Wade’s Health Law Highlights for November 3, 2026

Drugs & Compounding

• HHS will not take enforcement action against 503A compounding pharmacies that make six peptides FDA removed from the compounding bulks list in 2023. The policy, titled “Enforcement Discretion Policy Regarding 503A Compounding Using Certain Peptide Bulk Drug Substances,” covers BPC-157, Epitalon, KPV, MOTS-c, Semax, and TB-500 and was set for Federal Register publication on October 30. It does not change the peptides’ regulatory status; HHS instead states it will not pursue compounders who make them. HHS cited a July FDA advisory panel vote to add the six peptides back to the list, a panel to which Secretary Kennedy had named eight new members, at least six with ties to peptide businesses. HHS says the policy will steer patients away from research-use-only peptides from foreign manufacturers, while the Center for Science in the Public Interest and Americans for Safe and Effective Medicines say the products remain untested. Source: Ars Technica

Fraud & Abuse

• OIG will not sanction a nonprofit trustee that plans to use donations from health care providers and manufacturers to cover trust fees for financially needy Medicare beneficiaries enrolled in QMB or QMB+. The nonprofit runs a pooled special needs trust and charges participants up to $200 a month for operating the trust and helping them keep their Medicare Savings Program status. Under the proposal, donors would give unrestricted funds, and the trustee would subsidize the fees of eligible individuals first come, first served, using objective financial-need criteria. Donors would get only aggregate data, would have no influence over operations or seats on the board, and beneficiaries would not be told which donors paid for their subsidy. OIG concluded that the arrangement could generate prohibited remuneration under the Anti-Kickback Statute but presents a low risk of overutilization or steering, and that it does not violate the Beneficiary Inducements CMP. Source: HHS-OIG

AI & Patient Privacy

• AI glasses worn by healthcare staff can send recordings of patient encounters to outside AI platforms, raising HIPAA, confidentiality, and recording-consent issues. A device asked to summarize an exam can transmit symptoms, history, and treatment discussion before the visit ends, without the patient knowing a recording occurred. Fisher Phillips advises employers to set a consent process covering what is recorded, where it is processed and stored, and how long it is kept, and to have counsel review recording-consent and HIPAA authorization requirements. Employers should also determine whether devices upload automatically or allow AI training on the data, confirm any needed business associate agreements, and name approved and prohibited devices and uses in policy. The firm also recommends HIPAA and cybersecurity training before use and rules, signage, and escalation steps for patients and visitors who record in the facility. Source: Fisher Phillips
• Healthcare websites had the lowest failure rate on core privacy tests in a Datatrue study of 242 high-traffic U.S. sites, but most ignored visitors’ Global Privacy Control signal. Datatrue tested the sites, including 50 healthcare sites, on October 12 and 13, 2026, with the GPC browser signal switched on, checking for ad tracking, a clear opt-out option, and session replay on arrival. Healthcare sites failed at a 28% rate, compared with 40% for media, and had a median of 1.5 ad companies per site. Of the 18 healthcare sites that contacted ad or social media companies before visitors made a choice, 14 did nothing when GPC was enabled, and 32 of the 50 healthcare sites offered no opt-out option. Datatrue recommends an on-screen choice at arrival, disabling data-sharing tags when GPC is enabled, and holding session replay until a visitor consents. Source: The HIPAA Journal
• Staff who switch to free AI chatbots when a practice’s approved AI tool hits its usage limit can disclose PHI to vendors that have signed no business associate agreement. AI vendors measure business plans in tokens, credits, or messages, and some, including Microsoft, have moved AI features to usage-based billing with administrator spending caps. When a limit is reached, work stops, overage charges accrue, or employees turn to personal AI accounts, a practice known as shadow AI. IBM’s 2025 Cost of a Data Breach Report found that 63% of breached organizations had no AI governance policy and that high levels of shadow AI added about $670,000 to the average breach cost. The author recommends inventorying AI tools, approving only tools covered by a BAA, setting usage alerts, adopting an AI acceptable use policy that says what to do at a limit, and adding manual AI workflows to the HIPAA contingency plan. Source: Medical Economics

Cybersecurity & Breaches

• Healthcare breaches exposed 78.6 million people in the first eight months of 2026, up 14.8% from the same period in 2025. August brought 52 breaches of 500 or more records affecting 8,377,327 people, with hacking and IT incidents accounting for 78.8% of breaches and 98% of individuals affected. Johns Hopkins Bayview Medical Center began notifying 3,182 patients on October 22 that an employee uploaded a spreadsheet of patient information to an unapproved public AI platform. A vulnerability in the Metabase business-intelligence tool exposed records of 340,915 Blueberry Pediatrics patients, and an analytics vendor’s access key posted on a public website led Denver Health Medical Plan to notify 238,083 members. Federal action on the proposed HIPAA Security Rule overhaul remains delayed, while Florida has an offshore data-storage statute in place and a proposed 24-hour incident reporting rule in development. Source: Shattered
• The HIPAA Security Rule requires clinics to keep retrievable exact copies of ePHI and a disaster recovery plan, and ransomware recovery data shows untested backups often fail that requirement in practice. In Sophos’s 2024 healthcare survey, 22% of ransomware victims fully recovered within a week, 37% needed more than a month, and attackers tried to compromise backups in 95% of attacks. The Security Rule treats periodic testing of contingency plans as an addressable specification, and HHS does not prescribe a backup product, retention period, or recovery time objective. A 2025 proposal to strengthen the Security Rule had not been finalized as of October 24, 2026, with final action reportedly expected in July 2027. The guide recommends an immutable Object Lock repository, separate write and restore-only credentials, an isolated clean-room restore host, and a timed restore drill that produces a record for auditors. Source: Tech Insider
• A researcher identified four vulnerabilities in HAPI FHIR, the open-source library used in Smile Digital Health’s Smile CDR, that can allow cross-tenant access to patient records. Abhinav Agarwal demonstrated the flaws against HAPI FHIR 8.10.0 as used in Smile CDR 2026.05.R01 and identified eight other commercial products that incorporate the library. The two high-severity flaws allow an unauthenticated attacker to crash services with compressed payloads and allow a user authorized for one tenant to read and write another tenant’s data. The flaws could affect more than 30 U.S. payer deployments holding data on more than 110 million people, and no exploitation has been reported. Smile Digital Health said the compression flaw will be fixed in its November release and that the partition flaw requires an authenticated user with access to at least one partition. Source: The HIPAA Journal

Health Centers

• HRSA now contacts health centers that are behind on Single Audits every month and can suspend their grants if they miss a 120-day grant condition. Health centers that spend $1,000,000 or more in federal awards in a fiscal year, up from $750,000 under the revised Uniform Guidance, must file a Single Audit with the Federal Audit Clearinghouse. Since October 2025, delinquent centers must respond within 15 days, meet a 120-day condition to submit the most overdue audits, and face a 30-day suspension and possible termination if they do not. VMG Health notes that losing the Section 330 grant ends FQHC status, along with FTCA coverage, 340B eligibility, and FQHC prospective payment rates. Reviewers on Operational Site Visits are also holding centers to the Site Visit Protocol, with attention on the sliding fee program, board approvals recorded in minutes, credentialing, and Form 5A. Source: VMG Health

Hospital Charity Care

• Texas nonprofit hospitals must offer and publicize charity care, but patients and advocates say many eligible patients never learn the program exists. Federal and state law require nonprofit hospitals to offer financial assistance as a condition of tax exemption and to publicize it through ER postings, online notices, billing materials, and a yearly newspaper notice. Dollar For, which has helped more than 8,000 Texans apply, found in a national survey that the top reason people did not apply was that they did not know about it. A Rice University Baker Institute analysis of more than 100 Texas nonprofit hospitals estimated at least $127 million in 2019 bad debt for patients who should have received charity care. The Texas Hospital Association says all Texas nonprofit hospitals meet the legal standards for providing and giving notice of financial assistance. Source: Public Health Watch