Fraud & Abuse Enforcement
- A federal grand jury indicted Houston physician Dr. Joseph A. Montes on charges that he and others billed a federal COVID-19 program about $30 million for office visits that never occurred. The 12-count indictment, returned September 30 and unsealed October 6, alleges that Montes let co-conspirators run pop-up COVID-19 testing sites under his name while billing the Health Resources and Services Administration (HRSA) for office visits instead of the nasal swab tests patients received. Prosecutors allege his two clinics submitted more than 3,000 evaluation and management claims on each of about 29 dates, and more than 9,000 claims on December 1, 2021, alone, roughly one visit every nine seconds. HRSA paid about $20 million of the $30 million billed from 2020 to 2022, and Montes allegedly spent proceeds at a luxury car dealership and Tiffany & Co. He faces up to 20 years in prison for each wire fraud count and 10 years for each money laundering count. Source: U.S. Department of Justice
- Plano-based Heal 360 Urgent Care, Heal 360 Primary Care, and owner Dr. Mohammed Amer Mohiuddin agreed to pay $20 million to resolve False Claims Act allegations that they billed a federal COVID-19 program for evaluation and management services they did not perform. The government alleges the clinics ran dozens of walk-up and drive-through testing sites where patients stayed in their cars for a nasal swab, then billed HRSA’s uninsured program using higher-paying E/M codes instead of CPT 99211 for specimen collection. Remote scribes overseas allegedly filled template medical records with “past medical history” and “examination” sections, and Mohiuddin was listed as the rendering physician on most claims although he did not treat patients at the sites. The settlement resolves two qui tam suits filed in the Eastern and Northern Districts of Texas, and the whistleblowers will receive $3.4 million. A related asset forfeiture agreement credits proceeds from the sale of properties Mohiuddin bought toward the settlement. Source: The Washington Times
Medicare & Medicaid Policy
- CMS issued tiered guidance that states may use to decide which Medicaid beneficiaries are medically frail enough to be exempt from the work requirements taking effect in January 2027. The One Big Beautiful Bill Act requires most beneficiaries to complete 80 hours a month of work, education, work programs, or community service to stay enrolled. Under the guidance, Tier 1 conditions such as severe dementia qualify on diagnosis codes alone, Tier 2 conditions such as Type 2 diabetes need additional documentation of severity, and Tier 3 covers beneficiaries with too little data, who require manual review. The system is optional, and states may consider recent hospitalizations, prescription counts, and medical equipment use for Tier 2 decisions. The American College of Physicians and a group of beneficiaries sued CMS and HHS over the rule in September, and the Congressional Budget Office estimates the requirement could leave 5.3 million more people uninsured by 2034. Source: Healthcare Brew
- CMS finalized the Global Benchmark for Efficient Drug Pricing (GLOBE) Model, a mandatory test that uses international drug prices to calculate Medicare Part B inflation rebates for certain drugs. The model applies to separately payable Part B drugs and biologicals, which clinicians typically administer, and sets a benchmark from prices paid in economically comparable countries. The final rule excludes biosimilars and their reference products once a biosimilar enters the U.S. market, and, in response to comments, also excludes orphan-only drugs, plasma-derived products, and certain cell and gene therapies. GLOBE runs from January 1, 2027, through March 31, 2032, in randomly selected geographic areas covering about 25% of Original Medicare beneficiaries. Beneficiaries in those areas may see lower out-of-pocket costs starting April 1, 2027. Source: CMS.gov
Payers & Insurers
- Texas Attorney opened an investigation into whether UnitedHealthcare unlawfully denied coverage and engaged in deceptive practices. The office issued Civil Investigative Demands requiring the insurer to produce records, with the Texas Deceptive Trade Practices Act as the focus of the inquiry. Paxton cited a report that UnitedHealthcare paid nursing homes to delay hospitalizing patients, and a case in which the company allegedly withdrew a prior authorization for a procedure at RedBud Surgery Center in Austin and refused to pay after the procedure was done. UnitedHealthcare previously sued The Guardian, which first reported the nursing home allegations, for defamation, and a judge dismissed that suit on First Amendment grounds. The company has not publicly responded to the investigation. Source: HealthExec
- CHRISTUS Health Plan is withdrawing from Medicare Advantage in 2027, and thousands of East Texas enrollees must choose new coverage by December 7. Affected counties include Bowie, Cass, Red River, Gregg, Harrison, Marion, Morris, Panola, Titus, Upshur, Henderson, and Rusk. Most carriers leaving Medicare Advantage for 2027 are hospital-based plans, though national insurers have also reduced their offerings. Enrollees can get free help from the Texas Health Information, Counseling and Advocacy Program at 1-800-252-9240 or from 1-800-MEDICARE, and CHRISTUS members can call the plan at 1-844-282-3026. Source: Killeen Daily Herald
Artificial Intelligence
- States continue to enact laws governing AI in health care, including two Texas laws that require providers to disclose AI use to patients. The Texas Responsible Artificial Intelligence Governance Act, effective January 1, 2026, requires providers that use AI in a patient’s care to disclose it no later than the date service is first provided, and University Health and Houston Methodist have built the disclosure into their consent processes. Texas SB 1188, effective September 1, 2025, permits AI diagnosis and treatment recommendations if practitioners disclose the use and review AI-generated records, requires patient EHRs to be stored in the U.S., and sets civil penalties of up to $250,000 when protected health information is used for financial gain. California enacted AB 1979 and SB 503 on September 30, 2026, protecting clinician judgment when AI tools are used and requiring developers and deployers of clinical decision support systems to reduce and monitor bias. Iowa now bars AI from being the sole basis for denying a prior authorization request, and Rhode Island, Maine, and Illinois restrict AI in therapy and require patient notice or consent. Source: Becker’s Hospital Review
- HIPAA’s coverage turns on who holds health data rather than on the data itself, leaving a growing share of consumer health information and AI tools outside health-specific regulation. Records a patient directs to a third-party app lose HIPAA protection, and the FDA’s January 2026 General Wellness revision lets noninvasive trackers of blood pressure, oxygen saturation, and glucose trends avoid device review if they make no disease claims. The same AI tool can be a business associate when a hospital deploys it and an unregulated consumer app when a patient selects it, which leaves health system counsel unable to classify such tools. Recommendations include HHS guidance classifying AI intermediaries that handle clinical data and a congressional rewrite tying obligations to the function performed and the sensitivity of the data. For Texas, the recommendations call for clarifying when AI interpretation of health data is the practice of medicine, setting contract standards for AI tools in Medicaid managed care, and funding remote-monitoring programs in rural areas. Source: Baker Institute
- Houston Methodist increased cardiothoracic surgical volume by 7%, about 25 additional cases a month, after deploying an image-based AI platform in its 15-room suite. The health system measured the gain against a synthetic control built from other Houston Methodist operating room sites that had not adopted the technology. The platform, from vendor Apella, automatically identifies perioperative events and feeds dashboards, scheduling tools, and reports used by OR leaders, anesthesia, surgeons, housekeeping, and infection control. Case mix and operative minutes stayed stable while turnover times fell, so the added cases came from using existing OR hours more efficiently. Median late-start minutes fell about 2.7 minutes per case, a result the system describes as exploratory. Source: Healthcare IT News
HIPAA & Data Privacy
- A breach of legacy Cerner servers owned by Oracle Health exposed the health information of nearly 20 million people at up to 80 U.S. hospitals. A single attacker used stolen credentials to access two servers not yet migrated to Oracle Cloud between January 22 and April 1, 2026, took names, Social Security numbers, diagnoses, medications, test results, and medical images, and then demanded a ransom to prevent disclosure. State notifications show 2,992,244 affected individuals in Texas, 1,978,661 in Oregon, 283,903 in South Carolina, and 69,238 in Washington. Affected providers include AdventHealth, Aultman Health System, Baptist Health South Florida, and Munson Healthcare. Class actions filed against Oracle Health allege negligence, delayed notification, and violations of HIPAA and state breach notification laws. Source: Rescana
- A signed business associate agreement does not make a marketing tool HIPAA-compliant or cover the ad platforms and tracking pixels that receive patient data downstream. Hashed emails, IP addresses, and device IDs placed next to health context can be PHI, and hashing does not satisfy either HIPAA de-identification method. Server-side tagging changes where data is collected but not what is disclosed, and a vendor’s promise to strip PHI after receipt does not cure the disclosure. Disclosing PHI to a third party for marketing requires a HIPAA authorization, which a privacy policy or cookie banner cannot replace, and EHR data piped into customer data platforms can reach ad platforms through audience syncs. State wiretap and medical confidentiality class actions, with class periods reaching back to when a tag was installed, present the largest financial exposure. Source: MarTech
FDA Enforcement
- FDA warned Amazon and Walmart that over-the-counter products marketed for genital herpes symptoms and shipped through their fulfillment services are unapproved new drugs. FDA bought the products through amazon.com and walmart.com in July 2026, and the October 1 letters cover nine products sold through Fulfillment by Amazon and three sold through Walmart Fulfillment Services, including HClear for him, Herstat GST, and Terragen HG Formula on both sites. FDA cited label claims such as “fast-acting genital herpes symptom relief” and “reduces recurrence” and stated that it has not approved any OTC drug to treat, cure, or prevent a sexually transmitted infection, so distributing the products violates sections 301(d) and 505(a) of the Federal Food, Drug, and Cosmetic Act. Products labeled homeopathic remain subject to approval requirements, and five of the Amazon products fall outside FDA’s homeopathic enforcement guidance because they contain lemongrass, which the Homeopathic Pharmacopeia of the United States does not list. Walmart and Amazon each have 15 business days to respond. Source: FDA
- Leader Formulas of Tomball, Texas, recalled one lot of RAPTURE Preworkout after FDA testing found 1,3-dimethylamylamine (DMAA). DMAA can raise blood pressure and lead to heart attack, shortness of breath, and chest tightening. The recalled lot, 260327-4, includes Rainbow Twist, Electric Lemonade, and Berry Mojito flavors sold in 450g containers. The company distributed the product nationwide from January 29, 2025, through May 25, 2026, through retail stores and its website. Consumers should stop using it and return it for a refund, and the company has received no adverse event reports. Source: FDA
