Category: Health Law Highlights

Categories
Health Law Highlights

Wade’s Health Law Highlights for June 9, 2026

Artificial Intelligence in Healthcare

  • AI adoption in healthcare has moved from hesitation to integration, with roughly 40% of life sciences organizations reporting AI embedded throughout their operations. The speed of adoption is illustrated by AI scribes reaching 50% penetration across US healthcare systems in 18 months, compared to seven years for electronic medical records, with clinicians adopting the tools on their own initiative rather than through institutional procurement. Between 25% and 75% of healthcare practitioners, depending on jurisdiction, are already using AI to navigate patient histories, clinical questions, and treatment pathways, with the tools gaining traction primarily in workflow automation, scheduling, documentation, and data extraction. A structural barrier remains: approximately 80% of medical data is unstructured, sitting in PDFs, free text, and fragmented systems, creating opportunity for companies that can clean and contextualize that data for downstream AI use. On the investment side, standalone point solutions are losing ground to companies that can offer differentiated datasets, deep system integration, and auditable AI ecosystems, while the EU AI Act’s double layer of regulation on AI as a medical device risks raising costs and deterring innovators before the law is even fully in force. Source: McDermott
  • The Health Sector Coordinating Council has released an 87-page framework requiring healthcare organizations to integrate cybersecurity controls across the full AI lifecycle — from procurement and design through decommissioning. The framework covers clinical safety and ethics, privacy controls, generative AI and large language model risks, supply chain and concentration risks, and AI-specific incident response. Without governance structures in place, AI systems risk data leakage, operational disruption, bias, and patient harm. The HSCC recommends that organizations form an AI cyber governance committee composed of program leads, physician leaders, IT and security personnel, legal experts, and patient advocates. The framework is intended to complement, not replace, existing organizational governance activities. Source: TechTarget
  • Health care providers using AI face a layered web of state laws even as the federal government moves to assert national control over AI regulation. No comprehensive federal AI law exists, leaving states to apply technology-neutral statutes covering consumer protection, privacy, anti-discrimination, and professional licensing to AI use in clinical, administrative, and operational settings. California’s attorney general issued a legal advisory requiring health care providers to comply with existing state law — including unfair competition, professional licensing, anti-discrimination, and patient privacy laws — when deploying AI. On December 11, 2025, the Trump administration issued Executive Order 14365, directing the federal government to establish a national AI policy framework and to identify and challenge state laws that affect AI. Source: Reuters

Privacy, Cybersecurity & Data Protection

  • The California Supreme Court’s ruling in J.M. v. Illuminate Education Inc. narrows who qualifies as a “provider of healthcare” under the Confidentiality of Medical Information Act while lowering the threshold plaintiffs must meet to allege a breach. The court held that Illuminate, a K-12 education technology company whose software was used for educational planning rather than healthcare delivery, is not a provider of healthcare under the CMIA, reversing the Fourth Appellate District’s 2024 expansive interpretation. Under a new standard for Section 56.101, a CMIA violation requires showing a significant risk of unauthorized access or use, with no proof of actual viewing or affirmative disclosure required, though mere loss of possession is not always sufficient. The court also ruled that J.M. lacked standing under the California Customer Records Act because Illuminate’s contract was with the Ventura County Office of Education, rejecting the “intended beneficiary” theory and distinguishing “customer” from “consumer.” The opinion flagged AI-facilitated and automated cybercrime as a basis for declining to require proof of human viewing, and a concurrence indicated that encryption of sensitive data may shield companies from liability. Source: Cooley
  • AI PCs shift PHI risk from centralized cloud infrastructure directly onto endpoints, fundamentally restructuring HIPAA compliance obligations for healthcare organizations. Unlike traditional PCs, AI PCs run AI models locally on dedicated hardware, enabling clinical documentation, image analysis and point-of-care workflows without routing data through external systems — eliminating certain cloud-related exposure vectors but making each device a higher-value target. Clinical applications, EHR sessions and folders containing PHI must be explicitly excluded via enterprise policy from on-device features such as screen snapshots, semantic search indexes and ambient transcription, and AI PCs must generate immutable audit logs integrated into SIEM tools to satisfy HIPAA’s accounting of disclosures requirements. Retention policies must automatically purge AI caches and transcripts under minimum necessary principles, and devices must support remote wiping of AI data stores upon loss, theft or employee offboarding. Healthcare organizations should begin deployment with a use-case inventory identifying where local AI processing creates measurable workflow value, then conduct a HIPAA risk analysis specific to AI PC capabilities, while aligning with NIST Cybersecurity Framework 2.0, zero-trust principles and proposed HIPAA Security Rule updates — including multifactor authentication, encryption, network segmentation and continuous monitoring. Source: HealthTech Magazine
  • Privacy and data security now rank alongside intellectual property and employment as core diligence requirements in M&A transactions, exposing buyers to regulatory investigations, class actions, and operational disruption when compliance failures go undetected. The US regulatory framework is sector-specific rather than unified, meaning acquirers must map exposure across HIPAA, GLBA, COPPA, state consumer privacy laws, and biometric data statutes — each of which can affect valuation and integration strategy. Privacy policies function as enforceable legal commitments, and the absence of “transfer of assets” language in a target’s policy can block data sharing with a buyer absent additional notices or consent mechanisms. All 50 states and the District of Columbia impose breach notification requirements, and diligence should focus not merely on whether breaches occurred but on whether they were detected promptly, reported as required, and remediated — since gaps in incident response signal broader governance failures. Cross-border transactions face additional constraints under the GDPR and laws in jurisdictions such as China, where outbound data transfers may require regulatory approval, affecting both pre-closing diligence and post-closing data consolidation. Source: Morgan Lewis
  • Smart glasses from Meta, Google, and competitors create overlapping legal exposure under wiretap law, HIPAA, biometric statutes, the NLRA, and the ADA because the devices record audio and video without any visible cue that recording is occurring. Thirteen states require all-party consent to record a conversation, and because most smart glasses capture audio by default, wearers in those states cannot rely on implied-consent defenses that depend on a subject’s awareness of the recording. In healthcare settings, a staff member’s consumer smart glasses can constitute an impermissible HIPAA disclosure the moment the device captures a patient’s face, a chart, or a clinical conversation, and Meta does not sign business associate agreements, making its platform categorically incompatible with PHI workflows. Employers who issue blanket no-recording bans risk NLRA violations under the Stericycle standard, but narrowly drawn policies tied to specific confidentiality and safety interests — and confined to work time and work areas — have survived NLRB challenge, as seen in the January 2026 UPS ruling. Smart glasses also qualify as ADA-covered assistive technology for employees and patients with vision, hearing, or cognitive disabilities, meaning a flat refusal to permit their use, without engaging the interactive process or offering a conditioned accommodation, likely violates Title I or Title III. Source: Dickinson Wright Health Law Blog

Fraud & Abuse Enforcement

Medicare Payment & CMS Programs

Employment & Benefits

Pharmaceutical Patent Litigation

Facility Operations

  • Ambulatory surgery centers are taking on higher-acuity patients faster than their operational infrastructure can keep pace, driven by advances in anesthesia and minimally invasive techniques and pressure from payers to shift care to lower-cost settings. ASC patients increasingly present with comorbidities including cardiac and pulmonary conditions, diabetes, renal disease, obstructive sleep apnea, and obesity, creating greater anesthesia risk and postoperative monitoring demands. Clinical capability to perform a procedure does not equal operational readiness to manage every patient associated with it, and gaps frequently exist in emergency preparedness, pre-admission testing, staffing competency validation, medication management, and patient selection criteria. Accrediting organizations and regulatory surveyors are giving increased scrutiny to operational alignment as outpatient acuity rises, and centers that do not proactively assess readiness face elevated risks to patient safety, staffing performance, and regulatory compliance. ASCs that align clinical expansion with infrastructure investments — including updated policies, transfer and escalation protocols, and leadership engagement in daily operations — are better positioned for long-term growth. Source: VMG Health
Categories
Health Law Highlights

Wade’s Health Law Highlights for June 2, 2026

Fraud & Abuse: OIG Advisory Opinions

  • OIG has approved an orthopedic surgery provider’s proposed warranty program that refunds concierge fees to patients requiring revision surgery within two years of their initial procedure. In Advisory Opinion No. 26-12, the Requestor offers a voluntary Concierge Program, covering items such as wellness coaching, nutritional supplements, app-based health monitoring, leg elevators, and compression garments, for one year following surgery, with fees paid out-of-pocket at fair market value and not reimbursed by any Federal health care program. Under the Warranty, if a patient who substantially complies with the program nonetheless requires revision surgery within two years, the Requestor refunds the concierge fees paid in connection with the initial surgery, with no requirement that the patient return to the Requestor for the revision and no conditioning on exclusive or minimum purchases. OIG found that the arrangement satisfies the applicable elements of the warranty safe harbor at 42 C.F.R. § 1001.952(g), including written undertaking, accurate reporting of refunds on patient invoices, and the patient’s contractual obligation to provide information to the Secretary or State agency upon request. Accordingly, OIG concluded the Proposed Arrangement would not generate prohibited remuneration under the Federal anti-kickback statute or the Beneficiary Inducements CMP, and it would not impose administrative sanctions. Source: OIG Advisory Opinion No. 26-12
  • The OIG issued an advisory opinion on May 13, 2026, that an orthopedic medical device company’s plan to pay physician consultants royalties tied to product line revenue violates the Anti-Kickback Statute’s personal services safe harbor because the payments track the volume or value of referrals. Under the arrangement, physicians who met minimum hours and quality standards would receive a percentage of revenue from all products in a line they advised on, rather than a flat hourly rate, creating a financial incentive to recommend those products to other providers through teaching, training, and proctoring activities. The OIG characterized the structure as a potential payment-for-referrals scheme and cited studies showing physicians are more likely to order products from companies that compensate them, raising risks of patient steering, inappropriate utilization, and increased costs to Medicare and Medicaid. The OIG distinguished compliant arrangements, noting that fixed fair market value fees for documented services, IP royalties not tied to ongoing referrals, and compensation structures that carve out the consultant’s own procedures and affiliated facilities present lower fraud and abuse risk. Device companies should structure physician consulting agreements to satisfy an applicable Anti-Kickback Statute safe harbor and exclude consultants from any position to influence utilization of the products generating their pay. Source: Nixon Peabody LLP

HIPAA Security Rule Developments

HIPAA Privacy: Breach Notification & Patient Consent

  • HIPAA’s Breach Notification Rule effectively requires data mining in large-scale incidents because the law places the burden of proof on covered entities to rebut a presumption that any impermissible access constitutes a reportable breach. Under 45 C.F.R. § 164.402, any acquisition, access, use, or disclosure of protected health information that is not permitted under the Privacy Rule is presumed to be a breach unless the covered entity can demonstrate a low probability of compromise. To rebut that presumption, the entity must conduct a risk assessment addressing at least four enumerated factors, including what data was involved, whether it was accessed, and the likelihood of harm to affected individuals. Failure to conduct or adequately document that assessment leaves the presumption intact, triggering notification obligations to affected individuals, the Secretary of Health and Human Services, and, in incidents, the media. Source: IAPP
  • Electronic health privacy forms routinely use dark patterns to block patients from opting out of data sharing, even when the forms explicitly state that patients have the right to do so. At a Virginia telehealth clinic using Privia Health’s system, patients were presented with an “I accept” button as the only option to proceed through registration, with no visible way to decline data sharing through health information exchanges, despite the privacy notice describing an opt-out right — a design that University of Chicago law professor Lior Strahilevitz identified as both “obstruction” and “visual interference” dark patterns. HIPAA does not require patients to sign a notice of privacy practices, only to acknowledge receipt, and HHS has confirmed that providers are not prohibited from requiring acceptance as a condition of check-in — a gap that legal experts say was never anticipated when the rules were written. State law varies considerably: Florida and New York require explicit patient consent before data can be shared through health information exchanges, while Arizona, Maryland, and Virginia permit sharing by default with opt-out options. HHS is currently working to finalize a rule that would remove the written acknowledgment requirement, though privacy law experts are calling for stronger intervention — including a requirement that any notice describing an opt-out right must include a direct, working link to exercise it. Source: CalMatters

AI in Clinical Practice: Compliance & Litigation

  • AI transcription tools in health care create legal exposure under HIPAA, state privacy laws, and the False Claims Act that requires governance treatment equal to any other high-risk clinical process. A single patient encounter can generate multiple PHI-containing records—audio files, transcripts, summaries, draft notes, and system logs—each subject to distinct access, retention, and disclosure obligations that must be addressed in Business Associate Agreements with transcription vendors. Because these tools lack clinical judgment, errors in captured medication names, diagnoses, or dosages can corrupt the medical record and, if incorporated into billing submissions without human review, generate overpayment liability and False Claims Act scrutiny. Some states now require licensed professionals to obtain both oral and written patient consent before using AI tools to record or transcribe therapy sessions, and organizations must audit applicable state recording and confidentiality laws before deployment, particularly in behavioral health settings. Employees who bypass approved systems and use consumer-grade transcription tools—so-called “shadow AI”—can move PHI outside monitored environments and convert a routine compliance gap into a regulatory investigation by the HHS Office for Civil Rights or a state attorney general. Source: Foley & Lardner
  • Health care organizations face mounting litigation risk from AI tools that capture or process patient communications without consent. A class action filed in the Northern District of California targets a third-party “ambient AI” clinical documentation tool, with plaintiffs alleging that physician-patient conversations were recorded, transmitted, and processed without informed consent, in violation of the California Invasion of Privacy Act, the Confidentiality of Medical Information Act, the Unfair Competition Law, common law intrusion upon seclusion, and the federal Wiretap Act. Legal exposure extends beyond how an AI tool functions to how it is implemented, disclosed, governed, and monitored, and a single use case can implicate privacy, consent, data governance, cybersecurity, vendor management, professional liability, and consumer protection law simultaneously. Using a third-party platform does not transfer legal responsibility, so organizations must conduct vendor due diligence, track how data flows through AI systems, and ensure patient notices and authorizations align with actual data practices. Governance frameworks should include an inventory of AI use cases classified by patient impact and data sensitivity, pre-deployment assessments of privacy and clinical risk, human oversight of AI-informed decisions, and clear patient communication about what the technology does and how information is protected. Source: FBT Gibbons

Federal Enforcement & AI-Driven Audits

  • HHS launched AERO on May 21, 2026, using AI to re-score five or more years of Single Audit Act compliance data for every entity receiving $1 million or more in annual federal funds. Hospitals receiving Medicaid DSH payments, Graduate Medical Education funding, NIH and HRSA grants, or COVID and ARPA relief funds fall within scope, and findings against a state Medicaid agency can flow downstream to hospital subrecipients that had no involvement in the underlying audit deficiency. AERO findings can trigger payment withholding, cost disallowances, suspension or termination of awards, and debarment proceedings under 2 CFR Part 180. HHS announced AERO through a press release and letters to governors rather than through notice-and-comment rulemaking as required by the Administrative Procedure Act, and HHS’s own Trustworthy AI Playbook requires bias testing, human oversight, transparency, and OMB pre-clearance before deploying rights-impacting AI — none of which HHS has publicly documented for AERO. Hospitals should file a FOIA request before responding to any AERO correspondence, demanding the AI methodology, training data, validation studies, bias assessments, and OMB M-24-10 pre-clearance documentation, as courts in AI enforcement challenges have used FOIA-obtained records as the evidentiary foundation for invalidating agency actions. Source: Polsinelli

Telehealth & Workforce Compliance

Payer Disputes & No Surprises Act

Categories
Health Law Highlights

Wade’s Health Law Highlights for May 26, 2026

Fraud, Abuse & Enforcement

  • CMS has imposed six-month, nationwide moratoria on new Medicare enrollment for hospices and home health agencies, blocking both initial enrollment applications and certain changes in majority ownership. The moratoria do not affect existing providers, who may continue serving Medicare beneficiaries. CMS has already suspended payments to approximately 800 hospices and home health agencies in Los Angeles suspected of fraud — providers responsible for $1.4 billion in Medicare spending last year — with $70 million in payments suspended to date. The action marks the third such moratorium CMS has imposed, following a similar measure earlier this year targeting durable medical equipment, prosthetics, orthotics, and supplies companies. CMS has also launched a public hospice scoring system, expanded pre- and post-claim review of home health claims in six states, and imposed heightened oversight of newly enrolled hospice providers in Arizona, California, Georgia, Nevada, Ohio, and Texas. Source: CMS
  • Texas Children’s Hospital agreed to pay more than $10 million and overhaul its operations to settle DOJ and Texas Attorney General allegations that it violated a state ban on gender-affirming care for minors and submitted false claims to federal and private payers. The DOJ and Texas AG alleged that TCH used false diagnosis codes to conceal puberty blocker and cross-sex hormone treatments in violation of Texas Senate Bill 14 (2023), which prohibits healthcare providers from facilitating gender-affirming care for minors. Under the settlement, TCH must cease administering puberty blockers and cross-sex hormones to minors, terminate five physicians who provided the care, and establish the nation’s first detransition clinic offering services at no cost for five years. The settlement is the first of its kind under Executive Order 14187, signed January 28, 2025, which directed federal agencies to investigate fraud related to gender-affirming care for minors. Acting Attorney General Todd Blanche stated the DOJ would “use every weapon at its disposal” to end the practice. Source: Vedder
  • Dental billing fraud enforcement is intensifying as regulators deploy AI and data analytics to identify outliers across Medicaid-heavy practices. Dental practices face False Claims Act and overpayment liability not only from intentional misconduct but from documentation errors that repeat across high-volume services like imaging and routine cleanings, where a single miscoded procedure aggregates into material exposure over time. State attorneys general in Connecticut and Texas have pursued enforcement actions against dental providers for kickback arrangements and referral schemes that violate state Medicaid laws, regardless of whether the practices billed Medicare. Multiple dental entities paid $540,000 to resolve claims that services were billed under the national provider identifiers of credentialed dentists who did not perform the work. Dental service organizations face additional scrutiny under corporate practice of medicine doctrines, fee-splitting prohibitions, and the federal Anti-Kickback Statute, particularly where management compensation structures may influence clinical utilization. Source: McDermott Will & Emery
  • OIG Advisory Opinion No. 26-10 concludes that an orthopedic device company’s proposed Product Line royalty arrangement with physician consultants would generate prohibited remuneration under the Federal AKS. The Requestor, a manufacturer of hip, knee, shoulder, spine, and sports medicine implants, proposed paying certain Consultants a “royalty”—calculated as a percentage of net invoice price for all Products sold within a Product Line—in exchange for teaching, training, proctoring, design feedback, and clinical evaluation services, provided the Consultant met minimum hour requirements and received a “royalty-eligible” rating from an Evaluation Panel. OIG determined the arrangement would not fit within the safe harbor for personal services and management contracts because the payment methodology would take into account the volume or value of referrals and other business generated between the parties, particularly since the Requestor could not certify that the Product Line Services would not contribute to revenue generation. OIG identified risks of skewed clinical decision-making, patient steering, unfair competition, inappropriate utilization, and increased costs to Federal health care programs, noting that the payments could financially motivate Consultants to recommend the Products over competitors even when a competitor’s product might be more clinically appropriate. Source: Advisory Opinion 26-10
  • OIG Advisory Opinion No. 26-11 declines to impose sanctions on a precision oncology company that provides consenting patients a free supplemental multi-cancer detection report in connection with its FDA-approved blood-based colorectal cancer screening test. The Requestor performs the CRC Screening Test—the first FDA-approved blood-based biomarker test for primary colorectal cancer screening, covered by Medicare once every three years—in its CLIA-certified laboratory, and runs a Breakthrough Device-designated algorithm on the same blood sample to generate a Supplemental Report identifying potential signals for bladder, breast, CRC, esophageal, gastric, liver, lung, ovarian, pancreatic, and prostate cancers. To receive the Supplemental Report, a patient must have a valid CRC Screening Test order from an independent, unaffiliated physician who opts in to the additional results, and must sign a consent authorizing release of medical information up to four times over five years to support FDA approval and future payor coverage of the MCD Test. OIG concluded the risk of fraud and abuse is low because the MCD Test is not separately reimbursable and adds no cost to Federal health care programs, physicians receive no compensation for ordering the test or opting in, the Requestor’s laboratory is the only laboratory performing the CRC Screening Test, six of the detected cancers have no USPSTF-recommended screening alternative, and the Requestor refrains from direct-to-consumer advertising or targeted marketing of the Supplemental Report. Source: Advisory Opinion 26-11

Antitrust & Competition

  • The FTC and DOJ Antitrust Division closed public comments for new guidelines governing competitor collaborations, replacing the 2000 Antitrust Guidelines for Collaborations Among Competitors, which the agencies withdrew in December 2024 as obsolete. The incoming guidelines are expected to address vertical integration, roll-ups, joint licensing, algorithmic pricing, data sharing, and labor collaborations. The agencies had originally set an April 24 deadline for comments but extended it to May 21 to allow more time for input. Healthcare companies face particular exposure, as the 2000 Guidelines had established a safety zone for R&D collaborations that no longer exists, leaving businesses without clear guidance until new rules are issued. Companies should consult antitrust counsel before entering competitor collaborations while the agencies review public comments and draft the replacement framework. Source: Williams Mullen
  • The FTC and DOJ pursued an broad range of healthcare antitrust enforcement actions in the first quarter of 2026, spanning merger challenges, civil lawsuits, criminal prosecutions, and new policy initiatives. The FTC launched a Healthcare Task Force on March 20, 2026, and settled with Express Scripts over insulin drug pricing practices that the agency estimated cost patients up to $7 billion over 10 years, while also blocking or triggering the abandonment of three healthcare mergers — Sevita Health’s $835 million acquisition of BrightSpring’s community living business, Edwards Lifesciences’ $945 million acquisition of JenaValve Technology, and Alcon’s $430 million acquisition of LENSAR. DOJ filed civil antitrust suits against OhioHealth and New York-Presbyterian, alleging both hospital systems used payor contract restrictions to block the development of budget-conscious insurance plans, and secured a guilty plea in a bid-rigging scheme involving healthcare supply sales to the U.S. Air Force. In private litigation, a Massachusetts federal court allowed antitrust claims to proceed against Zelis and five major insurers for allegedly conspiring to suppress out-of-network provider reimbursement rates, while the Fifth Circuit dismissed claims against group purchasing organization Vizient after finding the plaintiff defined the relevant market too narrowly. Source: Vinson & Elkins LLP

Coverage & Reimbursement

Transactions, M&A & Investment

  • Private equity consolidation is reshaping the pharmacy sector through vertical integration, selective asset acquisitions, and structural restructurings as drug costs rise and margins compress. U.S. drug spending rose 11.4% in 2024, with oncology, autoimmune, and metabolic therapies projected to sustain increases through 2027, while PBM scrutiny and 340B Program litigation continue to erode margins for specialty pharmacies. CVS Health acquired 63 Rite Aid store locations and more than 600 prescription files across 15 states, and Walgreens Boots Alliance completed a take-private transaction in August 2025—both moves reflecting a shift away from broad ownership toward scale and operational flexibility. CVS Health, OptumRx, and Express Scripts now collectively manage pharmacy benefits for more than 75% of Americans, and Cigna’s Evernorth Health Services made a $3.5 billion investment in Shields Health Solutions to expand specialty dispensing control. Freestanding ambulatory infusion centers are projected to overtake hospital outpatient infusion volume by 2029 at a 30–40% cost advantage, and EBITDA across the pharmaceutical value chain is forecast to reach approximately $114 billion by 2029. Source: VMG Health
  • Provable ROI has displaced innovation as the primary criterion for securing capital in health tech, as multiple expansion fades and investors now require mid-teens EBITDA growth to hit target returns. Healthcare IT deal activity hit record volume and value in 2025, but valuations in 2026 are under pressure from AI uncertainty and a more selective buyer pool. Capital is concentrating in infrastructure-layer and tech-enabled services companies embedded in core workflows — revenue cycle, billing, staffing, and care navigation — where inefficiencies are measurable and switching costs are high. Investors evaluate AI on cost reduction (48%) and workflow efficiency gains (34%), not on narrative, and diligence now scrutinizes data usability, workflow integration depth, retention quality, and ROI attribution. Most liquidity is coming through PE-backed M&A and strategic buyers rather than IPOs, with exits bifurcating sharply between companies that can demonstrate repeatable ROI and those that cannot. Source: McDermott Will & Emery

Privacy & HIPAA

  • HIPAA privacy protections extend to deceased persons, with disclosure permitted only under specific conditions. Providers may share a decedent’s health information for treatment, payment, or healthcare operations — including treatment of living relatives — without authorization, and may disclose relevant information to family members or others who were involved in the decedent’s care, provided the disclosure does not conflict with the decedent’s prior expressed preferences and is limited to information relevant to that involvement. A personal representative — such as an executor or estate administrator — is entitled to a decedent’s health information regardless of prior involvement in the decedent’s care or the decedent’s own wishes regarding disclosure. Additional exceptions permit disclosure to law enforcement when criminal conduct is suspected, to coroners, medical examiners, and funeral directors, for decedent-only research, and to organ procurement organizations. HIPAA protections expire entirely 50 years after death, though providers must also check state laws and other federal rules, such as 42 CFR Part 2 for substance use disorder records, which may impose stricter requirements. Source: Holland & Hart’s Health Law Blog

AI & Emerging Technology

  • AI tools used in clinical trial protocol development and patient recruitment create unresolved compliance risks that sponsors bear alone, even when AI vendors cannot provide validation documentation. Because large language models produce non-deterministic outputs, sponsors cannot reproduce AI-generated inclusion criteria or satisfy ICH E6(R2) requirements for validated computerized systems, and the FDA’s January 2025 draft guidance on AI in drug development does not cover protocol design or drafting, leaving validation standards undefined. The FDA’s own internal AI tool, Elsa, has generated false citations and fabricated studies, illustrating that hallucinations in protocol development can produce incorrect dosing regimens or flawed statistical approaches without human verification. AI-powered recruitment tools, while capable of reducing trial costs by up to 40%, train on historically non-diverse datasets and can systematically exclude racial and ethnic minorities, older adults, children, and patients with comorbidities—contrary to the FDA’s December 2025 guidance requiring enrollment that reflects the intended-use population by age, sex, race, and ethnicity. To address these gaps, sponsors should validate reproducibility before IRB submission, audit recruitment algorithms for bias before enrollment, and require AI vendor contracts to include audit rights over model architecture, version control documentation, cooperation obligations for FDA proceedings, performance warranties, and indemnification for AI-specific harms. Source: Healthcare Law Insights

Hospital & Health System Governance

  • Hospital and health system boards are not keeping pace with the governance demands created by cybersecurity risks, AI adoption, workforce shortages, shifting reimbursement models, and compliance requirements. A study from The Governance Institute finds that governance structures and board education have fallen behind today’s healthcare challenges, with trustees now expected to engage on topics ranging from M&A activity and physician alignment to data privacy and quality outcomes. Knowledge gaps are inconsistent across boards — some trustees carry financial expertise but lack grounding in cybersecurity, while others bring community leadership experience but are unfamiliar with reimbursement dynamics or physician compensation structures. Traditional education models, including long board meeting presentations and generic materials, fail to address these gaps or fit the schedules of trustees who carry outside professional responsibilities. Ongoing, tailored board education — rather than annual or compliance-driven training — is now considered necessary for effective oversight, organizational strategy, and patient outcomes. Source: VMG Health
Categories
Health Law Highlights

Wade’s Health Law Highlights for May 19, 2026

Fraud, Abuse & Enforcement

  • CMS has imposed six-month, nationwide moratoria on new Medicare enrollment for hospices and home health agencies (HHAs), blocking initial enrollment applications and certain changes in majority ownership. The moratoria, coordinated with Vice President JD Vance’s Anti-Fraud Task Force, do not affect existing providers, who may continue serving Medicare beneficiaries. CMS has already suspended payments to 773 hospices and 23 HHAs suspected of fraud in Los Angeles alone, representing $70 million in suspended funds. This action follows an earlier moratorium on DMEPOS companies, bringing the total number of active CMS enrollment moratoria to three. Additional enforcement measures include nationwide hospice site visits, fingerprinting-based background checks for HHAs, a public hospice scoring system, and pre- and post-claim review of HHA claims in Florida, Illinois, Oklahoma, Ohio, North Carolina, and Texas. Source: CMS
  • Texas Children’s Hospital agreed to pay $10 million to settle healthcare fraud allegations brought by Texas Attorney General stemming from the hospital’s billing of Texas Medicaid for gender-transition procedures using false diagnosis codes. Under the settlement, negotiated in coordination with the U.S. Department of Justice, the hospital must establish the country’s first detransition clinic — a multidisciplinary facility providing care to patients who underwent gender-transition procedures — with all services funded by the hospital and free to patients for the first five years. Five physicians who performed gender-transition interventions will be permanently terminated and barred from future employment or credentialing at the hospital. Texas Children’s also agreed to cease providing gender-transition services, implement compliance and ethics measures, and amend its bylaws to require automatic revocation of privileges for any physician who violates Texas law prohibiting such interventions on minors. Source: Office of the Texas Attorney General
  • Federal prosecutors, courts, and regulators are pursuing health care fraud on multiple fronts, with recent actions spanning investor fraud, kickback schemes, and fraudulent export pricing. On May 6, a federal judge sentenced Parmjit Parmar, former CEO of Constellation Healthcare Technologies, to five years in prison and over $125 million in restitution after he pleaded guilty to conspiracy to commit securities fraud in a $212.5 million scheme that fabricated subsidiaries, falsified financial records, and misled investors into a take-private transaction. Modern Nuclear Inc., a mobile PET scan provider, agreed on May 1 to pay $8.3 million to resolve False Claims Act allegations that it paid above-fair-market-value fees to referring cardiologists as kickbacks, and entered into a five-year Corporate Integrity Agreement with HHS-OIG requiring an independent compliance expert. The 11th Circuit upheld wire fraud convictions on May 5 against Byramji Javat and Luis Soto, who between 2014 and 2017 fraudulently obtained medical equipment at export-only prices and resold it domestically, with Javat sentenced to 10 years and Soto to six, plus joint restitution of $29 million. Separately, AbbVie, AstraZeneca, Novartis, and Sanofi petitioned the Ninth Circuit for en banc rehearing to challenge the constitutionality of the FCA’s qui tam provisions, arguing that empowering private parties to sue over conduct the executive branch never deemed unlawful violates Article II. Source: ArentFox Schiff
  • Fair market value compensation and Stark Law compliance do not shield healthcare arrangements from liability under the federal Anti-Kickback Statute (AKS). The HHS Office of Inspector General, in updated FAQ guidance, stated that AKS liability turns on a facts-and-circumstances analysis of the parties’ intent, and that fair market value is “not a dispositive defense” under the statute. Satisfying a Stark Law exception also provides no automatic protection, as the two laws exist for different purposes and operate under separate legal frameworks — for example, a hospital providing event tickets to a referral source may violate the AKS even if the underlying financial relationship fits within a Stark exception. Healthcare entities must evaluate arrangements under both laws independently and, because the AKS is intent-based, should maintain documentation of the legitimate business purpose behind any arrangement involving remuneration and referral relationships. Protection from AKS liability requires either full compliance with an applicable safe harbor or a well-documented showing that the arrangement’s facts and circumstances are consistent with the statute. Source: Thompson Coburn LLP

Corporate Practice of Medicine & Private Equity

  • California and Oregon have produced the first enforcement actions under state laws barring corporate control of medical practices, resulting in a $2.3 million penalty against Aspen Dental Management and a scrapped hospital staffing deal in Eugene. California Attorney General Rob Bonta found that Aspen Dental — backed by Leonard Green & Partners and Ares Management — exceeded its role as a back-office support organization and participated in managing dental practices, violating the state’s corporate-medicine ban. In Oregon, U.S. District Judge Mustafa Kasubhai ruled that hospital operator PeaceHealth’s plan to bring in Atlanta-based ApolloMD amounted to an end-run around the state’s ban on corporate control of medical practices, after which PeaceHealth agreed to retain the incumbent physician group, Eugene Emergency Physicians. Both states passed their laws last year, aimed at strengthening longstanding corporate-medicine bans — on the books in about 30 states — that had become ineffective through lax enforcement and private-equity workarounds such as the “friendly physician” model and support-organization structures. Vermont’s state Senate advanced similar legislation, and Bonta has signaled intent to go further than the California statute by targeting the friendly-physician model directly. Source: Wall Street Journal
  • California’s corporate practice of medicine doctrine is under active judicial and legislative pressure that threatens the continuity agreements at the core of MSO-PC structures used by private equity and telehealth platforms statewide. A trial court ruled in Art Center Holdings, Inc. v. WCE CA Art, LLC that a private equity-backed MSO engaged in the unlicensed practice of medicine by using a continuity agreement to exercise broad discretion over ownership transfers within a physician-owned professional corporation. On appeal, the California Attorney General filed an amicus brief arguing that any contractual mechanism allowing an MSO to effectuate a physician ownership change raises CPOM concerns, regardless of whether clinical decisions are directly affected, while the California Medical Association filed a competing brief on April 15, 2026, urging a facts-and-circumstances standard rather than a categorical prohibition. Two laws effective January 1, 2026 — SB 351, which codifies CPOM prohibitions targeting private equity and hedge fund control over clinical and operational functions, and AB 1415, which requires 90 days’ advance notice to the Office of Health Care Affordability before closing material health care transactions — reinforce the AG’s position at the legislative level. Because many health care organizations structure their agreements to comply with California law as a national baseline, an appellate ruling adopting the AG’s approach would carry compliance consequences well beyond California’s borders. Source: Faegre Drinker Biddle & Reath LLP
  • Private equity in healthcare and life sciences is shifting from financial engineering to operational value creation as valuation resets, constrained capital, and higher financing costs force investors to be more disciplined. The market has bifurcated: differentiated assets still command premium prices, while lower-tier assets face wider bid-ask spreads, longer negotiations, and more structural complexity. Investors are sourcing under-the-radar businesses with niche dynamics, diversifying across healthcare segments, and driving portfolio companies through leadership changes, M&A, and pricing improvements rather than relying on multiple expansion. On AI, the most durable assets are seen as those grounded in physical products, specialist infrastructure, and embedded services—such as medical devices and critical care—while AI’s most credible near-term use cases are workflow automation, scheduling, and administrative efficiency rather than platform-level disruption. Continuation vehicles are gaining use as exit pathways remain constrained, but require a track record of performance, a credible path to exit, and clear alignment between general and limited partners. Source: McDermott Will & Emery

AI in Healthcare

  • The Pennsylvania State Board of Medicine filed suit against a generative AI company for the unauthorized practice of medicine, alleging that its platform enabled users to create chatbot characters posing as licensed health care professionals. During its investigation, state regulators interacted with a chatbot identified as a “doctor of psychiatry” that had logged over 45,000 user interactions, provided a false medical license number, and offered to conduct a mental health assessment. The Board is seeking an injunction to bar the platform from continuing to operate in this capacity. The action follows a February 2025 Federal Trade Commission injunction against an AI platform marketing itself as a “robot lawyer” for the unauthorized practice of law, and New York legislation introduced in 2025 to prohibit AI chatbots from impersonating licensed professionals. California, Illinois, Nevada, Utah, and Maine are among the states moving toward similar regulatory measures. Source: MG+M The Law Firm
  • Healthcare organizations deploying AI must navigate a layered compliance framework that begins with HIPAA but extends well beyond it. PHI — defined as individually identifiable information created, used, or disclosed in the course of treatment, diagnosis, or billing — cannot be processed through publicly available AI models, and any use must either fall within HIPAA’s treatment, payment, or operations exceptions or be covered by a valid authorization under 45 CFR 164.508, which carries technical requirements distinct from a standard consent form. Even when a TPO exception applies, PHI cannot be used to train a general-purpose model without a proprietary closed-loop system, appropriate permissions, and destruction protocols. Business associate agreements with AI vendors must expressly address processing, aggregation, de-identification, and data transmission, and HIPAA functions only as a regulatory floor — states including California, Washington, and Colorado impose additional or more restrictive requirements that organizations operating across state lines must separately evaluate. Ownership of AI training data and model outputs must be allocated by contract, and AI tools providing clinical decision support may also trigger FDA regulation. Source: Morgan Lewis
  • All 20 AI scribe vendors approved by the Ontario government for use by healthcare providers produced inaccurate or incomplete medical notes in tests conducted by the province’s auditor general. Nine vendors hallucinated patient information, 12 recorded information incorrectly, and 17 missed details about mental health issues discussed in two simulated patient-doctor conversations. Errors included fabricated referrals for blood tests or therapy, incorrect medication names, and omitted mental health details — findings the auditor general concluded could result in inadequate or harmful treatment plans. Despite these results, the accuracy metric accounted for only 4 percent of a vendor’s approval score, while a metric for domestic presence in Ontario carried 30 percent weight, meaning a vendor could score zero on accuracy and still gain approval. The auditor general recommended that IT departments require physicians to confirm review of AI-generated notes before those notes are entered into patient records. Source: Ars Technica

Prior Authorization & Payer Reform

  • CMS regulations and health plan voluntary commitments are reshaping prior authorization through two parallel tracks: process reform and reduction in the number of services requiring authorization. CMS’s 2024 Advancing Interoperability rule imposed requirements on certain health plans covering electronic prior authorization technology, approval timelines, and public reporting, with major provisions taking effect in 2027; a proposed 2026 rule would extend similar requirements to medications covered under a health plan’s medical benefit. In June 2025, AHIP and Blue Cross Blue Shield Association members pledged to approve at least 80% of prior authorization requests in real time when submitted electronically, standardize the submission process, ensure all denials are reviewed by a licensed clinician, and maintain continuity of care across plan changes — commitments that also apply to commercial plans outside CMS’s jurisdiction. On the volume side, health plans have eliminated 11% of prior authorizations since the 2025 pledge, representing 6.5 million fewer authorizations, and at least one national plan has committed to eliminating authorization requirements for 30% of services. Key uncertainties remain around whether providers — particularly those in rural areas or with fewer resources — will be positioned to use the new electronic systems once health plans are required to implement them in 2027. Source: McDermott+

HIPAA, Data Privacy & Cybersecurity

  • Healthcare data breaches cost an average of $9.77 million per incident — the highest of any industry for 13 consecutive years — because traditional document systems cannot enforce HIPAA at the architecture level, leaving audit logs editable, records alterable, and access controls subject to drift. HIPAA’s Privacy Rule, Security Rule, and HITECH Act require minimum necessary access, technical safeguards for electronic PHI, and breach notification obligations, with penalties for uncorrected willful neglect reaching $50,000 per violation and $1.9 million per category annually — and any third-party platform handling ePHI must execute a Business Associate Agreement before storing a single record. Blockchain addresses the compliance gap by making records immutable, generating cryptographic hashes that detect any alteration, and enforcing role-based access through smart contracts rather than manual permissions, satisfying all four technical safeguards required by NIST Special Publication 800-66r2. Current applications include patient consent forms recorded with timestamps and non-repudiation, treatment agreements with full version histories, and billing claims linked to verified documents — a structure that targets the $68 billion in annual U.S. healthcare fraud driven largely by billing manipulation. Implementation requires AES-256 encryption before data touches the blockchain, role-scoped access configured to the minimum necessary standard, a Business Associate Agreement executed prior to launch, and quarterly audits covering activity logs, smart contract behavior, and access permissions. Source: Vocal Media

Regulatory Compliance & Accessibility

Employment & Labor

  • ViaQuest Residential Services agreed to pay $975,000 to settle a federal lawsuit alleging it misclassified home health Program Managers as overtime-exempt under the Fair Labor Standards Act. Kenneth Simmons filed suit in January 2023, arguing that Program Managers spent the bulk of their time on direct patient care rather than managerial duties, making them nonexempt regardless of their titles; 106 current and former Program Managers ultimately joined the case. Under the FLSA, white-collar exemptions require that an employee’s primary duty be executive or administrative in nature — job titles and written job descriptions are not dispositive. Healthcare employers face heightened exposure because supervisory employees in that sector routinely perform both managerial and patient-facing tasks, and a misclassification applied uniformly across a role can affect every employee holding that position. Periodic classification reviews measured against the FLSA’s primary duty test, conducted with counsel, can identify misclassification before it produces collective or class action liability. Source: Sheppard

Health Technology & Innovation

Categories
Health Law Highlights

Wade’s Health Law Highlights for May 12, 2026

Fraud, Abuse & False Claims Enforcement

Medicare Reimbursement & Coverage

  • CMS and FDA have created a joint coverage pathway that compresses Medicare national coverage decisions for Breakthrough Devices from over a year to as little as two months after FDA market authorization. The Regulatory Alignment for Predictable and Immediate Device (RAPID) pathway applies to certain FDA-designated Class II and Class III Breakthrough Devices that address unmet medical needs among Medicare beneficiaries, requiring that eligible devices be the subject of an Investigational Device Exemption (IDE) study enrolling Medicare beneficiaries with clinical outcomes agreed upon by both agencies. Under the pathway, CMS will issue a proposed National Coverage Determination (NCD) on the same day an eligible device receives FDA market authorization, triggering a 30-day public comment period. The Transitional Coverage for Emerging Technologies (TCET) pathway will be paused for new candidates while CMS implements RAPID. A proposed procedural notice will be published in the Federal Register with a 60-day public comment period before a final notice takes effect. Source: CMS
  • The 2026 Medicare Physician Fee Schedule restructures physician reimbursement through three changes that directly affect how physician productivity is measured and compensated. CMS finalized an efficiency adjustment that reduces work relative value units (wRVUs) for 91% of physician services, targeting non-time-based procedural codes while leaving evaluation and management services unchanged, meaning procedural specialists will see lower reported wRVU productivity even if clinical volume holds steady. CMS also overhauled practice expense methodology by cutting indirect practice expense allocated per wRVU by 50% for facility-based services — rejecting the AMA’s updated survey data on methodological grounds — shifting reimbursement toward office-based settings on a budget-neutral basis to advance site neutrality. For the first time since the MPFS was established in 1992, CMS implemented two separate conversion factors, one for providers participating in Advanced Alternative Payment Models and one for those who are not, requiring organizations with mixed provider populations to maintain separate revenue forecasts and clarify which conversion factor governs percentage-of-Medicare contracts. Compensation rates, productivity thresholds, salary guarantees, and professional services agreements tied to wRVUs should be recalculated to reflect these changes. Source: VMG Health

Privacy, Cybersecurity & Data Breaches

Private Equity & Healthcare Transactions

  • A wave of state laws is tightening oversight of private equity investment in healthcare, filling a void left by federal inaction. Oregon’s SB 951, effective June 9, 2025, restricts management services organization (MSO) and PE control of healthcare practices and voids certain restrictive covenants, while California’s AB 1415 and SB 351, effective January 1, 2026, expand transaction notice requirements to include private equity firms and hedge funds and codify corporate practice of medicine limits on unlicensed entity influence over licensed healthcare professionals. Rhode Island enacted a pre-merger notification rule requiring 60 days’ advance notice of material changes in medical practice groups with fines up to $100,000 for noncompliance, and Washington signed legislation on March 25, 2026 expanding reporting and pre- and post-closing notification requirements for healthcare entity control changes. Indiana, New York, Hawaii, Vermont, Pennsylvania, and Illinois have each introduced or advanced legislation in 2026 requiring greater ownership disclosure, post-closing reporting, or advance notice for material healthcare transactions. States are also adopting “mini-HSR” laws requiring Hart-Scott-Rodino filings to be submitted to state attorneys general, broadening antitrust oversight of healthcare-related mergers at the state level. Source: Paul Hastings LLP

Drug & Pharmacy Regulation

  • Most compounded peptides being marketed to wellness and chiropractic practices today fall outside the legal pathways that federal law requires for lawful compounding, and practitioners who add them to their service offerings carry the legal risk themselves. Under Section 503A of the Federal Food, Drug, and Cosmetic Act, a bulk drug substance can only be legally compounded if it appears on the final 503A bulks list, holds Category 1 interim status, is a component of an FDA-approved drug, or has a USP or NF monograph — and as of April 2026, none of the popular compounded peptides, including BPC-157, TB-500, CJC-1295, ipamorelin, and melanotan II, meet any of those criteria. The FDA removed twelve of those substances from Category 2 and referred them to the Pharmacy Compounding Advisory Committee on April 15, 2026, but that referral is a procedural step, not an authorization, and pharmacies that compound them remain subject to enforcement. The DOJ reinforced that exposure on April 1, 2026, when it indicted a Utah physician for selling misbranded peptides to more than 200 patients, placing the prescribing provider — not just the pharmacy — inside the criminal liability chain. In Texas, chiropractors face additional layers of risk from turnkey vendor platforms, including fee-splitting violations under the Texas Patient Solicitation Act, unlicensed pharmacy operations if peptides are stored on-site, scope-of-practice violations under the Texas Chiropractic Practice Act, and malpractice coverage gaps because peptide therapy falls outside the scope chiropractic policies are written to cover. Source: Healthcare Empowered
  • Rescheduling marijuana from Schedule I to Schedule III eliminates the Section 280E tax penalty for state-licensed medical cannabis operators, cutting effective federal tax rates from over 70% down to the standard 21% corporate rate. Section 280E bars all ordinary business deductions for trafficking in Schedule I or II controlled substances but does not mention Schedule III, so the rescheduling order — effective April 22, 2026 — removes the penalty by its own statutory terms for qualifying medical operators. Treasury’s transition rule treats the relief as applying to the full 2026 calendar year, meaning medical operators can deduct wages, rent, utilities, and all other operating expenses for the entire year without mid-year allocation. Adult-use operators receive no relief; 280E remains fully in effect for recreational marijuana, and a separate rescheduling hearing beginning June 29 is the only near-term path to change that. Retroactive relief for prior tax years (roughly 2022–2025) is unresolved — the DOJ order encourages Treasury to consider it, but Treasury has made no commitment, leaving more than $1.6 billion in disputed 280E positions industry-wide, including approximately $445 million carried by Trulieve alone, in limbo pending further guidance. Source: Budding Trends

Congressional Oversight

Categories
Health Law Highlights

Wade’s Health Law Highlights for May 5, 2026

Cybersecurity, Data Privacy & HIPAA

Fraud & Abuse Enforcement

  • False Claims Act enforcement hit a record $6.8 billion in FY 2025, more than doubling the prior year’s $2.9 billion, with healthcare and life sciences accounting for $5.7 billion — roughly 83% — of total recoveries. Whistleblower-initiated qui tam filings reached 1,297, nearly double the prior 10-year annual average, and for the first time, relators recovered more in cases the government declined to join ($2.27 billion) than in cases it did ($2.23 billion), signaling that DOJ’s decision not to intervene no longer signals a case will collapse. At the same time, DOJ lost more than 5,000 employees in the first year of the second Trump administration, shut down over 900 federal fraud cases and more than 100 healthcare fraud matters, and proposed a FY 2026 budget cutting the FBI by $545 million — even as senior officials publicly named healthcare fraud a top enforcement priority and relaunched the DOJ-HHS FCA Working Group with six focus areas including Medicare Advantage, kickbacks, and EHR manipulation. A constitutional challenge in United States ex rel. Zafirov v. Florida Medical Associates, LLC is now before the Eleventh Circuit, with a panel that showed skepticism toward the government’s position at oral argument in December 2025, and observers expect an affirmance that could reach the Supreme Court. Healthcare providers should not treat DOJ’s staffing constraints as a reprieve, as the pipeline of pre-existing investigations continues to generate settlements, data analytics increasingly substitute for personnel, and the administration is also deploying the FCA against DEI practices and gender-affirming care billed to federal programs. Source: Arnall Golden Gregory LLP
  • The HHS Office of Inspector General issued a favorable advisory opinion declining to impose sanctions on a three-phase ownership transfer plan for a California ambulatory surgical center, even though the arrangement could generate remuneration implicating the Federal Anti-Kickback Statute. The plan, structured around the retirement of a sole physician-owner and estate planning objectives, would transfer ASC ownership interests to his non-physician spouse at no cost, allow his two physician-children to purchase shares at fair market value, and ultimately pass remaining interests to those children through testamentary transfer. Financial distributions to investors qualified under the single-specialty and multi-specialty ASC safe harbors because all transactions were structured at fair market value, returns were proportional to capital investment, no financing assistance was provided to investors, and no investment terms were tied to referral volume. Transfers that fell outside safe harbor protection — including the spousal gift and the children’s share purchases — were nonetheless deemed low-risk because the spouse had no role in health care, the transfers were documented as bona fide succession planning, and the retiring physician committed to cease clinical practice, relinquish all governance roles, and certify no referral influence without directing his patient panel to any specific successor. The OIG’s opinion signals that family-based ownership succession in ASCs can survive Anti-Kickback scrutiny where referrals are functionally decoupled from ownership and transactions reflect legitimate estate planning rather than disguised remuneration. Source: Lamb McErlane PC

Texas Legislation & Compliance

Medicare Coverage & Reimbursement

  • CMS is moving to eliminate reimbursement advantages for FDA breakthrough-designated devices while simultaneously creating a faster Medicare coverage pathway for the same class of products. The FY 2027 IPPS proposed rule would repeal the alternative New Technology Add-on Payment (NTAP) pathway, requiring all applicants — including FDA-designated breakthrough devices — to meet newness, cost, and substantial clinical improvement criteria beginning October 1, 2026; the same repeal would apply to the Transitional Pass-Through (TPT) program in the outpatient setting. On April 23, 2026, CMS and FDA jointly announced the RAPID (Medicare Regulatory Alignment for Predictable and Immediate Device) coverage pathway, under which eligible breakthrough devices — Class III devices and Class II devices in the FDA Total Product Life Cycle Advisory Program — that are the subject of an investigational device exemption study could receive a proposed national coverage determination the same day FDA grants market authorization, potentially compressing the coverage timeline from nine to twelve months to as little as two months. CMS has paused the Transitional Coverage for Emerging Technologies pathway to focus resources on RAPID implementation. Final IPPS policies are expected on or around August 1, 2026. Source: McDermott+

Practice Transactions & Business Models

Employee Benefits & Pharmacy

  • Employers can legally reimburse employees for GLP‑1 medications purchased through direct-to-consumer platforms using Health Reimbursement Arrangements (HRAs), despite widespread broker advice to the contrary. Platforms including Hims, Lilly Direct, and NovoCare offer GLP‑1 drugs at $149–$449 per month — versus $1,000-plus through traditional pharmacy channels — and their terms restrict reimbursement from “commercial insurance,” not from employer-funded HRAs, which carry no underwriter and involve no risk transfer. Lilly Direct’s checkout flow (fulfilled through Gifthealth) expressly invites HSA and FSA reimbursement, and a participant-directed HRA mirrors that same transaction structure: the employee pays cash at the point of sale and submits for reimbursement afterward from a separate employer account. Brokers and benefits vendors who advise against these arrangements are often commercially aligned with the carriers and PBMs that lose margin when prescriptions leave the traditional channel. Employers should retain independent benefits counsel to evaluate platform-specific terms and HRA plan design before accepting a blanket “too risky” conclusion. Source: Amundsen Davis

Medical Malpractice

  • Strokes are among the most commonly misdiagnosed conditions in the United States, and the errors that give rise to malpractice liability occur before, during, and after the event itself. Grounds for a claim include failure to order diagnostic tests, failure to treat known risk factors such as high blood pressure and diabetes, misdiagnosis as conditions including migraines, seizures, or sepsis, delayed or absent treatment after a correct diagnosis, and medication errors involving blood thinners, anticoagulants, or antiplatelet drugs. Errors by emergency responders and ER staff — including triage failures and surgical mistakes — also support liability, as does failure to monitor a patient after initial treatment. Florida law imposes strict timing requirements on malpractice claims, making prompt action necessary for anyone who believes a stroke was mishandled. Patients or family members with concerns should gather medical records, document the basis for their suspicions, and consult an attorney. Source: Searcy Law
Categories
Health Law Highlights

Wade’s Health Law Highlights for April 28, 2026

Fraud, Abuse & Government Enforcement

  • The HHS Office of Inspector General will not impose sanctions on a Medicare Advantage organization that proposes to share a percentage of its savings with employer groups through its Employer Group Waiver Plans. The arrangement would involve the MA organization making “Gainshare Payments” to groups such as employers, trusts, and unions when a negotiated medical expense ratio falls below an agreed-upon target, with payments typically issued in the third quarter of the following year. OIG concluded that the arrangement would generate prohibited remuneration under the Federal anti-kickback statute if the requisite intent were present, and no safe harbor applies. OIG nonetheless found the fraud and abuse risk sufficiently low because the Gainshare Payment is not guaranteed, does not affect amounts CMS pays to the MA organization, and each group must contractually use any payment to benefit enrollees. The opinion applies only to the requesting entity and could be modified or terminated if CMS rules governing EGWP operation or payment materially change. Source: OIG Advisory Opinion No. 26-07
  • IBM agreed to pay more than $17 million to settle allegations it violated the False Claims Act by failing to comply with Title VII anti-discrimination requirements while holding federal contracts. The government alleged IBM tied bonus compensation to diversity targets, used diverse interview slates in hiring decisions, set race and sex demographic goals for business units, and restricted training programs based on race, color, national origin, or sex. IBM denies the allegations but received cooperation credit under DOJ guidelines, though the damages multiplier exceeded 2x. The settlement follows prior legal challenges, including a June 2024 lawsuit by Missouri claiming IBM gave hiring preference to certain races and an August 2024 suit by a white former employee alleging termination based on racial quotas. IBM disbanded its DEI department in April 2025, and Deputy Attorney General Todd Blanche issued a memo in May 2025 instructing DOJ attorneys to use the False Claims Act against recipients of federal funds that promote DEI policies the Administration deems unlawful. Source: ArentFox Schiff
  • The Department of Health and Human Services Office of Inspector General issued Advisory Opinion 25-11 establishing guidance for pharmaceutical and medical device manufacturers on discount and rebate arrangements under the Federal Anti-Kickback Statute. The opinion addresses four discount structures: upfront discounts, upfront discounts with purchase requirements, bundled upfront discounts with purchase requirements, and bundled rebates. OIG permits arrangements outside the Discount Safe Harbor when they use objective, transparent metrics and do not emphasize exclusivity, impede competitor sales, or require customers to switch from competing products. Manufacturers must clearly disclose discounts and rebates in invoices and documentation to enable customers to determine and report net prices for payer program purposes. When safe harbor compliance is not feasible, manufacturers must conduct and document risk assessments that evaluate transparency, absence of intent to induce inappropriate utilization, preservation of clinical judgment, commercial reasonableness, and absence of steering federal program business. Source: Gardner Law
  • The HHS Office of Inspector General added two FAQs warning that compliance with Stark law exceptions and fair market value alone do not protect healthcare arrangements from Anti-Kickback Statute violations. FAQ #4 clarifies that financial arrangements satisfying Stark exceptions can still violate AKS because Stark is a strict liability statute where intent is irrelevant, while AKS requires knowing and willful intent to induce referrals. OIG provided an example where hospitals or laboratories offer sporting event tickets to referring physicians, which might satisfy the Stark exception for nonmonetary compensation under 42 C.F.R. § 411.357(k) but would be unlikely to receive AKS safe harbor protection. FAQ #17 states that fair market value is only one element of safe harbor compliance and OIG rejects the position that FMV eliminates unlawful remuneration. OIG characterizes this guidance as consistent with statutory text, regulatory safe harbors, and decades of OIG guidance. Source: Health Law Diagnosis
  • Texas Attorney General opened investigations into dozens of Medicaid providers using federal claims data released by DOGE earlier this year. The investigations target home health providers, occupational therapy providers, and entities that may have submitted fraudulent claims related to COVID-19 treatments. The AG’s office plans to combine the federal data with internal claims data and civil investigative demands in anticipation of litigation, and has recovered more than $1 billion from Medicaid fraud since 2020. Recent enforcement actions include a February lawsuit over improper Medicaid billing related to care for minors and a $41.5 million settlement involving adulterated drugs provided to children. The state’s use of federal data aligns with a Trump administration executive order establishing a task force to coordinate anti-fraud efforts across federal benefits programs, which may condition federal funding on states adopting enhanced safeguards. Source: Polsinelli
  • The DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy requires healthcare organizations to navigate four distinct and overlapping disclosure frameworks, each carrying different legal consequences. Under the DOJ policy, companies that voluntarily self-disclose, fully cooperate, and remediate will receive a declination of prosecution absent aggravating circumstances, but disclosure must occur before any imminent government investigation and within 120 days of an internal report to preserve eligibility. Separately, CMS requires Medicare providers to report and return overpayments within 60 days of identification under a six-year lookback period, with retention beyond that deadline creating False Claims Act liability; Stark Law violations are handled through CMS’s Self-Referral Disclosure Protocol; and Anti-Kickback Statute exposure is addressed through the OIG’s Provider Self-Disclosure Protocol, which typically requires settlement at a multiplier of at least 1.5 times damages. These pathways intersect — a billing issue can escalate from an overpayment matter to False Claims Act exposure, and a Stark issue can implicate the Anti-Kickback Statute depending on intent — meaning disclosure to CMS or OIG does not automatically preserve DOJ self-disclosure benefits. Organizations lose leverage not at the moment of disclosure but before it, when delays, miscalculation of exposure type, or failure to recognize escalating risk foreclose the option of a declination or reduced penalty. Source: Clark Hill PLC

Medicare & Reimbursement

Privacy & Data Security

Workforce & Non-Competes

  • Multiple states enacted laws in Q1 2026 restricting or banning non-compete agreements for health care workers and other employees. Washington passed H.B. 1155 on March 23, 2026, which bans all non-compete agreements with workers and businesses effective June 30, 2027, and requires employers to notify current and former employees that existing non-competes are void by October 1, 2027. Utah prohibited non-compete agreements with health care workers effective May 6, 2026, and Montana expanded its ban to include all physicians effective January 1, 2026. Virginia enacted a law barring enforcement of non-competes against employees terminated without cause unless the employer provides severance, effective July 1, 2026, and passed separate legislation prohibiting non-competes with health care professionals licensed by the Boards of Medicine, Nursing, Counseling, Optometry, Psychology, or Social Work, which awaits the Governor’s proposed amendment when the legislature reconvenes. California banned contractual clauses prohibiting providers from competing with medical or dental practices in contracts involving private equity groups or hedge funds, effective January 1, 2026. Source: Seyfarth Shaw Trading Secrets
  • The FTC has committed to prosecuting noncompete agreements it views as anticompetitive, pursuing enforcement on a case-by-case basis rather than through a nationwide ban. Chairman Ferguson stated that many noncompetes likely violate antitrust laws, and that enforceable agreements must advance a procompetitive employer interest and be narrowly tailored to achieve it. Commissioner Meador identified four evaluation factors: the wage and skill level of covered employees, the reasonableness of the agreement’s scope and duration (with durations beyond one to two years viewed as suspect), the employer’s degree of market dominance, and evidence of industrywide economic harm. Employers in health care, veterinary, and beauty industries face heightened scrutiny. Employers should consider alternatives such as nonsolicitation and nondisclosure agreements, document the business interests any noncompete is designed to protect, and limit noncompetes for low-wage or low-skill workers. Source: Troutman Pepper Locke

Corporate Practice & Healthcare Transactions

  • Ambulatory surgery centers trade at 7–8x EBITDA, with top-tier centers reaching double-digit multiples, driven by revenue cycle performance, physician alignment, and leadership infrastructure.** Buyers are applying greater diligence to CMS certification status, life-safety systems, and physical plant conditions, with compliance gaps serving as leverage in price negotiations or deal-killers outright. Revenue cycle management is the primary financial variable under scrutiny, as inconsistent collections, denial rates, and accounts receivable backlogs directly reduce EBITDA and can trigger valuation adjustments. Centers with case volume concentrated among a small number of physicians, or those dependent on a single founder for operations, face scalability concerns that reduce buyer confidence. Orthopedics, gastroenterology, and retina remain the most active specialties, while cardiology is drawing attention as procedural volume in ASC settings grows. Source: VMG Health
  • Physician organizations face regulatory and transaction risk not from single decisions, but from patterns of undocumented decisions, unmanaged conflicts, and informal governance that cannot withstand scrutiny. Board minutes should capture the business rationale for compensation changes, the alternatives considered, and any conflicts disclosed, while joint venture files should document ownership structure, expected returns, and the basis for satisfying applicable safe harbors. Performance tracking should measure group-level operational metrics and physician productivity tied to personally performed services — not referral patterns or site-of-service data that could imply compensation rewards referrals. Conflicts of interest require disclosure at inception, annually, and before any related decision, with records showing whether the conflicted party recused and how disinterested parties evaluated the arrangement. Organizations that maintain these practices enter due diligence and regulatory investigations with files that respond to document requests without reconstruction, align witness accounts, and allow buyers to price deals on operational performance rather than regulatory risk. Source: Healthcare Law Insights
  • Succession agreements in California MSO-PC structures are under direct legal threat after the CA Attorney General filed an amicus brief arguing that any MSO contract granting the right to replace a physician-owner constitutes impermissible corporate practice of medicine (CPOM). The brief arose from Art Center Holdings, Inc. v. WCE CA Art, LLC, in which a 2024 Los Angeles Superior Court ruling found that defendants unlawfully controlled a medical practice through a succession agreement giving them discretion to swap out a physician-owner at will. The AG’s position is categorical: where a contract lets a corporation replace the physician-owner, the corporation “effectively owns and controls all aspects of the practice,” and it is “difficult to imagine any circumstance” in which such a right would not produce undue influence. The California Medical Association filed its own amicus brief pushing back on a categorical rule and urging courts to apply a fact-specific analysis that considers the formation, function, and purpose of each structure, warning that a blanket prohibition could disrupt capital formation and destabilize physician alignment models across the state. California has not banned MSO-PC structures or private equity investment in MSOs, but the AG’s brief signals that succession agreements — including those triggered only by defined events such as loss of licensure — now carry material enforcement risk and require restructuring. Source: Ropes & Gray LLP

FDA & Drug Regulation

  • The FDA is narrowing the regulatory pathway for compounding peptides, restricting access to substances that lack FDA approval, USP or NF monographs, or inclusion on bulk substances lists. Peptides fuel a $740B longevity market and are accessed through compounding under Sections 503A and 503B of the Federal Food, Drug, and Cosmetic Act, but compounded drugs do not undergo the same premarket review for safety, effectiveness, or manufacturing quality as approved drugs. The FDA prohibits compounders from replicating commercially available drugs and evaluates intended use based on marketing, distribution, and real-world context rather than labeling alone, making “research use only” disclaimers ineffective where facts point to human use. Enforcement tools include warning letters, import alerts, and seizures, with potential exposure extending beyond manufacturers to clinics, telehealth platforms, and other intermediaries. Many peptides lack clinical data, standardized dosing protocols, and well-characterized safety profiles, limiting companies’ ability to support therapeutic or performance-based claims. Source: Gardner Law
  • The DOJ and DEA moved FDA-approved marijuana products and state-licensed medical marijuana products from Schedule I to Schedule III of the Controlled Substances Act, effective immediately. Acting Attorney General issued the order under his authority to reschedule drugs in compliance with U.S. obligations under the Single Convention on Narcotic Drugs, acting pursuant to President Trump’s December 18, 2025, Executive Order on Increasing Medical Marijuana and Cannabidiol Research. The DEA withdrew the prior administration’s August 29, 2024, notice of hearing and terminated those proceedings, replacing them with a new administrative hearing set to begin June 29, 2026, to consider broader rescheduling of marijuana from Schedule I to Schedule III. The new process includes firm deadlines intended to accelerate the rulemaking. Federal controls against illicit drug trafficking remain in place. Source: U.S. Department of Justice

Technology & AI

  • States, not Congress, are setting the rules for AI in healthcare— and the resulting patchwork of laws poses a compliance risk for health systems operating across state lines. In 2025, more than 250 AI-related healthcare bills were introduced in state legislatures, covering patient disclosure, bias prevention, clinician accountability, and insurer restrictions on AI use in coverage determinations. The Trump Administration released a National Policy Framework for Artificial Intelligence on March 20, 2026, calling on Congress to establish a single federal regulatory approach with guardrails on child safety, free speech, intellectual property, workforce impacts, and national security, though a December 2025 executive order seeking to preempt state AI laws lacks the legal force to override state statutes. Federal agencies — FDA, CMS, CDC, and NIST — are advancing AI policy through guidance, payment pilots, and voluntary standards rather than new rulemaking, with CMS testing AI-assisted prior authorization under the WISeR model and the FDA moving toward lifecycle oversight requirements for adaptive algorithms. Across HHS, common compliance priorities include auditability of AI outputs, traceability of training data, human oversight in clinical contexts, and ongoing performance monitoring as models evolve. Source: Holland & Knight
Categories
Health Law Highlights

Wade’s Health Law Highlights for April 21, 2026

Fraud, Abuse & Enforcement

Antitrust & Provider Contracting

Privacy, Cybersecurity & HIPAA

  • Texas has emerged as a major cybersecurity battleground for healthcare organizations, with security leaders now serving as strategists directly tied to patient outcomes and organizational trust. The state’s health systems and research institutions have elevated eight security executives who are shaping cybersecurity practices across the sector. Ron Mehring has led cybersecurity strategy at Texas Health Resources since 2011, while Randy Yates has served as CISO at Memorial Hermann Health System for over two decades. Gordon Groschl spent nearly two decades at Texas Children’s Hospital implementing Zero Trust architecture before moving to City of Hope, and George Finney oversees cybersecurity for millions of patients and students across the University of Texas System. Other leaders include Teresa Tonthat at Cook Children’s Health Care System, Fernando Blanco at CHRISTUS Health with operations spanning Latin America, Ian Schneller formerly of Health Care Service Corporation with background at U.S. Cyber Command and NSA, and Ashish Shah leading cybersecurity at MD Anderson Cancer Center. Source: Security Boulevard
  • The Office for Civil Rights of the U.S. Department of Health and Human Services published a proposed rule on January 6, 2025, to update HIPAA Security Rule requirements in response to increased cyberattacks targeting electronic protected health information. The proposed rule eliminates the distinction between “required” and “addressable” specifications, mandates written security documentation, and requires ongoing technology asset inventories and network mapping. Technical safeguards would include multi-factor authentication, encryption of data at rest and in transit, network segmentation, and penetration testing at least annually. The OCR indicated the rule remains on its agenda for finalization in May 2026, with compliance required within 240 days of publication, or early 2027. The proposed framework expands scrutiny to business associates, subcontractors, cloud service providers, and entities on the fringes of the health sector that handle health data. Source: Constangy Cyber Advisor
  • The Department of Health and Human Services Office for Civil Rights published a proposed rule on January 6, 2025, that would significantly amend the HIPAA Security Rule, with a final rule expected in May 2026. The proposed rule responds to increases in cyberattacks, expanded use of cloud and mobile technologies, and inconsistent compliance findings. The rule would mandate encryption of ePHI at rest and in transit, require multi-factor authentication, and add requirements for anti-malware, removal of unnecessary software, and disabling unnecessary network ports. Organizations would need to establish written procedures to restore systems and data within 72 hours of service disruption, develop incident response plans with periodic testing, and provide notice within 24 hours when workforce member access to ePHI is changed or terminated. Covered entities and business associates would have 180 days from the effective date to comply. Source: Healthcare IT News
  • The DOJ’s Bulk Sensitive Data Transfer Rule establishes compliance requirements for health care and life sciences organizations that provide foreign entities access to sensitive personal data, with thresholds as low as 100 individuals for genomic data. The rule, which originated from Executive Order 14117 and became effective in April 2025, targets data transactions with six countries of concern: China, Russia, Iran, North Korea, Cuba, and Venezuela. The regulation applies to four categories of transactions—data brokerage, vendor agreements, employment agreements, and investment agreements—and is triggered by the ability to access data, not just formal transfers, even when data has been de-identified or anonymized. Enforcement authority rests with DOJ’s National Security Division, with civil penalties up to $368,136 or twice the transaction value and criminal penalties up to $1 million and 20 years imprisonment. Organizations must conduct data mapping exercises to assess compliance, as HIPAA compliance alone does not satisfy the new requirements, though exemptions exist for federally authorized research and FDA-required regulatory activities. Source: Epstein Becker Green

AI & Healthcare Technology

FDA & Drug Development

Rural Health & Funding

Telehealth

Employment & Labor

Categories
Health Law Highlights

Wade’s Health Law Highlights for April 14, 2026

Fraud, Abuse & Enforcement

  • Aetna agreed to pay $115 million to settle allegations that it manipulated diagnosis codes to inflate risk scores for Medicare Advantage enrollees. A former risk-adjustment coding auditor filed the lawsuit on behalf of the federal government, claiming Aetna received inflated payments from the Centers for Medicare & Medicaid Services through a process known as upcoding. The Department of Justice alleged that in 2015, Aetna conducted chart reviews and used the results to seek additional payments while ignoring instances where it was overpaid. From 2018 to 2023, the company allegedly submitted morbid obesity diagnosis codes when BMI values indicated patients were not morbidly obese and directed coders to ignore conflicting information. The settlement resolves allegations only, with no determination of liability. Source: Texas Medical Association
  • Government investigations into physician organizations often begin without warning and rely on internal communications as evidence. Investigators from the Office of Inspector General, Department of Justice, or state Medicaid Fraud Control Units target emails, board presentations, investor materials, and strategic planning documents that use phrases like “keeping cases in-house,” “driving volume,” or “referral optimization” to establish violations of the Anti-Kickback Statute or Stark Law. Investigations typically begin through whistleblower complaints, billing data analysis, auditor referrals, related investigations, or transaction disclosures. Organizations should engage experienced healthcare regulatory counsel immediately and avoid responding, producing documents, allowing interviews, altering records, or creating new explanatory materials. Pending investigations affect mergers and acquisitions through expanded diligence, altered deal structures, price adjustments, insurance limitations, and timeline delays. Source: Healthcare Law Insights
  • The OIG issued a favorable advisory opinion on April 7, 2026, permitting a State-designated domestic crisis provider to bill Medicare and Medicaid for therapy services while waiving cost sharing for domestic violence survivors. The provider, located in a rural, medically underserved area, has historically offered all services—including crisis lines, legal advocacy, emergency shelter, and therapy—at no cost but faced funding losses that necessitated billing Federal health care programs. Although the arrangement would technically generate prohibited remuneration under the Federal anti-kickback statute and the Beneficiary Inducements CMP, the OIG determined the risk of fraud and abuse was sufficiently low. The OIG cited factors including the provider’s historical mission of free services, the prevalence of financial abuse among domestic violence survivors, the independent determination of medical necessity by mental health professionals, and the provider’s commitment not to advertise free therapy or shift costs to Federal programs. Source: OIG Advisory Opinion No. 26-06
  • The Office of Inspector General issued Advisory Opinion 25-11 addressing how biopharmaceutical manufacturers can structure discount arrangements for vaccines in compliance with the Anti-Kickback Statute. The OIG reviewed four types of discount structures proposed by a manufacturer, including upfront discounts, purchase requirement discounts, bundled discounts, and bundled rebates offered to pharmacies, group purchasing organizations, and health care providers. While the OIG determined that upfront discounts and purchase requirement discounts meet the discount safe harbor protections, bundled discounts involving products reimbursed under different Medicare systems do not meet the safe harbor but can present low fraud risk if discounts are attributable to each product and offered equally. The OIG concluded all proposed arrangements presented low risk of fraud and abuse, though it emphasized that discounts requiring purchasers to provide marketing services or switch patients between products fall outside safe harbor protections. The opinion signals that manufacturers have flexibility to structure certain discount arrangements that do not precisely meet safe harbor requirements if they include appropriate safeguards. Source: Foley & Lardner

Regulatory & Competition

  • The FTC established a Healthcare Task Force on March 20, 2026, to centralize enforcement across competition and consumer protection matters. Chairman Andrew Ferguson created the cross-bureau unit to address consolidation, exclusionary conduct, and deceptive practices that affect prices, quality, and access to care. The Task Force draws staff from the Bureaus of Competition, Consumer Protection, and Economics, and will coordinate with the Department of Health and Human Services and the Department of Justice. The FTC blocked a $945 million medical device merger in January 2026, challenged an IDD services provider merger, opposed a cataract surgery laser system merger in March 2026, and secured a settlement with a pharmacy benefit manager over insulin pricing practices in February 2026. The agency signals it will scrutinize mergers, contracts, and innovation competition in health care markets. Source: Seyfarth Shaw LLP
  • The Trump administration has not yet determined whether to proceed with a proposed overhaul of the HIPAA Security Rule that was published by the previous administration in January 2025. Paula Stannard, director of HHS Office for Civil Rights, told attendees at a HIPAA Summit that regulators are reviewing 4,700 public comments on the 125-page proposal, which would eliminate the distinction between “required” and “addressable” implementation specifications and mandate written documentation for all security policies. Stannard noted that the cost of cyberattacks may exceed compliance burdens, and that many entities, particularly smaller organizations, have treated addressable specifications such as encryption as optional. The proposal would also require greater specificity in security risk analyses, which Stannard identified as the most common compliance failure in security rule investigations. Final action on both the Security Rule update and a separate HIPAA Privacy Rule modification is anticipated for May 2025. Source: GovInfoSecurity
  • Texas HB 4224 requires healthcare providers to post instructions on how patients can request medical records, contact licensing boards, and file complaints. The law, which took effect September 1, 2025, applies to covered entities that handle personal health information and mandates postings both on websites and at physical facilities. The bill passed the Texas House 149-0 and the Texas Senate 31-0. Entities that exclusively perform claims processing, data processing, data analysis, utilization review, or billing on behalf of healthcare providers are exempt. The law addresses a gap where patients often cannot find clear information about accessing their records or filing complaints against providers. Source: Hendershot Cowart P.C.

Privacy, Cybersecurity & Data Breaches

AI in Healthcare

Categories
Health Law Highlights

Wade’s Health Law Highlights for April 7, 2026

Healthcare Transactions & Private Equity

  • Private equity firms have invested over $1 trillion in debt-financed healthcare transactions over the past decade, with 93% of healthcare companies carrying speculative debt being private equity-sponsored. A JAMA 2023 study showed a 25% increase in complications such as infections and falls following private equity investment in healthcare facilities. Private equity-sponsored healthcare businesses face a 10X increased risk of insolvency and account for two-thirds of healthcare bankruptcies, including seven of the eight largest bankruptcy cases in 2024. Rural and underserved communities experience the most pronounced consequences due to limited access to alternative providers. The NYU Stern report proposes reforms including full public disclosure of finances, prohibitions on sale-leasebacks for dividend payments, state authority to block transactions, and investor liability for healthcare fraud. Source: Rivkin Rounds
  • Language used in healthcare transaction materials can create regulatory risk even when the underlying business economics are defensible. Phrases such as “internal pipeline,” “keep more cases,” “move volume,” and “drive cases to the ASC” can be interpreted as plans to steer referrals for financial return, triggering expanded diligence and increased escrows from buyers. Buyers assume deal materials reflect how growth will occur and what drives the financial model, treating any suggestion that growth depends on changing physician referral patterns as a risk allocation issue. Government investigators request internal communications including emails, texts, draft decks, and spreadsheets to prove causation and organizational mindset regarding compensation and referral arrangements. Organizations should describe capacity and access rather than routing, keep messaging grounded in operations, and separate economics from referral patterns. Source: Healthcare Law Insights
  • Federal and state legislators introduced numerous bills in Q1 2026 to expand oversight of healthcare consolidation, though most state measures stalled. Of the state bills introduced, only 2 passed while 10 stalled and 10 remain active in battleground states. On the federal level, the U.S. District Court for the Eastern District of Texas vacated the FTC’s 2024 Hart-Scott-Rodino Final Rule on February 12, 2026, returning to pre-February 2025 rules while appeals proceed. Congress reintroduced the Stop Corporate Crimes Against Health Care Act of 2026, which would create federal crimes with up to six years prison time and allow clawback of executive compensation when actions contribute to patient injury or death, and introduced the Take Back Our Hospitals Act of 2026, which would prohibit Medicare payments to hospitals or nursing facilities owned or controlled by private equity funds or REITs. State legislation shifted focus from private equity alone to include real estate investment trusts, management services organizations, and health insurers, while revisiting corporate practice of medicine doctrine and considering private rights of action for violations. Source: Holland & Knight

Fraud & Enforcement

  • The Texas Attorney General filed two lawsuits against dental providers and marketing companies over alleged kickback schemes in the Medicaid program. The state alleges that dental practices worked with marketing firms Dental Axis and Dental Market One, paying them per patient, and the marketers then offered Medicaid patients cash, gift cards, or other incentives to influence their choice of provider. Under Texas law, compensation tied to patient referrals or inducements of value can taint any resulting Medicaid claims. The cases focus on marketing violations rather than clinical care, specifically targeting per-patient payments, patient incentives, and volume-based agreements. Dentists now account for 29% of full-scale provider investigations according to the March OIG quarterly report, placing them at the top of the list despite generating only 9% of initial complaints. Source: Texas Dentists for Medicaid Reform
  • The Ninth Circuit ruled on March 17, 2026, that False Claims Act claims related to alleged 340B Drug Pricing Program overcharges may proceed. In United States ex rel. Adventist Health System of West v. AbbVie Inc., the court reversed dismissal of a qui tam action where the relator alleged that drug manufacturers charged covered entities above the statutory ceiling price, particularly in scenarios requiring a $0.01 “penny price.” The court held that FCA claims are independent and not automatically barred simply because covered entities lack a private right to sue under the 340B statute. The relator alleged that manufacturers’ pricing practices harmed government programs by increasing Medicaid payments, Medicare cost-based reimbursements, and direct government purchases. The decision recognizes a pathway for alleged 340B issues to be litigated as FCA claims where overcharges tie to government payment, though the case remains at the pleading stage and returns to district court. Source: Husch Blackwell

Privacy & Data Security

  • Nacogdoches Memorial Hospital disclosed a data breach that exposed information on more than 257,000 patients. The hospital became aware of the attack on January 31 and notified law enforcement while launching an investigation. Hackers accessed names, addresses, Social Security numbers, dates of birth, medical record numbers, health plan details, and patient photos. The hospital began notifying those affected on March 31 and has reported no instances of identity theft linked to the breach, though it declined to offer credit monitoring services. No hacker group has claimed responsibility, and the method of attack remains undisclosed. Source: HealthExec
  • Health data now exists across marketing platforms, analytics tools, and scheduling systems outside the reach of HIPAA regulations. Data from appointment scheduling, symptom checkers, call center recordings, and website browsing can reveal conditions and treatments even when it does not qualify as protected health information. In 2025, California Attorney General Rob Bonta reached a $1.55 million settlement with Healthline under the California Consumer Privacy Act for sharing users’ article views about medical conditions with advertising partners without honoring opt-out rights. State laws including the CCPA and Washington’s My Health My Data Act now regulate health data based on what it reveals rather than where it resides, while the EU GDPR treats health data as a category requiring heightened protection regardless of who collects it. Organizations should evaluate health data based on sensitivity and implement protections for information that reveals health status, even when HIPAA does not formally apply. Source: IAPP
  • Small medical practices can implement HIPAA-aligned DevSecOps without enterprise budgets by focusing on basic security controls rather than expensive tools. These organizations handle sensitive patient data through portals, scheduling systems, and cloud applications, yet often struggle with common security gaps including excessive admin permissions, secrets stored in plain text, and untested backup recovery procedures. AWS provides encryption services, CloudTrail, CloudWatch, and Secrets Manager that can support security efforts, but using these tools does not automatically ensure HIPAA compliance without proper architecture and monitoring. DevSecOps integrates security into software development and deployment processes through CI/CD pipelines that scan dependencies, detect exposed secrets, and restrict production deployments. According to Andrii Klepak, DevOps Engineer and founder of CloudCare Pro, small practices need a baseline of limited admin access, MFA, encrypted storage, controlled deployments, and tested recovery rather than enterprise security programs. Source: HIT Consultant

Artificial Intelligence in Healthcare

  • Tennessee prohibits AI systems from being marketed as mental health professionals under a law signed April 1, 2026. SB 1580 bars developers or deployers of AI systems from advertising that such systems can act as qualified mental health professionals, effective July 1, 2026. The law defines AI as models and systems capable of performing functions associated with human intelligence, including reasoning and learning. Violations constitute violations of the Tennessee Consumer Protection Act of 1977 and carry civil penalties up to $5,000 per violation, with enforcement available through a private right of action. Tennessee lawmakers are considering companion bills that would make it a felony to train AI to encourage suicide or homicide. Source: Troutman Privacy

Regulatory Compliance

  • Recipients of federal financial assistance from the Department of Health and Human Services must ensure their digital content complies with WCAG 2.1 Levels A and AA standards by May 11, 2026, if they have 15 or more employees, or by May 10, 2027, if they have fewer than 15 employees. The rule, issued by HHS on May 9, 2024, represents the first comprehensive update to Section 504 regulations in nearly 50 years and applies to hospitals, physician practices, health centers, long-term care facilities, health plans, research institutions, and medical schools that receive HHS funds. The standards cover websites, mobile apps, social media accounts, patient portals, and telehealth platforms, though five exceptions exist for archived content, preexisting documents, password-protected individualized documents, preexisting social media posts, and content posted by third parties. Medicare Part B reimbursement alone triggers coverage under the rule. Noncompliance can result in investigations, suspension or termination from government programs, loss of federal funding, and private litigation. Source: Alston & Bird
  • Clinicians can communicate orders via text message to clinical staff under specific conditions. The Centers for Medicare and Medicaid Services and The Joint Commission allow text message orders when sent through HIPAA-compliant, secure texting platforms consistent with Medicare Conditions of Participation. Clinicians must ensure messages are sent securely, orders are promptly entered and authenticated in the medical record, and EHR documentation remains accurate and accessible. Many communication platforms claim HIPAA compliance, but free versions often lack this protection for texting. Organizations must routinely assess the security and integrity of their texting platforms to prevent risks to patient privacy and safety. Source: American Medical Association
  • Certain federal and state agencies can conduct unannounced inspections of companies without warrants or prior notice under “walk-in authority.” Companies in regulated sectors such as healthcare, government contracting, pharmaceuticals, and environmental face inherent risk of surprise compliance inspections. Agencies with walk-in authority include the Food and Drug Administration, the Occupational Safety and Health Administration, the Environmental Protection Agency, and the Centers for Medicare and Medicaid Services, but each agency can only request materials related to its regulatory area. Agencies without walk-in authority, such as the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Internal Revenue Service, must obtain a warrant or subpoena to conduct unannounced inspections. Companies can prepare by designating a communication point person, maintaining organized records, training staff, and establishing relationships with outside counsel. Source: Smith Anderson
  • CMS has implemented two regulatory changes that restrict ownership transactions and new enrollments for DMEPOS suppliers. The agency extended the 36-month rule to DMEPOS suppliers through a final rule published December 2, 2025, effective January 1, 2026, which prevents Medicare billing privileges from transferring to new owners when a change in majority ownership occurs within 36 months of initial enrollment or the most recent ownership change. On February 27, 2026, CMS imposed a nationwide six-month moratorium on new Medicare enrollments for certain DMEPOS medical supply companies across all 50 states, U.S. territories, and the District of Columbia. The intersection of these regulations means that suppliers undergoing ownership changes within the 36-month window during the moratorium period cannot reenroll in Medicare, potentially eliminating Medicare revenue from acquired businesses. Florida has followed suit with its own six-month moratorium on new DME provider enrollments in the state Medicaid program effective March 2026. Source: Katten Muchin Rosenman LLP

Insurance & Reimbursement