This week

• Ambulatory Surgery Centers
• Advisory Opinions
• Drug & Device
• Fraud & Abuse
• HIPAA
• Licensure
• Non-Competes
• Pharmacy Benefits Managers
• Reproductive Rights

Ambulatory Surgery Centers

• ​Ambulatory surgery centers now treat patients with conditions far beyond their original design parameters. ASCs increasingly care for patients with diabetes, obesity, cardiovascular disease, arrhythmias, anticoagulation therapy, pulmonary disease, and renal impairment, often in combination. Facilities face operational challenges including tracking postoperative infections when patients receive dialysis multiple times per week, determining whether to accept data from personal devices like continuous glucose monitors, and lacking equipment such as Hoyer lifts for non-ambulatory patients. Medicare expands the list of procedures eligible for ASC performance annually, adding total joint replacements, spine interventions, and cardiac and vascular procedures that bring longer operative times and higher risk. Accrediting organizations now require evidence of how care is delivered rather than just written policies, while staff confront questions about preoperative assessment responsibility when patients see multiple specialists. Source: VMG Health​

Advisory Opinions

• ​The HHS Office of Inspector General issued a Special Advisory Bulletin on January 27, 2026, establishing safeguards for direct-to-consumer prescription drug programs to mitigate risks under the federal Anti-Kickback Statute. The guidance, issued in anticipation of the TrumpRx platform launch, identifies DTC programs as low risk when prescription drugs are not billed to federal health care programs, sales are not conditioned on future purchases, and six characteristics are met including valid prescriptions from independent prescribers, no claims submission to insurers, no marketing of other products, no conditional pricing, availability for at least one plan year, and exclusion of controlled substances. The Bulletin does not address relationships between pharmaceutical manufacturers and physicians, pharmacies, pharmacy benefit managers, telemedicine vendors, or marketers. OIG published a Request for Information on January 29, 2026, seeking industry feedback on whether modifications to AKS safe harbors and Beneficiary Inducement Civil Monetary Penalty exceptions are needed to support DTC arrangements while preventing harms such as increased costs, inappropriate patient steering, and distorted clinical decision making. Source: DLA Piper​
• ​The Department of Health and Human Services’ Office of Inspector General issued two negative advisory opinions in 2025 finding that medical device companies’ arrangements to pay third-party fees required by healthcare provider customers violated the Anti-Kickback Statute. In Advisory Opinion 25-04, OIG determined that a medical device company’s proposal to pay a third party to screen the company for exclusion from federal healthcare programs relieved customers of a financial burden they would otherwise bear. In Advisory Opinion 25-08, OIG concluded that a medical device company’s payments to access a third-party billing platform customers required for purchasing surgical products constituted prohibited remuneration, even though customers also paid to use the platform. OIG rejected the personal services and management contracts safe harbor defense in AO 25-08 because the billing platform was redundant to the company’s existing systems and provided no benefits beyond meeting customer requirements. OIG determined both arrangements created anti-competition and steering risks by giving advantages to companies willing to pay the fees over competitors that declined such arrangements. Source: Paul Hastings LLP​

Drug & Device

• ​The FDA issued revised guidance in January 2026 that establishes when clinical decision support software and wellness products fall outside medical device regulation. For software to qualify as non-device CDS, it must meet four criteria: it cannot analyze medical images or diagnostic signals, must display patient data or medical information, can support but not replace clinician judgment, and must allow clinicians to review the reasoning behind recommendations. Wellness products can avoid regulation when intended only for general wellness use, present low risk, remain non-invasive, and do not diagnose, treat, or substitute for FDA-authorized devices. The guidance permits wellness wearables to measure blood pressure, oxygen saturation, blood glucose, and heart rate variability if outputs are validated and limited to wellness contexts. Marketing claims and intended use determine whether products trigger FDA oversight, as references to diseases, clinical thresholds, or unvalidated data can make software or wearables subject to regulation. Source: Arnall Golden Gregory LLP​
• ​The FDA has shifted toward reducing development burdens for biosimilar products through an abbreviated licensure pathway under Section 351(k) of the Public Health Service Act. A biosimilar must be highly similar to the reference product and have no clinically meaningful differences in safety, purity, and potency, while sponsors can now demonstrate biosimilarity through analytical assessments and pharmacokinetic or pharmacodynamic data rather than Phase 3 trials. Interchangeable biosimilars must meet two additional requirements: producing the same clinical result in any given patient and showing that switching between products carries no greater risk than continuing the reference product, though the FDA’s June 2024 draft guidance indicates switching studies are no longer required in most cases. Biosimilars operate under different statutory frameworks than generics, permitting labeling flexibility and product presentation differences, as evidenced by the FDA’s January 2025 approval of the first interchangeable biosimilar in an autoinjector format while the reference product was available only in vial or prefilled syringe formats. The first licensed interchangeable biosimilar receives exclusivity under Section 351(k)(6) of the PHSA, blocking approval of subsequent interchangeable biosimilars for defined periods. Source: Alston & Bird​

Fraud & Abuse

• ​The Department of Justice recovered $5.7 billion from the healthcare industry in False Claims Act cases. The enforcement actions targeted three areas: Medicare Advantage managed care plans, prescription drug companies, and providers billing for services that were medically unnecessary. Companies paid hundreds of millions in settlements for schemes including false diagnosis codes to inflate payments, kickbacks to brokers and prescribers, price fixing, and dispensing drugs without valid prescriptions. Omnicare and CVS faced a jury verdict of $948.8 million for billing federal programs for over three million false claims, while Teva Pharmaceuticals paid $450 million to resolve multiple allegations. The Medicare Advantage program represented a focus area because it is the largest component of Medicare by federal spending and beneficiaries. Source: Corruption, Crime & Compliance​
• ​The U.S. Department of Justice intervened in False Claims Act litigation against Priority Hospital Group, three long-term care hospitals, and a physician on January 16, 2026, alleging violations of the Anti-Kickback Statute and Stark Law related to medical director arrangements. The government alleges that Riverside Hospital paid Dr. Benjamin Newsom more than $450,000 between 2017 and 2022 under three medical director agreements to induce patient referrals and admissions, resulting in over $2 million in Medicare payments for referred patients and over $17 million for admitted patients. The DOJ claims the arrangements failed to satisfy legal safe harbors because no formal fair market value analysis was conducted, the hospitals prepared inaccurate timesheets showing 20 hours monthly when Dr. Newsom allegedly worked only two to two and a half hours per day, and the compensation was not tied to services rendered. Communications cited in the complaint include an instruction to staff to hand medical director checks to physicians “individually and ask for patients with them.” Organizations found in violation may face treble damages, civil penalties of $14,308 to $28,619 per violation, exclusion from federal healthcare programs, and criminal prosecution. Source: Barnes & Thornburg​
• ​A Houston transplant surgeon faces federal charges for allegedly falsifying medical records that rendered liver transplant patients ineligible for organ donations. John Stevenson Bynon Jr., 66, who served as Director of Abdominal Organ Transplantation and Surgical Director for Liver Transplantation at Memorial Hermann Health System, was indicted on five counts of making false statements in health care matters. The indictment alleges that Bynon made false entries in patient records that prevented them from receiving donor organ offers through the United Network for Organ Sharing, while patients, families, and other medical team members remained unaware of their ineligibility for months. Medicare continued to pay for health care benefits as if the patients were eligible for transplants. Two patients later received transplants at other facilities after the alleged falsifications were discovered. Source: U.S. Department of Justice, Southern District of Texas​
• ​Two healthcare companies agreed to pay more than $254,000 to settle allegations of improper billing practices. National Partners in Healthcare, LLC (NPH) of Richard, Texas, and Medstream Anesthesia Hawaii, PLLC of Dallas, Texas, agreed to pay $254,203.55 for allegedly violating the Civil Monetary Penalties Law. The companies self-disclosed their conduct to the Office of Inspector General. OIG alleged that NPH and Medstream submitted claims for time-based anesthesia services when no provider was present as required for billing such claims. Source: Office of Inspector General, U.S. Department of Health and Human Services​

HIPAA

• ​The healthcare industry faced a regulatory transformation in 2025 as federal and state agencies implemented changes to privacy and security requirements. In December 2024, HHS proposed the first update to the HIPAA Security Rule since 2013, eliminating the distinction between required and addressable safeguards and mandating multi-factor authentication, encryption, and 24-hour breach notifications from business associates, with the rule expected to become effective in July or August 2026. A federal court vacated the reproductive health privacy rule on June 18, 2025, while multiple states enacted privacy laws and HHS intensified enforcement, issuing its 53rd Right of Access action in March 2025 with a $200,000 penalty and warning that information blocking violations could result in penalties up to $1 million per violation. Healthcare data breaches affected 184 million individuals in 2024 and over 31 million in the first half of 2025, prompting regulators to focus on vendor oversight and supply chain security. On March 27, 2025, HHS announced a reorganization that will reduce its workforce from 82,000 to 62,000 employees and create a new Assistant Secretary for Enforcement to oversee all enforcement functions. Source: Healthcare Law Insights​
• ​Covered entities must update their Notice of Privacy Practices by February 16, 2026, and must account for state laws that impose stricter requirements than HIPAA. HIPAA establishes minimum privacy protections through “floor preemption,” allowing states to enact more demanding standards for health information privacy. State laws qualify as “more stringent” when they provide greater privacy protections, such as Colorado prohibiting disclosure of patient information for out-of-state investigations of gender-affirming care or reproductive healthcare, New Mexico requiring consent for electronic record disclosures, and Montana and Nevada mandating faster patient access to records than HIPAA requires (10 days and 10-20 working days respectively). The updated notices must reflect these more restrictive state rules where applicable, though many state privacy laws exempt HIPAA covered entities from their requirements. Covered entities that fail to analyze and incorporate applicable state laws risk noncompliance with both federal preemption requirements and state control mandates. Source: Holland & Hart LLP​
• ​Part 2 Programs and HIPAA covered entities that process substance use disorder records must update their Notice of Privacy Practices by February 16, 2026, under federal rulemaking. The requirement applies to providers that handle Part 2 SUD records from federally-assisted treatment facilities, including opioid treatment programs, hospital-based addiction counselors, and residential or outpatient treatment centers. HIPAA covered entities that process SUD records but are not Part 2 providers must disclose that SUD records carry heightened confidentiality protections, require written consent for most uses and disclosures, and cannot be used in legal proceedings without patient consent or a court order. Part 2 Programs must include a revised header, descriptions of permitted uses and disclosures, patient rights notifications, and program obligation statements in their updated NPPs. Part 2 programs may choose to integrate these revisions into their HIPAA NPP or create a separate document. Source: Roetzel & Andress​

Licensure

• ​The Texas Medical Board has established rules for provisional licenses for international medical graduates and limited licenses for unmatched physician graduates under House Bill 2038, though federal visa restrictions threaten implementation. IMGs, who comprise 25% of Texas physicians, must complete two cycles of two-year provisional licenses before qualifying for full licensure, with the second cycle restricted to rural or underserved areas. Unmatched physician graduates can practice only in counties with populations under 100,000 and must work under supervision for no more than 60 clinical hours per week. The program faces challenges from a $100,000 H-1B visa fee and Governor Abbott’s freeze on new H-1B petitions, while Medicare has not confirmed whether it will reimburse services from physician graduates. Online applications will become available in February, though only 19 Texas medical students went unmatched in 2025. Source: Texas Medical Association​

Non-Competes

• ​The FTC will pursue noncompete enforcement through case-by-case actions rather than pursuing a national ban, according to statements made at a recent workshop featuring commissioners and agency attorneys. Commissioner Ferguson stated the FTC lacks statutory authority to issue a rule banning noncompetes but will focus enforcement on agreements that are overly broad or used solely to prevent competition, applying a reasonableness test that requires companies to show a legitimate business interest. Commissioner Meador expressed concern about noncompetes being used as scare tactics in professions like nursing, bartending, and internships, particularly for lower-wage or non-specialized workers. Both commissioners recommended that employers consider alternatives such as non-solicitation agreements and intellectual property protections instead of noncompetes. The agency will continue to bring targeted enforcement cases, including its ongoing action against U.S. Anesthesia Partners in Texas, to demonstrate which types of noncompete agreements it considers illegal. Source: Polsinelli​

Pharmacy Benefits Managers

• ​President Trump signed H.R. 7148 into law, enacting provisions that address pharmacy benefit manager practices and prescription drug pricing. The legislation includes the Better Deals and Lower Prices Act, establishing transparency requirements for pharmacy benefit managers, which negotiate drug prices on behalf of employers and patients. Three pharmacy benefit managers control 90% of the market, making it difficult for companies to compare pricing or evaluate whether they are receiving competitive rates. The legislation aims to enable employers to compare pricing data across the market and reduce costs for businesses and families. Source: Congress.gov​

Reproductive Rights

• ​The Texas Medical Board has issued training for doctors on when they can legally terminate pregnancies, marking the first guidance since the state criminalized abortion nearly five years ago in 2021. The training, mandated by the Life of the Mother Act passed last year, provides nine case scenarios and assures doctors they can intervene even when a patient’s life is not in immediate danger. At least four women died after not receiving timely reproductive care under the ban, and sepsis cases in second-trimester pregnancy losses increased more than 50% after the law took effect. Doctors found guilty of performing illegal abortions face up to 99 years in prison and $100,000 in fines, and physicians say the training fails to address patients with chronic conditions or early pregnancy loss. All doctors who practice obstetric care must complete the online course before 2027 to obtain or renew their license. Source: News From The States​
• ​A California physician became the first person sued under Texas House Bill 7, a law that allows private citizens to sue anyone who manufactures, distributes, mails, or provides medication abortion pills into Texas for at least $100,000. The law, passed in September 2025 and effective December 4, 2025, was added as a claim to an existing lawsuit filed in July 2025 by a Texas man who alleges the doctor prescribed abortion pills to his former sexual partner. The original lawsuit accused the doctor of wrongful death and violations of state abortion laws and the Comstock Act from the 1800s. The plaintiff seeks to block the doctor from mailing abortion pills into Texas and from countersuing under California’s shield law, though he has not yet requested monetary damages under HB7. The Center for Reproductive Rights is defending the doctor, who is also facing an extradition request from Louisiana that California Governor Newsom denied. Source: Center for Reproductive Rights​