the prescription is legally deficient under the Medical Practice Act and the Texas Medical Board’s standard of care. Deficient prescribing exposes the physician to Board discipline and, where the underlying compounded substance is outside the lawful pathway, to potential criminal exposure.

The chiropractor’s clinical role. If the chiropractor recommends a specific peptide for a specific patient before the patient gets referred to the vendor’s prescriber, the recommendation itself is the practice of medicine. The fact that another provider writes the prescription afterward does not retroactively legalize the chiropractor’s diagnostic and therapeutic recommendation. The Texas Board of Chiropractic Examiners looks at the totality of the chiropractor’s marketing, intake forms, and patient interactions. The Chiropractic Board could consider that practice as “unprofessional conduct” and discipline the chiropractor.

The financial structure. Revenue-sharing between the chiropractic practice and the vendor for prescribed peptides raises issues under the Texas Patient Solicitation Act and fee-splitting prohibitions. When the financial relationship is the engine of the referral, what might otherwise be a clinical service can become an unlawful payment for a referral. Unlike Federal law, Texas’s statute applies to cash-pay patients. Fee splitting rules also prohibit a person from sharing revenues associated with medical services. By taking a percentage of the revenue, the chiropractor is impermissibly splitting fees with a physician.

Pharmacy operations. If the chiropractor stores or dispenses peptides on their premises, that activity may amount to operating as a pharmacy without a license under the Texas Pharmacy Act. This issue comes up frequently in platform models that ship products to the practice rather than the patient directly. The presence of a remote prescribing physician does not cure an unlicensed-pharmacy issue at the practice site.

The insurance coverage gap. Chiropractic malpractice policies are generally written to cover services within the chiropractic scope of practice. Peptide therapy is outside that scope. If a patient files a claim after an adverse outcome, the carrier’s may properly deny the claim as uncovered, leaving the chiropractor uninsured for both the injuries and the legal fees. Even if the chiropractor “wins” the case at trial, the chiropractor will have to pay out of pocket for legal fees.

The vendor’s standard answer to all of this is that they have lawyers and compliance people and the system is designed to work. Even if true, and it often isn’t, none of that protects the chiropractor when a state board investigator or an DEA inspector shows up.

Conclusion

There is no regulatory gray area when it comes to peptides. A peptide either qualifies through an approved pathway, or it does not. If it does not, the compounding is illegal. FDA can act on it. State law can act on it. The peptide vendor will not defend you, and the prescriber’s credentials will not protect you.

Even when a peptide qualifies, qualifying is the starting point, not the finishline. The compound still has to meet federal and state compounding standards. The pharmacy still has to hold a valid Texas pharmacy license. The prescription still has to come from an authorized prescriber, based on a good faith examination, consistent with the standard of care. And the administration still has to be performed by a provider whose license permits it. None of those layers is optional. A defect in any one is enough, on its own, to support an enforcement action, a Board complaint, or a civil claim.

The vendor platform model concentrates the legal risk on the chiropractor while delivering only logistics. Vendors do not warrant the regulatory status of the underlying peptide. They do not warrant the compounding pharmacy’s compliance. They do not warrant the prescriber’s adherence to the standard of care. They do not indemnify the chiropractor when any of those things fail. A practice that adopts the model without independent legal review is taking on the full cost of those risks in exchange for the vendor’s convenience.

The practical advice is the same advice anyone would give for any program with this much downside. Know where each specific peptide actually sits in the federal regulatory framework. Document the basis for that conclusion. Revisit it periodically, because the framework keeps moving. Verify the compounding pharmacy’s federal and state licensing and its USP compliance history. Verify that the prescribing physician’s clinical evaluation and documentation satisfy the Texas Medical Board’s standard of care. Have counsel review the vendor agreement for fee-splitting, kickback, and unlicensed-pharmacy issues. Confirm in writing what your malpractice carrier will and will not cover. The cost of doing that work on the front end is a fraction of the cost of cleaning up an enforcement action, a Board complaint, or an uninsured liability claim on the back end. The math is not close.

Categories
Article

HIPAA Update – Q1 2026

The first quarter of 2026 has brought a wave of regulatory activity, enforcement actions, and emerging compliance challenges under HIPAA. From a proposed overhaul of the Security Rule to new obligations around substance use disorder records, artificial intelligence, and vendor oversight, healthcare organizations are navigating one of the most consequential periods for health information privacy in over two decades.

This article surveys the key developments from late 2025 through early 2026 and outlines the practical steps healthcare providers and covered entities should be taking right now.

The Security Rule Might Get Its First Major Update in Over Twenty Years

Healthcare has been the number one targeted industry for cyberattacks for thirteen consecutive years. In 2024, data breaches affected more than 182 million individuals across more than 670 reported incidents — a figure likely understated given the scale of the Change Healthcare ransomware attack that year. The existing HIPAA Security Rule, largely unchanged since its original publication, has simply not kept pace.

In December 2024, the Department of Health and Human Services published a proposed update to the Security Rule — commonly referred to as “HIPAA Security Rule 2.0.” Finalization is expected in May 2026, with the rule likely becoming effective by July or August of that year. While that may seem like runway, the scope of the proposed changes is significant enough that organizations should begin preparing now.

What the Proposed Rule Requires

The most consequential change is the elimination of the distinction between “required” and “addressable” implementation specifications. Under the current rule, many organizations have treated “addressable” safeguards as optional. The proposed update makes all safeguards mandatory — fully implemented, documented, and enforced. Other key requirements include:

  • Encryption of all electronic protected health information, both at rest and in transit.
  • Multi-factor authentication on all systems that access ePHI.
  • 24-hour access termination for departing employees.
  • 72-hour system recovery following a cyber incident.
  • Annual compliance audits, technology asset inventories, and network mapping.

Manual compliance approaches — spreadsheets, human-led audits — will no longer meet the standard. For healthcare providers relying on electronic health record vendors that do not understand their obligations under the updated rule, this creates significant downstream risk.

A Divided Industry Response

The proposed rule has drawn sharp reactions. CHIME (the College of Healthcare Information Management Executives) and more than 100 hospital systems sent a letter to HHS Secretary Robert F. Kennedy Jr. in December 2025 calling for the rule to be withdrawn entirely, citing “crushing regulatory burdens.” The rule spans more than 390 pages, and OCR is now reviewing over 4,700 public comments.

On the other side, OCR Director Paula Stannard has defended the proposal, arguing that the cost of cyberattacks — in ransom payments, system remediation, lawsuits, reputational damage, and regulatory penalties — far exceeds the cost of compliance. Even the industry groups opposing the rule acknowledge that cybersecurity is a patient safety issue.

The rule’s future remains uncertain under the current administration’s deregulatory agenda, but experts recommend that organizations adopt best practices like the NIST Cybersecurity Framework now rather than waiting for a mandate.

New OCR Guidance on System Hardening

Separately from the proposed Security Rule update, OCR issued guidance in January 2026 establishing system hardening and patching as mandatory components of current HIPAA Security Rule compliance. Regulated entities must maintain IT asset inventories, monitor vulnerability alerts from NIST and CISA, conduct vulnerability scanning, and implement formal vulnerability management programs. Patching must be treated as a continuous process, not an episodic task. When patches are unavailable — for legacy systems or zero-day vulnerabilities — OCR requires compensating controls such as network segmentation and access restrictions.

The guidance specifically identifies unused software, default administrator accounts, and improperly configured security tools as enforcement targets.

Notice of Privacy Practices: A Deadline That Has Already Passed

February 16, 2026 marked a deadline that required virtually every HIPAA-covered entity to update its Notice of Privacy Practices. The primary driver was the alignment of 42 CFR Part 2 — the regulations governing substance use disorder (SUD) records — with HIPAA standards. HHS published the rule in February 2024, giving covered entities two years to comply.

Under the new framework, patients may grant blanket consent for use of their SUD records for treatment, payment, and healthcare operations, replacing the prior requirement for separate consent for each disclosure. However, SUD records retain heightened confidentiality protections: they cannot be used in civil, criminal, administrative, or legislative proceedings without patient consent or a court order. Updated NPPs must disclose these restrictions, include redisclosure warnings, and provide opt-out opportunities for fundraising communications involving SUD records.

Critically, this requirement extends beyond SUD treatment providers. Any HIPAA-covered entity that receives Part 2 records — through care coordination, payment, or operations — must update its notice. HHS did not issue an updated model notice, meaning organizations must work with counsel to draft compliant language.

State Laws Add Another Layer

HIPAA establishes a floor for privacy protections, not a ceiling. When updating their NPPs, covered entities must also account for state laws that impose stricter requirements. New York now imposes a 30-day breach notification deadline and has expanded its definition of protected data to include medical history and health insurance identifiers. Colorado prohibits disclosing patient information for out-of-state investigations of gender-affirming or reproductive healthcare. Montana and Nevada require faster patient access to records than HIPAA’s 30-day standard. New Mexico requires patient consent for electronic record disclosures. Alabama raised its age of medical consent from 14 to 16, effective October 2025.

Organizations operating in multiple states face a complex compliance matrix. Those that fail to incorporate applicable state requirements risk noncompliance with both federal and state mandates.

Artificial Intelligence Creates New Compliance Frontiers

AI is rapidly transforming healthcare delivery — and creating entirely new categories of compliance risk. HHS has proposed expanding HIPAA Security Rule requirements to explicitly cover AI systems that handle patient health data. The January 2025 proposed rule, scheduled for finalization in May 2026, establishes that ePHI used in AI training data, prediction models, and algorithms is protected under HIPAA. Covered entities and business associates will need to maintain written inventories of AI software and monitor for vulnerabilities.

Public-server tools such as ChatGPT do not comply with HIPAA Privacy and Security Rules. AI tools must use encrypted internal servers. Civil penalties can reach $50,000 per violation, and criminal penalties for knowing violations carry one to ten years of imprisonment with fines up to $250,000. Twelve states have already enacted their own AI healthcare legislation, adding further complexity.

The per-violation structure is important to understand: every patient record improperly disclosed can constitute a separate violation. Five hundred improperly disclosed records could mean five hundred individual penalty assessments.

AI Scribes Under Scrutiny

The AI medical scribing market has grown from $397 million in 2024 to a projected $3 billion by 2033. But this rapid adoption is outpacing compliance. In November 2025, a class action was filed against Sharp HealthCare in San Diego, alleging the organization used Abridge’s ambient AI documentation tool to record more than 100,000 clinical encounters without patient consent, violating California’s all-party consent wiretapping statute. The lawsuit further alleges that EHR notes contained fabricated consent language claiming patients had agreed to recording when no such consent occurred.

Thirteen states require all-party consent for recordings, and California’s AB 3030 (effective January 2025) requires healthcare providers using generative AI to include disclaimers in patient communications.

The De-Identification Problem

Researchers at New York University have demonstrated that AI language models can re-identify patients from medical notes that have been stripped of all HIPAA identifiers. Using a BERT-based model trained on nearly 223,000 clinical notes, the researchers achieved over 99.7% accuracy predicting biological sex and produced re-identification risk 37 times higher than baseline. This vulnerability exists within a multi-billion dollar market in which hospitals and data brokers sell de-identified clinical notes to pharmaceutical firms, insurers, and AI developers. The researchers recommend shifting the policy conversation from technical de-identification solutions toward legal consequences for misuse.

Enforcement Returns to Full Strength

OCR has returned to pre-pandemic enforcement levels — and in some areas has grown more aggressive. In 2025, OCR levied more than $6.6 million in HIPAA fines. Notable settlements include $250,000 against Syracuse Ambulatory Surgical Center following a ransomware incident where no risk analysis had ever been conducted, $225,000 against Deer Oaks after a coding error exposed patient information online for eighteen months, and $182,000 against Cadia Healthcare for posting patient names, photographs, and treatment information as “success stories” without written authorization.

Right of Access enforcement continues to be a priority. In March 2025, OCR imposed a $200,000 penalty against an academic medical center for delays in providing patient records — the agency’s 53rd-plus enforcement action on patient access. Proposed rule updates may reduce the required response time from 30 days to 15 days.

Updated Penalty Structure

The HIPAA penalty structure was updated effective January 28, 2026, under the Federal Civil Penalties Inflation Adjustment Act. For the most serious category — willful neglect not corrected within 30 days — penalties now range from $73,011 to $2,190,294 per violation, with an annual cap of $2,190,294. Criminal penalties can reach $250,000 per violation and include one to ten years of imprisonment. A 2019 Notice of Enforcement Discretion remains in effect that lowers maximum penalties in three of four tiers, but organizations should not count on it remaining indefinitely.

Data Breaches and Vendor Risks at Scale

Healthcare data breaches affected 184 million individuals in 2024 and over 31 million in the first half of 2025 alone. A survey of 613 healthcare professionals found that 60% of organizations have experienced a HIPAA-related incident or near miss, with 49% of incidents caused by internal employee error rather than external attacks.

Third-party risk is particularly acute. More than one-third of healthcare data breaches stem from third-party supplier compromises, yet only 33% of organizations conduct annual vendor risk assessments and just 69% require HIPAA training from vendors. Business associate agreements do not absolve providers of responsibility when breaches occur at the vendor level. Tracking pixels embedded in patient portals and telehealth platforms have incurred over $100 million in fines for unauthorized data sharing to analytics and social media companies.

Legacy PHI in email systems represents another underappreciated risk. A single business email compromise can expose PHI for tens of thousands of individuals, and internal emails — which typically contain the most PHI — often fall outside encryption requirements. Organizations should implement email archiving, encrypt PHI in transit, and deploy filters to detect PHI before transmission.

Legal and Legislative Developments

Several legal and legislative developments merit attention. A Texas lawsuit that challenged both the 2024 reproductive health privacy rule and the validity of the entire 2000 HIPAA Privacy Rule was dismissed in November 2025 by joint stipulation — a significant outcome for HIPAA’s continued authority. The proposed Health Information Privacy Reform Act (HIPRA) would extend HIPAA-style obligations to wearables, health apps, wellness programs, retail clinics, and data vendors that currently operate outside HIPAA coverage. HHS initiated information blocking enforcement in September 2025 under the 21st Century Cures Act, with penalties up to $1 million per violation, though no public actions have been announced as of late 2025.

HHS itself is undergoing reorganization, reducing its workforce from 82,000 to 62,000 employees and creating a new Assistant Secretary for Enforcement. The impact on regulatory pace and enforcement capacity remains to be seen.

Six Action Items for Healthcare Organizations

The regulatory landscape is shifting rapidly. Here is what organizations should prioritize:

  1. Update your Notice of Privacy Practices. The February 16, 2026 deadline has passed. If your NPP has not been revised to address Part 2 substance use disorder requirements and applicable state mandates, act immediately.
  2. Begin preparing for Security Rule 2.0. Even if the rule’s final form is uncertain, start your gap analysis. Encrypt all ePHI, implement multi-factor authentication, inventory your technology assets, and establish 72-hour system recovery capability.
  3. Audit your AI tools. Inventory every AI system that touches patient data — including tools employees may be using without your knowledge. Ensure encrypted internal servers and establish consent protocols, particularly for AI scribes.
  4. Strengthen vendor oversight. Conduct annual vendor risk assessments, customize business associate agreements to address AI-driven analytics and behavioral tracking, and implement continuous monitoring.
  5. Address email and legacy risks. Archive old emails, encrypt all PHI in transit, deploy email filters to detect PHI, and review data retention policies.
  6. Conduct a thorough risk analysis. The single most common finding in OCR enforcement actions is the failure to complete a comprehensive risk analysis. Documenting your analysis and taking meaningful steps to close identified gaps will put your organization in a significantly better position if a breach occurs.

The pace of change in healthcare privacy regulation shows no signs of slowing. Organizations that take proactive steps now — rather than waiting for mandates or enforcement actions — will be best positioned to protect both their patients and themselves.

Categories
Article

No, You Can’t Just Not Take Medicare: What Every Chiropractor Needs to Know

A growing number of chiropractors are moving away from insurance panels in favor of cash-pay practice models built around direct-pay patient relationships. The appeal is understandable—simplified billing, transparent pricing, and greater clinical autonomy. But this shift has created a widespread compliance problem that many chiropractors do not realize they have: an obligation to Medicare that persists regardless of how they choose to bill.

The assumption among many cash-pay chiropractors is straightforward: “I don’t take Medicare, so Medicare rules don’t apply to me.” That assumption is wrong. If any patient in a chiropractor’s practice is a Medicare beneficiary, the chiropractor is subject to federal Medicare enrollment requirements—regardless of whether the practice bills Medicare, regardless of what services are provided, and regardless of what financial arrangements the patient has agreed to.

Chiropractors Cannot Opt Out of Medicare

Under the Medicare Claims Processing Manual, a defined list of provider types—including physicians, podiatrists, optometrists, and psychologists—are eligible to formally opt out of Medicare and enter into private contracts with beneficiaries. Chiropractors are not among them. They fall squarely within the category of providers for whom opt-out is prohibited. This prohibition derives from the Social Security Act and is not subject to exception or workaround.

No mechanism exists—not ABN forms, not patient waivers, not financial agreements—that allows a chiropractor to circumvent this requirement. There is no “cash practice exception” to Medicare enrollment. The only lawful way to avoid enrollment is to refrain from treating Medicare beneficiaries entirely.

Common Workarounds and Why They Fail

Despite the clarity of the rule, chiropractors routinely attempt workarounds that do not hold up under scrutiny. Some take the position that because they provide only maintenance care—which Medicare does not cover—they are exempt from enrollment. Others rely on the fact that they offer only non-covered services such as exams, x-rays, shockwave therapy, or extremity adjustments, reasoning that if Medicare would not pay for the service, the enrollment requirement does not attach. A third common approach involves having patients sign an Advance Beneficiary Notice and then collecting cash for all services, treating the ABN as though it functions as a private contract.

None of these approaches satisfy the law. The Medicare enrollment obligation is triggered by the treatment of Medicare beneficiaries—not by whether a particular service is covered. The nature of the service is irrelevant. If the patient is a Medicare beneficiary, the provider must be enrolled.

Enforcement Consequences

Treating Medicare beneficiaries without proper enrollment constitutes a violation of federal Medicare regulations. CMS and the Office of Inspector General actively enforce these requirements, and the consequences are substantial: financial sanctions, audit exposure, exclusion from federal healthcare programs, and in serious cases, criminal prosecution. These are not theoretical risks. They are the documented outcomes of non-compliance, and they apply to providers who may have genuinely believed they were operating within the rules.

The Compliant Path: Non-Participating Enrollment

Chiropractors who prefer a cash-oriented practice model have a clear, lawful option: enroll in Medicare as a non-participating (non-PAR) provider. Under this arrangement, the chiropractor does not accept assignment. Instead, the chiropractor collects the full “limiting charge”—115% of the non-PAR fee schedule amount—directly from the patient at the time of service. The chiropractor then submits a non-assigned claim to Medicare. Medicare reimburses the patient directly for its portion, and the chiropractor has already been paid in full.

To illustrate, consider a 98941 (spinal manipulation, three to four regions) under the 2026 Texas locality 99 fee schedule. A participating provider accepts $37.61, with the patient responsible for 20% coinsurance of $7.52. A non-PAR provider collects $41.09—the full limiting charge—from the patient upfront. Medicare then reimburses the patient $30.08 (80% of the PAR rate after the deductible), resulting in a net out-of-pocket cost to the patient of approximately $11.01. The difference to the patient is roughly $3.50 per visit. The chiropractor receives payment at the time of service, and the arrangement is fully compliant.

A related question arises for chiropractors who perform only non-covered services, such as spinal decompression. Even in that scenario, enrollment is required. The chiropractor is not necessarily obligated to submit claims for non-covered services, but the underlying enrollment obligation remains. The type of service provided does not eliminate the need to enroll.

Medicare Advantage Considerations

The same enrollment requirement applies to Medicare Advantage patients: a chiropractor must be enrolled in Original Medicare (Part B) before treating them. One practical distinction exists, however. If a Medicare Advantage patient carries an HMO plan with no out-of-network benefits and the chiropractor is not in-network, there are no benefits to bill. In that situation, the chiropractor must still be enrolled in Medicare, but may treat the patient on a cash basis because no billable benefit exists. Proper practice requires verifying benefits in advance, confirming zero out-of-network coverage, and documenting that verification.

For Medicare Advantage PPO plans that include out-of-network benefits, the chiropractor may be required to submit claims as a non-PAR provider. As a practical matter, however, the majority of Medicare Advantage enrollees carry HMO plans, making the cash arrangement the more common scenario.

Conclusion

A cash-pay practice model and Medicare compliance are not mutually exclusive. The non-PAR enrollment pathway allows chiropractors to collect payment at the time of service, maintain the direct-pay relationship they value, and operate within the boundaries of federal law. The process is not burdensome, and it closely mirrors the financial workflow most cash practices already follow.

What chiropractors cannot do is ignore the requirement. Treating Medicare beneficiaries without enrollment is a federal compliance violation with serious consequences—consequences that are entirely avoidable through a straightforward enrollment process.

Three Takeaways

  1. Chiropractors cannot opt out of Medicare. Unlike physicians and certain other provider types, chiropractors are explicitly prohibited from opting out under the Medicare Claims Processing Manual. No waiver, ABN form, or patient agreement can change this. If you treat Medicare beneficiaries, you must be enrolled.
  2. Non-PAR enrollment supports a cash-focused practice within the law. By enrolling as a non-participating provider, chiropractors can collect the full limiting charge at the time of service and, for covered services, submit a non-assigned claim while Medicare reimburses the patient directly. For non-covered services, enrollment is still required, but claims need not be submitted unless the patient requests it or a secondary policy requires it.
  3. The cost of non-compliance far exceeds the burden of enrollment. Treating Medicare beneficiaries without enrollment exposes a chiropractor to federal audits, financial penalties, program exclusion, and potential criminal liability. The enrollment process is straightforward, and the non-PAR model aligns naturally with how most cash-pay practices already operate.
Categories
Article

Consent Requirements for Complementary and Alternative Medicine

Effective January 2025, the Texas Medical Board (TMB) adopted new Complementary and Alternative Medicine (CAM) standards that require physicians to use a specific disclosure and consent process before providing any CAM therapy. These rules apply broadly to any non-conventional treatment—whether or not it is FDA-approved—including popular offerings such as peptides, stem cells, and exosomes.

What counts as CAM under the new rules

Under Rule §171.1, the TMB defines:

  • Alternative medicine as methods of diagnosis or treatment that are not generally considered conventional and may or may not be regulated by the FDA.
  • Complementary medicine as the use of conventional care together with some form of alternative therapy.

In short, if you are offering therapies outside standard conventional care—especially those not approved by the FDA—these standards apply.

The new required consent and disclosure form Rule §171.2 requires that, before any CAM drug, device, treatment, or intervention is provided, the physician and patient must review and execute the TMB’s Complementary and Alternative Medicine Treatment Disclosure and Consent form. Key parameters:

  • The fully executed form must be part of the patient’s medical record.
  • The form cannot be altered or customized (other than translating it or adding supplemental pages as necessary).
  • Physicians must continue to comply with all applicable statutes.

What must be covered with the patient

The mandated form (22 TAC §171.2(b)) lays out a structured, line-by-line process—each section is initialed by physician and patient, with “N/A” allowed only when truly inapplicable. Among the required elements:

Assessment

  • A description of conventional and non-conventional diagnostic methods.
  • A completed medical history and physical exam.
  • Discussion of conventional treatment options and referrals if needed.
  • Documentation of any prior conventional treatments and outcomes, including if the patient declined them.
  • An assessment of whether the CAM therapy could interfere with ongoing or recommended care.

Disclosure

  • Objectives and expected outcomes (e.g., functional improvement, pain relief, psychosocial benefits).
  • Risks and benefits of the proposed treatment.
  • The extent to which the treatment may interfere with other medical care.
  • A description of the proposed treatment’s therapeutic basis or mechanism of action, in plain language.
  • The regulatory status of any drug/supplement/remedy involved:
    • FDA-approved for human use,
    • Exempt from FDA preapproval under DSHEA (dietary supplements), or
    • A non-commercial pharmaceutical compound under clinical investigation standards.
  • A documented, individualized treatment plan incorporating history, prior records, exam findings, and the need for further testing, consults, referrals, or other modalities.
  • A favorable risk/benefit profile compared to other treatments for the same condition.
  • A reasonable expectation of a favorable outcome, including preventive benefits.
  • An expectation of greater benefit than no treatment.
  • Plans for periodic review at reasonable intervals, based on the patient’s progress and any new information about the condition, to confirm treatment objectives are being met.

The form also emphasizes that consent is voluntary; patients should not feel pressured and may withdraw consent at any time. Importantly, physicians must keep accurate, complete records, including discussions about off-label use or CAM.

Why this matters—for patients and physicians

  • Transparency and trust: Patients deserve to know when a therapy is unconventional, not FDA-approved, investigational, or a dietary supplement, and how that status affects safety and efficacy claims.
  • Safety and coordination: Many CAM therapies can interact with other treatments. The required assessment and interference review help ensure care is coordinated and harm is minimized.
  • Shared decision-making: Clear objectives, risks, benefits, and mechanisms—explained in plain language—support informed choices aligned with patient goals and values.
  • Quality and accountability: A tailored treatment plan, periodic reassessment, and documentation of conventional alternatives help maintain clinical rigor.
  • Regulatory compliance and risk management: Using the TMB’s unmodified form and preserving it in the medical record reduces legal risk and demonstrates adherence to state standards.

Practical steps for clinics

  • Update intake and consent workflows to include the TMB CAM Consent before any CAM therapy is initiated.
  • Train clinicians and staff to review each required element, ensure patient comprehension, and document all discussions.
  • Build templates for supplemental pages (e.g., treatment-specific risks/benefits, literature summaries, monitoring schedules).
  • Standardize how you disclose FDA/DSHEA/compounding status for treatments like peptides, stem cells, and exosomes.
  • Schedule periodic reviews and track outcomes to meet the rule’s reassessment requirement.
  • Ensure your EHR stores the fully executed form and related notes in a consistent, auditable location.

Bottom line

Texas now requires a standardized, thorough disclosure and consent for all CAM therapies. For practices offering non-FDA-approved options such as peptides, stem cells, or exosomes, compliance isn’t just a regulatory checkbox—it’s good medicine.

By setting clear expectations, coordinating care, evaluating risk/benefit, and documenting shared decision-making, physicians can protect patients and themselves while preserving access to innovative therapies.

Categories
Article

Texas’s New IV Therapy Law: What Patients, Clinics, and Clinicians Need to Know

After a highly publicized death linked to an IV infusion at a Texas spa in 2023, state lawmakers moved to bring clearer rules and stronger oversight to IV services offered outside traditional medical settings. The result is House Bill 3749—formally “Jenifer’s Law”—signed by Governor Greg Abbott on June 20, 2025, and effective September 1, 2025. The law sets statewide standards for who may order and administer elective IV therapy in non-facility locations such as wellness spas, mobile IV services, and in-home settings. It also tightens how physician oversight must work when care is delegated. Here’s what the law says, why it matters, and how it will change everyday practice for patients and providers.

What the Law Covers: “Elective IV Therapy” Outside Traditional Settings

Jenifer’s Law creates a new chapter in the Texas Occupations Code devoted to “elective intravenous therapy.” The law defines this as IV treatment sought by a patient to relieve temporary discomfort or improve short-term wellness—think hydration drips, vitamin infusions, and similar services. The rules apply when the IV is provided outside of a physician’s office, a licensed health facility, a licensed mental hospital, or a state-operated hospital. In other words, the law targets non-facility locations that have fueled the growth of wellness-focused IV services.

Key Takeaway: If an IV service is offered at a spa, pop-up, mobile unit, hotel, workplace, or a client’s home, it is likely covered by the new rules.

Who Can Prescribe or Order Elective IV Therapy

Under the law, a physician is the center of care. Each elective IV session must be prescribed or ordered by a physician licensed in Texas, or delegated by a Texas physician to one of only two types of clinicians:

  • Physician assistants (PAs)
  • Advanced practice registered nurses (APRNs)

That delegation must occur under “adequate physician supervision” and via a prescriptive authority agreement between the physician and the PA or APRN.

Who Can Administer Elective IV Therapy

The law also narrows who may physically start and run the IV. A physician may delegate the act of administering elective IV therapy only to:

  • PAs
  • APRNs
  • Registered nurses (RNs)

Again, this must happen under adequate physician supervision.

What “Adequate Physician Supervision” Means in Practice

The statute uses the term “adequate physician supervision” without a highly technical definition. In practical terms, existing Texas standards and commentary make clear that:

  • Supervision must match the training and experience of the PA, APRN, or RN.
  • Physicians are expected to provide ongoing oversight, ensure protocols and emergency procedures are in place, and review care.
  • The supervising physician does not have to be physically present at all times, but must be continuously responsible for appropriate oversight.

Prescriptive Authority Agreements: Limits and Requirements

When a PA or APRN is delegated authority to prescribe or order elective IV therapy, a written prescriptive authority agreement with the physician is required. These agreements are a cornerstone of the new framework:

  • They must spell out practice locations, which drugs or devices may be used, how to consult and refer, how to handle emergencies, and how the team communicates.
  • They should include quality checks like chart reviews and periodic meetings.
  • They must be reviewed, signed, and dated annually by all parties.
  • They count toward the physician’s cap on prescriptive authority agreements—Texas generally limits a physician to seven PA/APRN agreements (combined or full-time equivalent). Importantly, the usual exception that sometimes allows exceeding that cap does not apply to elective IV therapy.
  • Agreements must be registered with the Texas Medical Board before the delegated clinician begins work.

What This Means for Medical Spas, IV Clinics, and Mobile Providers

The most immediate changes are operational:

  • Unlicensed staff may not start or administer IV drips in non-facility settings.
  • New patients need an order or prescription from a physician or a delegated PA/APRN working under a registered prescriptive authority agreement.
  • A supervising physician must be actively overseeing the care, with protocols for screening, emergencies, and communication.
  • Physicians are limited by the seven-agreement cap for PAs and APRNs engaged in elective IV therapy, which may affect staffing and growth plans.
  • Documentation should emphasize safety screening (medical history, contraindications, vital signs as appropriate) and demonstrate physician oversight.

Providers should prepare by:

  • Auditing staffing models to ensure only PAs, APRNs, or RNs administer IVs.
  • Updating intake, consent, and emergency procedures to reflect the elective nature of services and safety-focused screening.
  • Reviewing and registering prescriptive authority agreements, including updating them to specify drugs, protocols, and quality measures.
  • Training teams on escalation and emergency response, including when to call 911.
  • Monitoring guidance from the Texas Medical Board, which may clarify expectations around supervision and documentation.

Does the Law Loosen or Tighten the Industry?

There are two lenses on the law’s impact:

  • Tightening: The statute clearly limits who may order and administer elective IV therapy in non-facility settings and ties those actions to physician oversight and formal prescriptive agreements. That will prevent the unlicensed practice scenarios that contributed to the 2023 tragedy and will raise the bar on staffing, documentation, and supervision.
  • Potential flexibility: By explicitly framing these services as “elective,” some see a shift in emphasis from proving medical necessity to ensuring safety. In that view, the focus becomes careful screening for contraindications and clear consent rather than diagnosing and treating a specific medical condition. Some industry observers speculate this could support menu-style offerings, provided they are safe for the individual patient.

For now, providers should treat the law as a safety and oversight mandate and await any medical board guidance on how “elective” intersects with existing standards of care.

What Patients Can Expect

For consumers, the experience should feel more medical and more consistent:

  • You should be asked about your medical history, allergies, medications, and any conditions that could make IV therapy risky.
  • A physician will have ordered the therapy, either directly or through a PA/APRN working under a formal agreement.
  • A licensed clinician (PA, APRN, or RN) will start and manage your IV.
  • The site should have clear protocols and be prepared to respond to complications.

Bottom Line

Jenifer’s Law brings overdue clarity and safety standards to a fast-growing corner of wellness care. It ensures a physician is accountable for ordering elective IV therapy and supervising care, restricts who can administer IVs in non-facility settings to licensed clinicians, and requires formal, board-registered agreements when PAs and APRNs are involved in prescribing. Clinics will need to tighten protocols, adjust staffing, and document oversight. Patients should see better screening and more professionalized care.

Categories
Article

New Restrictions on Non-Compete Agreements for Physicians and Health Care Practitioners

Texas Enacts Significant New Restrictions on Non-Compete Agreements for Physicians and Health Care Practitioners

Effective September 1, 2025, Texas Senate Bill 1318 (SB 1318) will substantially alter the landscape for non-compete agreements involving physicians and other health care practitioners. This new law amends the Texas Business & Commerce Code to impose strict requirements on the enforceability of restrictive covenants in the health care sector. Employers, practice groups, and health care organizations should review and update their employment and contractor agreements to ensure compliance with these sweeping changes.

Key Provisions of SB 1318

1. Scope of Application

New and Renewed Contracts. SB 1318 applies to non-compete agreements entered into or renewed on or after September 1, 2025. This will likely mean that old provisions in contracts that auto-renew will become non-compliant when they renew.

More Health Care Providers. The law covers not only physicians licensed by the Texas Medical Board, but also extends similar restrictions to dentists, professional and vocational nurses, and physician assistants. This marks a significant expansion from prior law, which focused primarily on physicians. Interestingly, it does not apply to other providers like podiatrists, chiropractors, or mental health providers.

2. Duration and Geographic Limitations

One-Year Maximum Duration: Any non-compete agreement with a covered health care practitioner may not restrict practice for more than one year following the termination of employment or contractual relationship.

Five-Mile Geographic Restriction: The restricted area may not exceed a five-mile radius from the location where the practitioner “primarily practiced” prior to termination. For practitioners working at multiple sites, it is critical to clearly define the “primary practice location” in the agreement to avoid ambiguity and potential disputes.

3. Buyout Requirement and Cap

Mandatory Buyout Provision: All covered non-compete agreements must include a buyout clause, allowing the practitioner to be released from the restriction by paying a specified amount.

Buyout Cap: The buyout amount cannot exceed the practitioner’s total annual salary and wages as of the date of separation. This replaces the prior “reasonable price” standard and eliminates the option for arbitration to determine the buyout amount. Employers must ensure that the buyout figure is clearly stated and does not surpass this statutory cap.

4. Written Clearly and Conspicuously

The law requires that all terms and conditions of the non-compete be set forth “clearly and conspicuously” in writing. Vague or ambiguous language may render the agreement unenforceable.

5. Good Cause Required for Enforcement

If a physician is involuntarily discharged without “good cause,” any non-compete restriction is void and unenforceable. “Good cause” is defined as a reasonable basis for discharge directly related to the physician’s conduct, job performance, or employment record. Employers should maintain thorough documentation of performance and disciplinary issues to support any assertion of good cause.

6. Additional Patient Access Protections

The law preserves existing requirements that non-compete agreements must not deny physicians access to patient lists or medical records and must allow for the continuation of care for patients with acute illnesses.

7. Preemption of Other Laws

SB 1318 expressly preempts any conflicting common law or statutory provisions regarding the enforceability of non-compete agreements for covered practitioners.

Practical Implications and Recommended Actions

1. Immediate Review

We recommend clients immediately audit their current agreements, particularly focusing on contracts that auto-renew after September 1st. Agreements entered into or renewed on or after September 1, 2025, must comply with the new requirements. Non-compliant provisions will not be enforceable.

2. Define Primary Practice Location

For practitioners who work at multiple sites or remotely, it is essential to specify the “primary practice location” in the agreement to ensure the enforceability of the five-mile restriction.

3. Update Termination Protocols

Employers should establish clear protocols for documenting the reasons for any involuntary termination, particularly to demonstrate “good cause” if enforcement of a non-compete is anticipated.

4. Communicate Changes to Stakeholders

Inform current and prospective employees, as well as human resources and legal teams, about these changes to ensure consistent application and understanding across the organization.

5. Monitor Existing Agreements

While SB 1318 applies prospectively, courts may look to the new statutory standards when evaluating the reasonableness of pre-existing agreements. Employers should give careful consideration before enforcing older agreements with broader than necessary restrictions.

Consequences for Employers and Practitioners

For employers, failure to comply with SB 1318 may result in non-compete agreements being declared void and unenforceable. This means that an employer may lose the ability to restrict former employees from competing within the defined time and geographic scope, potentially impacting patient retention, business goodwill, and competitive advantage. Additionally, attempting to enforce a non-compliant agreement could expose the employer to legal challenges, increased litigation costs, and reputational harm within the health care community. Employers may also face difficulties in recruiting and retaining talent if their agreements are perceived as overly restrictive or not in line with current law.

For health care practitioners, non-compliance with the new statutory requirements may create uncertainty regarding their post-employment rights and obligations. Employers may now be motivated to allege wrongdoing by the provider to support a determination of “good cause”. Providers subject to overly broad or non-compliant provisions may feel compelled to limit their professional opportunities unnecessarily or may become involved in costly legal disputes to challenge unenforceable provisions.

Given these significant consequences, we recommend that all health care employers and practice groups act now to review and update their agreements and internal procedures. Ensuring compliance with SB 1318 will help protect your organization’s interests, minimize legal risk, and foster a fair and competitive environment for health care professionals.

Conclusion

SB 1318 represents a significant shift in Texas law, reflecting a broader national trend toward limiting restrictive covenants. Non-compliance can have immediate consequences for both employers and health care providers.

Categories
Article

Transforming Texas Long-Term Care: The Upcoming PDPM LTC Methodology

Big changes are on the horizon for long-term care in Texas. The Texas Health and Human Services Commission (HHSC) is gearing up to implement a new payment methodology, the Patient Driven Payment Model for Long-Term Care (PDPM LTC), set to take effect on September 1, 2025. This marks a significant shift from the current Resource Utilization Group (RUG-III) model, promising enhanced payment accuracy and a stronger focus on the individual needs of patients.

Why the Change? A Shift Towards Patient-Centric Care

The core objective behind PDPM LTC is to move away from a payment system based solely on the volume of services provided, towards one that prioritizes the unique characteristics and complex needs of each individual patient. This aligns payments more closely with the actual costs of care, particularly for long-stay residents with complex conditions and cognitive impairments.

This Texas-specific version of PDPM is modeled after the framework already implemented in skilled nursing facilities (SNFs). Its development has been a collaborative effort, stemming from an internal HHSC workgroup formed in 2019 and extensive consultation with the Nursing Facility Payment Methodology Advisory Committee (NF-PMAC) since early 2020. In April 2022, the NF-PMAC recommended the Texas-specific PDPM model as the best fit for accurately representing Texas nursing home resident characteristics, care services, and costs. This recommendation ultimately led to a legislative directive in the 2024-25 General Appropriations Act (House Bill 1, Rider 25) formally tasking HHSC with its development and implementation.

How PDPM LTC Works: Key Components

The new PDPM LTC methodology leverages the Minimum Data Set (MDS) version 3.0 as its foundational data source for classifying residents. Unlike RUG-III, which has five rate components with only two case-mix adjusted, PDPM LTC operates with a different structure:

  • Nursing Component: This component aims to quantify the direct care needed by a resident based on their MDS 3.0 assessment data. Residents are classified into one of six nursing groups, ranging from “extensive services” (Group E – for high-acuity needs like tracheostomy or ventilator care) to “reduced physical function” (Group P). It’s important to note that this Texas version includes six nursing groups, not all 25 possible CMS SNF PDPM nursing groups. Section GG items are utilized in the calculation of this component.
  • Non-Therapy Ancillary (NTA) Component: This component captures the medical complexity of residents by identifying specific conditions and services, using a weighted count of comorbidities derived from MDS items. Residents are assigned to one of three NTA groups based on their total NTA score.
  • Case-Mix Index (CMI): The Nursing and NTA components are adjusted by a CMI, a relative value assigned based on assessment data. These CMIs for both components will be directly based on the Skilled Nursing Facility (SNF) Medicare PDPM CMIs from the CMS Final Rule for fiscal year 2024. HHSC will not automatically adjust CMIs when CMS updates them, but will evaluate the impact for legislative consideration.
  • Non-Case-Mix Component: This part of the total reimbursement rate is constant for all residents and is not adjusted by CMI. It covers costs related to dietary services, laundry, housekeeping, general administration, and fixed capital assets. This component will be calculated as a weighted median from the most recently examined cost reports.

Special Considerations and Add-ons

PDPM LTC also includes specific considerations for certain patient populations:

  • Severe Cognitive Impairment (BIMS Add-on): Residents with confirmed severe cognitive impairment, as determined by their Brief Interview for Mental Status (BIMS) score on the MDS, will receive an additional 5% of the highest CMI-adjusted nursing rate.
  • HIV/AIDS Add-on: Mirroring Medicare’s SNF PDPM, residents with a confirmed HIV/AIDS diagnosis will receive an additional 18% of their nursing group’s rate and be assigned to the highest NTA rate. Due to federal and state regulations, this diagnosis cannot be reported on MDS data and must be indicated on the claim using ICD-10 Code B20.
  • Therapy Components: The new methodology does not include payments for physical, occupational, and speech/language therapy (PT/OT/SLP) components in the daily care rates; these will continue to be reimbursed through Nursing Facility Specialized Services.
  • Hospice Care: The proposed methodology does not introduce any changes to reimbursement for hospice care, which will continue at 95% of the total rate per resident’s PDPM LTC group.

In total, the combination of these components allows for 72 possible different reimbursement rates. Additionally, two default groups will be in place for situations where MDS assessments are missing or contain errors, ensuring providers are still reimbursed at a base rate.

Implementation and What Comes Next

HHSC plans a phased implementation, with algorithms for PDPM LTC replacing RUG-III calculations and relevant changes being made to the Long-Term Care Online Portal (LTCOP) and claims system. While Section GG of the MDS will be visible in the LTCOP by August 2024 (nursing facilities have been completing it since November 2022), it will not be used for payment calculations until the September 1, 2025, implementation. The Assessment Reference Date (ARD) of the MDS will continue to guide the calculation of PDPM LTC. Importantly, the Long-Term Care Medicaid Information (LTCMI) will still be required for assessments, though the data collected will not be used in PDPM LTC calculations.

HHSC is committed to providing support and resources for providers during this transition. Webinars like the one held on April 12, 2024, are being recorded and made available online, along with presentation slides and a Frequently Asked Questions (FAQ) document summarizing stakeholder questions and HHSC responses. User guides will be updated, and training materials developed to help providers familiarize themselves with the changes. A PDPM LTC calculation worksheet and a crosswalk for billing under the new payment groupers will also be published closer to implementation.

This significant overhaul represents a move towards a more equitable and accurate payment system in Texas long-term care, aiming to better reflect the diverse and complex needs of its residents. Providers are encouraged to stay informed and utilize the resources provided by HHSC as the implementation date approaches.

Categories
Article

Legal Risks of Patient Marketing

Health care providers seeking to grow their practice must tread carefully when it comes to marketing arrangements. While increasing patient volume is a common business goal, not all marketing tactics are legally permissible—especially when they involve payment structures tied to patient referrals. Even seemingly harmless agreements, such as paying a company based on the number of patients it delivers, can trigger serious legal and regulatory consequences.

The health care marketing industry often promotes services promising fast and measurable patient growth. These offers can be enticing, especially in competitive markets. However, providers must scrutinize these deals, as some cross legal boundaries. In Texas, the Patient Solicitation Act makes it illegal to offer or receive anything of value in exchange for referring patients. That means performance-based marketing arrangements could be interpreted as unlawful inducements.

Federal law also casts a wide net. The Anti-Kickback Statute prohibits remuneration for referrals involving federally funded programs like Medicare and Medicaid. Violations can lead to significant civil and criminal penalties, including fines, exclusion from federal health care programs, and even imprisonment. Additionally, such conduct may run afoul of the False Claims Act, especially if it results in improperly billed federal claims.

Texas law adds another layer of complexity with its barratry statute, which bans the improper solicitation of professional services—including by health care providers. This statute is often enforced in the context of personal injury and legal services, but its reach can extend to medical marketing tactics that resemble client chasing.

Penalties for violating these laws can be severe. In addition to civil and criminal liability, providers risk disciplinary action from their licensing boards, which may include suspension or revocation of their professional licenses.

To avoid these pitfalls, health care providers should never enter into marketing or referral agreements without first consulting qualified legal counsel. A proactive legal review can help ensure that promotional strategies comply with both state and federal laws, protecting the provider’s reputation, finances, and professional standing. When it comes to patient marketing, compliance must always come before convenience.

Categories
Article

Think Twice Before Responding to That Negative Online Review

It’s natural to want to defend your practice—especially when a negative online review feels unfair, misleading, or outright false. But for healthcare providers, responding to a bad review isn’t just a public relations concern—it’s a legal one. You could be walking straight into a HIPAA violation.

Under HIPAA—and many state privacy laws—healthcare providers are prohibited from disclosing patient health information to unauthorized individuals. This includes not only obvious disclosures, such as a diagnosis or treatment details, but also something as seemingly harmless as confirming that someone is a patient. Even a simple statement like, “I’m sorry you felt that way about your visit,” could be interpreted as a disclosure of protected health information (PHI).

So what should you do when confronted with a negative review?

First, decide if it’s worth responding at all. Not every negative review needs a response. Sometimes, the most strategic move is to let it go. However, if the review contains false or defamatory statements, you may want to contact the review platform and request that it be removed in accordance with their content policies.

If you do choose to respond, you can still do so in a way that protects patient privacy. A compliant response should acknowledge that your practice takes concerns seriously, reaffirm your general commitment to quality care, and invite the individual to contact your office directly to discuss the matter further. This approach demonstrates professionalism without crossing any legal boundaries.

What you should never do is reference the reviewer’s condition, visit, or any personal detail—no matter how vague it seems. Likewise, avoid blaming the patient, even if you feel their account is inaccurate or incomplete. Comments like, “You missed several appointments” or “You didn’t follow the treatment plan,” are not only unprofessional—they may constitute a HIPAA violation.

Also, don’t get pulled into an online back-and-forth. Responding more than once can escalate tensions, increase the risk of disclosing sensitive information, and reflect poorly on your practice. One thoughtful, respectful response is enough.

Finally, remember that your response is not just for the reviewer—it’s for everyone else reading it. Potential patients will form impressions about your professionalism, judgment, and values based on how you handle criticism. Always be polite, measured, and HIPAA-compliant. A negative review can be frustrating—but turning it into a HIPAA violation is far worse. Stay calm, stay professional, and when in doubt, don’t respond publicly at all.

Categories
Article

Can Compounding Pharmacies Continue to Compound Name Brand Weight Loss Drugs by Adding B12?

In the world of pharmaceuticals, compounding pharmacies play a crucial role in customizing medications to meet the unique needs of individual patients. However, the practice of compounding is tightly regulated to ensure patient safety and maintain the integrity of the drug approval process.

One contentious issue is whether compounding pharmacies can continue to compound name brand drugs by simply adding an ingredient like Vitamin B12 to the formulation. This blog post will delve into the regulations and guidelines provided by the FDA under Sections 503A and 503B of the Federal Food, Drug, and Cosmetic Act (FD&C Act) to analyze the validity of this practice.

Understanding FDA Regulations on Compounded Drugs

The FDA has established specific conditions under Sections 503A and 503B of the FD&C Act that must be met for compounded drugs to qualify for exemptions from certain regulatory requirements. These exemptions include current good manufacturing practice (CGMP) requirements, labeling with adequate directions for use, and new drug approval requirements. One critical condition is that the compounded drug must not be “essentially a copy of a commercially available drug product” unless there is a change made for an identified individual patient that produces a significant difference for that patient, as determined by the prescribing practitioner.

What Constitutes “Essentially a Copy”?

The FDA defines “essentially a copy” of a commercially available drug product as a compounded drug that:

  1. Has the same active pharmaceutical ingredient(s) (API) as the commercially available drug product.
  2. The API(s) have the same, similar, or an easily substitutable dosage strength.
  3. The commercially available drug product can be used by the same route of administration as prescribed for the compounded drug.

The Requirement for Significant Difference

For a compounded drug to be exempt from being considered “essentially a copy,” there must be a documented determination by the prescribing practitioner that the change in the formulation produces a significant difference for the patient. This determination must be specific and documented on the prescription. Examples of significant differences include:

  • Removing an allergenic dye for a patient with allergies.
  • Changing the dosage form for a patient who cannot swallow tablets.
  • Adjusting the dosage strength for a patient who requires a different dose.

The Role of Adding B12 to the Formulation

Can adding Vitamin B12 to a name brand drug formulation exempt the compounded drug from being considered “essentially a copy”? The answer is not straightforward. The addition of B12 must produce a significant difference for the patient, as determined by the prescribing practitioner. This significant difference must be documented on the prescription, specifying the change and the benefit it provides to the patient.

FDA’s Position on Minor Changes

The FDA’s guidance explicitly states that minor changes in strength or formulation that do not produce a significant difference for the patient do not exempt the compounded drug from being considered “essentially a copy.” For example, changing the strength from 0.08% to 0.09% is not considered significant unless it is specifically determined to be so for an individual patient.

Minor changes that do not produce a significant difference for the patient do not qualify the compounded drug for exemptions. This is to ensure that compounders do not evade the limits set by the FDA by making relatively small changes to a compounded drug product and then offering it to the general public without regard to whether a prescribing practitioner has determined that the change produces a significant difference.

Conclusion

The position that compounding pharmacies can continue to compound name brand drugs by simply adding B12 to the formulation is not valid unless the addition of B12 produces a significant difference for the patient, as determined and documented by the prescribing practitioner.

The compounded drug must meet all other conditions under Section 503A or 503B of the FD&C Act to qualify for exemptions. Without a documented significant difference, the compounded drug would still be considered “essentially a copy” of the commercially available drug product, and compounding it would not be permissible under FDA regulations.

Adding an ingredient like B12 to a name brand drug does not automatically make it permissible to compound unless it meets the specific criteria set forth by the FDA.