Wade’s Health Law Highlights for October 27, 2026

Fraud & Abuse Enforcement

• Gilead Sciences agreed to pay Texas $45 million to resolve claims that it offered kickbacks to providers that influenced Texas Medicaid prescriptions. The Texas Attorney General sued Gilead in October 2023, alleging it gave providers incentives including “free nurses” and reimbursement support services to prescribe its drugs over competitors’ medications. The State alleged the resulting Medicaid claims violated the Texas Health Care Program Fraud Prevention Act. The settlement follows a similar settlement with AstraZeneca, and the office has also sued Eli Lilly and Sanofi-Aventis. Source: Texas Attorney General
• A Harlingen couple who operated a DME company received federal prison sentences of 110 and 80 months for defrauding Medicare. Jeremiah and Maria Luisa Yzaguirre, who ran Southwest Medical Homepatient, caused Medicare to be billed about $14 million between 2019 and 2023 for power wheelchairs, parts, and repairs for only 37 beneficiaries. They admitted being paid millions for parts and repairs never performed, including about $736,072 billed for one beneficiary by claiming to have replaced expensive parts hundreds of times. Both were ordered to pay $9,248,976 in restitution and a $25,000 fine. Source: U.S. Department of Justice
• A federal grand jury indicted a Texas physician and a retired postal union official in an alleged $19 million scheme to defraud the federal workers’ compensation program. The superseding indictment charges Dr. Javaria Jabeen, who operated clinics in Flower Mound and Grand Prairie, and Allendor Kenyon Brown with conspiracy to commit health care fraud against the Federal Employees’ Compensation Act program from 2017 to 2023. The defendants allegedly billed for knee braces, physical therapy, PRP infusions, and ultrasonic devices that were unnecessary or never provided, resulting in at least $17 million in payments. Brown allegedly recruited federal employees to the clinics and was paid through an entity he controlled to conceal the payments. Chiropractor Demitrious Gilmore, charged in the July 2025 takedown, previously pleaded guilty. Source: U.S. Department of Justice

HIPAA & Data Privacy

• Labcorp agreed to pay $2,287,455 to 43 states and the District of Columbia over a 2019 data breach at one of its debt collection vendors. The Assurance of Voluntary Compliance, effective October 1, 2026, resolves potential claims under state consumer protection, privacy, and breach notification laws and HIPAA, without an admission of liability. Labcorp must employ a qualified chief information security officer, review its information security program annually, and limit PHI disclosures to vendors to the minimum necessary. The company must also run a vendor risk management program and require debt collectors, by contract, to follow frameworks such as the NIST Cybersecurity Framework, conduct annual penetration testing, and complete annual SOC 2 Type 2 audits or biannual HITRUST assessments. Labcorp must obtain an independent compliance assessment within 18 months, and many obligations run for five years. Source: Holland & Knight
• HHS will not adjust HIPAA civil monetary penalties for inflation in 2026 and will keep the 2025 amounts. The Bureau of Labor Statistics could not produce October 2025 CPI-U data during last fall’s government shutdown, so OMB cancelled the 2026 inflation adjustment in an April 2026 memorandum. The maximum HIPAA penalty remains $2,190,294 per violation per year, up 46% from the $1,500,000 set by the HITECH Act. The 2027 multiplier will account for cost-of-living increases from 2025 to 2027. Source: The HIPAA Journal
• A vendor’s access to PHI does not give it the right to use that data to train AI models unless the business associate agreement expressly permits it. Any AI vendor that creates, receives, maintains, or transmits PHI is a business associate, even if it processes only encrypted data it cannot read, consistent with OCR’s December 2022 cloud computing guidance. HIPAA does not assign ownership of data, so data-use rights must be set by contract, and terms like “product improvement” do not authorize model training. Properly de-identified data falls outside HIPAA, but de-identification requires either removal of 18 identifiers under the Safe Harbor method or an expert determination. Covered entities should address training rights, subcontractor flow-downs, audit rights, return or destruction of models and derived data, and ownership of outputs in the BAA. Source: Dentons
• 23andMe agreed to pay California $6 million to resolve state claims arising from a credential-stuffing breach that exposed data of about 6.9 million people, including 855,000 Californians. California did not join the 42-state, $18 million settlement reached in July and pursued its own claims instead. After the breach, 23andMe filed for bankruptcy and was sold for $305 million to TTAM Research Institute, a nonprofit controlled by co-founder Anne Wojcicki, and California’s attempt to block the sale under the Genetic Information Privacy Act failed. Under the settlement, California drops further appeals, the sale stands, and customers keep the right to have their personal and genetic data deleted. 23andMe also settled class action litigation for $46.75 million, approved in July 2026. Source: The HIPAA Journal
• Practices that text patients must comply with HIPAA, the TCPA, carrier registration rules, and some state telemarketing laws. Under the TCPA, patients can revoke consent in any reasonable manner, and practices must honor opt-outs within a reasonable time and no later than 10 business days. Marketing texts require written consent, while informational texts such as appointment reminders may rely on oral consent. Businesses sending automated texts from 10-digit long codes must register their brand and campaigns through The Campaign Registry, and Florida and Oklahoma impose their own consent requirements for marketing texts. Standard SMS is not end-to-end encrypted, and any texting vendor that handles PHI must sign a business associate agreement. Source: Medical Economics
• Healthcare organizations reported 804 breaches affecting 500 or more people in 2025, up from 741 in 2024. The 2025 breaches affected about 140.6 million people, based on OCR breach portal data. HHS guidance describes Security Rule risk analysis as an ongoing process that must account for ePHI wherever it is created, received, maintained, or transmitted, including outside the organization. HHS does not set a single schedule for risk analysis, which depends on an organization’s size, complexity, and environment. AI monitoring tools can compare policies against access records and system logs to flag mismatches, but any such tool becomes part of the environment that must itself be governed. Source: DesignRush

AI & Digital Health

• State medical boards and legislatures are applying licensing, consumer protection, and healthcare rules to AI chatbots that perform clinical functions in telehealth. Pennsylvania’s State Board of Medicine filed the first state medical board action alleging an AI chatbot engaged in the unauthorized practice of medicine, after a Character Technologies chatbot named “Emilie” claimed to be a licensed psychiatrist with a fabricated Pennsylvania license number. Colorado, Maine, Rhode Island, Tennessee, and Vermont banned AI therapy chatbots in 2026, joining Illinois and Nevada, while California’s AB 1979 requires licensed providers to exercise independent judgment when AI clinical decision support informs care, with most obligations effective January 1, 2027. Utah’s regulatory sandbox permits AI-supported prescribing pilots with phased physician review, but the agreements do not waive federal law, provide a malpractice shield, or alter the standard of care. The Ryan Haight Act still generally requires an in-person evaluation before prescribing controlled substances over the internet, and FDA device requirements may apply depending on a tool’s intended use. Source: Holland & Knight
• CMS’s integration of AI tools with Medicare patient data through its Health Technology Ecosystem is drawing objections from patient and privacy groups. Since 2025, CMS has partnered with more than 700 companies, including Google, Microsoft, and OpenAI, and in April began offering Medicare patients AI virtual assistants through an online app library. About two dozen apps have been listed so far, which consultants attribute to companies working through data security and privacy requirements. Advocates point to the 2024 Change Healthcare breach, which exposed more than 192 million records, and a July whistleblower suit alleging Mayo Clinic failed to properly de-identify data used to train its AI assistant. A bipartisan Senate bill, the Health Information Privacy Reform Act, would extend HIPAA-like standards to health apps, wellness platforms, and smartwatches and require HHS and the FTC to set de-identification guidelines for data used in AI. Source: Bloomberg Law
• FDA issued final guidance on when content from apps distributed with prescription drugs requires FDA submission and when an app belongs on a drug’s labeling. Apps connected to a medical device, such as one paired with an asthma inhaler, generally should be described in the drug’s prescribing information. Standalone apps, such as symptom trackers and dose reminders, should appear on the label only if the company shows the app is essential for safe and effective use or provides a meaningful clinical benefit. In most cases, content a companion app displays to users will be treated as promotional labeling. The final guidance aligns the approach of FDA’s drug and device centers. Source: FDA

Compounding, Peptides & GLP-1s

• HHS Secretary Robert F. Kennedy Jr. said the administration aims to create a regulated marketplace for peptides. Kennedy made the comments after FDA submitted a proposed policy change to the White House for review that could make it easier for pharmacies to compound certain peptides. In July, outside advisers to FDA recommended loosening restrictions on six of seven peptides under review, including BPC-157, against the advice of FDA staff. The peptides under consideration have not been approved by FDA as safe or effective. Compounding pharmacies may mix ingredients of approved drugs in specialized doses and in other circumstances such as drug shortages. Source: Reuters
• Apothecary Pharma LLC recalled 22 lots of compounded tirzepatide injections nationwide over possible microbial contamination. The voluntary recall, issued September 24, was announced in an FDA notice. Compounded GLP-1 products are not FDA approved and are used as lower-cost alternatives to brand-name drugs. The affected lots carry beyond-use dates from October 7 through November 26, 2026. Source: The Boston Globe

Litigation & Courts

• The federal government asked the Supreme Court to decide whether the APA allows courts to vacate agency rules universally, in a No Surprises Act case. The petition in U.S. Department of Health & Human Services v. Texas Medical Association (No. 26-491) follows an en banc Fifth Circuit decision affirming nationwide vacatur of rules implementing parts of the No Surprises Act. The government argues the APA’s direction to “set aside” unlawful agency action does not authorize relief beyond the parties, extending the reasoning of Trump v. CASA, which limited universal injunctions but did not address vacatur. Justices Thomas, Barrett, and Gorsuch have expressed skepticism of universal vacatur, while Chief Justice Roberts and Justice Kavanaugh have described it as consistent with longstanding practice. A ruling for the government could leave regulated parties subject to different rules depending on whether they were parties to a successful challenge. Source: Arnold & Porter
• The Texas Supreme Court held that Conduent is a government contractor, not a “governmental unit,” and had no right to an immediate appeal in a suit brought by Medicaid orthodontists. The Court vacated the Third Court of Appeals’ 2024 opinion and returned the lawsuit by M&M Orthodontics and Drs. Scott and Diana Malone to the trial court. The dentists allege Conduent harmed them by approving orthodontic prior authorizations without reviewing medical necessity, after the State recovered $236 million from Conduent and the Malones paid $2 million to settle the State’s Medicaid fraud claims. The Court also rejected Conduent’s appeal route for individual state employees, because a limited liability company is not an “individual.” The ruling did not decide Conduent’s sovereign immunity defense, and the Court suggested the trial judge may authorize a permissive interlocutory appeal on that question. Source: Texas Dentists for Medicaid Reform
• The U.S. Supreme Court declined to let the Trump administration enforce new medical restrictions for transgender federal inmates while litigation proceeds. The order leaves in place U.S. District Judge Royce Lamberth’s ruling requiring treatments to continue, and Justices Alito and Thomas would have allowed enforcement. The Bureau of Prisons policy, adopted under a Trump executive order, would halt surgeries, taper off hormones, and end social accommodations, while continuing mental health services. About 600 inmates were receiving hormone therapy in 2025. A divided appeals court panel had earlier left the injunction in place. Source: AP News

Practice Transactions & Business

• Physician-founded healthcare companies can lose investment and exit value when early entity, ownership, and regulatory choices do not fit later growth. The choice between a Delaware C corporation and an LLC depends on financing plans, tax considerations including potential QSBS benefits, and exit strategy, and changing structure later adds cost. Corporate practice of medicine rules, fee-splitting prohibitions, and fraud and abuse laws affect ownership and compensation, and a PC/MSO structure must reflect who actually controls clinical decisions. Recent California and Oregon legislation increases scrutiny of management arrangements and investor control over medical practices. Physicians who serve as investor, medical director, and referral source for the same company raise fraud and abuse concerns that fair market value alone does not resolve. Source: Husch Blackwell
• Physician partnership agreements need to address how the relationship ends as well as how it begins. In an episode of the PracticeCare podcast, Fox Rothschild partner E.J. Cyran covers the components of a partnership agreement, the issues that arise when agreements are tested, and the conversations healthcare professionals should have before becoming business partners. The discussion applies to medical, dental, behavioral health, and other healthcare practices negotiating buy-ins and buy-outs. Source: Fox Rothschild

Rural Health & Safety Net

• CMS awarded $78 million in Rural Health Transformation Program funding to 216 rural Texas providers through the Rural Texas Strong initiative. The funds support prevention and management of chronic diseases including diabetes, cardiovascular disease, chronic respiratory disease, and obesity. Providers will also use the money to recruit and retain physicians, emergency personnel, and other healthcare workers and to upgrade equipment and facilities. The program is funded through the Working Families Tax Cuts Act’s $50 billion investment in rural health. Source: CMS
• FQHCs receiving a New Access Point award have 120 days to open all proposed sites, deliver all required services, and demonstrate Health Center Program compliance. Recipients must also verify each site in HRSA’s Electronic Handbooks and pass an Operational Site Visit if one is scheduled. HRSA can place a condition on an award that misses the deadline, allow up to 120 more days to resolve it, and then terminate the award, which can also cost the center FTCA coverage, 340B pricing, and enhanced PPS reimbursement. Of the 158 awardees in the most recent cohort, only eight were new organizations, with the rest existing grantees adding sites or Look-Alikes converting to grantee status. Look-Alikes converting to grantees must learn to manage H80 grant funds and Payment Management System drawdowns and coordinate 340B registration to avoid a gap in coverage. Source: VMG Health