Insights

On October 1, 2026, the U.S. Department of Justice’s (DOJ) National Fraud Enforcement Division issued Directive 26-12: Corporate Enforcement in the Fight Against Fraud. Assistant Attorney General Colin M. McDonald’s October directive follows his August 2026 memorandum setting the Division’s enforcement priorities. The directive signals — in the DOJ’s words — “an aggressive, all-tools” enforcement posture across the Division’s health care, government contracting, tax, and trade fraud priorities, while simultaneously supporting the incentives designed to promote transparency, reward cooperation, and encourage voluntary disclosure of misconduct. 

 On September 28, 2026, the U.S. District Court for the Middle District of Florida upheld the U.S. Centers for Medicare and Medicaid Services’ (CMS) final rule governing organ procurement organizations (OPO). The rule, promulgated in 2020, will have its fullest effect when CMS releases final OPO performance rankings determining the fate of the 55 OPOs (Regulatory Uncertainty Ahead For Organ Transplant System). The Middle District of Florida is among five courts hearing challenges to the rule and the first to issue a decision. Legacy of Life Hawaii v. HHS, which was filed August 6, 2026, is the most recent.  

On August 31, 2026, the U.S. Securities and Exchange Commission (SEC) and the U.S. Food and Drug Administration (FDA) signed a Memorandum of Understanding (MOU) establishing a formal framework for the two agencies to share non-public information concerning FDA-regulated products and the companies and individuals engaged in their manufacture, distribution, and sale. The MOU was signed by SEC Chairman Paul S. Atkins and Acting FDA Commissioner Kyle Diamantas. It takes immediate effect and runs for three years, subject to renewal, modification, or termination. In a press release, Chairman Atkins described FDA-related disclosures by public companies as having “a significant impact on our markets” and identified the FDA as “a valuable partner in our efforts to administer and enforce applicable disclosure requirements under the federal securities laws.” Acting Commissioner Diamantas framed the MOU as protecting “both the patients who rely on FDA-regulated products, and the public trust that drives health care innovation.”

The rapid emergence of AI/ML tools in drug discovery, from target identification to generative molecular design, lead optimization, and repurposing, has transformed how life sciences companies build some of their most valuable assets. As AI/ML tools take on an increasingly significant role in the drug discovery process, companies face a set of largely unresolved IP challenges that require careful planning and proactive governance.  

The Centers for Medicare and Medicaid Services (CMS) will add four condition tracks to its Advancing Chronic Care with Effective, Scalable Solutions (ACCESS) Model next spring, according to a September 15 announcement, to address gaps in chronic disease management between scheduled provider visits. The 10-year voluntary model officially launched on July 5, 2026. In its initial form, ACCESS targeted four high-prevalence conditions: high blood pressure, diabetes, chronic musculoskeletal pain, and depression. CMS reports that three out of four Medicare beneficiaries qualify for at least one existing ACCESS track. The new and expanded condition tracks are heart failure, chronic obstructive pulmonary disease (COPD), substance use disorders (SUDs), and tobacco cessation. In addition, the existing chronic musculoskeletal pain track, which is currently limited to an initial 12-month period, will be extended for certain specified conditions.  

The U.S. Department of Health and Human Services’ (HHS) Office of Research Integrity (ORI) published its long-anticipated Guidance on Generative Artificial Intelligence in August. The guidance explains how generative AI (GenAI) use is evaluated under the revised research misconduct regulations (42 CFR Part 93), which took effect January 1, 2025, and became applicable to new allegations on January 1, 2026. The new guidance builds on prior guidance documents regarding the definitions of fabrication, falsification, and plagiarism, as well as revised evidentiary standards. As of April 30, 2026, institutions were required to have compliant policies on file with ORI as part of their annual report covering 2025. 

Between 2021 and 2025, Medicaid spending on ABA therapy grew six times faster than the number of children who received services, making it one of the fastest-growing areas of Medicaid expenditure, according to CMS. On August 4, 2026, CMS released a toolkit to help state Medicaid and CHIP agencies strengthen their programs and limit fraud, waste, and abuse tied to increased demand for ABA therapy. In 2025, Medicaid spent about $10 billion on ABA and related therapy services for children with ASD — a dramatic increase from the $2 billion spent in 2021. 

Over the past several years, the biopharmaceutical industry has embraced artificial intelligence and machine learning (AI/ML) in near lockstep with the pace of AI/ML innovations. Today, industry leaders are using AI/ML to, among other things: discover and assess biological pathways, target chemical structures and sequences; design proteins; model pre-clinical and clinical trials; recruit and screen potential patient populations; evaluate clinical trial results and biomarker data; prepare regulatory filings; and manage supply chains. Deployment of new AI/ML models promises extraordinary advances in pharmaceutical development. However, as with any technological and scientific advances, the use of AI/ML also poses substantial legal risks that life sciences companies need to consider and proactively manage. 

On September 8, 2026, the U.S. Department of Labor's (DOL) Employee Benefits Security Administration (EBSA) issued “Field Assistance Bulletin No. 2026-03” to clarify compliance with the Mental Health Parity and Addiction Equity Act (MHPAEA) and nonquantitative treatment limitations (NQTL). Under the 2013 final rule implementing MHPAEA, health plans and issuers must use comparable processes, strategies, evidentiary standards, or other factors when applying NQTLs and they cannot apply such methods more stringently to benefits for mental health and substance use disorder (MH/SUD) compared to benefits for general medical and surgical care. While the bulletin doesn’t break much new ground on compliance, it does reaffirm existing enforcement priorities and expectations. 

The U.S. Food & Drug Administration (FDA) is seeking feedback on a regulatory framework that could be used to evaluate generative artificial intelligence (GenAI)-enabled medical devices. Such devices could create new types of risks because their outputs can vary and evolve, unlike more traditional software-enabled devices. An August 18, 2026, discussion paper (“Considerations for the regulation of GenAI-enabled medical devices”) discusses potential regulatory considerations for GenAI-enabled medical devices. 

On August 13, 2026, the Centers for Medicare and Medicaid Services (CMS) published its final rule banning the use of federal funds — through Medicaid and the Children’s Health Insurance Program (CHIP) — to pay for gender-affirming care for children and youth. The final rule takes effect October 13, 2026 (“Prohibition on Federal Medicaid and Children's Health Insurance Program Funding for Sex-Rejecting Procedures Furnished to Children”). While CMS finalized several key elements of its late-2025 proposed rule (Client Alert December 24, 2025), the proposed Medicare hospital Condition of Participation rule remains in proposed form.

After identifying a ransomware attack in 2021, OSF Healthcare System waited until its forensic investigation had concluded before notifying the U.S. Department of Health and Human Services (HHS) — and the affected individuals — of the breach. The 110-day delay (nearly double the 60-calendar-day notification deadline mandated by the HIPAA Breach Notification Rule) triggered an investigation from HHS’s Office for Civil Rights (OCR). The health system’s investigation determined that protected health information (PHI) had been stolen.

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

In June 2026, federal regulators and lawmakers continued their efforts to improve drug affordability through targeted reforms. These recent developments will primarily impact pharmaceutical manufacturers, managed care organizations, and pharmacy benefit managers (PBM) serving Medicare Part D program members. PBMs, Medicare Advantage organizations, and Part D sponsors should monitor these changes in the interest of maintaining compliance and providing input on regulatory proposals that may influence their business operations or compensation structures in the future.

Two significant recent developments illustrate the Trump administration’s increasing focus on policing of hospital contracting practices that limit health plan network design flexibility. On June 16, 2026, the U.S. Department of Justice (DOJ) Antitrust Division and Ohio attorney general filed a proposed consent decree resolving their civil antitrust suit against OhioHealth. (Prior Alert) Two days later, the White House Council of Economic Advisers (CEA) released a memorandum quantifying the potential economic effects of a broader ban on the types of contracting restrictions at issue in the OhioHealth case and the DOJ's parallel suit against NewYork-Presbyterian. This alert updates our prior coverage of the OhioHealth complaint and summarizes both developments.

On the surface, United States v. Bankman-Fried is a case about the collapse of a cryptocurrency exchange. But the U.S. Court of Appeals for the Second Circuit’s recent opinion — affirming Samuel Bankman-Fried’s conviction on seven counts of fraud and conspiracy — carries important lessons that extend well beyond the world of digital assets.

On Wednesday, June 3, 2026, the Department of Health and Human Services (HHS) published an interim final rule with comment (IFC) instructing all state Medicaid agencies to incorporate “community engagement” as an eligibility condition for program participation by no later than January 1, 2027. The rule (Medicaid Program; Community Engagement Requirement for Certain Individuals) does not impose affirmative operational obligations for Medicaid managed care plans, as it focuses primarily on equipping the states to administer the community engagement requirement. However, it does establish a few specific guardrails to govern the role managed care organizations, prepaid inpatient health plans, and prepaid ambulatory health plans may — and may not — play in that administration.

With the Centers for Medicare & Medicaid Services (CMS) poised to determine which organ procurement organizations (OPO) will retain their Medicare certification and service territories under a controversial new performance framework, a coalition of OPOs is fighting to have its day in court — but first, it must convince a federal judge that the courthouse doors are open to it at all. The U.S. District Court for the Middle District of Florida is actively weighing whether it has jurisdiction to hear a pre-enforcement challenge to a 2020 Final Rule, which introduced a competitive three-tier performance model that threatens lower-performing OPOs with the loss of their designated service areas (DSA) and, potentially, their Medicare certifications. The resolution of this threshold question will determine whether the plaintiff OPOs can seek judicial relief ahead of decertification proceedings, which CMS has signaled will occur after it finalizes its 2026 Proposed Rule at the end of the year.

On May 27, 2026, the U.S. District Court for the Southern District of Georgia issued a sweeping decision in Clover Insurance Company v. HHS that could ultimately lead to the invalidation of nearly half of all Star Ratings measures and, potentially, lead the Centers for Medicare & Medicaid Services (CMS) to seek statutory changes to Medicare law.

The first applications to lift an automatic suspension under the Procurement Act 2023 (the Act) have recently been decided. In Parkingeye Limited v Velindre University NHS Trust & Anor [2026] EWHC 1019 (TCC), handed down on 1 May 2026, HHJ Keyser KC dismissed applications by two NHS contracting authorities to lift the suspension preventing them from concluding a car park management services contract. This is the first judicial consideration of the new test under section 102(2) of the Act.