Insights

On August 13, 2026, the Centers for Medicare and Medicaid Services (CMS) published its final rule banning the use of federal funds — through Medicaid and the Children’s Health Insurance Program (CHIP) — to pay for gender-affirming care for children and youth. The final rule takes effect October 13, 2026 (“Prohibition on Federal Medicaid and Children's Health Insurance Program Funding for Sex-Rejecting Procedures Furnished to Children”). While CMS finalized several key elements of its late-2025 proposed rule (Client Alert December 24, 2025), the proposed Medicare hospital Condition of Participation rule remains in proposed form.

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

In June 2026, federal regulators and lawmakers continued their efforts to improve drug affordability through targeted reforms. These recent developments will primarily impact pharmaceutical manufacturers, managed care organizations, and pharmacy benefit managers (PBM) serving Medicare Part D program members. PBMs, Medicare Advantage organizations, and Part D sponsors should monitor these changes in the interest of maintaining compliance and providing input on regulatory proposals that may influence their business operations or compensation structures in the future.

Two significant recent developments illustrate the Trump administration’s increasing focus on policing of hospital contracting practices that limit health plan network design flexibility. On June 16, 2026, the U.S. Department of Justice (DOJ) Antitrust Division and Ohio attorney general filed a proposed consent decree resolving their civil antitrust suit against OhioHealth. (Prior Alert) Two days later, the White House Council of Economic Advisers (CEA) released a memorandum quantifying the potential economic effects of a broader ban on the types of contracting restrictions at issue in the OhioHealth case and the DOJ's parallel suit against NewYork-Presbyterian. This alert updates our prior coverage of the OhioHealth complaint and summarizes both developments.

On the surface, United States v. Bankman-Fried is a case about the collapse of a cryptocurrency exchange. But the U.S. Court of Appeals for the Second Circuit’s recent opinion — affirming Samuel Bankman-Fried’s conviction on seven counts of fraud and conspiracy — carries important lessons that extend well beyond the world of digital assets.

On Wednesday, June 3, 2026, the Department of Health and Human Services (HHS) published an interim final rule with comment (IFC) instructing all state Medicaid agencies to incorporate “community engagement” as an eligibility condition for program participation by no later than January 1, 2027. The rule (Medicaid Program; Community Engagement Requirement for Certain Individuals) does not impose affirmative operational obligations for Medicaid managed care plans, as it focuses primarily on equipping the states to administer the community engagement requirement. However, it does establish a few specific guardrails to govern the role managed care organizations, prepaid inpatient health plans, and prepaid ambulatory health plans may — and may not — play in that administration.

With the Centers for Medicare & Medicaid Services (CMS) poised to determine which organ procurement organizations (OPO) will retain their Medicare certification and service territories under a controversial new performance framework, a coalition of OPOs is fighting to have its day in court — but first, it must convince a federal judge that the courthouse doors are open to it at all. The U.S. District Court for the Middle District of Florida is actively weighing whether it has jurisdiction to hear a pre-enforcement challenge to a 2020 Final Rule, which introduced a competitive three-tier performance model that threatens lower-performing OPOs with the loss of their designated service areas (DSA) and, potentially, their Medicare certifications. The resolution of this threshold question will determine whether the plaintiff OPOs can seek judicial relief ahead of decertification proceedings, which CMS has signaled will occur after it finalizes its 2026 Proposed Rule at the end of the year.

On May 27, 2026, the U.S. District Court for the Southern District of Georgia issued a sweeping decision in Clover Insurance Company v. HHS that could ultimately lead to the invalidation of nearly half of all Star Ratings measures and, potentially, lead the Centers for Medicare & Medicaid Services (CMS) to seek statutory changes to Medicare law.

The first applications to lift an automatic suspension under the Procurement Act 2023 (the Act) have recently been decided. In Parkingeye Limited v Velindre University NHS Trust & Anor [2026] EWHC 1019 (TCC), handed down on 1 May 2026, HHJ Keyser KC dismissed applications by two NHS contracting authorities to lift the suspension preventing them from concluding a car park management services contract. This is the first judicial consideration of the new test under section 102(2) of the Act.

On April 29, 2026, the New York Department of Financial Services (NYDFS) announced the finalization of a $2.25 million settlement with Delta Dental of New York and Delta Dental Insurance Co., resolving allegations that the affiliated companies failed to comply with the state’s stringent cybersecurity, consumer data protection, and incident reporting requirements. For health insurers, managed care organizations, and their third-party service providers operating in New York, the announcement comes as the latest signal that the NYDFS intends to aggressively enforce its cybersecurity regulations — which are widely considered the strictest in the nation following a 2023 overhaul. These regulations, codified at 23 NYCkRR 500 (Cybersecurity Requirements for Financial Services Organizations), apply to any entity licensed under New York insurance law, including health insurers, managed care organizations, and their third-party service providers.

The appropriate use of AI tools during the claims review process continues to be a major topic of debate within the health care industry — but in recent weeks, emerging litigation has inspired critics to turn their attention specifically to the technology’s application within federal health programs. On March 25, 2026, the Electronic Frontier Foundation (EFF) filed a lawsuit against the Centers for Medicare and Medicaid Services (CMS), citing the agency’s alleged failure to answer a Freedom of Information Act (FOIA) request for records the EFF believes will provide crucial insight into the design, safeguards, vendor relationships, and real-world performance of the Medicare Wasteful and Inappropriate Service Reduction (WISeR) Model, CMS’s  AI-driven prior authorization pilot program for certain Medicare services.

On April 30, 2026, the DOJ announced the launch of the Fraud Oversight through Careful Use of Statistics initiative (FOCUS) to increase coordination between the Department and the growing host of data miners who sift through publicly available government data to identify patterns of alleged fraud. The launch of FOCUS highlights a growing trend in False Claims Act (FCA) enforcement: civilian data miners with access to public data — but no other connection to the alleged defendants — are filing almost as many qui tam complaints as company insiders.

On April 10, 2026, the Centers for Medicare and Medicaid Services (CMS) issued a proposed rule (2026 CMS Interoperability Standards and Prior Authorization for Drugs, or CMS-0062-P) outlining the agency’s plans to impose new interoperability requirements on payors participating in certain Medicare and Medicaid programs. As described by the agency in a recent press release, the proposed rule “builds on” prior rulemaking by clarifying and enhancing interoperability requirements for payors’ prior authorization processes, specifically those associated with coverage requests for pharmaceutical therapies.

In mid-April, a bipartisan coalition of 45 State Attorneys General (AG) submitted a formal letter to the U.S. Department of Labor (DOL) expressing their collective support for a proposed rule (Improving Transparency into Pharmacy Benefit Manager Fee Disclosure, or RIN 1210-AB37), which would — if enacted — impose new disclosure obligations on pharmacy benefit managers (PBM) regulated under the Employee Retirement Income Security Act of 1974 (ERISA).

In keeping with ongoing efforts to intensify regulatory oversight of organ procurement organizations (OPOs) and curtail improper spending within federal health programs, the Centers for Medicare & Medicaid Services (CMS) recently issued a proposed rule that would, among other adjustments, align Medicare payment policies for non-renal organs to be consistent with those currently applicable to kidneys. If enacted as drafted, this latest rule could have a direct impact on the financial stability of OPOs and histocompatibility laboratories (HCL) at a time when such organizations face increasing pressure to meet CMS’s new outcome measures — or else face non-renewal or decertification later this year. 

On April 6, 2026, the Centers for Medicare & Medicaid Services (CMS) published its final rule governing the Medicare Advantage (Part C) and Prescription Drug Benefit (Part D) programs for Contract Year (CY) 2027. The final rule is effective June 1, 2026, with most provisions applicable to coverage beginning January 1, 2027, and marketing and communications changes taking effect October 1, 2026. Beyond payment, the rule pursues a broad deregulatory agenda aligned with Executive Order 14192, reversing marketing and enrollment safeguards introduced in 2023 and easing documentation and reporting obligations, while introducing new program integrity requirements.

Is evidence that a company tracked return on investment (ROI) for certain actions and expenses sufficient to prove mens rea and plead a violation of the federal Anti-Kickback Statute (AKS) with the requisite particularity? A recent decision in the U.S. District Court for the Southern District of New York (SDNY) suggests that it is.

On Friday, April 10, 2026, the U.S. Department of Justice (DOJ) announced that International Business Machines Corporation (IBM) has agreed to pay just over $17 million to resolve allegations that it violated the False Claims Act (FCA) by failing to comply with federal anti-discrimination requirements incorporated into its federal contracts due to allegedly discriminatory diversity, equity, and inclusion (DEI) employment practices. This resolution marks the first FCA settlement secured by the DOJ under its Civil Rights Fraud Initiative, created in May 2025, and announced by then-Deputy Attorney General Todd Blanche as part of the administration’s coordinated efforts to target allegedly unlawful DEI practices. Per the agreement, the settlement is neither an admission of liability by IBM nor a concession by the United States that its claims are not well founded.

On April 6, 2026, the Centers for Medicare and Medicaid Services (CMS) circulated the Announcement of Calendar Year (CY) 2027 Medicare Advantage (MA) Capitation Rates and Part C and Part D Payment Policies (the CY 2027 Rate Announcement) to communicate Medicare Advantage (MA) capitation rates and Parts C and D payment policies. The Rate Announcement announces decisions regarding proposals initially published on January 26, 2026, in CMS’s CY 2027 Advance Notice for MA and Part D. The following is a summary of the most significant issues in the Rate Announcement, with further details below: