This monthly update highlights key regulatory developments, enforcement trends, and legal issues affecting healthcare providers, including independent practices, physician groups, mental health providers, hospitals, and health systems. Each section includes practical action items to help providers assess risk and prepare for upcoming obligations.

Regulatory Developments

Iowa Property Tax Exemptions: What Tax-Exempt Healthcare Providers Need to Know

Healthcare providers that operate as nonprofit or governmental entities may assume that their tax-exempt status automatically extends to the real estate they own or occupy. Under Iowa law, however, property tax exemptions depend on the applicable statutory provisions and the ownership and use of the property.

Iowa Code § 427.1 establishes exemptions for several categories of property. Section 427.1(2) addresses certain publicly owned property devoted to public use and not held for pecuniary profit, while § 427.1(8) addresses property used by charitable and other qualifying institutions. The requirements are not identical. For charitable organizations, the analysis generally focuses on whether the property is used for the organization’s qualifying purposes and whether it is leased or otherwise used with a view toward pecuniary profit. Federal recognition as a tax-exempt organization under Internal Revenue Code § 501(c)(3) does not, by itself, establish eligibility for an Iowa property tax exemption.

These distinctions can become particularly important when a hospital or nonprofit healthcare provider purchases additional property, leases space to another provider, operates a clinic through a related entity, or changes how an existing building is used. Iowa law also addresses property with mixed charitable and commercial uses, including specific provisions applicable to hospitals. Depending on the circumstances, a commercial use may affect the exemption for a portion of the property without necessarily eliminating the exemption for the entire property. See Iowa Code § 427.1(14).

For organizations claiming the charitable property exemption under Iowa Code § 427.1(8), Iowa generally requires an exemption claim to be filed with the local assessor by February 1. Once the claim is allowed, the exemption generally continues in succeeding assessment years without annual refiling so long as the property continues to be used for the purposes stated in the original claim. Organizations must notify the assessor if the property’s qualifying use changes. See Iowa Code § 427.1(14).

Action Items

  • Review the ownership and actual use of property currently treated as exempt.
  • Evaluate exemption eligibility before acquiring property, entering into leases, or changing how property is used.
  • Review arrangements involving related entities, independent providers, or commercial tenants for potential property tax implications.
  • Confirm whether exemption applications or updated information must be submitted to the local assessor.
  • Calendar the applicable February 1 filing deadline for charitable property exemption claims.

Contracting Focus

Management Services Organizations: Structuring MSO Relationships for Healthcare Practices

Management services organizations (MSOs) are becoming an increasingly common consideration for healthcare practices seeking administrative support, outside investment, or a structure that separates business operations from clinical services. An MSO may provide services such as billing, staffing support, scheduling, marketing, technology, purchasing, and general business administration.

These arrangements can offer operational flexibility, but the structure must be carefully evaluated under applicable professional practice and healthcare regulatory requirements. In particular, an MSO should not be used to circumvent restrictions in accord with the corporate practice of medicine doctrine, to circumvent professional ownership issues or to improperly transfer clinical decision-making authority to individuals who are not authorized to exercise it.

For physician practices, the analysis may involve Iowa professional-entity requirements, physician licensing rules, restrictions on the unauthorized practice of medicine, the limitations presented through the corporate practice of medicine doctrine and limitations on the delegation or control of clinical functions. Other licensed healthcare professions may have different ownership, entity, and practice requirements. The appropriate structure therefore depends on the professionals involved, the services offered, and the proposed allocation of ownership and management responsibilities.

The management services agreement is central to the arrangement. It should clearly identify the services the MSO will provide, the compensation structure (which should be in accord with FMV considerations), responsibility for personnel and expenses, access to patient information, ownership of records and business assets, and the authority retained by licensed professionals over clinical matters.

Compensation arrangements require special attention. Depending on the services, parties, and payer relationships involved, management fees may raise issues under federal or state anti-kickback, fee-splitting, or other healthcare regulatory requirements. An arrangement that is commercially attractive is not necessarily compliant simply because the parties operate through separate legal entities.

Action Items

  • Evaluate professional licensing, entity ownership, professional-entity requirements, unauthorized-practice restrictions, and other applicable professional-practice rules before establishing an MSO structure.
  • Clearly separate administrative management responsibilities from clinical decision-making authority.
  • Review management fees and other financial arrangements for applicable fraud and abuse and fee-splitting concerns.
  • Address personnel, billing, patient records, intellectual property, and termination responsibilities in the management services agreement.
  • Determine whether the MSO’s access to protected health information requires a business associate agreement.

Compliance Focus

AI Use Policies: Practical Considerations for Healthcare Practices

Artificial intelligence is becoming part of everyday healthcare operations. Physicians, therapists, nurse practitioners, and other healthcare professionals may use AI-assisted tools for clinical documentation, administrative work, patient communications, scheduling, and practice management. These tools can improve efficiency, but they also introduce privacy, accuracy, professional responsibility, and oversight concerns.

A healthcare practice does not necessarily need an elaborate AI governance program. It should, however, establish clear expectations regarding which AI tools may be used, what information may be entered into those tools, and when human review is required.

Patient confidentiality is a particular concern. Workforce members should not assume that a publicly available AI platform is appropriate for processing protected health information. Before using an AI tool with patient information, practices should evaluate the vendor’s privacy and security practices, determine whether a business associate agreement is required, and consider how information is stored, retained, and used.

AI-generated content also requires appropriate professional oversight. Whether AI is used to prepare clinical notes, summarize records, draft patient communications, or support other practice activities, clinicians remain responsible for ensuring that information is accurate and appropriate. Practices should also consider whether patients need to be informed about particular AI-enabled services and whether additional consent or other requirements apply.

An effective AI use policy should be tailored to the practice’s actual operations, rather than simply prohibiting all AI use or permitting employees to use any available tool.

Action Items

  • Identify AI tools currently being used by clinicians and administrative personnel, including tools adopted without formal approval.
  • Establish written expectations for permitted uses, prohibited uses, and approval of new AI applications.
  • Prohibit entry of protected health information into unapproved AI platforms.
  • Require appropriate human review of AI-generated clinical documentation and patient-facing information.
  • Review vendor agreements, privacy protections, data retention practices, and business associate requirements.
  • Provide practical workforce training regarding responsible AI use.

Litigation and Risk Management Trends

When Healthcare Providers Leave a Practice: Managing Patient Relationships, Records, and Legal Risk

The departure of a physician, therapist, nurse practitioner, or other healthcare professional can create significant legal and operational challenges for both the practice and the departing provider. Even when the parties agree on the employment transition, disagreements may arise concerning patient communications, medical records, confidentiality, solicitation, and ongoing patient care.

A practice should not assume that its contractual relationship with a departing provider determines where patients may receive future care. Patients generally retain the right to choose their healthcare provider, and practices must consider applicable professional obligations and continuity-of-care requirements when communicating about a departure.

Medical records are another common source of disputes. The practice’s responsibility to maintain records, respond to patient requests, and protect confidential information must be distinguished from a departing provider’s need to obtain information necessary for authorized patient care. Providers should not independently remove or transfer patient lists or medical records without appropriate legal authority.

Employment agreements may also contain notice, nonsolicitation, confidentiality, or other post-employment obligations. These provisions should be reviewed alongside applicable professional standards and patient rights. A dispute over restrictive covenants should not interfere with legally required access to records or appropriate continuity of care.

Planning for departures before a conflict arises can reduce the risk of litigation, licensing complaints, disrupted patient care, and reputational harm.

Action Items

  • Review employment and independent contractor agreements for notice, confidentiality, solicitation, and post-employment obligations.
  • Establish a process for patient notification and continuity of care when a clinician leaves.
  • Clarify responsibility for medical records, patient access requests, and authorized record transfers.
  • Protect confidential business information without improperly restricting patient choice or access to care.
  • Address scheduling, outstanding documentation, payer participation, and other transition responsibilities before the departure date.

FAQ of the Month

Can a Healthcare Provider Charge Patients for Copies of Their Medical Records?

Generally, yes, but federal and Iowa law place limits on the fees that may be charged.

Under the HIPAA Privacy Rule, a covered healthcare provider may charge a reasonable, cost-based fee when an individual requests a copy of their protected health information. The permissible fee generally is limited to certain costs of copying the records, applicable supplies and postage, and preparation of an explanation or summary when the individual has agreed to receive one. Fees generally may not include the costs of searching for or retrieving the records. See 45 C.F.R. § 164.524(c)(4).

Iowa law also addresses medical record requests and copying fees. Iowa Code § 622.10(6) generally requires providers to respond to covered written requests from patients, their legal representatives or attorneys, and certain adverse parties within 30 days. The statute bases permissible copying charges on actual production costs, subject to additional limitations and requirements. It also permits advance payment under specified circumstances, which may affect the production deadline. A patient, legal representative, or attorney is entitled to one copy of the patient’s complete billing statement without a copying fee, subject to applicable postage or delivery charges.

Providers should distinguish an individual’s request to access their own protected health information under HIPAA from requests made by attorneys, insurers, or other third parties under an authorization, subpoena, or other legal process. The applicable timeframe, authorization requirements, and permissible fees may differ depending on the nature of the request and the legal authority under which the records are sought. HIPAA’s individual right-of-access fee limitations do not govern every third-party records request.

Healthcare providers should maintain a consistent process for identifying the type of request, determining the applicable fee limitations, and responding within required deadlines. State and federal requirements should be analyzed together, with the applicable requirements depending on the requester, the legal basis for the request, and the type of records involved.

Upcoming Deadlines & Reminders

  • Iowa Charitable Property Tax Exemptions — February 1, 2027: Organizations seeking a charitable property tax exemption under Iowa Code § 427.1(8) should evaluate eligibility and applicable filing requirements under Iowa Code § 427.1(14) and coordinate with the local assessor.
  • Year-End Compliance Review: Review outstanding compliance matters, professional licenses, employment and contractor agreements, HIPAA policies, cybersecurity safeguards, payer arrangements, and priorities for 2027.
  • Iowa Medicaid Provider Revalidation: Iowa Medicaid’s statewide revalidation initiative continues through June 30, 2028. Providers have 30 business days from the date of their individual notice to submit required revalidation materials.
  • Section 504 Accessibility Compliance: Recipients of HHS funding with 15 or more employees have until May 11, 2027, to comply with applicable web and mobile accessibility requirements, including applicable WCAG 2.1 Level AA standards. Recipients with fewer than 15 employees have until May 10, 2028.
  • HIPAA Claims Attachment Standards: Covered entities must comply with the new electronic healthcare claims attachment standards by May 26, 2028.
  • OIG Exclusion Screening: Continue applicable screening against the OIG List of Excluded Individuals and Entities (LEIE), consistent with organizational compliance procedures.

Disclaimer

The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult legal counsel regarding specific questions or implementation decisions.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

Brick Gentry attorneys Paul A. Drey and Emily E. Reiners are expanding their work with mental health providers, medical aesthetics practices, wellness businesses, and other healthcare professionals who are starting, operating, or growing their own practices.

Healthcare professionals building a practice must navigate both the ordinary challenges of operating a business and the regulatory requirements associated with providing healthcare services. The legal considerations will vary depending on the practice’s ownership, professional licenses, services, staffing model, and plans for future growth.

Paul and Emily assist new and established practices with matters including:

  • Business formation, ownership, and governance;
  • Corporate practice of medicine considerations and practice ownership structures;
  • Professional and facility licensing;
  • Employment and independent contractor agreements;
  • Medical director and professional services agreements;
  • HIPAA policies, privacy notices, and related documentation;
  • Patient intake, informed consent, and financial policies;
  • Office and facility leases;
  • EHR, billing, equipment, and other vendor agreements;
  • Scope-of-practice, supervision, and delegation requirements;
  • Regulatory compliance and risk management; and
  • The addition of providers, locations, or new service lines.

Mental health professionals establishing a solo or group practice may need assistance with issues extending well beyond formation of the business entity. Licensing, patient documentation, HIPAA compliance, payer and EHR agreements, office leases, and relationships with employed or contracted clinicians should all be considered when developing the practice’s legal foundation.

Medical spas, aesthetics practices, and wellness businesses face their own challenges at the intersection of healthcare regulation and business. Their legal structures and operational requirements may depend upon who owns the practice, which licensed professionals provide services, how clinical decisions are made, and the particular treatments offered.

Brick Gentry provides practical legal guidance tailored to each practice’s circumstances and stage of development. For certain new practices, the firm offers defined startup service options designed to help owners identify and address their foundational legal needs. Depending on the scope of the work, fee arrangements may include fixed fees, hourly billing, or a combination of the two, taking into account the client’s needs, timeline, and budget.

Healthcare professionals considering starting, acquiring, or expanding a mental health, medical aesthetics, wellness, or other healthcare practice may contact Paul or Emily to discuss their plans.

This monthly update highlights key regulatory developments, enforcement trends, and compliance issues affecting healthcare providers across the continuum—from solo practices to hospitals and large physician groups. Each section includes practical action items to help organizations assess risk and prepare for upcoming obligations.

Regulatory Developments

Healthcare Noncompetes in Iowa: Understanding What Changed—and What Didn’t

Questions continue regarding the effect of Iowa House File 2254 on noncompete agreements involving healthcare professionals. As discussed in our August update, HF 2254 requires the Iowa Board of Regents to adopt a policy prohibiting University of Iowa Hospitals & Clinics (UIHC) from including noncompete clauses in employment contracts with certain healthcare professionals, including physicians, advanced registered nurse practitioners, physician assistants, pharmacists, registered nurses, and licensed practical nurses. The law applies to covered contracts entered into, extended, or renewed on or after June 2, 2026.

Importantly, HF 2254 did not create a statewide prohibition on healthcare noncompetes. Healthcare professionals employed outside UIHC may still be subject to restrictive covenants, and the enforceability and scope of those provisions depend on applicable Iowa law and the specific contractual language and circumstances involved.

Healthcare professionals considering a transition to a new employer or independent practice should review their existing agreements before taking concrete steps toward the transition. Noncompete provisions are also only one part of the analysis. Nonsolicitation provisions, confidentiality obligations, patient records requirements, notice provisions, and other post-employment obligations may continue to apply even where a noncompete does not.

Action Items

  • Review existing employment agreements before beginning a transition to a competing organization or independent practice.
  • Do not assume HF 2254 invalidates noncompete provisions outside UIHC.
  • Identify nonsolicitation, confidentiality, notice, and other post-employment obligations in addition to traditional noncompete provisions.
  • Employers should periodically review restrictive covenant provisions to ensure they remain appropriate for the position and consistent with current law.

Contracting Focus

Starting an Independent Healthcare Practice: More Than Forming an LLC

An increasing number of healthcare professionals—including nurse practitioners, therapists, social workers, and other licensed clinicians—are considering independent practice. Forming a business entity is an important step, but it is only one component of establishing a compliant healthcare practice.

The appropriate structure depends on the provider’s professional license, scope of practice, services offered, ownership, prescribing activities, payer participation, and whether other clinicians will provide services through the practice. Providers may also need to address payer enrollment and credentialing, National Provider Identifier (NPI) requirements, professional liability coverage, patient agreements and consents, leases, employment or independent contractor arrangements, billing practices, and supervision or collaboration requirements where applicable.

Iowa Medicaid’s September 2026 quarterly provider training focused on Medicaid enrollment workflows, providing a timely reminder that enrollment and credentialing should be considered early in the planning process. Delays in enrollment can create significant operational and cash-flow issues for a new practice.

There is no single entity structure that works for every healthcare professional. The requirements applicable to a mental health therapist, social worker, nurse practitioner, physician assistant, or other licensed provider may differ significantly based on professional licensing requirements and the services the practice intends to provide.

Action Items

  • Evaluate professional licensing, scope-of-practice, ownership and entity requirements, including any applicable corporate practice of medicine or other professional practice restrictions, before forming the practice.
  • Begin payer enrollment and credentialing sufficiently in advance of the anticipated opening date.
  • Determine appropriate individual and organizational NPI enrollment and billing arrangements.
  • Develop appropriate patient agreements, consents, and other practice documents.
  • Address employment, independent contractor, lease, vendor, and other material agreements before operations begin.

Compliance Focus

The Final 90 Days: Time for a Year-End Compliance Checkup

As healthcare organizations enter the final months of 2026, now is a good time to evaluate whether compliance priorities identified earlier in the year have been completed and to begin developing the organization’s 2027 compliance work plan.

Year-end review should be tailored to the organization’s size and operations. Providers may want to consider whether recurring billing or documentation concerns have been addressed; required workforce training is current; policies accurately reflect existing practices; compliance complaints and investigations have been appropriately resolved; and corrective action plans have been completed and documented.

Privacy and security should remain part of that review. On September 17, 2026, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced a $700,000 HIPAA settlement following an investigation of a phishing incident potentially affecting more than 225,000 individuals. OCR identified potential Security Rule deficiencies involving risk analysis, termination of workforce access, and unique user identification.

The settlement provides a timely reminder that cybersecurity compliance requires more than technical safeguards. Organizations should periodically evaluate whether their written policies, workforce practices, access controls, training, and actual operations align.

Action Items

  • Review the 2026 compliance work plan and identify outstanding items requiring completion before year-end.
  • Evaluate recurring billing, documentation, privacy, or operational issues that should be addressed in the 2027 work plan.
  • Confirm required compliance and HIPAA training is current.
  • Review the organization’s HIPAA security risk analysis and address outstanding mitigation items.
  • Confirm access is promptly terminated when workforce members leave or change roles.
  • Document completion of corrective actions arising from audits, complaints, investigations, or identified compliance concerns.

Litigation and Risk Management Trends

Payer Audits and Recoupments: Prepare Before the Request Arrives

Healthcare providers continue to face audits, medical record requests, claim denials, and recoupment demands from commercial and government payers. An audit may begin with what appears to be a routine request for records but can ultimately result in claim denials, repayment demands, extrapolated overpayments, or disputes regarding medical necessity, coding, documentation, or reimbursement requirements.

Providers are generally in a stronger position when documentation and billing practices are evaluated before an audit occurs. Internal reviews can help identify recurring documentation gaps, coding inconsistencies, patterns of claim denials, or differences between clinical practice and payer requirements.

Providers should also understand the audit, recoupment, offset, and appeal provisions contained in payer agreements and incorporated provider manuals. A pattern of denials or recoupments may signal a broader contractual, credentialing, documentation, or reimbursement issue rather than isolated claim errors.

The final months of the year provide an opportunity to identify higher-risk services, evaluate recurring payer issues, and address potential weaknesses before they become the subject of a significant audit or repayment demand.

Action Items

  • Review patterns in claim denials, record requests, and recoupments rather than evaluating each claim in isolation.
  • Conduct targeted documentation and billing reviews for higher-risk or frequently denied services.
  • Review payer contracts and provider manuals for audit, recoupment, offset, and appeal provisions.
  • Confirm clinical documentation supports the services and level of care billed.
  • Identify recurring payer issues that may warrant contractual, compliance, or legal review.

FAQ of the Month

Should My Iowa Healthcare Practice Be an LLC or a PLLC?

This is one of the first questions healthcare professionals often ask when starting a practice. The answer depends on the services the entity will provide, the professional licenses of its owners, and whether the practice will be owned by one or multiple professionals.

Under Iowa law, a professional limited liability company (PLLC) is generally organized to practice one specific profession, or multiple professions that may lawfully be practiced together. Individuals organizing a PLLC must be licensed to practice a profession the PLLC is authorized to practice. See Iowa Code §§ 489.1102, 489.1104.

This becomes particularly important when two or more licensed professionals want to own a practice together. Different professional licenses cannot automatically be combined within the same PLLC merely because each owner is a licensed healthcare professional. Iowa law does, however, expressly permit certain professions to practice together. For example, marital and family therapy, mental health counseling, psychology, and social work may be practiced in combination for purposes of Iowa’s PLLC statute. Iowa law similarly recognizes medicine, osteopathic medicine, and physician assistant practice as professions that may be practiced in combination. See Iowa Code § 489.1102(2).

An ordinary LLC and a PLLC also should not be viewed as interchangeable labels. The appropriate entity structure should be determined by examining the professional services being provided, applicable licensing laws and professional board requirements, proposed ownership, and how the practice will operate. The availability of a PLLC also does not eliminate the need to evaluate profession-specific ownership, supervision, delegation, or licensure requirements.

For that reason, healthcare professionals planning a new practice—particularly practices involving owners with different professional licenses—should evaluate the ownership structure before filing organizational documents with the Iowa Secretary of State.

Upcoming Deadlines & Reminders

  • Final 90 Days of 2026: Review outstanding compliance work plan items, provider enrollment and credentialing information, expiring employment and independent contractor agreements, annual training requirements, privacy and security policies, payer contracts, and professional licensure requirements. Begin identifying priorities for the 2027 compliance work plan.
  • Iowa Medicaid Provider Revalidation: Iowa Medicaid’s statewide revalidation initiative continues through June 30, 2028. Providers have 30 business days from the date of their individual notice to complete and submit required revalidation materials.
  • Section 504 Accessibility Compliance Deadlines: Recipients of HHS funding with 15 or more employees must comply with applicable web and mobile accessibility requirements by May 11, 2027. Recipients with fewer than 15 employees have until May 10, 2028.
  • HIPAA Claims Attachment Standards – Compliance Deadline: May 26, 2028.
  • Monthly OIG Exclusion Screening: Continue applicable exclusion screening against the OIG List of Excluded Individuals and Entities (LEIE).
  • Medicare and Medicaid Enrollment: Continue monitoring enrollment, revalidation, and credentialing notices and applicable response deadlines.

Disclaimer

The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult legal counsel regarding specific questions or implementation decisions.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

This monthly update highlights key regulatory developments, enforcement trends, and
compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

Iowa Medicaid Provider Revalidation Is Underway

Iowa Medicaid has launched a statewide provider revalidation initiative that will continue through June 30, 2028. All enrolled provider types are subject to revalidation, although providers will be contacted in phases based on factors including federal risk category, enrollment age, and data completeness.

Once notified, providers will have 30 business days from the date of the notice to complete and submit required revalidation materials. Failure to timely complete revalidation may result in deactivation of the provider’s Medicaid enrollment, causing claims to be denied until the provider completes revalidation.

Providers should ensure that enrollment and contact information is current and that responsibility for monitoring and responding to Medicaid enrollment communications is clearly assigned.

Action Items

  • Confirm Iowa Medicaid enrollment and contact information is current.
  • Identify who within the organization is responsible for receiving and responding to revalidation notices.
  • Begin gathering current licensure, ownership, and other enrollment information that may be needed for revalidation.
  • Calendar the 30-business-day response deadline immediately upon receipt of a notice.
  • Promptly address enrollment discrepancies or requested updates to avoid potential deactivation.

Contracting Focus

Iowa’s New UIHC Noncompete Law: What It Does—and Does Not—Change

Recent changes involving noncompete provisions at University of Iowa Hospitals & Clinics (UIHC) have generated some confusion. Importantly, the change was not simply a business or institutional decision by UIHC. The Iowa Legislature enacted House File 2254, which was signed by the Governor and became effective June 2, 2026.

HF 2254 amended Iowa Code section 262.9 to require the Iowa Board of Regents to develop a policy prohibiting UIHC from including noncompete clauses in employment contracts with advanced registered nurse practitioners, licensed practical nurses, pharmacists, physicians, physician assistants, and registered nurses. The prohibition applies to covered employment contracts entered into, extended, or renewed on or after June 2, 2026.

Importantly, HF 2254 does not establish a statewide prohibition on healthcare noncompetes. The legislation specifically addresses employment contracts with UIHC. Healthcare organizations outside UIHC should continue to evaluate restrictive covenants under applicable Iowa law and the terms and circumstances of the particular employment relationship.

Action Items

  • Do not assume Iowa has enacted a statewide ban on healthcare noncompetes.
  • Review restrictive covenants when recruiting covered healthcare professionals currently employed by UIHC.
  • Consider whether a UIHC employment agreement was entered into, extended, or renewed on or after June 2, 2026.
  • Continue evaluating restrictive covenants in private healthcare employment agreements under applicable Iowa law.
  • Continue to monitor whether the Iowa legislature broadens this prohibition on healthcare non-competes to other healthcare employers.

Compliance Focus

HIPAA Right of Access Enforcement Continues

On August 27, 2026, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced its 55th enforcement action under the HIPAA Right of Access Initiative.

The settlement involved a healthcare provider’s alleged failure to provide an individual timely access to protected health information within the 30-day period required by the HIPAA Privacy Rule. The individual did not receive the requested records until nearly two years after the initial request and after OCR initiated its investigation. The provider agreed to pay $50,000 and implement a corrective action plan that includes policy review, workforce training, and ongoing monitoring.

The enforcement action is a timely reminder that patient record requests should not be treated as purely administrative matters. Organizations should have processes for identifying requests, tracking applicable deadlines, documenting responses, and escalating delays.

Action Items

  • Review policies and procedures governing patient access to medical records.
  • Confirm staff understand applicable response deadlines.
  • Track requests from receipt through completion.
  • Review workforce training regarding HIPAA access requirements.
  • Establish an escalation process for requests that may not be completed timely.

Litigation and Risk Management Trends

Payer Audits, Claim Denials, and Recoupment Demands Require a Coordinated Response

Healthcare providers continue to face audits, medical record requests, claim denials, and recoupment demands from both government programs and commercial health plans. Although some requests are routine, others can develop into significant reimbursement disputes involving medical necessity, coding, documentation, provider enrollment, contractual interpretation, or audit methodology.

Providers should avoid treating every significant payer request as simply a billing department issue. Before responding to an audit or recoupment demand, organizations should identify the payer’s legal or contractual authority for the review, applicable deadlines, the scope of records requested, and available appeal rights.

Commercial payer procedures vary by payer and contract. Provider agreements and incorporated payer manuals may contain important provisions governing audit rights, repayment, offsets, extrapolation, and appeals. A coordinated response involving revenue cycle, clinical personnel, compliance, and legal counsel when appropriate can help preserve appeal rights and reduce the risk that an initial response creates problems later in the process.

Action Items

  • Establish an internal process for escalating significant payer audits, recoupment demands, and patterns of claim denials.
  • Calendar all response and appeal deadlines immediately.
  • Review applicable payer contracts and provider manuals before responding to significant audit requests.
  • Review responsive records for completeness before production.
  • Preserve relevant correspondence, records, and supporting documentation throughout the audit and appeal process.

FAQ of the Month

Our Claims Are Being Denied. When Does This Become a Legal Issue?

An isolated claim denial can often be addressed through the organization’s ordinary billing and appeal processes. A pattern of denials, however, may warrant broader review.

Legal involvement may be appropriate when denials appear inconsistent with the provider agreement or payer policies; involve disputes over medical necessity, reimbursement methodology, credentialing, or enrollment; are accompanied by an audit or recoupment demand; involve extrapolation across a larger group of claims; or create significant financial exposure. Legal review may also be appropriate when appeal rights are unclear or important contractual deadlines are approaching.

Providers experiencing repeated denials should consider whether the problem involves individual claims or reflects a broader contractual, reimbursement, enrollment, or regulatory issue. Identifying that distinction early can help determine the most effective response.

Upcoming Deadlines & Reminders

  • Iowa Medicaid Provider Revalidation: The statewide initiative is underway and continues through June 30, 2028. Providers have 30 business days from the date of their individual notice to complete and submit required revalidation materials.
  • Section 504 Accessibility Compliance Deadlines: Recipients of HHS funding with 15 or more employees must comply with applicable web and mobile accessibility requirements by May 11, 2027. Recipients with fewer than 15 employees have until May 10, 2028.
  • HIPAA Claims Attachment Standards – Compliance Deadline: May 26, 2028.
  • Monthly OIG Exclusion Screening: Continue monthly screening against the OIG List of Excluded Individuals and Entities (LEIE).
  • Medicare Revalidation: Continue monitoring CMS notices and applicable enrollment revalidation deadlines.

Disclaimer

The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult legal counsel regarding specific questions or implementation decisions.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

This monthly update highlights key regulatory developments, enforcement trends, and
compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

Iowa HF 2635 Brings Significant Changes to Prior Authorization Requirements

Effective July 1, 2026, Iowa House File 2635 implements several reforms affecting health carriers, utilization review organizations, and healthcare providers. Among the most significant changes, health insurers are prohibited from requiring prior authorization for medically recommended cancer screenings and emergency medical services. These reforms are intended to reduce administrative barriers to timely care and improve patient access to preventive and emergency services.

HF 2635 also establishes new standards governing the use of artificial intelligence (AI) in utilization review. While health carriers may use AI-assisted tools during the prior authorization process, AI may not serve as the sole basis for denying, delaying, or downgrading a request involving medical necessity. Human clinical judgment must remain part of any adverse determination.

As implementation approaches, providers should review their prior authorization processes and monitor communications from commercial payers regarding revised authorization requirements and implementation procedures.

Action Items

  • Continue documenting medical necessity, even when prior authorization is no longer required.
  • Review current prior authorization workflows in anticipation of the July 1, 2026 changes.
  • Educate clinical, scheduling, and revenue cycle staff regarding services that no longer require prior authorization under Iowa law.
  • Monitor communications from commercial payers regarding updated prior authorization policies and implementation guidance.
  • Update internal policies and patient communication materials, as appropriate.

Contracting Focus

OIG Requests Public Input on Anti-Kickback Safe Harbor Regulations

On June 22, 2026, the Office of Inspector General (OIG) issued a Request for Information seeking public input on whether modifications to the Federal Anti-Kickback Statute safe harbor regulations or beneficiary inducement exceptions are warranted, particularly in connection with remuneration provided to individuals participating in clinical trials.

Although the request focuses on clinical trial participation, it reflects the OIG’s continued evaluation of whether existing fraud and abuse regulations appropriately accommodate evolving healthcare delivery models. Organizations entering into physician arrangements, vendor relationships, care coordination initiatives, or patient engagement programs should continue to ensure those arrangements are carefully structured to comply with applicable fraud and abuse laws.

Organizations with an interest in these issues – including health systems, academic medical centers, clinical trial sponsors, and industry stakeholders may wish to consider submitting comments to the OIG during the public comment period. Participation in the rulemaking process provides an opportunity to help shape future regulatory guidance and safe harbor protections.

Action Items

  • Review physician compensation and referral arrangements for continued compliance.
  • Evaluate vendor and care coordination agreements for Anti-Kickback Statute implications.
  • Monitor future OIG guidance and rulemaking related to safe harbor regulations and beneficiary inducement exceptions.
  • Consider whether your organization or industry association should submit comments to the OIG.
  • Consult legal counsel before implementing new financial incentive or patient engagement programs.

Compliance Focus

National Health Care Fraud Takedown Highlights Continued Enforcement Priorities

On June 23, 2026, the U.S. Department of Justice and the U.S. Department of Health and Human Services announced the results of the 2026 National Health Care Fraud Takedown, charging 455 defendants in connection with more than $6.5 billion in alleged fraudulent schemes. The cases involved allegations of false claims, medically unnecessary services, kickbacks, telemedicine fraud, laboratory testing, durable medical equipment, wound care products, community mental health services, and other fraudulent billing practices.

While most providers maintain robust compliance programs, the enforcement action serves as a reminder that federal agencies continue to rely heavily on data analytics, coordinated investigations, and interagency cooperation to identify potential fraud. Organizations should continue emphasizing accurate documentation, medical necessity, billing integrity, and effective compliance oversight.

Action Items

  • Review internal auditing and monitoring activities.
  • Reinforce documentation and medical necessity requirements with providers and staff.
  • Evaluate compliance training related to fraud, waste, and abuse.
  • Encourage workforce reporting through established compliance reporting mechanisms.

Litigation and Risk Management Trends

Enforcement Continues to Emphasize Documentation and Oversight

Recent federal enforcement actions continue to demonstrate that inadequate documentation, insufficient oversight, and weak internal controls frequently serve as the foundation for False Claims Act investigations and other enforcement actions. Even where allegations involve intentional misconduct, regulators routinely examine the effectiveness of an organization’s compliance program, auditing practices, and leadership oversight.

Healthcare organizations should periodically assess whether existing compliance programs are effectively identifying and addressing operational risks before they become enforcement issues.

Action Items

  • Conduct periodic compliance risk assessments.
  • Review documentation standards in high-risk service lines.
  • Evaluate internal reporting and corrective action processes.
  • Assess whether compliance committee reporting adequately addresses emerging risks.

FAQ of the Month

We Received a Commercial Payer Audit or Request for Records. What Should We Do?

Do not assume an audit or records request is routine or that every requested record should simply be produced without review. Commercial payer audits can result in claim denials, recoupment demands, extrapolated overpayment findings, or allegations that documentation does not support the services billed.

Organizations should promptly identify the scope of the request, preserve all responsive records, verify applicable response deadlines, and carefully review the medical record for completeness before submission. It is also important to understand the payer’s contractual audit rights, applicable provider manual provisions, and available appeal rights before responding.

A thoughtful, coordinated response can often improve the outcome of an audit and better position the organization should an appeal become necessary.

Upcoming Deadlines & Reminders

  • Iowa HF 2635 Effective Date: July 1, 2026.
  • HIPAA Claims Attachment Standards – Compliance Deadline: May 26, 2028.
  • Section 504 Accessibility Compliance Deadlines: Covered entities with 15 or moreemployees must comply with applicable web and mobile accessibility requirements by May 11, 2027. Covered entities with fewer than 15 employees have until May 10, 2028 to comply.
  • Monthly OIG Exclusion Screening: Continue monthly screening of employees, contractors, and vendors against the OIG List of Excluded Individuals and Entities (LEIE).
  • Medicare Revalidation: Monitor CMS notices and applicable enrollment revalidation deadlines.

Disclaimer

The information provided in this publication is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this publication. Because the application of these legal developments depends on the specific facts and circumstances of each situation, organizations should consult legal counsel regarding questions or implementation decisions.

For questions about these developments or assistance with healthcare regulatory, compliance, contracting, or reimbursement matters, please contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

May 2026

Iowa has enacted significant reforms to its Certificate of Need (CON) program through House File 2635, signaling a clear shift toward a more limited regulatory framework for healthcare capital projects and service expansion.

For healthcare providers, the practical takeaway is straightforward: fewer projects will require CON review, and those that do will face a more streamlined process.

Higher Thresholds Will Remove Many Projects from Review

The most consequential change is a substantial increase in the dollar thresholds that trigger CON review. Beginning January 1, 2027, the threshold will increase to $4 million, with additional increases scheduled in future years.  Because prior thresholds generally applied at much lower levels, the revised framework will exclude a broad range of mid-sized capital projects (particularly equipment acquisitions and facility investments) from the CON process altogether.

Equipment Purchases Will More Often Proceed Without Approval

The legislation also revises how equipment acquisitions are treated under the CON framework. In combination with the higher thresholds, these changes reduce the likelihood that the acquisition, replacement, or leasing of medical equipment will require state approval.  As a result, providers may have greater flexibility to move forward with diagnostic and procedural equipment investments without the delays historically associated with CON review.

Certain Services No Longer Require CON Approval

The law also removes CON requirements for several categories of services that were previously regulated, including behavioral health outpatient facilities, radiation therapy, cardiac catheterization, open-heart surgery, and organ transplantation.  While not all providers will be directly affected by these changes, they reflect a broader narrowing of the CON program and may lead to increased competition in certain service lines.

Fewer Projects Will Qualify for Review

In addition to raising thresholds, the legislation revises the definition of what constitutes a “new or changed institutional health service,” which is the threshold determination for CON applicability. These changes further reduce the number of projects that will fall within the CON framework.

Process Changes Reduce Delay and Administrative Burden

For projects that remain subject to CON review, the law simplifies the process by eliminating certain procedural requirements, including the letter of intent and public hearings, and by tightening review timelines. These changes are expected to reduce administrative burden and limit opportunities for delay.

What This Means for Providers

Taken together, these changes represent a meaningful recalibration of Iowa’s CON program. Providers evaluating capital projects, service expansions, or equipment acquisitions should reassess those plans under the revised framework.  In many cases, projects that would previously have required CON approval may now proceed without it particularly beginning in 2027. At the same time, reduced regulatory barriers may facilitate entry by additional providers in certain markets, which should be considered in longer-term planning.

This monthly update highlights key regulatory developments, enforcement trends, and
compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

HIPAA Claims Attachment Standards Become Effective

The U.S. Department of Health and Human Services has finalized new standards governing
health care claims attachments and related electronic signatures under the HIPAA Administrative Simplification framework, 45 C.F.R. Part 162.

The rule became effective on May 26, 2026, and covered entities must comply by May 26, 2028. The new standards are designed to support the secure electronic exchange of documentation used in claims processing and related transactions. The rule is expected to reduce reliance on manual processes, such as faxing and mailing, while improving consistency and efficiency in the exchange of clinical and administrative information between providers and health plans.

Organizations should use the implementation period to evaluate current workflows, vendor capabilities, and internal policies related to claims documentation and transmission.

Action Items:

  • Identify claims attachment processes that rely on manual or nonstandard methods.
  • Engage clearinghouses and vendors regarding implementation timelines and system
  • readiness.
  • Review internal policies governing documentation transmission and authentication.
  • Begin planning for implementation activities leading up to the May 26, 2028 compliance deadline.

Contracting Focus

Vendor Agreements and Technology Governance

As reliance on third-party vendors continues to expand, healthcare organizations should
periodically evaluate whether existing agreements adequately reflect current operations and risk allocation.

Particular attention should be given to business associate responsibilities, cybersecurity
safeguards, incident response obligations, use of automated or AI-enabled tools, service-level
expectations, audit rights, and data governance provisions. Organizations should also consider whether vendor relationships create operational dependencies that could affect continuity of care or regulatory compliance.

A proactive contract review can help align legal risk with evolving operational realities.

Action Items:

  • Review business associate agreements for consistency with current operations.
  • Evaluate cybersecurity and incident response provisions in vendor contracts.
  • Assess contractual responsibilities relating to AI-enabled tools and automated systems.
  • Confirm that service-level, audit, and data governance provisions remain adequate.

Compliance Focus

Artificial Intelligence in Utilization Review and Governance

Iowa House File 2635, effective July 1, 2026, establishes new standards applicable to health
carriers and utilization review organizations, including guardrails on the use of artificial
intelligence in prior authorization processes.

The law permits the use of AI-based tools for initial review of prior authorization requests.
However, for determinations involving medical necessity, AI may not serve as the sole basis for a decision to deny, delay, or downgrade a request. Human clinical judgment must be incorporated into adverse determinations.

Although HF 2635 focuses on utilization review and prior authorization, it reflects broader
regulatory concerns regarding AI governance and accountability. Healthcare organizations
increasingly utilizing AI-enabled tools should evaluate whether appropriate oversight, validation, and documentation processes are in place.

Action Items:

  • Inventory current AI-enabled tools across clinical, administrative, and operational functions.
  • Define where human oversight is required and how it will be documented.
  • Ensure policies, training, and governance frameworks reflect actual use of automated tools.
  • Evaluate vendor contracts to confirm accountability for AI-enabled products and services.

Litigation and Risk Management Trends

Cybersecurity and Third-Party Risk Remain Enforcement Priorities

Federal regulators continue to emphasize cybersecurity compliance, particularly in connection with risk assessments, incident response planning, and oversight of third-party vendors. Recent enforcement activity demonstrates that organizations may face significant exposure arising from vendor vulnerabilities and insufficient monitoring of business associates.

Healthcare organizations should ensure that cybersecurity planning extends beyond internal
systems and addresses vendors, contractors, and other external partners that have access to
protected health information or critical operational systems.

Action Items:

  • Review and update cybersecurity risk assessments.
  • Evaluate third-party vendor security practices and contractual obligations.
  • Conduct tabletop exercises involving cybersecurity incidents and vendor-related disruptions.
  • Confirm incident response plans remain current and operational.

FAQ of the Month

Do We Need a Formal AI Policy?

A standalone AI policy is not required in all circumstances. Many organizations address AI-
related risks through a combination of compliance, information security, privacy, and operational policies.

However, organizations using AI-enabled tools should ensure they maintain a documented
governance framework addressing permitted and prohibited uses, required human oversight,
documentation and validation expectations, vendor accountability, and workforce training.

The form of the framework may vary, but expectations should be clear, operational, and aligned with actual practice.

Upcoming Deadlines & Reminders

  • HIPAA Claims Attachment Standards – Effective Date: May 26, 2026.
  • HIPAA Claims Attachment Standards – Compliance Deadline: May 26, 2028.
  • Section 504 Accessibility Compliance Deadline: May 11, 2027, for covered entities with 15 or more employees.
  • Iowa HF 2635 – Effective Date: July 1, 2026.
  • Monthly OIG Exclusion Screening: Conduct monthly exclusion screening using the OIG List of Excluded Individuals and Entities (LEIE).
  • Medicare Revalidation (Rolling Deadlines): Monitor CMS notices and published revalidation deadlines.

Disclaimer: The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult with their own qualified attorney for advice regarding their specific legal situation.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

This monthly update highlights key regulatory developments, enforcement trends, and compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.  April developments reflect increased scrutiny of emerging care delivery models, including medical spa services and technology-assisted care. 

Regulatory Developments

Iowa CON Framework and Emerging Technology Risks

Iowa’s Certificate of Need (CON) program continues to evolve as policymakers evaluate the scope and applicability of facility and service regulation. The current CON framework is set forth at Iowa Code §§ 10A.711–10A.729, which governs review requirements for certain institutional health facilities, capital expenditures, and service expansions.  Recent legislative activity reflects continued interest in modifying CON requirements, particularly with respect to review thresholds and applicability. Providers considering new facilities, capital expenditures, or service line expansions should evaluate whether proposed projects trigger CON review or fall within available exemptions under current law.  

At the federal level, regulators continue to focus on emerging technology in healthcare, including the use of artificial intelligence in clinical decision-making, documentation, and administrative functions. Although comprehensive AI-specific regulation remains limited, existing requirements governing billing, documentation, and nondiscrimination apply regardless of the tools used, including obligations under 42 U.S.C. § 1320a-7k(d) (overpayments) and 45 C.F.R. Part 84 (Section 504 nondiscrimination).

Action Items:

  • Evaluate whether proposed expansions or capital projects trigger CON review under Iowa Code §§ 10A.711–10A.729. 
  • Confirm whether any statutory exemptions apply to planned projects. 
  • Inventory use of AI tools in clinical, billing, or administrative workflows. 
  • Ensure human oversight and documentation protocols remain in place when AI tools are utilized.

Contracting Focus

Medical Director Oversight and GLP-1 Expansion in Iowa Medical Spa and Wellness Models

Regulators and licensing boards are increasingly scrutinizing supervision and delegation arrangements in Iowa medical spa and wellness clinic settings. This scrutiny has intensified as providers expand services involving injectables and weight-loss medications, particularly GLP-1 receptor agonists (e.g., semaglutide and tirzepatide).  Demand for these therapies has also led to growth in compounded products, off-label prescribing, and direct-to-consumer care models, all of which raise additional regulatory and compliance considerations. In addition, emerging “next-generation” incretin-based therapies such as combination GLP-1 receptor agonists and other multi-agonist drugs are expected to further expand this space, increasing complexity around prescribing, supervision, and documentation.

In Iowa, medical spa services that constitute the practice of medicine must be performed by, or under the supervision of, a licensed physician, consistent with applicable scope of practice requirements. Physicians serving in a medical director role remain responsible for the medical services provided under their direction. Iowa Board of Medicine rules, including Iowa Admin. Code ch. 653-13 (Physician Practice) and Iowa Admin. Code r. 653-13.6, establish standards of physician practice and professional responsibility that apply regardless of the care setting. These responsibilities require meaningful physician involvement and cannot be satisfied through nominal or purely administrative oversight.  Delegation and supervision are also informed by Iowa Admin. Code ch. 653-15 (Physician Assistants) and applicable nursing board rules. Collectively, these requirements mandate that delegated medical services be performed under appropriate physician oversight and within the training and competence of the individual performing the service.

In addition to scope of practice considerations, compensation and ownership structures in these models may implicate the Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), and applicable safe harbors at 42 C.F.R. § 1001.952, particularly where compensation is tied to volume, referrals, or service utilization.

Action Items:

  • Confirm that all GLP-1 and related therapies are prescribed and administered by appropriately licensed individuals or under proper physician supervision. 
  • Evaluate medical director arrangements to ensure active physician involvement, oversight, and accountability, consistent with Iowa Admin. Code r. 653-13.6. 
  • Review policies addressing compounded medications and off-label use, including sourcing, prescribing protocols, and documentation practices. 
  • Ensure patient evaluations support medical necessity and are not limited to questionnaire-based or asynchronous prescribing models. 
  • Evaluate compensation and ownership arrangements for compliance with federal fraud and abuse laws. 
  • Confirm that delegation protocols align with Iowa Admin. Code ch. 653-13 and ch. 653-15 and applicable scope of practice requirements.

Compliance Focus

Informed Consent and Documentation in AI-Assisted Care

As providers increasingly incorporate AI tools into clinical workflows, regulators are focusing on whether existing informed consent and documentation practices adequately reflect how care is delivered. While no uniform federal statute governs AI-specific consent, traditional informed consent principles continue to apply, including requirements that patients receive sufficient information to make informed decisions regarding their care.  Use of AI-assisted documentation or coding tools may increase risk if outputs are not reviewed and validated by licensed providers. Inaccurate or unsupported documentation may create exposure under the False Claims Act, 31 U.S.C. §§ 3729–3733, particularly where claims are submitted based on deficient records.  In addition, nondiscrimination requirements under 45 C.F.R. Part 84 (Section 504) apply regardless of whether care decisions are supported by automated tools, including potential concerns related to bias in algorithmic decision-making.

Action Items:

  • Review informed consent policies to address technology-assisted care where appropriate. 
  • Confirm that AI-assisted documentation is reviewed and validated by licensed providers. 
  • Evaluate whether patient communications accurately describe services being provided. 
  • Train staff on appropriate use and limitations of AI-assisted tools. 

Litigation and Risk Management Trends

Expansion of Consumer Protection and Licensing Enforcement
Recent enforcement trends reflect increased activity not only under federal fraud statutes, but also under state consumer protection laws and professional licensing frameworks. This is particularly evident in areas such as medical spas, weight-loss clinics, and direct-to-consumer healthcare models.  In Iowa, enforcement risk may arise under the Iowa Consumer Fraud Act, Iowa Code § 714H.3, as well as through disciplinary authority exercised by state licensing boards. These cases often focus on advertising practices, supervision, scope of practice, and whether services are provided in a manner consistent with professional standards.  Billing-related issues may also trigger repayment obligations under 42 U.S.C. § 1320a-7k(d) and 42 C.F.R. § 401.305.

Action Items:

  • Review marketing and advertising materials for compliance with Iowa Code § 714H.3 and applicable professional standards. 
  • Confirm that services are provided within licensure and scope of practice parameters. 
  • Evaluate supervision structures in higher-risk service lines. 
  • Document compliance efforts and corrective actions where issues are identified.

FAQ of the Month

“Do we need to disclose use of AI tools to patients?”

There is currently no uniform federal requirement mandating disclosure of AI use in all circumstances. However, existing informed consent principles require that patients receive sufficient information to understand the nature of their care.  If AI tools materially affect clinical decision-making, documentation, or communication, providers should consider whether disclosure is appropriate as part of the informed consent process. Clear documentation and provider oversight remain critical to reducing risk.

Upcoming Deadlines & Reminders

  • Section 504 Accessibility Requirements – Extended Compliance Date May 11, 2027: HHS has extended compliance deadlines for certain accessibility requirements under 45 C.F.R. Part 84, including web and mobile application accessibility for covered entities with 15 or more employees. 
  • HIPAA Claims Attachment Standards – Effective May 26, 2026: Covered entities should continue preparing for implementation of standardized electronic claims attachment transactions and electronic signature requirements under 45 C.F.R. Part 162. 
  • HIPAA Claims Attachment Compliance Deadline – May 26, 2028: Full compliance with the new transaction standards will be required within two years of the effective date. 
  • Monthly OIG Exclusion Screening: Conduct monthly exclusion screening as recommended by OIG guidance using the List of Excluded Individuals and Entities (LEIE). 
  • Medicare Revalidation (Rolling Deadlines): Providers should monitor for CMS revalidation notices and comply with deadlines stated in CMS communications. 
  • Iowa CON and Insurance Reform Developments (HF 2635): Providers should monitor implementation of HF 2635 (2026), which has been enrolled and sent to the Governor and, if signed, is scheduled to take effect July 1, 2026.

Disclaimer: The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult with their own qualified attorney for advice regarding their specific legal situation.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

This monthly update highlights key regulatory developments, enforcement trends, and compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

New Federal Activity Emphasizes Billing Integrity and Accessibility Requirements

March 2026 saw significant federal activity focused on billing accuracy and administrative simplification. On March 24, 2026, HHS finalized new HIPAA standards governing electronic claims attachments and electronic signatures under the Administrative Simplification provisions, 45 C.F.R. Part 162. These standards are intended to replace manual processes such as fax and mail with standardized electronic transactions supporting claims documentation.

The final rule becomes effective May 26, 2026, with compliance required by May 26, 2028.

In parallel, CMS has continued to emphasize program integrity and fraud detection, including a Request for Information seeking stakeholder input on expanded enforcement tools and data-driven oversight mechanisms.

Recent CMS and OIG activity also continues to highlight improper payments tied to documentation deficiencies and inconsistencies between clinical records and billed services, reinforcing the government’s ongoing focus on billing integrity.

Providers should also be preparing for compliance obligations under HHS’s updated Section 504 regulations governing nondiscrimination and accessibility, 45 C.F.R. Part 84, with key accessibility-related requirements for many covered entities taking effect in May 2026.

Action Items:

  • Conduct targeted documentation audits in high-risk service areas.
  • Ensure clinical documentation supports medical necessity and level of service billed.
  • Provide refresher training to providers and coding staff on documentation requirements.
  • Evaluate internal controls around claims submission and supporting documentation.

Contracting Focus

Increased Scrutiny on Technical Compliance with Written Agreements

Recent enforcement activity continues to highlight technical deficiencies in contracting, particularly where agreements are expired, unsigned, or inconsistent with actual services performed. Even where compensation appears to be fair market value, the absence of a current written agreement remains a recurring basis for Stark Law exposure under 42 U.S.C. § 1395nn and its implementing regulations at 42 C.F.R. §§ 411.351 and 411.357.

Regulators also continue to evaluate these arrangements under the Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), and applicable safe harbors at 42 C.F.R. § 1001.952.

Action Items:

  • Inventory all physician and vendor agreements and confirm execution status.
  • Identify and remediate expired or unsigned agreements.
  • Ensure contract terms align with actual services being performed.
  • Implement or update contract tracking systems to monitor renewal and signature requirements.

Compliance Focus

Ongoing Emphasis on Internal Auditing and Program Effectiveness

Recent OIG activity, including work plan updates and audit findings, continues to emphasize the importance of active internal auditing and monitoring. These expectations align with OIG’s General Compliance Program Guidance and the Department of Justice’s Evaluation of Corporate Compliance Programs.

In addition, the updated Section 504 regulations under 45 C.F.R. Part 84 expand expectations around nondiscrimination, effective communication, and accessibility, requiring organizations to evaluate not only policies but also operational practices and digital access.

Action Items:

  • Finalize and implement a 2026 compliance audit work plan.
  • Prioritize audits in high-risk areas, including billing, documentation, and referral arrangements.
  • Review nondiscrimination policies and procedures for alignment with Section 504 requirements.
  • Document audit findings and corrective actions.
  • Report audit results to leadership and governing bodies.

Litigation & Risk Management Trends

Expansion of Data Analytics and Continued False Claims Act Exposure

Government enforcement agencies continue to expand the use of data analytics to identify billing outliers and target providers for audit. Both government and commercial payors increasingly rely on extrapolation methodologies, increasing potential financial exposure.

Failure to timely return identified overpayments may create exposure under the False Claims Act, 31 U.S.C. §§ 3729–3733, particularly in light of repayment obligations under 42 U.S.C. § 1320a-7k(d) and 42 C.F.R. § 401.305.

At the same time, providers should anticipate increased scrutiny of nondiscrimination and accessibility issues under federal civil rights laws, including Section 504, particularly where access to services or communication methods may be limited.

Action Items:

  • Analyze internal billing data for outliers compared to peer benchmarks.
  • Conduct internal reviews where anomalies are identified.
  • Develop a standardized audit response protocol.
  • Assess accessibility of services, including communication methods and digital platforms.
  • Maintain documentation supporting medical necessity and coding decisions.

FAQ of the Month

“What should we be doing now to prepare for Section 504 compliance requirements?”

Healthcare organizations should begin by reviewing nondiscrimination policies, communication practices, and accessibility of services in light of updated requirements under 45 C.F.R. Part 84.

This includes evaluating how services are provided to individuals with disabilities and assessing accessibility of electronic and information technology. Organizations should identify gaps and develop a plan to address them prior to applicable May 2026 compliance requirements for covered entities.

Upcoming Deadlines & Reminders

  • CMS Program Integrity RFI – Comments Due March 30, 2026: Providers may wish to evaluate and respond to CMS’s request for input on expanded fraud detection and enforcement tools.
  • Monthly OIG Exclusion Screening: Conduct monthly exclusion screening as recommended by OIG guidance using the List of Excluded Individuals and Entities (LEIE). Screening should be completed before the end of each month, with documentation retained.
  • Medicare Revalidation (Rolling Deadlines): CMS continues to issue revalidation notices on a rolling basis. Providers should monitor for revalidation letters and comply with deadlines stated in CMS notices or published revalidation due dates.
  • Section 504 Accessibility Requirements – May 2026: Covered healthcare entities should prepare for compliance with updated nondiscrimination and accessibility requirements under 45 C.F.R. Part 84, including accessibility of services and digital platforms.
  • HIPAA Claims Attachment Standards – Effective May 26, 2026: Covered entities should begin preparing for implementation of standardized electronic claims attachment transactions and electronic signature requirements under 45 C.F.R. Part 162.
  • HIPAA Claims Attachment Compliance Deadline – May 26, 2028: Full compliance with the new transaction standards will be required within two years of the effective date.
  • Corporate Transparency Act (If Applicable): Entities should confirm whether any current Beneficial Ownership Information reporting obligations apply under 31 U.S.C. § 5336 and current FinCEN guidance, particularly for foreign reporting companies.

Disclaimer: The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult with their own qualified attorney for advice regarding their specific legal situation.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.

This monthly update highlights key regulatory developments, enforcement trends, and compliance issues affecting health-care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

Continued Enforcement Focus on Data Security and Billing Integrity

Federal regulators continue to prioritize HIPAA Security Rule compliance under 45 C.F.R. Part 164, Subpart C, particularly the required risk analysis under 45 C.F.R. § 164.308(a)(1)(ii)(A). Agencies also remain focused on timely reporting and repayment of identified overpayments under the 60-Day Rule, 42 U.S.C. § 1320a-7k(d) and 42 C.F.R. § 401.305. In addition, referral relationships and marketing arrangements continue to receive scrutiny under the Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b). Recent enforcement activity from HHS’s Office for Civil Rights and the Department of Justice underscores a consistent message: regulators expect proactive compliance infrastructure, documented oversight, and timely corrective action.

Action Items:

  • Confirm your HIPAA Security Risk Analysis is current and reflects ransomware and third-party access risks.
  • Conduct a tabletop exercise to test breach response procedures.
  • Audit internal billing practices for medical necessity documentation and modifier usage.
  • Review referral and marketing relationships for written documentation and regulatory compliance.

Contracting Focus

Fair Market Value and Commercial Reasonableness

Compensation arrangements remain one of the most common enforcement triggers under the Stark Law, 42 U.S.C. § 1395nn and its implementing regulations at 42 C.F.R. §§ 411.351 and 411.357, as well as under the Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), and its regulatory safe harbors at 42 C.F.R. § 1001.952. Regulators are evaluating not only whether contracts exist, but whether they are commercially reasonable, supported by fair market value, and consistent with actual operational practices. Agreements that appear compliant on paper may still present risk if services are not performed as documented or if compensation methodology raises referral concerns.

Action Items:

  • Review expiring physician, medical director, and management agreements.
  • Confirm services described in agreements are actually performed and documented.
  • Update fair market value support when compensation changes.
  • Ensure compensation formulas do not take into account the volume or value of referrals where prohibited.

Compliance Focus

Board and Leadership Oversight Expectations

Both the Department of Justice and the Office of Inspector General have emphasized active
governance oversight in compliance programs, including in the DOJ’s Evaluation of Corporate Compliance Programs guidance and OIG’s updated General Compliance Program Guidance. A written compliance plan alone is no longer sufficient. Regulators increasingly expect demonstrable leadership engagement, meaningful reporting structures, and documented oversight at the executive and board levels. The absence of documentation often becomes as problematic as the absence of compliance activity itself.

Action Items:

  • Ensure compliance reporting occurs regularly at the executive or board level.
  • Document leadership discussions regarding compliance risks.
  • Confirm anonymous reporting mechanisms are accessible and functional.
  • Update annual compliance training to reflect current enforcement priorities.

Litigation & Risk Management Trends

Overpayments, False Claims Exposure, and Employment Claims

Failure to timely return identified overpayments can create exposure under the False Claims Act, 31 U.S.C. §§ 3729–3733. Courts have interpreted “identified” broadly once a provider is put on notice of a potential overpayment, placing increased importance on prompt internal investigation and documentation. Healthcare employers also continue to face retaliation claims under 31 U.S.C. § 3730(h), wage-and-hour disputes under the Fair Labor Standards Act, 29 U.S.C. § 201 et seq., and restrictive-covenant challenges, depending on evolving state-law standards. Strong internal documentation and consistent employment practices significantly reduce litigation risk.

Action Items:

  • Establish a written overpayment investigation protocol.
  • Document steps taken once a billing issue is discovered.
  • Audit wage classification for exempt and non-exempt employees.
  • Review restrictive covenants for enforceability under current law.

FAQ of the Month

“If we identify a potential overpayment but are still investigating, when does the 60-day clock start?”

Under 42 U.S.C. § 1320a-7k(d) and 42 C.F.R. § 401.305, the repayment obligation is triggered
once an overpayment is “identified.” Courts have held that identification occurs when a provider has actual knowledge of the overpayment or acts in reckless disregard or deliberate ignorance. The regulation defines “identified” as when a provider has determined, or should have determined through reasonable diligence, that an overpayment was received. Prompt investigation, written documentation of findings, and timely repayment when required are critical to mitigating False Claims Act exposure.

Upcoming Deadlines & Reminders

  • Monthly OIG Exclusion Screening: Conduct monthly exclusion screening as recommended by OIG guidance using the List of Excluded Individuals and Entities (LEIE). Screening should be completed before the end of each month, with documentation retained.
  • Medicare Revalidation (Rolling Deadlines): CMS continues to issue revalidation notices on a rolling basis. Providers should monitor for revalidation letters and calendar submission deadlines immediately upon notice. Revalidation typically must be completed within 60 days of CMS notification to avoid deactivation.
  • HIPAA Security Risk Analysis Review: While HIPAA does not impose a fixed annual deadline, organizations that conduct risk analyses on a calendar-year cycle should schedule completion during Q1 2026 to maintain consistency with 45 C.F.R. § 164.308(a)(1)(ii)(A).
  • Overpayment Monitoring and Repayment Protocols: Ensure internal processes are in place to identify, investigate, and timely return overpayments in accordance with 42 U.S.C. § 1320a-7k(d) and 42 C.F.R. § 401.305.
  • Corporate Transparency Act (If Applicable): Entities subject to the Corporate Transparency Act should confirm applicable Beneficial Ownership Information reporting obligations under 31 U.S.C. § 5336 and current FinCEN guidance. Enforcement timelines have been subject to ongoing federal litigation, and reporting obligations should be verified prior to filing.
  • Annual Compensation Review Preparation: Organizations anticipating mid-year compensation adjustments should begin Stark Law and fair market value review processes early in the year to allow adequate documentation prior to implementation.

Disclaimer: The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult with their own qualified attorney for advice regarding their specific legal situation.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.