This week

• Business of Healthcare
• Clinical Laboratories
• Cybersecurity & Data Breaches
• Electronic Health Record
• Emergency Preparedness
• Emerging Tech
• Fraud & Abuse
• Medicare Reimbursement
• Mergers & Acquisition
• Transgender Care

Business of Healthcare

• ​Healthcare organizations face financial losses from compliance failures, with non-compliance leading to penalties, reputational damage, and operational disruption. The company helped an academic institution save $310,000 using their Compliance Risk Analyzer software, which provides statistical analysis of audit risk for physician claims. VMG Health offers services including fair market value opinions, coding audits, transaction support, and staff training to help healthcare organizations navigate compliance challenges. The firm has developed FMV-MD software to standardize valuation management processes and reduce risks associated with physician compensation arrangements under Stark Law. With 30 years of experience focused on healthcare, VMG Health provides compliance services across all healthcare sectors. Source: VMG Health​
• ​Physician groups must evaluate tax efficiency, legal structure, and compliance issues before considering strategic transactions to avoid pitfalls and devaluation. Medical practice consolidation has increased in recent years with lucrative valuations, but groups need consensus before exploring transactions—full consensus for smaller groups of 2-4 physicians and substantial consensus of 80% or more for larger groups of 5-30+ physicians. Groups must agree on proceeds allocation early and address compliance issues including monthly exclusion checks, Stark/DHS compliance, HIPAA policies, co-pay waiver violations, and employee classification problems. Real estate leases between physician owners and practices should reflect fair market value terms rather than friendly arrangements. Engaging experienced healthcare transaction attorneys and advisors is crucial for proper advance planning and positioning. Source: Medical Economics​

Clinical Laboratories

• ​The U.S. Department of Health and Human Services Office of Inspector General announced in June 2025 a new Work Plan review examining Medicare payments for clinical diagnostic laboratory tests in 2024. This annual review, mandated by the Protecting Access to Medicare Act of 2014, will analyze the top 25 laboratory tests by Medicare expenditures, including tests such as comprehensive metabolic panels, complete blood counts, Hemoglobin A1c, and lipid panels. The OIG’s findings could result in future payment rate adjustments, increased audit scrutiny, or enforcement actions against providers identified as outliers. Clinical laboratories and healthcare providers must ensure their billing practices comply with Medicare regulations, maintain documentation supporting medical necessity, and implement compliance programs with internal audits and staff training. Recent False Claims Act litigation, including Jensen ex rel. United States of America v. Genesis Laboratory, demonstrates the risks laboratories face for non-compliance with federal regulations regarding medical necessity and the Anti-Kickback Statute. Source: Healthcare Law Insights​

Cybersecurity & Data Breaches

• ​Healthcare became the most targeted industry for ransomware attacks in 2024, with data breaches costing organizations an average of $9.77 million. Medical records sell for up to 50 times more than credit card numbers on the dark web because they cannot be cancelled and enable identity theft and insurance fraud. The sector faces vulnerabilities from outdated systems, with 71% of medical devices running obsolete software in 2019 and 60% of French hospitals operating on outdated infrastructure in 2022. Human error accounts for 70% of successful cyberattacks in healthcare in France, with phishing serving as the most common entry point. The analysis recommends treating obsolete IT systems as systemic risks, reimagining spending models to allow flexibility between capital and operational expenditures, mandating cybersecurity training, encouraging regional collaboration, and securing electronic health records as priorities. Source: Cisco​
• ​Healthcare organizations face mounting pressure to deliver personalized care while protecting patient data privacy. A 2023 poll found 95% of patients worry about medical record breaches, while a 2022 American Medical Association survey revealed 92% of respondents believe privacy is a right regarding their health data. Patients trust healthcare providers more than tech companies with their information, with 64-75% comfortable sharing data with doctors and hospitals compared to over 67% who are uncomfortable sharing with technology companies. Nearly half of patients report not getting all questions answered during provider visits, creating opportunities for health plans to fill gaps through educational content that uses aggregate data analysis rather than accessing protected health information. Solutions exist that allow care management teams to personalize member experiences through tiered approaches including self-service resources, automated engagement for rising-risk members, and care manager support for higher-risk populations. Source: Wolters Kluwer​
• ​In June 2025, Winkler County Hospital District notified 637 patients about an insider incident involving the unauthorized disclosure of their protected health information. The incident occurred in April 2025 when a former employee emailed patient data to a personal account. Source: HIPAA Journal​

Electronic Health Record

• ​Texas Governor Greg Abbott signed S.B. 1188 into law, creating data localization requirements for electronic health records. The law requires covered entities to physically maintain all electronic health records of Texas patients within the United States, including those stored by third-party cloud computing services. Healthcare practitioners may use AI for diagnostic purposes only if they disclose its use to patients, operate within their licensing scope, and review AI-generated records according to Texas Medical Board standards. The law establishes a definition of “biological sex” based on reproductive systems and restricts amendments to biological sex information in health records to clerical error corrections or sexual development disorder diagnoses. Violations can result in civil penalties ranging from $5,000 to $250,000 per violation, with most provisions taking effect September 1, 2025, and data localization requirements beginning January 1, 2026. Source: Hunton Andrews Kurth​

Emergency Preparedness

• ​Texas HB 3595 establishes statewide emergency preparedness standards for assisted living communities while allowing providers flexibility in how they meet backup power requirements. The law, effective September 1, requires communities to maintain areas of refuge with temperatures between 68 and 82 degrees during emergencies and conduct full building evaluations of electricity needs. Communities must report power outages lasting more than 12 hours to state agencies, triggering ongoing monitoring conversations to ensure resident safety. The legislation was prompted by Winter Storm Uri, which killed 107 Texas older adults from hypothermia in 2021, and Hurricane Beryl, which caused 28 deaths among older adults, half from overheating. Industry groups support the flexible approach over statewide generator mandates, noting that only 47% of Texas assisted living communities have generators, and more than half of the state’s 2,000 communities house fewer than 17 residents. Source: McKnight’s Senior Living​

Emerging Tech

• ​Texas will implement the Texas Responsible Artificial Intelligence Governance Act on January 1, 2026, regulating businesses operating in the state, those with products used by Texans, or those developing AI systems in Texas. The law prohibits using AI to incite criminal activity, cause harm, violate discrimination laws, impair constitutional rights, or create child pornography and deepfake imagery. Companies must obtain consent before using biometric identifiers for commercial AI purposes and destroy the data within one year after the collection purpose expires. Healthcare providers must notify patients before using AI tools in treatment, and the law establishes a 36-month regulatory sandbox program allowing approved businesses to test AI systems without prosecution. The Texas attorney general will enforce the law, which includes safe harbor provisions for companies that promptly remediate violations and a rebuttable presumption of care for following recognized industry standards. Source: Sheppard Mullin Richter & Hampton LLP​
• ​Healthcare platforms combining artificial intelligence, Internet of Things, and blockchain technology are creating self-learning ecosystems that transform patient care from reactive to proactive. These cognitive healthcare platforms use IoT devices such as fitness trackers and hospital equipment to continuously collect patient data including heart rate, blood pressure, and glucose levels, enabling early intervention before symptoms appear. Blockchain technology ensures secure, tamper-proof storage and sharing of medical records, allowing authorized healthcare providers to access complete patient histories while preventing data breaches and fraud. AI analyzes the real-time data streams to identify patterns and predict health risks such as early signs of diabetes or cancer from subtle changes in body metrics. The platforms reduce administrative burdens for healthcare providers while offering patients transparent access to their health records and remote consultation capabilities, though implementation faces challenges including infrastructure limitations in rural areas and interoperability issues between different hospital systems. Source: Healthcare Asia Magazine​

Fraud & Abuse

• ​The HHS Office of Inspector General issued an unfavorable advisory opinion on July 7, 2025, ruling that flat fee payment structures do not protect healthcare arrangements from Anti-Kickback Statute violations. The Advisory Opinion 25-08 involved a proposed arrangement between a medical device company and a software vendor, where the device company would pay $395 per license annually (totaling $1.2 million) to access software that facilitates device sales to hospitals and surgical centers. The OIG determined the arrangement failed to meet the Personal Services and Management Contracts Safe Harbor because the software services were “redundant” to the company’s existing accounts receivable processes and provided no tangible benefits beyond accessing referrals from surgical providers. The opinion emphasized that payments primarily intended to access referrals rather than obtain legitimate services can violate the Anti-Kickback Statute regardless of whether compensation is structured as a flat fee. The OIG also expressed concerns about anti-competitive behavior, noting that such arrangements could inappropriately steer healthcare providers toward companies willing to pay these fees while disadvantaging competitors. Source: Holland & Knight​
• ​Medical practices must navigate two federal laws designed to prevent financial conflicts of interest that could influence patient referrals. The Stark Law prohibits physicians from referring Medicare patients for designated health services to entities with which they or their family members have financial relationships unless specific exceptions apply, and violations can occur regardless of intent since it is a strict liability statute. The Anti-Kickback Statute criminalizes exchanges of value to induce referrals for federal healthcare program services and requires proof of intent but applies more broadly to all federal programs. In 2024, the Department of Justice resolved multiple cases involving alleged violations, including a Delaware health system that paid $42.5 million to settle allegations it provided free clinical support to a neonatology practice that then billed for services performed by staff. The Office of Inspector General recommends medical practices implement a seven-element compliance framework that includes internal audits, written policies, designated compliance officers, training programs, prompt violation response, open communication, and disciplinary standards. Source: CSH Law​

Medicare Reimbursement

• ​CMS will require specialists in selected regions to participate in a new payment model targeting heart failure and low back pain starting January 1, 2027. The Ambulatory Specialty Model will run for five years through December 31, 2031, and initially cover specialists in roughly one-quarter of core-based statistical areas who treat Original Medicare patients. Participation will be mandatory for cardiologists treating heart failure and specialists in anesthesiology, pain management, neurosurgery, orthopedic surgery, and physical medicine treating low back pain, provided they have historically treated at least 20 episodes per year. The model rewards specialists for improving patient health outcomes and coordinating with primary care providers to reduce avoidable hospitalizations and unnecessary procedures. CMS expects the program to lower costs to Original Medicare while improving patient experience and outcomes. Source: CMS​
• ​CMS announced a proposed rule to slash Medicare reimbursement for skin substitutes by nearly 90% to combat what it calls “abusive pricing practices” in the wound care industry. The 2026 Medicare Physician Fee Schedule would pay for skin substitutes as incident-to-supplies at a flat rate of $125.38 per square cm instead of the current biologicals framework, which allows products to be priced as much as $2,000 per square inch. Medicare spending on these cellular and tissue-based products that treat chronic wounds jumped from $252 million in 2019 to more than $10 billion in 2024. The proposal would categorize skin substitutes by their FDA regulatory status and aims to incentivize products with clinical evidence while saving billions in taxpayer dollars. Industry stakeholders have until September 12 to provide comments, with manufacturers warning the cuts could limit patient access and reduce innovation while advocacy groups support the cost-control measures. Source: MedPage Today​

Mergers & Acquisition

• ​Healthcare mergers and acquisitions demonstrate resilience in 2025, with transaction levels nearly double pre-2020 volumes despite economic and regulatory challenges. Private equity participates in roughly 40% of healthcare transactions, driven by large reserves of undeployed capital and urgency to generate returns. Behavioral health and home health/hospice sectors remain top targets for deals, while revenue cycle management and infusion therapy show increased momentum due to their tech-enabled potential and operational scalability. The Federal Trade Commission and state attorneys general have heightened scrutiny around private equity ownership and market concentration, slowing deal timelines but not halting activity. Organizations now conduct annual strategic portfolio reviews instead of three- to five-year planning cycles, with many preparing to bring deals to market for the remainder of 2025. Source: Modern Healthcare​

Transgender Care

• ​Physician groups must evaluate tax efficiency, legal structure, and compliance issues before considering strategic transactions to avoid pitfalls and devaluation. Medical practice consolidation has increased in recent years with lucrative valuations, but groups need consensus before exploring transactions—full consensus for smaller groups of 2-4 physicians and substantial consensus of 80% or more for larger groups of 5-30+ physicians. Groups must agree on proceeds allocation early and address compliance issues including monthly exclusion checks, Stark/DHS compliance, HIPAA policies, co-pay waiver violations, and employee classification problems. Real estate leases between physician owners and practices should reflect fair market value terms rather than friendly arrangements. Engaging experienced healthcare transaction attorneys and advisors is crucial for proper advance planning and positioning. Source: Medical Economics​