Compliance Crossroads: Decoding the Latest Enforcement Wave and Policy Shifts for Healthcare Leaders

2026-08-21

The regulatory tides are rising, and healthcare leaders must navigate a dramatically intensified enforcement environment. From new federal fraud divisions targeting telemedicine to critical shifts in data privacy and billing, understanding these developments is paramount for maintaining compliant and resilient operations. This roundup dissects the latest actions and mandates shaping the future of healthcare compliance.

The healthcare regulatory landscape is in a constant state of flux, but recent months have demonstrated an undeniable intensification of enforcement activity and a strategic realignment of agency priorities. For telehealth founders, medspa owners, national practice operators, and compliance officers, staying abreast of these shifts is not merely advisable – it is existential. The initiatives we are observing today signal a proactive, data-driven approach by federal and state authorities, leaving no room for complacency.

> For more on this topic, see our analysis: [Federal Fraud Amplification & State-Specific Scope: A Critical Regulatory Roundup for Healthcare Leaders](/blog/federal-fraud-amplification-state-specific-scope-critical-regulatory-roundup-hea).

The Unyielding Gaze of Federal Enforcement: The DOJ's Amplified Anti-Fraud Efforts

Perhaps the most significant development in recent months comes from the Department of Justice (DOJ), which has formally established the National Fraud Enforcement Division (NFED). This pivotal move represents a substantial escalation in federal healthcare fraud enforcement, fundamentally altering the risk calculus for all providers. With increased resources, including dedicated prosecutors, agents, and forensic accountants embedded in U.S. Attorney's Offices nationwide, the NFED is designed to be 'lean, flat, and agile,' enabling faster investigations and more comprehensive prosecution of fraudulent schemes.

The NFED has explicitly outlined its 2026 healthcare fraud priorities, placing a sharpened focus on several critical areas: telemedicine, Medicare/Medicaid billing, and controlled substance diversion. The new National Fraud Detection Center will leverage advanced data analytics to proactively identify billing anomalies and potential fraud patterns at an unprecedented scale. This means that practices billing federal healthcare programs, especially those engaged in telemedicine or prescribing controlled substances, are under an enhanced and continuous microscope. Any inconsistencies in billing for services rendered, improper kickback arrangements, or diversion of controlled substances will be met with swift and coordinated civil and criminal enforcement actions.

This heightened scrutiny is not theoretical. We saw a tangible example of its consequences with the sentencing of a former home care agency owner in Montgomery County, Pennsylvania, for a $1.76 million Medicaid fraud scheme. The individual received a prison sentence for her involvement in approving kickback arrangements, assigning fraudulent caregivers, and billing for services not rendered between 2020 and 2023. This case underscores the DOJ's emphasis on personal accountability, meaning owners and executives face severe penalties, including imprisonment, for their involvement in or oversight of fraudulent activities.

Actionable Insight: All healthcare businesses, regardless of size or specialty, must conduct an immediate and thorough review of their compliance programs. This includes robust training on the Anti-Kickback Statute (AKS), Stark Law, and False Claims Act. Implement regular, independent audits of billing practices, particularly for Medicare and Medicaid claims. For telehealth providers, meticulously document medical necessity, patient consent, and service delivery to withstand potential scrutiny. Update prescribing protocols for controlled substances, ensuring strict adherence to federal and state guidelines, as the DOJ's focus on diversion is acute.

Telehealth Under the Microscope: Data Privacy, Billing Practices, and Value-Based Care

The rapid expansion of telehealth has brought immense benefits, but also increased regulatory attention, particularly concerning data privacy and consumer protection. The Federal Trade Commission (FTC), in a significant move, joined by the State of Utah and Los Angeles County, has filed a lawsuit against prominent telehealth provider Hims & Hers Health. The complaint alleges deceptive privacy promises, unlawful billing and subscription practices, and the sharing of sensitive health information with advertising platforms through tracking technologies.

This action signals a clear intent by federal and state regulators to aggressively pursue companies that fail to uphold their privacy commitments or engage in misleading consumer practices. The use of third-party tracking technologies on healthcare websites and apps is now a major enforcement risk, especially if personal health information (PHI) is shared without explicit, informed consent.

Beyond privacy, the Centers for Medicare & Medicaid Services (CMS) continues to refine its approach to telehealth reimbursement and value-based care. Effective October 1, 2026, CMS is mandating a billing change for Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs) concerning distant-site non-behavioral telehealth. These entities must cease using code G2025 and transition to specific service codes, requiring immediate attention to billing system updates and staff training to ensure uninterrupted reimbursement.

In a related, forward-looking development, CMS has also introduced the ACCESS (Advancing Chronic Care with Effective, Scalable Solutions) Model. This 10-year voluntary program aims to test outcome-aligned payments for technology-supported chronic care services. While voluntary, the ACCESS Model underscores CMS's strategic shift towards value-based care models that leverage virtual, asynchronous, and device-driven technologies for managing chronic conditions like hypertension, diabetes, and depression. This model signals a pathway for future Medicare payment innovation, rewarding practices that can demonstrate measurable health outcomes.

Actionable Insight: Telehealth operators, medspas, and clinical practices utilizing digital platforms must meticulously review their privacy policies, terms of service, and data sharing agreements. Ensure that patient consent for data sharing, especially with third-party marketing or analytics platforms, is explicit, granular, and easily revocable. Transparency in billing and subscription models is non-negotiable; clearly communicate pricing, services included, and straightforward cancellation processes. FQHCs and RHCs must immediately update their billing systems and processes to comply with the October 2026 telehealth billing changes. All providers should evaluate opportunities presented by value-based care models like ACCESS, focusing on outcomes data and technological integration to demonstrate efficacy and qualify for future reimbursement structures.

Controlled Substances and Product Scrutiny: New Classifications and Quality Assurance

The regulatory environment surrounding controlled substances remains exceptionally stringent, with authorities demonstrating a low tolerance for any potential for abuse or diversion. The Drug Enforcement Administration (DEA) has taken a decisive step by issuing a temporary order placing O-desmethyltramadol (O-DSMT), including its isomers, esters, ethers, and salts, into Schedule I of the Controlled Substances Act (CSA). This action, effective from August 12, 2026, to August 12, 2028, classifies O-DSMT as having no currently accepted medical use and a high potential for abuse. As a Schedule I substance, its manufacture, distribution, dispensing, prescribing, or possession for any purpose is strictly prohibited and subject to severe penalties.

While O-DSMT is not an FDA-approved drug, its classification as a mu-opioid agonist means healthcare providers must be acutely aware of its illegal status. This extends beyond direct prescribing to vigilance against illicit substances that may be misrepresented or emerge in the grey market, particularly for practices involved in pain management or prescribing any controlled substances.

In a related vein, the FDA continues its commitment to product quality and efficacy, particularly for advanced therapies. The agency recently announced the availability of new draft guidance titled 'Potency Assessment of Active Immunotherapy Products.' While primarily impacting developers and manufacturers of complex biological products like active immunotherapy products (ACTIMPs), this guidance underscores the FDA's unwavering focus on rigorous scientific assessment of product quality and safety. For practices considering offering or partnering on advanced medical interventions, understanding such foundational regulatory expectations for product characterization and quality control is paramount.

Actionable Insight: Healthcare entities must immediately update their drug formularies and controlled substance policies to reflect the Schedule I classification of O-DSMT. Implement robust checks and balances to ensure no substances handled or prescribed, directly or indirectly, contain O-DSMT. Staff education on this prohibition and the severe consequences of non-compliance is essential. For practices involved in or contemplating advanced therapeutic offerings, closely monitor FDA guidance on product development and quality, ensuring any new services meet the highest standards of potency and safety assessment.

State-Specific Scope and Market Competition: Defining Practice Boundaries and Ensuring Fair Play

Beyond federal mandates, state-level regulatory bodies continue to define and enforce scope of practice, which is particularly critical for practices utilizing mid-level providers or assistants. The Medical Board of California recently provided definitive guidance on the permissible scope of practice and required supervision for Medical Assistants (MAs) within the state. The guidance explicitly states that MAs are unlicensed individuals who perform non-invasive technical support services under direct, on-premises supervision by a licensed physician and surgeon, podiatrist, physician assistant, nurse practitioner, or nurse midwife.

This clarification means that MAs in California cannot perform any invasive procedures, diagnose, treat, or make medical assessments. The ultimate responsibility for the appropriate use of unlicensed personnel rests solely with the supervising licensee. Non-compliance can lead to serious regulatory infractions against the supervising professional, including loss of licensure.

On a broader market front, the FTC has initiated an antitrust inquiry into Epic Systems Corp., the dominant vendor of electronic health records. This investigation focuses on potential anticompetitive practices, specifically examining the company's employee non-compete agreements and its policies regarding rival technology companies' access to patient data. While not a direct compliance mandate for most practices, this inquiry signals a heightened regulatory focus on competition and data interoperability within the healthcare technology sector. Potential outcomes could reshape how EHR vendors operate, potentially improving data access for third-party integrators and fostering innovation.

Actionable Insight: For practices operating in California, and as a best practice for all states, meticulously review the roles and responsibilities of Medical Assistants and other unlicensed personnel. Ensure strict adherence to state-specific scope of practice laws and supervision requirements. Licensed professionals must be physically present for direct supervision of MAs performing technical support. All practices should also review their own contractual agreements and data sharing practices for compliance with antitrust and fair competition principles, understanding that federal regulators are keenly focused on ensuring open markets and data accessibility in healthcare technology.

Looking Ahead: Informing Future Research and Regulation in Emerging Areas

Anticipating future regulatory trends is as crucial as responding to current mandates. The FDA's Office of Women's Health and Center for Drug Evaluation and Research will host a public workshop on September 17, 2026, to examine current scientific evidence and knowledge gaps regarding testosterone use in menopausal women. This initiative aims to inform future research and potential drug development for testosterone products in this population. While not an immediate regulatory change, it signifies the FDA's active engagement in gathering scientific data and stakeholder input that will likely shape future guidance, labeling requirements, and potentially new drug approvals in this therapeutic area.

Actionable Insight: Practices, particularly medspas and telehealth providers offering hormone replacement therapies (HRT), should closely monitor the discussions and outcomes of the FDA's workshop. Understanding the agency's evolving perspective on efficacy, safety, and measurement challenges for testosterone use in menopausal women is critical for maintaining compliant and evidence-based practices. Participation in public comment periods, where applicable, offers an opportunity to contribute to the scientific and regulatory dialogue, influencing the future framework for these therapies.

What This Means For Your Practice

The collective weight of these recent developments presents a formidable, yet navigable, challenge for healthcare businesses. The message is clear: proactive, comprehensive, and continuously updated compliance is no longer a best practice; it is a fundamental operational imperative.

1. Elevate Your Compliance Program: With the DOJ's NFED, the scrutiny on fraud, especially in telemedicine and controlled substances, is unprecedented. Invest in robust compliance programs, regular audits, and comprehensive staff training on federal and state anti-fraud statutes. Document everything meticulously. 2. Scrutinize Data Privacy and Billing: The FTC's actions against telehealth highlight the severe risks associated with lax data privacy and deceptive billing. Review all data sharing agreements, especially with third-party vendors, and ensure explicit, informed patient consent. Make billing and subscription models transparent and easy to understand. 3. Master State-Specific Scope of Practice: California's clarification on Medical Assistants is a potent reminder: understand and rigorously enforce state-specific scope of practice laws for all personnel, especially unlicensed individuals. Liability ultimately rests with the supervising licensed professional. 4. Stay Ahead of the Curve: Monitor emerging FDA guidance, such as the testosterone workshop, to anticipate future regulatory expectations in evolving therapeutic areas. Embrace value-based care models like ACCESS as CMS shifts towards outcomes-aligned reimbursement.

TrueEval provides the essential infrastructure to navigate this complex regulatory terrain. By offering sophisticated, continuously updated compliance intelligence and practical solutions, we empower healthcare leaders to build resilient, compliant, and thriving practices in an environment of escalating oversight. The time to reinforce your compliance posture is now.