Regulatory Tides Turn: Navigating Heightened Enforcement and Evolving Telehealth Mandates

2026-08-03

Recent regulatory actions signal a dramatic shift in healthcare compliance, particularly for telehealth, medspas, and national practices. From aggressive FTC enforcement on data privacy and deceptive advertising to critical extensions for controlled substance prescribing and state-level licensure advancements, the landscape demands unwavering vigilance. This roundup cuts through the noise, detailing specific updates and their actionable implications for your operations.

The regulatory currents in healthcare are undeniably strengthening, shaping an environment where proactive compliance is no longer merely advantageous but absolutely essential for survival and growth. From federal agencies wielding new enforcement powers to state legislatures refining long-standing medical practice parameters, healthcare businesses—especially those operating in the dynamic telehealth, medspa, and multi-state practice arenas—must navigate a complex and rapidly evolving legal terrain. TrueEval is committed to providing the clarity and strategic insights necessary to thrive amidst these shifts.

> For more on this topic, see our analysis: [The Compliance Gauntlet Tightens: Navigating Heightened Enforcement in Telehealth and Beyond](/blog/compliance-gauntlet-tightens-telehealth-enforcement).

This roundup synthesizes critical recent developments, highlighting direct enforcement actions, significant policy changes, and emergent compliance directives that will define operational best practices for the foreseeable future. Each point underscores the imperative for robust internal controls, transparent patient communications, and unwavering adherence to both federal and state mandates.

> For more on this topic, see our analysis: [The Compliance Gauntlet Tightens: Navigating Heightened Enforcement in Telehealth and Beyond](/blog/compliance-gauntlet-tightens-telehealth-enforcement).

Unprecedented Scrutiny on Data Privacy and Deceptive Practices

The Federal Trade Commission (FTC) has demonstrably intensified its focus on consumer protection within the digital health space, delivering clear warnings to any healthcare entity handling sensitive patient data or engaging in direct-to-consumer advertising. These actions underscore a non-negotiable expectation for transparency, ethical data handling, and truthful marketing.

FTC's Hammer Falls on Deceptive Health Data Sharing and Billing

Recent enforcement actions against prominent telehealth providers serve as a stark reminder of the FTC's broadened reach and aggressive stance. The FTC, in conjunction with state regulators from Utah and California, initiated action against telehealth provider Hims & Hers, alleging a range of deceptive practices. These included the sharing of consumers' sensitive health information with third-party advertisers and the implementation of deceptive billing and challenging subscription cancellation processes. This lawsuit, though still in progress, signals that the FTC is not merely targeting egregious outliers but scrutinizing fundamental business practices of well-established digital health platforms.

Separately, the FTC launched its first-ever enforcement action under the Health Breach Notification Rule (HBNR) against GoodRx. The agency alleged GoodRx illegally shared consumers' sensitive health information with advertising platforms like Facebook and Google. This action resulted in a proposed order imposing a $1.5 million civil penalty and a strict prohibition on sharing user health data for advertising purposes. This case is monumental as it establishes a precedent for HBNR enforcement beyond traditional HIPAA-covered entities, directly impacting digital health apps and platforms that handle health information but are not covered by HIPAA.

Adding to this wave, the FTC finalized an enforcement action against telehealth provider NextMed and its principals, targeting deceptive weight-loss advertising for GLP-1 programs, unsubstantiated claims, the use of fake reviews, and unfair billing and cancellation procedures. This resulted in a $150,000 payment for consumer refunds and specific prohibitions on future advertising and billing practices.

What This Means For Your Practice: * Data Governance is Paramount: All telehealth providers, medspas, and clinical practices must rigorously audit their data flows. This includes ensuring privacy policies are not only robust and comprehensive but also accurately reflect actual data handling practices. Explicit, informed consent is now non-negotiable for *any* data sharing beyond direct treatment, especially when integrating with third-party advertising or analytics platforms. * Transparency in Billing and Subscriptions: Review all consumer-facing policies regarding pricing, subscription terms, and cancellation procedures. Practices must ensure clear, unambiguous communication to prevent accusations of unfair or deceptive trade practices, processing cancellations and refunds promptly and fairly. * Authenticity in Advertising: All marketing claims, particularly around popular treatments like GLP-1 weight-loss drugs, must be substantiated. The use of patient testimonials and reviews requires strict verification of authenticity to avoid FTC scrutiny. * HBNR Implications: Understand that the HBNR applies beyond HIPAA. If your platform collects or stores individually identifiable health information and is not a HIPAA-covered entity or business associate, you likely fall under the HBNR and must have a breach notification plan.

Navigating Telemedicine's Evolving Landscape: Stability Amidst Transition

The landscape for telehealth continues to solidify, offering both welcome stability and ongoing calls for vigilance as temporary measures pave the way for permanent regulations.

DEA and HHS Extend Telemedicine Controlled Substance Prescribing Flexibilities

In a critical development that averted an impending 'telemedicine cliff,' the U.S. Department of Health and Human Services (HHS) and the Drug Enforcement Administration (DEA) announced a fourth temporary extension of telemedicine flexibilities for prescribing controlled medications through December 31, 2026. This decision allows practitioners to continue prescribing controlled substances via telehealth without a prior in-person visit, mitigating significant disruptions in patient care, particularly for mental health and substance use disorder treatments.

What This Means For Your Practice: * Temporary Relief, Not Permanent Solution: While this extension provides a crucial window, practices must recognize its temporary nature. The emphasis remains on the eventual finalization of permanent rules, which are expected to include the proposed 'Special Registration for Telemedicine.' * Unwavering Adherence to Existing Laws: The extension does not relax existing federal and state laws regarding legitimate medical purpose, licensed practice, and all other prescribing requirements. Providers must continue to adhere strictly to these regulations. * Prepare for Permanent Rules: Actively monitor ongoing regulatory developments for permanent rules. Practices that prescribe controlled substances via telehealth should begin strategizing for compliance with anticipated 'Special Registration' requirements and any new in-person visit mandates that may eventually emerge.

CMS Finalizes Permanent Telehealth Service List and Expands Coverage

Medicare's commitment to telehealth has taken a decisive step forward with CMS finalizing a new, simplified 3-step process for adding services to the Medicare Telehealth Services List. Crucially, all services identified for 2026 have been made permanent. This update further removes certain frequency limits, permits direct supervision for specific diagnostic imaging via telehealth, and incorporates new behavioral and infectious disease services.

What This Means For Your Practice: * Regulatory Certainty: The permanence of the 2026 Medicare Telehealth Services List provides unprecedented stability, allowing telehealth providers to invest with greater confidence in infrastructure, technology, and staffing. * Enhanced Operational Flexibility: The removal of frequency limits offers increased flexibility in patient care delivery and billing, reducing administrative burdens and allowing for more patient-centric care models. * Expanded Service Offerings: Practices offering diagnostic imaging services should review the new allowances for direct supervision via telehealth, which could significantly improve patient access and optimize workflows. The specific inclusion of behavioral health and infectious disease services highlights areas of continued growth and opportunity. * Review and Maximize: Healthcare businesses should immediately review their service offerings against the finalized list and updated supervision requirements to ensure maximum compliance and to leverage new opportunities for patient care and reimbursement.

Massachusetts Advances Interstate Medical Licensure Compact Legislation

In a positive development for multi-state practice, Massachusetts House Bill H.2393, which aims to authorize the state's entry into the Interstate Medical Licensure Compact (IMLC), has progressed through its legislative journey. The bill was favorably reported by the Public Health committee and subsequently referred to the House Committee on Ways and Means, indicating momentum toward facilitating multi-state licensure for physicians.

What This Means For Your Practice: * Streamlined Licensure for Expansion: The eventual passage of H.2393 would significantly streamline the process for physicians to obtain licenses in Massachusetts, and for Massachusetts-licensed physicians to practice in other compact states. This reduces administrative burdens and accelerates expansion opportunities for telehealth platforms, medspas offering medical services, and other practices. * Enhanced Provider Recruitment: Entry into the IMLC would enhance the ability of practices to recruit providers, as the barrier to multi-state practice would be lowered, contingent upon the compact's provisions and subsequent state-specific rule promulgation. * Monitor and Plan: Practices with expansion strategies involving Massachusetts or other IMLC states should closely monitor the bill's progress and factor its potential passage into future operational and staffing plans.

Integrity in the Healthcare Ecosystem: Due Diligence and State-Specific Mandates

Maintaining integrity within the healthcare workforce and adhering to granular state-specific prescribing mandates remain critical pillars of compliance.

FDA Issues Final Debarment Orders for Drug Product Felonies

The Food and Drug Administration (FDA) has issued final orders permanently debarring individuals, including Angela Anatilde Baquero (applicable August 3, 2026) and Ricardo Andres Acuna, from providing services in any capacity to persons with approved or pending drug product applications. These actions stem from convictions for felonies under Federal law related to the development or approval of drug products. Both individuals waived their right to a hearing, leading to permanent debarment.

What This Means For Your Practice: * Critical Due Diligence in Hiring and Contracting: While your practice may not directly develop drug products, these debarment orders underscore the FDA's vigilance in maintaining integrity across the pharmaceutical and healthcare sectors. Engaging individuals or entities that have been debarred by the FDA, even in seemingly unrelated capacities, can expose your organization to significant regulatory risk. * Routine Screening: Any professional providing services to your practice, particularly those with a history in the broader healthcare or pharmaceutical sectors, should be screened to ensure they are not subject to such exclusions. Regularly checking federal databases, such as those maintained by the FDA and HHS-OIG, is a critical best practice to mitigate compliance risks and safeguard your practice's reputation and standing with federal healthcare programs.

Kentucky Board of Dentistry Clarifies Controlled Substance Prescribing Requirements

The Kentucky Board of Dentistry has issued comprehensive guidance outlining strict requirements for dentists prescribing controlled substances. These mandates include mandatory DEA registration, an active Kentucky All Schedule Prescription Electronic Reporting (KASPER) account, and strict adherence to Electronic Prescribing of Controlled Substances (EPCS) rules. The guidance emphasizes that dentists must operate strictly within their defined scope of practice for oral, maxillofacial, and associated structures, prioritizing patient safety and compliance with both state and federal regulations to combat opioid abuse.

What This Means For Your Practice: * Robust State-Specific Compliance: For dental practices operating in Kentucky, or any practice dealing with controlled substances, this guidance underscores the critical need for a robust, state-specific compliance infrastructure. Strict adherence to mandates like KASPER and EPCS is non-negotiable. * Technology and Workflow Integration: Practices must ensure their Electronic Health Record (EHR) systems are fully EPCS certified or seek appropriate waivers when exceptional circumstances arise. All prescribing dentists must have an active KASPER account, accessed via the Kentucky Online Gateway (KOG), and integrate KASPER reviews into their prescribing workflows. * Scope of Practice: Any prescribing must fall squarely within the dental scope of practice. Practitioners should prioritize patient safety by considering non-opioid alternatives, educating patients on medication use and disposal, and documenting prescribing decisions thoroughly.

Peripheral but Potentially Impactful: 340B Rebate Model Pilot Program

HRSA Announces 340B Rebate Model Pilot Program

The U.S. Department of Health and Human Services (HHS), through its Health Resources and Services Administration (HRSA), has announced a revised 340B Rebate Model Pilot Program. This pilot will implement a rebate mechanism for certain drugs, allowing qualifying manufacturers to effectuate the 340B ceiling price via rebates instead of upfront discounts. This initiative aims to build on established rebate programs for a limited set of drugs, following stakeholder input.

What This Means For Your Practice: * Indirect but Strategic Awareness: For most telehealth brands, medspas, dental practices, and chiropractic offices, the direct operational impact of the 340B Rebate Model Pilot Program is generally indirect, as these entities typically do not qualify as 340B covered entities. However, any healthcare business that partners with or refers patients to 340B covered entities (such as certain hospitals and clinics) should be aware of this significant shift in drug pricing methodology. * Supply Chain Implications: The change from upfront discounts to a rebate system affects the financial operations and cash flow management for drug manufacturers and directly participating covered entities. Understanding these underlying shifts in drug pricing frameworks is crucial for strategic planning, especially for those considering partnerships or operating within broader healthcare ecosystems where 340B entities are prevalent. * Signal of Continued Scrutiny: This initiative signals HRSA's continued efforts to refine and enforce drug pricing compliance, which can have ripple effects across the entire pharmaceutical supply chain, eventually impacting drug availability and costs even for non-340B entities.

Looking Ahead: The Imperative of Proactive Compliance

The regulatory landscape is not merely shifting; it is fundamentally transforming. The collective weight of these recent actions and policy changes underscores a clear message: compliance cannot be a reactive afterthought. For telehealth operators, medspas expanding services, and traditional practices navigating a digital future, the stakes are higher than ever.

What This Means For Your Practice: * Integrate Compliance into Strategy: Compliance must be interwoven into every aspect of your business strategy, from technology infrastructure and marketing campaigns to staffing and billing practices. This includes regular, proactive auditing of your privacy policies, data flows, advertising claims, and billing procedures. * Invest in Expertise: The complexity of these regulations necessitates access to specialized compliance expertise. Whether through internal teams or external partners like TrueEval, ensuring you have reliable guidance is paramount. * Stay Agile and Informed: The pace of regulatory change is accelerating. Regularly monitoring federal and state legislative and enforcement updates is crucial for maintaining an agile and compliant operation. Leverage platforms and resources that provide timely, actionable intelligence.

TrueEval remains dedicated to equipping healthcare leaders with the insights and infrastructure needed to not only meet but exceed the demands of this evolving regulatory environment. The future belongs to those who prioritize ethical practice, transparent operations, and unwavering compliance.