Regulatory Tides Shift: Unpacking Critical Compliance and Enforcement Waves Across Healthcare

2026-08-23

The past week has seen a torrent of critical compliance developments, from federal enforcement actions challenging market giants and individual fraudsters to significant shifts in telehealth billing and state-level scope of practice. Navigating this intricate web of evolving regulations is not merely an obligation but a strategic imperative for healthcare enterprises. This digest offers a targeted analysis of the most impactful changes, equipping leaders with the intelligence needed to fortify their compliance frameworks and anticipate future industry trajectories.

The healthcare regulatory landscape is a dynamic ecosystem, constantly reshaped by enforcement actions, legislative shifts, and technological advancements. For founders, operators, and compliance officers across telehealth, medspas, dental practices, and broader healthcare services, staying abreast of these changes is paramount. This past week has underscored the increasing vigilance of federal and state authorities, coupled with a proactive push towards value-based care and clearer operational guidelines. TrueEval offers this curated briefing to help you decipher these complex developments and translate them into actionable compliance strategies.

> For more on this topic, see our analysis: [Federal Scrutiny Escalates: DOJ, FTC, and CMS Reshape Healthcare Compliance in a New Regulatory Era](/blog/federal-scrutiny-escalates-healthcare-compliance).

Heightened Enforcement: A Clear Message on Accountability and Data Integrity

The regulatory environment continues to demonstrate a clear trend: enforcement actions are becoming more frequent, more stringent, and increasingly focused on individual accountability and data stewardship. Ignorance is not a defense, and proactive measures are non-negotiable.

DEA Targets Illicit Substances: O-DSMT Placed in Schedule I

The Drug Enforcement Administration (DEA) has issued a temporary order placing O-desmethyltramadol (O-DSMT), along with its isomers, esters, ethers, and salts, into Schedule I of the Controlled Substances Act (CSA). Effective immediately and extending for two years (August 2026 to August 2028), this action is driven by a finding that O-DSMT poses an imminent hazard to public safety.

Implications: This is a critical development for all healthcare providers. Schedule I substances are deemed to have no currently accepted medical use and a high potential for abuse. This means manufacturing, distributing, dispensing, prescribing, or possessing O-DSMT for *any* purpose, even purported medical ones, is strictly prohibited under federal law. Non-compliance carries severe administrative, civil, and criminal penalties, including loss of licensure, substantial fines, and imprisonment. While O-DSMT is not an FDA-approved drug, its status as a mu-opioid agonist means practices in pain management or those prescribing any controlled substances must exercise extreme vigilance. Update your compliance programs and educate staff immediately to ensure no involvement with this substance, directly or indirectly, enters your operations.

DOJ and State Authorities Intensify Fight Against Medicaid Fraud

A recent sentencing in Pennsylvania serves as a stark reminder of the personal consequences associated with healthcare fraud. The former owner of a Montgomery County home care agency received a prison sentence for her involvement in a $1.76 million Medicaid fraud scheme. The fraudulent activities, which occurred between 2020 and 2023, included approving kickback arrangements, assigning unqualified caregivers, and billing for services never rendered.

Implications: This case underscores the unwavering commitment of the Department of Justice (DOJ) and state authorities to pursue and prosecute individuals, particularly owners and executives, who engage in fraudulent billing practices against government programs. For telehealth providers, medspas, dental practices, and chiropractic offices, this is a critical call to action: robust compliance programs are essential, not optional. This includes regular internal and external audits, comprehensive employee training on anti-kickback statutes, clear policies against billing for unprovided services, and stringent oversight of billing practices. The personal accountability highlighted in this case means that leadership must prioritize compliance to protect both the financial health of their organization and their personal liberty.

FTC, Utah, and Los Angeles Take Aim at Telehealth Data Sharing and Billing Practices

In a landmark move, the Federal Trade Commission (FTC), joined by the State of Utah and Los Angeles County, has filed a lawsuit against prominent telehealth provider Hims & Hers Health. The core allegations revolve around deceptive privacy promises, unlawful billing and subscription practices, and the unauthorized sharing of sensitive health information with advertising platforms through tracking technologies.

Implications: This action sends an unequivocal message to all telehealth providers and healthcare businesses with online presences: privacy is paramount, and transparency in data handling is non-negotiable. The complaint highlights critical areas of vulnerability: * Data Sharing Agreements: Meticulously review all agreements with third-party vendors, especially those related to marketing, analytics, and advertising. Understand exactly what data is being shared and for what purpose. * Patient Consent: Ensure consent mechanisms for data sharing are explicit, granular, and easily understandable. Generic privacy policies may no longer suffice. * Billing and Subscription Practices: Your billing models must be clear, transparent, and provide straightforward cancellation options. Avoid practices that could be construed as deceptive or difficult to discontinue.

This case signals heightened federal and state scrutiny on how healthcare companies manage sensitive patient data and their financial interactions with consumers. Compliance programs must evolve to address these complex data privacy and consumer protection issues, extending beyond traditional HIPAA considerations to encompass broader FTC mandates.

FTC Initiates Antitrust Scrutiny of Epic Systems

The Federal Trade Commission (FTC) has launched an antitrust inquiry into Epic Systems Corp., the dominant electronic health records (EHR) vendor. The investigation focuses on potential anticompetitive practices, specifically examining the company's employee non-compete agreements and its policies regarding rival technology companies' access to patient data.

Implications: While this investigation targets a major EHR vendor, its implications resonate across the entire healthcare technology ecosystem. For telehealth brands, medspas, dental practices, chiropractic offices, and other healthcare businesses, this inquiry signals a broader regulatory emphasis on fair market practices and data interoperability. Should the FTC find antitrust violations, it could lead to significant changes in how major EHR vendors operate, potentially fostering greater data access for third-party integrators and increasing competition within the health tech sector. Practices reliant on Epic's ecosystem or those seeking to integrate novel technologies may, in the long term, benefit from improved data exchange capabilities and a more competitive marketplace. Conversely, it serves as a reminder for all healthcare businesses to critically review their own contractual agreements and data sharing policies for compliance with antitrust and fair competition principles.

Adapting to an Evolving Regulatory Landscape: From Telehealth Payment to Drug Equivalence

Beyond enforcement, regulators are actively shaping the future of healthcare delivery and product assessment, demanding proactive adaptation from providers.

CMS Mandates Telehealth Billing Change and Launches ACCESS Model for Chronic Care

Two significant announcements from CMS will reshape telehealth reimbursement and chronic care delivery:

1. Mandatory Billing Change for FQHCs/RHCs: Effective October 1, 2026, Federally Qualified Health Centers (FQHCs) and Rural Health Clinics (RHCs) must cease using code G2025 for distant-site non-behavioral telehealth. They must transition to specific service codes. 2. ACCESS Model Launch: CMS has introduced the ACCESS (Advancing Chronic Care with Effective, Scalable Solutions) Model, a 10-year voluntary program. This model aims to test outcome-aligned payments for technology-supported chronic care services.

Implications: For FQHCs and RHCs, the billing code change is a critical operational update requiring immediate attention to system modifications and staff training to ensure compliant billing by the deadline. For the broader telehealth industry and healthcare businesses focused on chronic disease management, the ACCESS Model is a beacon for future Medicare payment innovation. It signifies CMS's strong commitment to value-based care delivered through virtual, asynchronous, and device-supported means. While voluntary, practices capable of demonstrating measurable health outcomes for conditions like hypertension, diabetes, and depression, and willing to invest in robust technology and care coordination, will find ACCESS a viable pathway for sustainable growth and reimbursement. This also underscores the increasing regulatory focus on the efficacy and accountability of technology-enabled care models.

FDA Focuses on Testosterone Use in Menopausal Women

The FDA's Office of Women's Health and Center for Drug Evaluation and Research will host a public workshop on September 17, 2026, to examine the scientific evidence and knowledge gaps regarding testosterone use in menopausal women. The goal is to inform future research and potential drug development for testosterone products in this population.

Implications: For telehealth providers, medspas, and other healthcare businesses offering hormone replacement therapies (HRT), this workshop is highly significant. While not an immediate regulatory change, it signals the FDA's active interest in gathering scientific data that will likely inform future guidance, labeling requirements, and potentially new drug approvals. Practices currently prescribing testosterone off-label for menopausal women should pay close attention to the scientific discussions and regulatory considerations. Understanding the FDA's perspective on efficacy, safety, measurement challenges, and long-term outcomes is crucial for maintaining compliant and evidence-based practices. Participation in the public comment period offers a valuable opportunity to contribute to the scientific and regulatory dialogue.

FDA Finalizes Guidance on Therapeutic Equivalence

The FDA has finalized its guidance document, "Evaluation of Therapeutic Equivalence." This guidance clarifies the FDA's approach to therapeutic equivalence evaluations and codes, which are crucial for drug product selection and healthcare cost containment. These evaluations are listed in the FDA's "Orange Book" and advise state health agencies, prescribers, and pharmacists.

Implications: This finalized guidance offers critical clarity for all healthcare businesses involved in prescribing or dispensing medications, including telehealth platforms, medspas, and dental practices. Understanding FDA's therapeutic equivalence evaluations and codes (TE codes) is essential for compliant and cost-effective drug product selection. Practices that emphasize generic prescribing or seek to optimize patient costs must ensure their prescribing practitioners and pharmacists are familiar with the Orange Book and the principles outlined in this guidance. Non-adherence, even if unintentional, could lead to questions regarding drug efficacy, patient safety, and economic stewardship.

FDA Issues Draft Guidance on Potency Assessment for Active Immunotherapy Products

The FDA has released new draft guidance titled 'Potency Assessment of Active Immunotherapy Products,' providing recommendations for developing and evaluating assays to ensure the potency of active immunotherapy products (ACTIMPs).

Implications: While this guidance may not directly impact traditional telehealth, medspas, dental, or chiropractic practices, it underscores the FDA's stringent regulatory environment governing innovative biological products. For healthcare businesses involved in or considering advanced therapies, understanding that the FDA prioritizes robust methods for ensuring product potency is crucial for patient safety and treatment effectiveness. It signals a consistent high bar for quality control and characterization of advanced medical interventions.

State-Level Directives: Refining Scope of Practice

State medical boards continue to define and refine the operational parameters for healthcare personnel, requiring granular attention to detail.

California Medical Board Clarifies Scope of Practice for Medical Assistants

The Medical Board of California has provided definitive guidance on the permissible scope of practice and required supervision for Medical Assistants within the state. The guidance emphasizes that Medical Assistants are unlicensed individuals who perform non-invasive technical support services under direct supervision.

Implications: For healthcare businesses operating in California, particularly medspas, dental practices, chiropractic offices, and telehealth providers utilizing in-person administrative or technical support, understanding these precise limitations is critical for compliance. The California Medical Board explicitly states that Medical Assistants are unlicensed personnel whose activities are strictly limited to non-invasive, routine technical support under direct, on-premises supervision. This means a licensed physician and surgeon, podiatrist, physician assistant, nurse practitioner, or nurse midwife must be physically present to oversee their duties. Practices must ensure Medical Assistants are not performing any invasive procedures, diagnosing, treating, or making assessments, as these fall outside their legal scope. The ultimate responsibility for the appropriate use of unlicensed persons rests with the supervising physician. Non-compliance can lead to serious regulatory infractions, including actions against the supervising licensee.

What This Means For Your Practice: Navigating Complexity with Precision

The convergence of these federal and state-level developments paints a clear picture: proactive, granular, and continuous compliance is the bedrock of sustainable healthcare operations.

Embrace Proactive Risk Management: The enforcement actions against individuals and large enterprises alike demonstrate that authorities are actively looking for non-compliance. Your internal audit mechanisms, whistleblower protections, and compliance training must be robust and regularly updated.
Fortify Data Privacy and Security: The Hims & Hers lawsuit is a wake-up call. Beyond HIPAA, understand FTC's broader consumer protection mandates. Scrutinize all data sharing agreements, particularly with marketing and analytics partners, and ensure patient consent is explicit and transparent.
Master Billing and Reimbursement Accuracy: For those participating in government programs or offering subscription services, impeccable billing practices are essential. Review coding protocols, ensure services are documented and rendered, and make pricing and cancellation terms unambiguous.
Ensure Staff Competency and Scope Adherence: The DEA's scheduling update and California's Medical Assistant guidance highlight the critical need for ongoing staff education and strict adherence to defined scopes of practice and supervision requirements. Missteps here carry significant legal and reputational risks.
Strategically Adapt to Payment Innovation: CMS's ACCESS Model signals a clear direction towards value-based, technology-supported care. Evaluate how your practice can align with these models to secure future reimbursement opportunities and demonstrate measurable patient outcomes.

The regulatory tides are indeed shifting, bringing both challenges and opportunities. By leveraging intelligence from these developments, healthcare leaders can not only mitigate risks but also strategically position their organizations for compliant growth in an increasingly complex environment. TrueEval remains committed to providing the clarity and tools necessary to navigate this landscape with confidence and authority.