Dorsey Health Law

On July 6, 2026, the Centers for Medicare & Medicaid Services (“CMS”) proposed a rule that would expand its administrative remedies to combat potential fraud. The proposed rule is the latest in a round of administrative actions that signal CMS’s intent to aggressively pursue allegations of Medicare and Medicaid fraud and heighten the risk of fraud enforcement against even well-intentioned Medicare and Medicaid providers and suppliers. The proposed rule includes several changes to regulations that govern Medicare billing privileges. Providers and suppliers should be aware that these changes dramatically expand the flexibility afforded to CMS in enrollment and revocation actions, potentially leading to harsh consequences for ministerial and administrative errors. If finalized, moreover, the proposed rule could have material implications for providers and suppliers facing threatened revocation, including heightened risk of overpayment liability and increased hurdles to challenging revocations and denials of enrollment. Added Flexibility to Existing Revocation Grounds   CMS has proposed to remove a number of factors that the regulations list as relevant to a determination of whether a provider has engaged in “abuse of billing privileges.” While acknowledging that the inclusion of these factors in the regulations was permissive (requiring consideration only where “as appropriate or applicable”), CMS stated that it must be afforded “the maximum flexibility to address all possible . . . scenarios without the rigid constraints of our existing factors.” CMS provided little guidance as to the outer bounds of what conduct could constitute an “abuse of privileges” that merits revocation of Medicare billing privileges. Instead, CMS noted that a “pattern of practice” of abuse of billing privileges might be established “by a simple finding that several of a provider’s claims do not meet Medicare requirements.” Similarly, CMS has proposed to expand the regulatory provision that permits revocation of enrollment if a provider certifies as “true” false or misleading information in Medicare enrollment application or renewal forms to include any scenario in which a provider submits “false or misleading information on or associated with any CMS Medicare enrollment-related form,” including materials submitted to Medicare contractors. CMS stated that it interprets this expanded rule to include anything related to Medicare enrollment, and not only those submissions that are “intended to gain or maintain Medicare enrollment.” If finalized, the proposed rule would add significant flexibility to CMS’s ability to pursue revocation of a provider’s enrollment. While CMS has assured providers that it would “invoke [the revised regulations]. . . only when legitimately warranted under the facts and circumstances and not as a matter of course,” such expanded flexibility threatens unpredictability in the event of even administrative or ministerial errors in submissions and claims. These changes would, moreover, make it more difficult for providers to challenge a revocation action. Expanded Revocation Grounds In addition to adding flexibility to existing grounds for revocation, CMS’s proposed rule adds to and expands CMS’s already broad authority to revoke provider and supplier enrollment. Such proposed changes include adding the following grounds for revocation: Denial of Enrollment Application. Where CMS could previously revoke a provider’s other enrollments if one enrollment is revoked, CMS would also be able to revoke a provider’s existing enrollments if an application for enrollment submitted by the provider is denied. High-Risk Enrollments. CMS would be able to revoke enrollment if it determines the provider or supplier (including owning/managing employees or organizations) poses a high risk of fraud, waste, or abuse due to “. . . an affiliation under [42 C.F.R.] § 424.519” or “the provider’s or supplier’s location within a limited geographic area that has an excessive number of providers and suppliers.” Certain Misdemeanor Convictions. CMS would be able to revoke enrollment if a provider or supplier—or its owners, managing employees, managing organizations, officers, or directors—are convicted of a “misdemeanor related to sexual assault or financial misconduct within the past 10 years that CMS deems detrimental to the best interests of the Medicare program and its beneficiaries.” Ownership Changes (HHA, Hospice, DMEPOS). CMS would have broad authority to revoke enrollment of home health agencies, hospices, and DMEPOS suppliers who do not comply with the regulations governing provider changes of ownership. These proposed, expanded grounds for revocation are notably broad, and CMS provides only limited guidance as to what conduct might result in revocation under these grounds. As with the proposed expansion of existing grounds for revocation, the open-ended nature of these proposed grounds for revocation may make it more difficult for providers and suppliers to challenge revocation actions. Expanded Grounds to Deny Medicare Enrollment As with revocations, CMS proposes to expand the grounds under which a provider’s application to enroll in Medicare can be denied. These expanded and additional grounds include many of the grounds added for revocations, but also include: Medicare Debt or Payment Suspension. CMS proposes expanding the ground to deny enrollment based on Medicare debt or payment suspension to include a provider or supplier’s “managing employee, managing organization, or individual or entity with any other form of business or financial relationship with the provider or supplier[.]” Significantly, this expansive definition (called an “associated party” under the proposed regulation) currently contains no material limitations, meaning almost any person or entity with whom an applicant does business could create denial liability. Sharing Locations with Denied/Revoked Providers or Suppliers. CMS would have authority to deny applications where a “provider’s or supplier’s practice location is in the same suite or office as another provider or supplier whose Medicare enrollment has been revoked or denied.” Hospices with Distant Medical Directors or Administrators. CMS would have discretion to deny hospice applications if the hospice’s medical director or administrator serves “multiple other hospices” or practices/is located “at such a distance (for example, in a different state) from the enrolling hospice that the medical director cannot realistically perform all medical director functions,” with a similar provision for administrators. In addition, CMS proposes applications denied for “other program termination or suspension,” may be applied to the provider or supplier in its own name or NPI or that of its owners, managing employees, or managing organization regardless of whether any appeals are pending. Retroactive Revocation CMS proposed to restructure and expand the regulatory grounds for retroactive revocation of billing privileges. Currently, Medicare regulations provide that revocations are, by default, prospective in nature: effective 30 days after CMS or the CMS contractor mails notice to the provider. Under certain circumstances, the regulations provide for revocations to be retroactive, such as when a provider is convicted of a felony, the date a professional license is suspended, revoked, or surrendered, or when a provider submits a false certification in their enrollment application. CMS has proposed to reframe the rule so as to default to retroactive revocation of billing privileges. CMS expressed concern that providers may collect payment from Medicare while remaining so non-compliant with enrollment requirements as to merit revocation. To address this concern, CMS proposed that all revocations be retroactive to the date of determined non-compliance.[1] As a result, providers suspected of misconduct or non-compliance are likely to face claims of retroactive overpayments in addition to the immediate concern no longer receiving Medicare payments while their enrollment is revoked. Reapplication Bar CMS’s proposed rule expands the grounds from which a provider may be prohibited from seeking reapplication as a Medicare provider. Under current regulations, CMS may prohibit prospective providers from enrolling in Medicare for up to 10 years if its enrollment application is denied because the applicant submitted false or misleading information in its application. Under the proposed rule, CMS will have the discretion to prohibit a provider from enrolling in Medicare if their enrollment application is denied for any reason. Conclusion As a part of the federal government’s increasingly aggressive push to combat real or perceived healthcare fraud, the proposed rule both broadens CMS’s authority to revoke and deny Medicare enrollment and raises the stakes for revocation and denial. What the proposed rule does not share is how CMS plans to exercise this expanded discretion: as a result, the proposed rule, if enacted, increases the unpredictability and potential ramifications of even technical noncompliance with CMS rules. As a result, Medicare providers should keep a close eye on potential revisions to these rules and their potential implementation and consider proactively evaluating their compliance under CMS standards. [1] In the proposed rule, CMS identifies, with respect to each ground for revocation, what it will consider to be the effective date of revocation.

This year, Utah commenced a contract with Doctronic to pilot a medication renewal program where Doctronic’s AI system autonomously authorizes refills for certain routine medications. The contract arranged for a partnership between the Utah Office of Artificial Intelligence Policy (Office) and the Utah Department of Professional Licensing (DOPL), who agreed to refrain from regulatory enforcement during the 12-month term of the pilot program. The implementation of this type of AI pilot program in the state was made possible by the Utah Artificial Intelligence Policy Act (UAIP) which was passed in 2024. The UAIP established the Office and tasked it with creating a mechanism for companies to apply with the Office to receive 12 months of regulatory mitigation while developing a proposed AI system. This regulatory “sandbox” allows Doctronic to test its medication renewal program without professional licensing or scope-of-practice enforcement concerns. Doctronic’s program is the first state-approved AI tool that is legally permitted to participate in autonomous medical decision-making for prescription renewals. In late April, the Utah Medical Licensing Board (Medical Board) released a letter responding to the launch of the new statewide pilot program. The Medical Board criticized the state for failing to include the Medical Board in the decision-making process prior to executing the Doctronic contract, and called on the state to immediately suspend the Doctronic program. While the DOPL creates and executes professional regulations in the state, the Medical Board serves in an advisory capacity regarding practice and licensing standards in Utah. The Medical Board’s letter expressed concern that it was not given the opportunity to opine on the Doctronic pilot program despite the Medical Board’s expertise and advisory role. The Doctronic AI Prescription Renewal Tool During the course of the pilot program, patients who choose to participate will access a cloud-based web application and create a free member account which will verify their identity to have their prescription refilled. Patients must then submit photographic evidence of their current medication (prescription label or pill bottle showing medication name, dosage, and prescriber information). After identifying the patient and the prescription, the AI system will perform a secondary verification using Surescripts—a national health information network. The AI tool will then gather a medication-focused medical history from the patient and available data. Finally, the AI tool will determine if prescription renewal is appropriate and if so, will send the prescription refill order to the patient’s preferred pharmacy. The pilot program has 3 phases. Under phase one, for the first 250 patients, all AI-generated renewal decisions will undergo review by licensed physicians prior to the renewal being submitted to the pharmacy. During phase two, AI-generated renewal decisions for the next 1,000 patients will be retrospectively reviewed by licensed physicians. During the final phase, the pilot will have a structured sampling approach to quality oversight with: (i) 5-10% of all renewals reviewed monthly; (ii) quarterly analysis of escalated cases; and (iii) annual review of performance metrics and clinical outcomes. The contracted-for mitigation includes the state forgoing any enforcement action for unlawfully practicing a regulated profession, such as the practice of medicine, without a license. State Laws While Utah’s AI prescription renewal pilot program is the first of its type, its implementation reflects a nationwide legislative push to increase the use of AI technology and AI decision-making in healthcare. As of early June, over 280 bills across 44 states have been introduced this year focusing on the use of AI in health care. Eleven of these bills address autonomous clinical decision-making by AI platforms. After its Utah contract, Doctronic has confirmed it is in active discussions to implement similar “sandbox” programs with Texas, Arizona, and Wyoming. Additionally, there are several other large AI platforms on the market that are involved in, or seeking to become involved in, government sanctioned healthcare technology programs. Federal Law   The use of AI in health care is also the subject of legal initiatives at the federal level. The Trump administration has issued several executive orders (EOs) meant to promote and steer the use and development of AI technologies. The 2025 “Removing Barriers to American Leadership in Artificial Intelligence” EO is notable as it directs the Assistant to the President for Science and Technology to revoke all policies, directives, regulations, orders, and other actions taken pursuant to the revoked Executive Order 14110 (Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence) in order to achieve the EO’s purported goals of encouraging development and innovation in the AI sector. Another similar and notable EO is the “Promoting Advanced Artificial Intelligence Innovation and Security” EO, which establishes a legal framework allowing AI developers to collaborate with the federal government to ensure secure AI innovation and to accelerate the deployment of the developers’ AI technologies. While this second EO primarily focuses on the development of AI tools for military use and national security, these and other AI-focused EOs from the Trump administration evidence a general desire to focus on developing and improving AI tools. In addition to many EOs, the introduction of federal legislation such as the Healthy Technology Act of 2025 demonstrates a shift towards AI decision-making in health care even at the Federal level. The Healthy Technology Act of 2025, was proposed to amend the Federal Food, Drug, and Cosmetic Act (FDCA) to clarify that artificial intelligence and machine learning technologies can qualify as a practitioner eligible to prescribe drugs if a) authorized by the law of the State involved; and b) approved, cleared, or authorized by the Food and Drug Administration. Under the FDCA certain drugs can only be dispensed pursuant to a prescription issued by a legally recognized “practitioner.”  While the bill would not automatically allow AI systems to prescribe nationwide, it would allow AI systems to qualify as a “practitioner” when approved under state law. If the Healthy Technology Act were passed, Utah’s regulatory sandbox is the exact type of state-level program contemplated by the law—although, it is notable that proponents and opponents of the Utah pilot program currently disagree on whether the AI system should be considered the practitioner issuing judgment or a renewal assistant acting pursuant to delegated authority under a supervising practitioner’s license. Where states characterize an AI tool as a practitioner, the Healthy Technology Act (or similar legislation) would create a federal pathway recognizing that AI systems can be approved and recognized as prescribing practitioners, eliminating any question as to whether a prescription initiated by a state-and FDA-approved AI technology is a valid prescription under federal law. Alternatively, in states not introducing frameworks for AI systems to operate as a “practitioner,” the proposed Healthy Technology Act would have no effect. It is unclear whether Doctronic’s AI system being utilized in the Utah pilot program is operating as a “helper” or the “practitioner”. On the one hand, the tool may be characterized as a “helper” to the practitioner and not the practitioner themselves. The fact that Utah uses the named prescriber’s license number when authorizing the renewal is evidence of this “helper” characterization.  Using the “helper” characterization potentially takes advantage of a regulatory loophole allowing the Utah program to avoid the question of whether—without redefining a practitioner under the FDCA—AI tools acting independently can generate a lawful prescription. On the other hand, the Doctronic contract seems to characterize the AI tool as a practitioner by saying that the AI program itself may “authorize” a renewal. The ability of states to avoid culpability for having AI tools operate as practitioners by recharacterizing the tool as a helper rather than the practitioner may have explained, in part, why the Healthy Technology Act has stalled and no similar legislation has been presented. The Act was introduced and referred to the House Committee on Energy and Commerce on the same day in January 2025 but has since had no further actions. Benefits to Autonomous AI Prescribing By utilizing AI in healthcare, both state and federal governments hope to decrease administrative burden, reduce employee burnout, and improve patient satisfaction. The stated goals of the Utah program are to improve medication adherence, address refill delays, improve healthcare access in underserved communities, and minimize practitioner time spent on routine refill requests. Criticisms of Autonomous AI Prescribing Despite the potential positive benefits of AI prescribing tools, clinicians, patients, and healthcare organizations raise significant concerns about the technology. The Medical Board cited concerns such as the AI tool’s inability to reassess patients and apply clinical judgment to safely adjust doses, monitor for side effects, or ensure continued efficacy based on the assessment findings. Opponents note that when patients are responsible for entering their information into an AI platform, the patient could make a mistake.  Additionally, patients may exclude information they don’t know is important. AI models will analyze and make decisions based on the data they receive, even if it is incorrect or incomplete and will not challenge discrepancies between a narrative and a physical presentation like a human practitioner can during a patient visit. Opponents argue that human providers are likely to have better outcomes than AI when an informed medical opinion requires both accurate patient data and assessment of the patient’s physical presentation. The critics’ argument is that a human provider can collect more accurate and complete data from a patient because they have the benefit of being able to compare what the patient is saying with the clinical picture the provider is seeing or has previously seen; allowing the provider to challenge inconsistencies—catching prescription errors or inefficiencies sooner, more often, or without needing an adverse event to alert the patient or others to an error. Other concerns include inadequate safety protocols (regulatory and within the AI itself), privacy concerns, fewer opportunities for a clinician to lay eyes on their patients as AI takes on a larger role, and scope creep—a phenomenon where, once the initial AI is reviewed and approved, the technology company can implement updates that don’t face the same level of regulatory scrutiny and thus, the technology company may expand the AI’s scope beyond medication renewals. One of the most prominent legal concerns with AI autonomous clinical decision-making is professional liability. The following are just some of the critical questions that arise when analyzing professional liability implications when AI tools exercise autonomous medication renewal decisions: Who will be responsible if there is an erroneous prescription renewal? AI developer, prescribing practitioner, the pharmacy, the state? As AI become more autonomous, will hospitals need to credential it? Must it be incorporated into privileging processes? How does peer review apply? Do existing corporate practice laws create obstacles? Does the reliance on AI establish a new standard of care? In other words, could failure to use AI eventually become evidence of negligence? Whether the numerous concerns about AI will dampen the adoption of autonomous AI decision-making in healthcare remains to be seen. Instead, the concerns may drive developers, regulators, and proponents to creating stronger safeguards, oversight mechanisms, and regulatory frameworks, in response. What is clear is that AI developers are moving AI tools beyond those that simply perform administrative functions and into tasks traditionally reserved for licensed healthcare professionals. As states continue to experiment with regulation and legislative bodies consider expanding AI’s role in clinical care, healthcare organizations should closely monitor developments involving liability, scope-of-practice requirements, privacy protections, and standards of care. The answers to these questions and concerns may ultimately determine how AI is used in healthcare, the extent to which patients and providers are willing to trust healthcare AI programs, and whether organizations choose to incorporate AI programs into their clinical practices.

On June 15, 2026, Vermont Governor Phil Scott signed H.583 (“Act 133”) into law, making Vermont the most recent state to reinforce their Corporate Practice of Medicine doctrine by restricting private equity and hedge fund influence over clinical decision-making. The legislation follows a flurry of interest from states inspired by similar legislative action in both Oregon and California. This blog post provides a general overview of Vermont’s new restrictions and places them in the context of the broader national trend toward scrutiny of private investment in health care. Act 133 has three operative sections: § 9772 codifies Vermont’s common-law prohibition on corporate involvement in clinical decision-making as it relates to private equity and hedge fund investments; § 9773 requires disclosure of private equity and hedge fund ownership and control interests in certain health care entities; and § 9774 provides for public transparency and sharing of such ownership information. Restrictions on Private Equity Influence Over Clinical Decision-Making Section 9772 is the substantive heart of Act 133. It establishes that clinical decision-making and other core functions affecting patient care must remain under the control of licensed health care professionals, effectively codifying, at least in part, Vermont’s Corporate Practice of Medicine doctrine. This section specifically prohibits private equity groups or hedge funds from: interfering with providers’ clinical judgment, including by determining appropriate diagnostic tests, referrals to other providers, patient treatment options, work schedules, and patient loads; and exercising control over, or being delegated the power to set: (i) clinical standards or policies; (ii) access to and control of patient medical records; (iii) hiring or firing of medical professionals based on clinical competency or proficiency; (iv) parameters for contracting with third-party payers or other providers; (v) prices or rates for a provider’s services; (vi) coding and billing decisions; and (vii) selection or approval of medical equipment and supplies. Section 9772 does not prohibit private equity firms and hedge funds from investing in health care entities. Nor does it ban unlicensed individuals or entities from providing non‑clinical management, administrative, or business services, so long as a licensed health care professional retains ultimate responsibility for or approval of any decisions affecting patient care. Finally, § 9772 creates a private right of action for health care providers to seek equitable relief, actual damages, costs, and attorney’s fees against a private equity group or hedge fund (or entity controlled directly, in whole or part, by one). New Ownership and Control Disclosure Requirements Section 9773 establishes a mandatory disclosure and data sharing regime to ensure transparency around private equity and hedge fund involvement in health care. It requires defined health care entities and management services organizations (“MSO”), which are owned at least in part by private equity groups or hedge funds (“Applicable  Entities”), to report specific ownership and control information (enumerated below) to Vermont’s state health regulatory board, the Green Mountain Care Board (the “State Board”). Certain entities are exempted, including nursing homes, health care staffing companies, organizations whose services are delivered exclusively through telehealth, and federally qualified health centers. Notably, health care entities and MSOs with no private equity or hedge fund ownership or investment must still attest to no such ownership or investment. Under this section, Applicable Entities must report to the State Board: the name, business address, and business identification numbers for each person that has an ownership, investment, or controlling interest, has a significant equity investment, or is an MSO of a health care entity; a current organizational chart showing the business structure of the health care entity or MSO, including affiliates and subsidiaries; and the health care entity’s or MSO’s most recent fiscal year’s profit and loss statement and balance sheet. Additionally, the State Board must work with the Agency of Human Services and relevant stakeholders to develop data reporting processes pursuant to these requirements. Information shared pursuant to this section shall be public information and not considered confidential, proprietary, or a trade secret, except for specified personal identifying information and certain confidential financial information. Lastly, § 9773 institutes financial penalties of up to $10,000 per year for failing to report required information and up to $25,000 for each material misrepresentation reported. Public Reporting and Transparency Requirements Section 9774 promotes transparency by requiring the State Board to report all ownership and control disclosures made under § 9773. It authorizes interagency sharing of that information for oversight and enforcement and provides that, except for specified personal identifiers, the information is public. Lastly, the section permits the State Board to share reported information with the Attorney General, Secretary of State, and other state agencies and officials to prevent duplicative reporting requirements and facilitate oversight and enforcement pursuant to Vermont law. The Big Picture Act 133 is one example of the larger national trend toward increased scrutiny of health care ownership and control. While Vermont’s new law appears to specifically focus on control over clinical decision-making by private equity and hedge funds, numerous other states, including Oregon, Massachusetts, Indiana, New Mexico, and Washington, passed broader ownership transparency-related laws in 2025 and 2026 (with other additional states at least considering such bills). Collectively, these measures reflect a broad national movement toward increased scrutiny of lay-investor influence in the health care sector. Please contact the authors or your regular Dorsey attorney with any questions about how these restrictions could affect your current business model or any contemplated transactions.    

Oregon’s sweeping new corporate practice of medicine (“CPOM”) law, Senate Bill 951 (“SB 951”), has already faced its first major courtroom test. As discussed in our prior post, SB 951 significantly expands Oregon’s restrictions on healthcare management services organization (“MSO”) structures and so-called “friendly PC” models. Among other things, SB 951 limits overlapping MSO/PC ownership, control, or employment and traditional friendly PC governance arrangements between MSOs and physician practices, restricts operational control by non-clinicians, and creates private enforcement rights allowing physicians to challenge allegedly unlawful arrangements. Most provisions applicable to new friendly PC arrangements took effect on January 1, 2026, while certain existing Oregon organizations have until 2029 to comply. This new legal framework is now at the center of Eugene Emergency Physicians, P.C. v. PeaceHealth. The dispute arose after PeaceHealth announced in March 2026 that it would not renew its long-standing emergency department staffing arrangement with Eugene Emergency Physicians (“EEP”), a local physician-owned group. Instead would transition services to ApolloMD, a national emergency medicine management company. EEP filed suit shortly thereafter against PeaceHealth, ApolloMD, ApolloMD Business Services, and Lane Emergency Physicians LLC (the friendly medical practice managed by ApolloMD in Oregon), seeking a preliminary injunction blocking the transition. According to the complaint and preliminary injunction filings, EEP alleged that the proposed structure utilized by ApolloMD violates SB 951 and Oregon’s CPOM doctrine by authorizing impermissible corporate control over a professional medical practice through a friendly PC arrangement. The litigation quickly attracted significant attention in Oregon and nationally, in part because it appears to be the first private enforcement action brought under SB 951, which itself is arguably the strictest CPOM law in the country. During preliminary injunction proceedings held in early May 2026, the federal court expressed skepticism regarding aspects of the defendants’ testimony and operational structure, with the presiding judge stating that certain ApolloMD officials had been “dishonest under oath.” Reportedly, the court called into question ApolloMD’s reference to a “playbook” they had for emergency room staffing, suggesting that ApolloMD was practically functioning as the clinical staffing shot-caller and Lane Emergency Physicians was only established to shield liability. Before the court issued a ruling on the injunction request, however, the parties privately reached a settlement. PeaceHealth subsequently announced plans to renew its relationship with EEP rather than proceed with the ApolloMD transition. Although the case did not produce a merits ruling interpreting SB 951, the litigation underscores several key points for healthcare investors, MSOs, hospitals, and physician groups operating in Oregon: Oregon stakeholders appear willing to aggressively test and enforce SB 951; Traditional friendly PC structures may face increased scrutiny under Oregon law; and Courts and regulators are likely to focus on operational realities, not merely formal ownership documents, when evaluating CPOM compliance. Healthcare organizations with Oregon operations should continue reviewing governance arrangements, management agreements, compensation structures, and operational control provisions in light of SB 951’s broad restrictions and evolving enforcement landscape. Please contact the authors or your regular Dorsey attorney with any questions about how these restrictions could affect your current business model or any contemplated transactions.  

For the first time in more than two decades, the U.S. Department of Health and Human Services, Office of Inspector General (OIG) released new Industry Segment-Specific Voluntary Compliance Program Guidance (ICPG) for Medicare Advantage Organizations (MAOs). This new Medicare Advantage ICPG broadens the scope of the guidance’s application and serves as a key resource for the Medicare Advantage (MA) industry directly and for related entities. This guidance represents CMS’s acknowledgment of the ever-growing Medicare Advantage program and OIG’s possible enforcement priorities. The ICPG details risks for Medicare Advantage providers and provides practical considerations for mitigation. This voluntary, nonbinding guidance is intended to complement CMS regulations to “further focus and enhance compliance.” The ICPG identifies seven key risk areas for Medicare Advantage Organizations: Access to Care (Network Adequacy and Prior Authorization) MAOs should ensure that enrollees can access all covered services and applicable supplemental services through 1) provider networks adequacy and directory accuracy; and 2) proper use of utilization management tools like prior authorization. Provider Network Adequacy: The ICPG states that “MAOs must maintain and monitor provider networks that are sufficient to provide their enrollees with adequate access to covered services to meet their needs.” As part of this duty, MAOs should proactively make sure provider networks meet enrollees’ needs. MAOs should make timely updates to provider directories to avoid inadvertently submitting false information to CMS. By taking such proactive measures, providers may avoid misleading possible enrollees into enrolling into an MA plan without sufficient provider access based on “false, outdated, or incomplete” provider information. Utilization Management Tools: MAO should evaluate where utilization management tools, like prior authorization, could inappropriately limit access to medically necessary services. MAOs must “make medical necessity determinations based on the individual patient’s circumstances.” If an algorithm is used to support medical necessity determinations, MAOs should not determine “coverage based on a larger data set instead of the individual patient’s medical history, the physician’s recommendations, or clinical notes.” Recommended compliance steps include reviewing trends in claim and prior authorization denials (including denials overturned on appeal), pulling sample claims for individualized medical necessity reviews, and reviewing algorithm-based tools to ensure “decisions on claims and prior authorization focus on patients’ individualized circumstances.” Marketing and Enrollment Medicare Advantage Organizations must ensure their marketing and enrollment activity 1) does not create improper financial incentives; and 2) avoids deceptive marketing practices. Improper Financial Incentives: Marketing and enrollment practices should avoid efforts “that may not be in the best interests of enrollees and potential enrollees.” Enrollment and marketing programs should avoid agent and broker payments for steering patients, meeting enrollment volume targets, not offering plans that competitors offer, or that are tied to enrollee health. Payments for MA marketing and enrollment “should not create incentives for agents and brokers to enroll individuals in MA plans that may not best meet the individuals’ health care needs.”  Improper financial incentives also risk administrative sanctions, False Claims Act civil liability, or Federal Anti-Kickback liability. Deceptive Marketing Practices: MAO compliance programs should oversee third parties conducting marketing on behalf of it. Under CMS regulations, MAOs may not “mislead, confuse, or provide materially inaccurate information to current or potential enrollees.” To mitigate this risk, MAOs should establish a process to review and approve marketing materials, ensure they are clear certain benefits may not be available to all enrollees, periodically audit and require attestations from third party marketers, track and investigate complaints against agents or brokers, and monitor problematic outlier enrollment trends (especially outside the annual enrollment period). Risk Adjustment MAOs may be paid on a capitated per member per month rate, which are in part based on the person’s health risk score. Since higher risk scores result in higher payment rates to MAOs, OIG has raised concerns about risk-assessment scores generated by in-home assessments and chart reviews. MAOs should make sure diagnoses are supported by medical records, as this area is a frequent target for audits and enforcement by OIG. Quality of Care A portion of MAO reimbursement may be tied to quality of care based on a 5-star quality rating system. OIG suggests that MAOs monitor their contracted providers to make sure that no providers have been excluded by the CMS Preclusion List and requiring providers to be enrolled in Medicare to maintain Star Rating data integrity. Oversight of Third Parties Relationships between MAOs and supporting entities are essential to keeping MA programs running efficiently. However, OIG stated that “CMS regulations emphasize that MAOs maintain the ultimate responsibility for fulfilling the obligations of their contracts with CMS.” OIG provided guidance on the relationships between MAOs and First Tier, Downstream, or Related Entities (FDRs). MAOs can only outsource certain compliance functions to FDRs and may be required to audit and monitor the FDRs. Before delegating anything to an FDR, OIG recommends that MAOs conduct a thorough review of risk evaluation to determine the possible “level of compliance or fraud and abuse risk presented by working with a particular third party.” Additionally, MAOs’ contacts with FDRs should be drafted to explicitly secure compliance-related rights and obligations. Compliance Programs with Vertically Integrated Organizations and Other Ownership Structures Vertical integration of entities in the MA industry presents distinct compliance challenges. OIG emphasizes that compliance officers should have sufficient experience, empowerment at their subsidiary MAO, and access to organization-wide leadership. OIG particularly flagged that investors who are less familiar with Medicare Advantage programs may not be familiar with the pitfalls inherent in Medicare Advantage program compliance. It suggested that investors new to the health care industry and MA industry consult the General Compliance Program Guidance and ensure robust training and communications. Submission of Accurate Claims MAOs must certify that the data they submit is accurate to receive payment or else face liability under the False Claims Act or other statutes. OIG recommends robust internal controls, regular audits, and prompt corrective action to promote organization-wide data accuracy at MAOs. The ICPG is an opportunity for MAOs and MA-participating organizations to enhance their current compliance frameworks. It represents OIGs enforcement priorities and offers practical guidance for managing risk. If you have any questions on this Dorsey Health Law blog post, please contact the authors or your regular Dorsey attorney with any questions about how this new guidance document could affect your current or contemplated business practices.

On March 9, 2026, the Department of Health and Human Services Office of Inspector General (“OIG”) posted an advisory opinion addressing a medical technology manufacturer and distributor’s proposal to offer ambulatory surgery centers (“ASCs”) a discount on (“IOLs”) and other surgical supplies used to perform cataract surgery, contingent on affiliated physician practices purchasing the company’s software product at full price.  The OIG found that the proposed arrangement would constitute prohibited remuneration under the Federal anti-kickback statute if the intent to induce referrals were present, but the OIG stated it would not impose sanctions due to three factors that mitigate the risk of fraud and abuse.  This is the first OIG advisory opinion to rely expressly in part on the rationale that a proposed arrangement “does not present an inappropriately high risk of steering or unfair competition.” The proposed arrangement is structured as follows: the medical technology manufacturer and distributor “(the “Company”) would offer discounts to ASCs on supplies needed to perform cataract surgery contingent on a physician group practice with ophthalmic surgeons who perform cataract surgery at the ASC (the “Practice”) purchasing a subscription agreement for software that the Company sells. The Practice must purchase a license to the Company’s software at full price, and the ASC would then become eligible for discounts on the Company’s surgical supplies. The OIG found that the arrangement was low risk under the Federal anti-kickback statute for three reasons: The proposed arrangement “should not increase costs to Federal health care programs or result in overutilization.” This is due to the way that Federal health care programs reimburse for cataract surgeries – via set facility fees and professional services fees – such that the software and surgical supplies are not separately billable items.  Because Federal health care programs would pay the same amount regardless of which software and surgical products are used, the proposed arrangement should not increase costs to Federal health care programs. The proposed arrangement “presents a low risk of interference with clinical decision-making” because the discounted surgical supplies do not require the use of specific corresponding IOLs or supply packs, and the software will function the same regardless of the electronic health record, diagnostic equipment used, or brand or type of IOLs or supply packs chosen. The OIG recognized that surgeons with ownership in the ASC could receive an indirect benefit from the surgical supply discounts, but it noted that a discount of this nature is only one factor that a surgeon might consider when choosing surgical supplies.  And because purchasing the software would present an additional expense for the Practice, the arrangement would not act as a financial incentive that would distort clinical decision-making. Finally, the proposed arrangement “does not present an inappropriately high risk of steering or unfair competition” because the discount on IOLs and surgical supplies is only one of many factors that impact selection of IOLs, surgical supplies and software platforms. The OIG noted that because the referral source (the Practice) must purchase a full-price software license in order for the referral recipient (the ASC) to receive the supply discount, the risk is lower than if the referral source received the discount contingent on the referral recipient paying full price for other items or services. This is the first time that the OIG has articulated this third rationale as, in part, a basis for issuing a favorable advisory opinion.  The OIG’s analysis here indicates that while the OIG gives weight to potential steering or unfair competition, some steering and some potentially unfair competition may be permissible as long as that risk is low or not inappropriately high, respectively.  In examining this arrangement, the OIG concluded that a discount that does not meet the discount safe harbor to the anti-kickback statute can be one factor impacting competition, but that may be acceptable so long as it is not the only factor or even a strong factor.  And the OIG found that the relationship between the parties – who can refer to whom and which party pays full price and which party gets the discount – is an important consideration. As always, OIG advisory opinions are only applicable to the requesting individual or entity and cannot be relied on by other individuals or entities. However, this advisory opinion may help clinicians, manufacturers and their legal counsel assess arrangements involving more complex discount arrangements that do not meet the discount safe harbor to the anti-kickback statute. If you have questions or would like additional information, please contact the authors or any of your contacts in the Dorsey & Whitney health care practice group.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Alex Hontos, Chris DeLong, Seth Goertz, Matthew Gillespie, and Anna Ashley for the following e-newsletter update: The Department of Justice (DOJ) announced that False Claims Act (FCA) settlements and judgments surpassed $6.8 billion in FY 2025—the highest single-year total in FCA history. DOJ reported a record 1,297 qui tam filings and 401 new government investigations opened for the year. Healthcare fraud enforcement once again dominated the recoveries, accounting for more than $5.7 billion of the total. Read More >

On May 23, 2025, Minnesota Governor Tim Walz signed the Human Services omnibus policy bill into law, which included in part, the addition of a new statutory provision in the state’s criminal code, Chapter 609. Effective August 1, 2025, Section 609.542 of the Minnesota Statutes will essentially inscribe the federal Anti-Kickback Statute (United States Code, title 42, section 1320a-7b(b)) into state law, so that state prosecutors may address fraud against Human Services programs, including without limitation, the state Medical Assistance and Child Care Assistance programs as well as state-funded substance use disorder treatment programs. The new statute makes it a crime for an individual or entity to “intentionally” solicit, receive, offer, or provide “money, a discount, a credit, a waiver, a rebate, a good, a service, employment, or anything else of value” in exchange for (i) referring another individual for the furnishing or arranging to furnish any item or service; (ii) purchasing, leasing, ordering, or arranging for or recommending purchasing, leasing or ordering any good, facility, service, or item; or (iii) applying for or receiving any item or service which is payable in whole or in part under a federal health care program (as defined in United States Code, title 42, section 1320a-7b(f), including without limitation Medicare, Medicaid, and TRICARE), state behavioral health program (see Chapter 254B of the Minnesota Statutes), or state child care assistance program (see Chapter 142E of the Minnesota Statutes). Like the federal analog, a violation of the state-level anti-kickback statute constitutes a false or fraudulent claim for purposes of the state-level false claims act (see Section 15C.02 of the Minnesota Statutes). But, at the same time, the same exceptions, or Safe Harbors, to the federal Anti-Kickback Statute also apply to Chapter 609.542. In addition to the adoption of the federal Safe Harbors, the statute adds an exception for employers enrolled in the Child Care Assistance program. The new statute does not apply to payment from an employer to an employee who provides covered items or services under Chapter 142E in the scope of their employment or to childcare provider discounts, scholarships, or to other financial assistance to families allowable under Section 142E.17, subdivision 7 of the Minnesota Statutes. The criminal sentence for a violation of this statute varies depending on the value of the kickback at issue. For a kickback that is not more than $5,000, the sentence may include imprisonment for not more than five years or payment of a fine of not more than $10,000, or both. For a kickback that is more than $5,000 and not more than $35,000, the sentence may include imprisonment of not more than ten years or payment of a fine of not more than $20,000, or both. And for a kickback that exceeds $35,000, the sentence may include imprisonment of not more than 20 years or payment of a fine of not more than $100,000, or both. The dollar amounts of any kickbacks provided within a six-month period may be aggregated for the purposes of charging and sentencing under this statute. In comparison, criminal penalties for a violation of the federal Anti-Kickback Statute may include imprisonment of not more than ten years or payment of a fine not more than $100,000, or both. The federal statute does not discuss aggregation of claims. But note that a violation of the federal Anti-Kickback Statute may also be subject to civil monetary penalties up to $50,000 per kickback plus three times the amount of the kickback (also known as treble damages). The new Minnesota statute does not contemplate the collection of state-level civil monetary penalties in connection with a violation of Chapter 609.542. We note, however, that pursuant to Section 62J.23 of the Minnesota Statutes, the state commissioner of health separately may levy a fine against any individual or entity that violates the federal Anti-Kickback Statute in the amount of $1,000 or 110 percent of the estimated kickback, whichever is greater. Legislative Background Section 609.542 appears to be, at least in part, a direct reaction to the recent indictment of Evergreen Recovery and the recent $18.5 million settlement between the United States Department of Justice and NUWAY Alliance. Both Evergreen and NUWAY are substance use disorder treatment program providers in Minnesota that allegedly provided free or subsidized housing for patients in exchange for patients’ attendance at counseling sessions payable by federal healthcare programs. These state investigations serve as a good reminder that prosecutable kickbacks do not always take the form of cash, but can be anything of value, including discounted or in-kind services. Expected Impact Unlike state-level anti-kickback statutes in other states and unlike Section 62J.23 (discussed above), the new Minnesota statute notably does not expand the scope of state kickback enforcement to commercial arrangements. The expected impact of this statute is that, as of August 1, 2025, state prosecutors will be able to file anti-kickback claims that previously were the purview of only federal prosecutors and may ask for additional jail time (20 years instead of ten years) during sentencing for violations. We will have to wait for additional guidance, or new enforcement actions, to fully understand how broadly Minnesota prosecutors and, ultimately, the courts will interpret the mens rea term “intentionally,” as it is used in Chapter 609.542. If a violation of the state statute merely requires intentional action, rather than intentional wrongful action, the requisite mens rea under the state-level anti-kickback statute may be a lower threshold than under the federal Anti-Kickback Statute.[1] Overall, it remains to be seen whether this new statute will indeed significantly increase healthcare fraud enforcement in Minnesota, particularly against individuals and entities that do business with the state. Please contact the authors or your regular Dorsey attorney with any questions about how this new statute could affect your current or contemplated business practices. [1] At least under Eighth Circuit precedent. There currently is a significant federal Circuit split regarding the requisite mens rea under the Anti-Kickback Statute.

On June 9, 2025, Oregon Governor, Tina Kotek, signed SB 951[1] into law, making Oregon’s “corporate practice of medicine” doctrine one of the country’s most restrictive. SB 951 places numerous restrictions on the relationships between management services organizations and clinician practices, which will impact many of the written arrangements and techniques that management services organizations and clinician practices currently use. SB 951 also places new and/or clarified restrictions on professional medical corporation structuring and the use of certain restrictive covenants in contracts among health industry parties. This blog post provides a general overview of these new restrictions. Key Definitions Here are key definitions that help clarify the scope of SB 951: “Management services organization” or “MSO” is defined as an entity that provides management services to a professional medical entity in return for monetary compensation under a written agreement. “Management services” is broadly defined and includes payroll, human resources, employment screening, employee relations, and other administrative or business services. “Medical licensee” or “licensee” is defined as an individual who is licensed in Oregon to practice medicine or naturopathic medicine or as a nurse practitioner or physician assistant. “Professional medical entity” is defined as an Oregon professional corporation organized for the purpose of practicing medicine, practicing naturopathic medicine, or allowing physicians, nurse practitioners and physician assistants to jointly render healthcare services, or a limited liability company, partnership limited liability partnership or partnership organized for a medical purpose that is authorized to transact business in Oregon.[2] Restrictions on MSOs MSOs, including their shareholders, directors, members, managers, officers and employees (collectively, “agents”), may not, with certain exceptions: own or control a majority of; be a director, officer, employee or independent contractor of, or receive compensation from the MSO to manage; or exercise a proxy, right or power to vote the shares of; a professional medical entity with which it has a management services agreement (“MSA”). Additionally, MSOs and their agents may not, with certain exceptions: control or enter into agreements to, or otherwise permit a non-licensee to, control or restrict the sale or transfer of a professional medical entity’s ownership interests or assets; issue, or cause a professional medical entity to issue, ownership interests in the professional medical entity or a subsidiary or affiliate of the professional medical entity; pay dividends from a professional medical entity’s ownership interests; acquire, or finance the acquisition of, a majority of a professional medical entity’s ownership interests; or exercise de facto control over a professional medical entity’s administrative, business or clinical operations in a manner that affects the professional medical entity’s clinical decision making or the nature and quality of its medical care, which includes, but is not limited to, hiring or setting compensation for licensees, setting clinical or billing and collection policies, and negotiating agreements with third-party payors and other third parties that are not employees of the professional medical entity. So, what can an MSO still do? SB 951 clarifies that the restrictions still permit an MSO to: enter into agreements to control or restrict the transfer or sale of a professional medical entity’s ownership interests or assets for cause, including, but not limited to, an owner’s loss of their professional license, exclusion from a federal health care program, breach of the MSA or death; provide management services as long as the MSO is not exercising de facto control over a professional medical entity’s operations in a manner that affects the professional medical entity’s clinical decision making or the nature and quality of its medical care; purchase, lease or take assignment of a right to possess a professional medical entity’s assets in an arms’-length transaction with a willing seller, lessor or assignor; provide support and consultation on any business operations matters, such as accounting, facilities management and compliance with applicable laws; advise a professional medical entity’s participation in payor arrangements, value-based arrangements or vendor agreements; collect quality metrics as required by law or one of the professional medical entity’s agreements; and set criteria for reimbursement under an agreement between a professional medical entity and a payor. Any MSA provision that violates any of the above restrictions is void and unenforceable. Additionally, professional medical entities and licensees have a private right of action against MSOs and the MSO’s agents, and damages may include actual damages, an injunction or other equitable relief, punitive damages and attorneys’ fees. Existing MSOs and professional medical entities conducting business in Oregon have until January 1, 2029 to comply with these restrictions. However, new MSOs and professional medical entities planning to conduct business in Oregon, including those involved in a sale or transfer of ownership, must comply with these restrictions by January 1, 2026. Restrictions on Professional Medical Corporations SB 951 also imposes restrictions on professional medical corporations (“PCs”), with certain exceptions. PCs’ articles, bylaws and other organizational arrangements may not allow for the removal of any director or officer without a majority vote of licensee-shareholders or licensee-directors, except for cause. Additionally, PCs may only replenish or transfer control over their operations through a valid shareholder agreement that is solely among and for the benefit of a majority of shareholders who are physicians licensed in Oregon. These restrictions apply to any agreements that are entered into or renewed on or after June 9, 2025. Non-Competition, Non-Disclosure and Non-Disparagement Agreements Lastly, non-competition agreements with professional licensees that restrict the practice of medicine or nursing as well as non-disclosure and non-disparagement agreements between an MSO, hospital or hospital-affiliated clinic and an employed licensee are void and unenforceable, with certain exceptions. These restrictions also apply to any agreements that are entered into or renewed on or after June 9, 2025. The Big Picture Notably, as of 2022, OHA requires notice of and reviews material health care transactions. This, along with the passage of SB 951, indicates Oregon’s strong focus on its regulation and oversight of the “corporate practice of medicine.” And Oregon is not alone. These are recent developments in a long history of state concerns with the separation of corporations and unlicensed individuals and healthcare professional’s medical decision making and patients’ care (i.e., the corporate practice of medicine) and, more recently, private equity involvement in health care. SB 951 materially reinforces and expands Oregon’s “corporate practice of medicine” doctrine and impacts not only MSAs but other MSO-practice relationships, MSO and PC governance and agreements with restrictive covenants. SB 951 raises difficult issues such as the permitted scope of an MSO’s authority if the requirement is to avoid control that affects the professional medical entity’s clinical decision making or the nature and quality of medical care. Given the wide-reaching implications of this new law and to ensure compliance with SB 951 by the applicable compliance dates, existing MSOs and clinician practices conducting business in Oregon will need to review and likely revise their current business models, practices, and written agreements as necessary, and new MSOs and clinician practices planning to conduct business in Oregon will need to closely review their proposed business models and practices. Please contact the authors or your regular Dorsey attorney with any questions about how these restrictions could affect your current business model or any contemplated transactions. [1] https://olis.oregonlegislature.gov/liz/2025R1/Downloads/MeasureDocument/SB951/Enrolled. [2] While this law does not currently apply to other healthcare providers. Oregon House Majority Leader, Ben Bowman, predicts that future legislative sessions will likely address the expansion of this law to other healthcare providers, such as hospitals and dentists.

On June 18, 2025, a Texas court issued a ruling that vacated, on a nationwide basis, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (the “Reproductive Health Rule”), just one year after the rule went into effect. In Purl v. United States Department of Health and Human Services, No. 2:24-CV-228-Z (N.D. Tex. June 18, 2025), plaintiffs, Dr. Carmen Purl and her medical clinic, challenged the validity of the Department of Health and Human Services (“HHS”) Reproductive Health Rule on the grounds that the rulemaking exceeded HHS’ statutory authority and unlawfully restricted state-mandated reporting obligations, particularly in the context of child abuse investigations. The plaintiffs argued that federal law 42 U.S.C. § 1320d-7(b) provides that "[n]othing in [HIPAA] shall be construed to invalidate or limit the authority, power, or procedures established under any law providing for the reporting of disease or injury, child abuse, birth, or death, public health surveillance, or public health investigation or intervention." Dr. Purl and her medical clinic argued that the Reproductive Health Rule did just that: it unlawfully impeded Texas’ state-mandated reporting of child abuse and public health investigations—in contravention of 42 U.S.C. § 1320d-7(b)—by interfering with health care providers’ ability to make such reporting if the reporting involved the broadly defined term “reproductive health care”.  As the court noted, the Administrative Procedure Act states: courts must "hold unlawful and set aside" agency actions that are "not in accordance with law" or are "in excess of statutory jurisdiction, authority, or limitations, or short of statutory right" (5 U.S.C. § 706(2)(A), (C)).  Accordingly, the court held that HHS acted outside of the bounds of its statutorily delegated authority and in contravention of federal law because the Reproductive Health Rule 1) "unlawfully 'limits' state public health laws," 2) "impermissibly redefines 'person' and 'public health,' in contravention of Federal law and 'in excess of statutory authority,'" and 3) was adopted without authority expressly delegated by Congress. The Reproductive Health Rule went into effect on June 25, 2024, with a compliance deadline of December 23, 2024.  The Reproductive Health Rule amended the Health Insurance Portability and Accountability Act (“HIPAA”) regulations by adding a class of protected health information (“PHI”) that carried heightened protection, called “reproductive health information”.  The Reproductive Health Rule was issued by HHS in reaction to the U.S. Supreme Court case, Dobbs v. Jackson Women's Health Organization, 597 U.S. 215 (2022), which overturned the federal right to an abortion, returning authority to regulate abortion to the states.  Given widespread concerns that state abortion restrictions could interfere with individuals’ willingness to seek reproductive health care, HHS responded to Dobbs by amending HIPAA’s Privacy Rule to limit the circumstances under which “reproductive health information” could be disclosed for certain non-healthcare purposes.  Specifically, under the Reproductive Health Rule, HIPAA-regulated entities were not allowed to disclose “reproductive health information” for the following purposes: (i) To conduct a criminal, civil, or administrative investigation into or impose criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care, where such health care is lawful under the circumstances in which it is provided; or (ii) The identification of any person for the purpose of conducting such investigation or imposing such liability. HIPAA-regulated entities were required to obtain a written attestation from persons requesting PHI related to reproductive healthcare in situations involving health oversight, judicial or administrative proceedings, law enforcement and disclosures regarding decedents such as disclosures to coroners and medical examiners.  Compliance with the Reproductive Health Rule entailed HIPAA-regulated entities adopting new policies and procedures, conducting internal training, and often required education of any third parties who were presented with an attestation in response to their requests for PHI. With the ruling in Purl, just one year after the Reproductive Health Rule went into effect, HIPAA-regulated entities that implemented new policies and procedures in accordance with the Reproductive Health Rule can now terminate those policies and procedures immediately, with the exception of a future compliance obligation related to a separate topic that was included as part of the Reproductive Health Rule: patient notification about substance use disorder treatment records.  Notably, the Reproductive Health Rule also requires that HIPAA-regulated entities amend their Notice of Privacy Practices (“NPP”) by February 16, 2026 to reflect changes in the uses and disclosures of substance use disorder treatment records in light of changes in federal substance use disorder regulations at 42 C.F.R. Part 2 (the “Part 2 NPP Requirement”).  The Purl decision severed the Part 2 NPP Requirements from its order vacating the Reproductive Health Rule, and therefore, HIPAA-regulated entities are still required to amend their NPPs pertaining to substance use disorder regulations by February 16, 2026. Please contact this author or your regular Dorsey & Whitney LLP attorney to discuss this legal development.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Christopher DeLong, Alex Hontos, Caitlin Hull, Eric Weisenburger, Matthew Gillespie, and Annie Boeckers for the following e-newsletter update: On Monday, May 19, 2025, Department of Justice Deputy Attorney General Todd Blanche issued a memorandum establishing the “Civil Rights Fraud Initiative,” which is the latest signal that DOJ intends to aggressively enforce the False Claims Act in pursuit of the Trump Administration’s goals. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Erin Bryan, Nathan Honson, Joseph Lynyak, and Matthew Dickerson for the following e-newsletter update: Last week FinCEN issued an interim final rule that significantly narrows the reporting obligations under the CTA to foreign (i.e., non-U.S. corporate entities), and also exempts all U.S. persons from reporting beneficial ownership information. New reporting time periods are established for foreign entities that are still required to file initial reports and update reports as needed. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Erin Bryan, Nathan Honson, Joseph Lynyak, and Matthew Dickerson for the following e-newsletter update: On February 18, 2025, in a widely expected decision, the Eastern District of Texas, in the case of Smith v. United States Dep't of the Treasury, 2025 WL 41924 (E.D. Tex.), and following the decision of the U.S. Supreme Court on January 23, 2025, granted the U.S. Government’s request to stay the nationwide temporary injunction CTA”). In keeping with a prior notification, on February 19, 2025, FinCEN confirmed that it has extended the general reporting deadline for reporting companies to March 21, 2025. This means, as of now, for the vast majority of entities formed in the U.S., or registered to do business in the U.S., they must file an initial, updated and/or corrected beneficial ownership report on or before that date, unless they are exempt. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Jack Sullivan, Nisha Verma, and Sam Richter for the following e-newsletter update: In a widely expected move, Acting National Labor Relations Board (“NLRB”) General Counsel William Cohen rescinded a range of Biden Administration labor-law policies, including high-profile directives that targeted non-competition agreements as unlawful under the National Labor Relations Act (“NLRA”) and that increased the financial penalties that could be imposed on employers accused of violating the NLRA. Employers with union and non-union workplaces alike should take note, as the changes will have an immediate impact on how NLRB regional offices investigate and prosecute unfair labor practice charges filed by individuals and unions. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Kirk Schuler, Mike Sevilla, and Andrew Stone for the following e-newsletter update: Attorney General Bondi’s first actions in her role as chief law enforcement officer of the Federal Government demonstrate her focus on immigration enforcement. This may lead to additional criminal investigations into companies that are suspected of employing undocumented immigrants, and could even lead to criminal cases against state and local officials who choose not to comply with requests from federal immigration authorities. Organizations and individuals, public and private, should ensure they are prepared for these potential enforcement actions. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Alex Hontos, Chris DeLong, and Eric Weisenburger for the following e-newsletter update: The Trump Administration has signaled that it is disrupting settled relationships with recipients of Federal financial assistance, including grants and loans. For organizations currently implementing federal grant programs—or relying on federal assistance funding as part of future projects—it is important to understand legal rights and obligations. And to understand what remedies are available if the United States abruptly alters those rights. Read More >

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Alex Hontos, Christopher DeLong, and Eric Weisenburger for the following e-newsletter update: On January 27, the Acting Director of the Office of Management & Budget issued a new Memorandum (M-25-13) that presages significant disruption—if not outright cancellation—of many federal assistance awards. Spanning federal grants and federal loans and loan guarantees, recipients of such funds should be paying close attention to current or planned projects, experiments, research, and programs funded in whole or in part by federal funds. Read More >

For over a decade, agents with U.S. Immigration and Customs Enforcement (“ICE”) were instructed pursuant to official policies to refrain from conducting law enforcement actions in or near various “sensitive locations” or “protected areas,” such as healthcare facilities, schools, and churches. Exceptions existed in the policies for exigent circumstances, such as when the enforcement action involved a national security threat or there was an imminent risk of death, violence, or physical harm to a person. But the exceptions and the policies are no more: One of President Trump’s first actions in his second term was to rescind the policies, first put in place in 2011 and reiterated in 2021.  In the following days, hospitals and other previously protected places began to report the presence of ICE agents conducting enforcement actions involving searches, interviews, and arrests. Because of this abrupt change in policy, many hospitals and other healthcare facilities are understandably unfamiliar with what to do and expect when ICE agents arrive at your door. But fear not, below is a short list of “dos” and “do nots” to follow when (and even before) ICE agents arrive at your facility.  This guidance is intended to help your staff balance cooperating with federal agents and protecting patient privacy. Do: Prepare a written policy and standard operating procedure for interacting with immigration agents (which should accompany policies for interacting with law enforcement authorities in general). Identify an internal resource (in-house counsel or other representative with education and training on dealing with law enforcement), whether a single person or a team, who is well-versed in the rules for interacting with ICE agents. Identify an external resource, such as outside counsel, who can support your response when immigration agents arrive. Contact your internal and external resources immediately when immigration agents arrive. Instruct your front desk staff to inform the ICE agents that they must speak with your internal or external resource, and make arrangements to do so. While making those arrangements, direct the ICE agents to a conference room away from patients in order to avoid causing patient concern/disruption. Identify the ICE agent and inquire whether any government lawyer is aware of their activities. Understand that ICE agents are allowed in public spaces like a hospital waiting room, parking lots, and cafeterias, but to enter any private patient care areas they need a valid warrant or your permission (which you may withhold, unless there is a judicial warrant). Understand that any warrants or subpoenas served by immigration agents may be judicial (issued by a federal or state court judge) or administrative (issued by the government agency, including an immigration judge), and that agents do not have the authority to enter private areas with an administrative warrant or subpoena. Have in-house or outside counsel review all warrants and subpoenas to determine their validity, and cooperate with agents that present valid judicial warrants or subpoenas.  Generally speaking, any judicial search warrants should: Be signed by a judge. Specify the name of the hospital, the time period for executing the warrant (and the current time is within that stated time period) and describe the scope of the search. If there is no judicial warrant or subpoena, but the ICE agents are armed with an administrative warrant or subpoena, or otherwise describe an exigent circumstance (e.g., their actions are necessary to avoid imminent harm to the public, national security, or your staff/other patients), evaluate the circumstances.  It is important to balance protection of patient privacy with cooperating in an investigation that appears necessary to protect individuals/the public. Have at least one facility representative accompany each ICE agent around the facility.  Note any staff or patients interviewed or items/records seized. Staff may videotape the ICE agents. Protect patient privacy in accordance with HIPAA and applicable state law.  HIPAA generally does not allow disclosure of patient information (protected health information) including patient names or immigration status unless an exception under HIPAA is satisfied.  Your lawyer can help to evaluate whether an exception applies to any requested disclosure.  This may include objecting to a search that is outside of a valid warrant. Employees, patients, and visitors have the right to remain silent and they can be advised on that right. Be aware the ICE agents may not be in the facility for surveillance or investigation, but instead may be there to deliver an I-9 audit.  It is important to develop policies and procedures to appropriately respond to an I-9 audit.  The facility will have three business days to produce the requested I-9 forms.  It is important to contact the facility’s attorney immediately if you receive an I-9 audit. Understand that immigration agents visiting your facility may be with ICE, or with US Customs and Border Protection (“CBP”), or with the United States Citizenship and Immigration Services (“USCIS”). For example, USCIS officers may be conducting a Fraud Detection and National Security (FDNS) site visit to confirm the veracity of a nonimmigrant (H-1B, L-1, TN, etc.) petition. Cooperation with this type of site visit is not mandatory, but it is beneficial to provide officers with requested information so that they are able to make a finding with a full record. Do Not: Do not allow ICE agents into patient care areas without the input of your internal and/or external resources, and confirmation that they have valid authority or your permission.  The front desk staff can tell the ICE agents that they are not allowed to let them into private patient care areas without talking to the facility’s lawyer. Do not give statements to ICE agents without consulting with an attorney. Do not direct employees or patients to refuse to speak to ICE agents when questioned. Do not hide patients or employees or assist them in leaving the premises. Do not provide false information or destroy records. Do not leave patient information visible from public areas. Even without a search warrant, ICE agents in public areas can look at things that are in plain view, such as papers and computer screens.  So, reasonable safeguards should be implemented to cover patient information that is in public spaces, such as covering papers or shielding computer screens or taking any conversations into private spaces to avoid any inadvertent disclosure. Do not allow the presence of ICE agents to interfere with patient access to health care. Dorsey attorneys are actively monitoring activities of the new Administration and will continue to publish updates and analysis on the impacts of these actions in health care. Contact your regular Dorsey attorney or the authors for further guidance.

UPDATE - January 29, 2025: The Trump Administration rescinded the OMB memorandum ordering the federal grant and loan pause on January 29, 2025.   UPDATE - January 28, 2025: The federal grant and loan pause described in this blog post has been temporarily enjoined by a U.S. District Court until February 3, 2025 for funds that were already set to be disbursed. We will continue to monitor the status of the pause on federal assistance. UPDATE - January 28, 2025: Following a widespread lock out to Medicaid portals in all 50 states, the White House Press Secretary issued a statement  on X that Medicaid would not be impacted by the OMB spending freeze memo and the Medicaid portal should be back online soon. A memorandum from the Office of Management and Budget (“OMB”) on January 27, 2025 notified heads of federal agencies of a temporary pause on all disbursements of federal grants and loans, effective at 5pm Eastern on January 28, 2025.  The OMB memorandum requires federal agencies to submit detailed information on programs, projects, or activities subject to the pause by February 10, 2025 so that OMB can evaluate their alignment with the Administration’s priorities for federal spending which have been revealed in part through recent Executive Orders. There is some uncertainty as to how broadly the pause in federal funding will apply, as the OMB memo permits OMB to grant exceptions on a case-by-case basis, and notes that the pause is subject to what is “permissible under applicable law.” The memo states that the pause does not impact direct federal assistance to individuals, and therefore should not disrupt the flow of Medicare reimbursement to health care providers, or impact Social Security payments. Many in the health care industry will be impacted, however, as the pause will impact federal funding disbursed by the Department of Health and Human Services, which is the largest grant-making agency in the U.S. Access to Medicaid payment portals was cut off in all 50 states as of January 28, 2025, creating uncertainty about the pause’s applicability to Medicaid and Medicaid beneficiaries’ ability to access care. The federal funding pause will likely impact every state-federal cooperative program which receives funding through the federal government  For example, health centers providing family planning, HIV treatment/prevention and other services which are paid for through federal funding, including impacting these clinics’ ability to make payroll and keep the centers open for patient care. The pause will also have an impact on federal research and loans to research institutions, as well as to universities and other private organizations. The pause raises questions regarding the President’s ability to override spending decisions made by Congress and compliance with a federal statute called the Impoundment Control Act. The first lawsuit challenging the pause, which includes health care industry plaintiffs, was filed on January 28, 2025. For additional guidance on steps for recipients of federal grant and loan funding to take now, please see this post by our Dorsey colleagues. An important first step is to seek clarification from your grants management official regarding permissible activities under the grants during this period of time covered by the pause. Then, continue to follow up and monitor any changes to that advice as the issues continue to play out over the coming days, weeks and months. Dorsey attorneys are actively monitoring Executive Orders and other activities of the new Administration and will continue to publish updates and analysis on the impacts of these actions in health care.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Alex Hontos, Chris DeLong, and Eric Wisenburger for the following e-newsletter update: Yesterday President Trump issued an Executive Order with far-ranging impacts for Federal contractors and grantees related to anti-discrimination plans, affirmative action plans, and DEI initiatives. The EO works a significant change to settled expectations and compliance programs, and forecasts significant enforcement efforts against Federal contractors and grantees that run afoul of what the Administration views as discrimination. Read More >

Upcoming Webinar: Just a few days into the Trump administration, employers have seen drastic shifts in enforcement relating to DEI programs, federal contracting requirements, and transgender rights in the workplace, and further changes are expected, as well as legal challenges. Employers will be left to navigate these developments legally while simultaneously responding to employee questions and concerns being raised in real time. Aaron Goldstein, Matthew Durham, and Nisha Verma will provide an overview of these fast moving developments and practical advice as to how employers can manage their business and workforce productively during these turbulent times. How Trump Policy Shifts Will Affect Employers’ Relationship With Their Employees Friday, January 31, 2025   Register now PROGRAM FORMAT Webinar WEBINAR SCHEDULE 8:00 am – 9:00 am PT 9:00 am – 10:00 am MT 10:00 am – 11:00 am CT 11:00 am – 12:00 pm ET   LOG-IN & MATERIALS Prior to the program you will receive a reminder email with the instructions for accessing the program, materials, and attendance sheet.   REGISTRATION Complimentary. Registration required. Register Now

On January 8, 2025, the governor of Massachusetts signed into law H.5159, An Act enhancing the market review process (the “Act”). Among various other healthcare market oversight enhancements, the Act expands the authority of the Massachusetts Attorney General, Center for Health Information and Analysis (“CHIA”), and Health Policy Commission (“HPC”) to review and gather data regarding private equity investment into healthcare providers and healthcare management companies. This law will be effective on April 8, 2025 (90 days following the governor’s signature). For more than a decade, Massachusetts has required certain healthcare providers and provider organizations to submit notifications to applicable commonwealth regulators 60 days in advance of material change transactions. These material change notices (“MCN”) trigger a 30-day preliminary market review, the result of which may be a more extensive cost and market impact review (“CMIR”). Under the Act, this notification requirement and review process has been expanded to include material change transactions involving “significant equity investors”. The following definitions are critical in understanding the scope of this expansion:   “Significant Equity Investor” is defined as “(i) any private equity company with a financial interest in a provider, provider organization or management services organization; or (ii) an investor, group of investors or other entity with a direct or indirect possession of equity in the capital, stock or profits totaling more than 10 per cent of a provider, provider organization or management services organization; provided, however, that “significant equity investor” shall not include venture capital firms exclusively funding startups or other early-stage businesses.” “Private Equity Company” is defined as “any company that collects capital investments from individuals or entities and purchases, as a parent company or through another entity that the company completely or partially owns or controls, a direct or indirect ownership share of a provider, provider organization or management services organization; provided, however, that “private equity company” shall not include venture capital firms exclusively funding startups or other early-stage businesses.” “Management Services Organization” is defined as “a corporation that provides management or administrative services to a provider or provider organization for compensation.” Notably, transactions involving a Significant Equity Investor that result in a change of ownership or control of a provider or provider organization must now be reported to the applicable Massachusetts oversight authorities. However, private equity investment solely in a Management Services Organization may not need to be reported under the Act if the Management Services Organization does not also meet the definition of a “provider organization” (e.g., the Management Services Organization does not represent providers in contracting with carriers) and the transaction does not otherwise result in any change of ownership or control of a provider. So, while the Act adds a broad definition for Management Services Organizations, it appears to do so primarily to bolster the added definition for Significant Equity Investor. In the absence of clarifying guidance from the applicable Massachusetts oversight authorities, the Act does not seem to materially expand on the circumstances in which notification of a transaction involving only a Management Services Organization would need to be reported in Massachusetts. Further, the Act expands on the applicable regulatory authorities’ rights to gather data, including post-closing data, to assess impacts of any reportable material change in a couple of important ways. First, for material change transactions involving a Significant Equity Investor, regulators may require the Significant Equity Investor to submit information regarding its capital structure, general financial condition, ownership and management structure, and audited financial statements as part of the notice. Second, regulators may require providers and provider organizations to submit data and information necessary to assess the post-transaction impacts of a material change for a period of 5 years following completion of the reported change, greatly extending the amount of time that transacting parties in the healthcare industry remain under the microscope in Massachusetts. Every transaction is different. Therefore, each healthcare industry transaction involving a state with a healthcare transaction notification law, of which there are increasingly many, should be reviewed for any necessary notification requirements. These laws can impose significant reporting obligations and materially impact transaction timelines. Reach out to the authors of this post or your regular Dorsey attorney should you have any questions.

Iowa’s fetal heartbeat law, House File 732, which was signed into law by Governor Kim Reynolds in 2023, will go into effect on Monday, July 29, 2024. This blog post gives a brief background and summary to help hospitals and providers understand their obligations under the law. The fetal heartbeat law has been temporarily enjoined from enforcement since July 2023. However, a 4-3 decision from the Iowa Supreme Court in June 2024 in Planned Parenthood of the Heartland, Inc. v. Reynolds ex rel. State, 2024 Iowa Sup. LEXIS 74, 2024 WL 3209943, and a subsequent order from District Court Judge Jeffrey Farrell dissolving the temporary injunction, will allow the fetal heartbeat law to go into effect on July 29. The fetal heartbeat law bans abortions, with exceptions for rape, incest, non-viability of the fetus and medical emergencies, after a fetal heartbeat can be detected. A fetal heartbeat can be detected as early as six weeks into a pregnancy. In order to be effective as an exception to the law, the rape and incest exceptions require reporting to law enforcement, a public health agency, or doctor within 45 days for rape, and 140 days for incest. With regard to the medical emergency exception, some have read the Iowa Supreme Court in Planned Parenthood of the Heartland, Inc., to interpret this exception narrowly. Under this narrow reading, “medical emergency” (which permits an abortion after fetal heartbeat detection), would include neither “psychological conditions, emotional conditions, familial conditions, or the woman’s age” or, “when continuation of the pregnancy will create a serious risk of substantial and irreversible impairment of a major bodily function of the pregnant woman.” Id. at 6. This interpretation would mean that unless a woman has a life-threatening condition, an abortion is not permitted in order to preserve the health of the mother – even if the mother’s health would be at risk of substantial and irreversible impairment of a major bodily function. However, federal law, known as the Emergency Medical Treatment and Labor Act (EMTALA), currently preempts Iowa law to the extent that Iowa law conflicts with EMTALA. EMTALA defines “emergency medical condition” to encompass health-jeopardizing, and not merely life-threatening conditions. Therefore, if the treating physician determines that an abortion is necessary to stabilize a women’s emergency medical condition, then EMTALA would control the decision under those circumstances. While this potential conflict between state and federal law will come to the forefront in Iowa starting on July 29th, the issue of EMTALA pre-emption of a state abortion restriction was already addressed in June 2024 by the U.S. Supreme Court. In that case, the U.S. Supreme Court allowed an order by a federal judge in Idaho to remain in place that temporarily blocks the State of Idaho from enforcing an abortion ban (which is similar to Iowa’s fetal heartbeat law) to the extent that the Idaho law conflicts with EMTALA. This means that Idaho doctors currently have the discretion to perform emergency abortions if a provider determines that an abortion is necessary in order to stabilize a woman’s medical emergency. It is likely that other cases will come before federal courts across the country to test EMTALA pre-emption of abortion restrictions in the context of medical emergencies, so hospitals and providers should continue to monitor the status of these cases. In order to better understand their EMTALA obligations, hospitals and physicians should review the CMS guidance which addresses the EMTALA obligations of hospitals and physicians in light of new state laws prohibiting or restricting access to abortion. It is important to note that in addition to the fetal heartbeat law, there are other requirements in Iowa related to providing an abortion. For example, Iowa Code Chapter 146A includes a number of prerequisites that a physician performing an abortion must complete. These prerequisites include a written certification from the pregnant woman 24 hours prior to the abortion that she has undergone an ultrasound, an opportunity to view the ultrasound and hear a description of the ultrasound and heartbeat, and has been provided information regarding alternative options to abortion, risks associated with abortion and materials developed by the State. Notably, the Iowa Code Chapter 146A abortion prerequisites do not apply in the event of an abortion performed in a medical emergency. We will continue to monitor the progress of these laws and provide updates in this blog. If you have any questions about these laws’ impact on you or your organization, please contact the authors or your regular Dorsey attorney.

Violations of the federal Anti-Kickback Statute (the “AKS”)[1] have long served as a basis for liability under the federal False Claims Act (the “FCA”).[2]  Recently, however, there has been increasing uncertainty regarding how far a violation of the AKS sweeps to render claims “false” under the FCA.  Courts are currently at odds with each other regarding the appropriate causation standard—how directly an AKS violation must cause submission of a claim—in order for that claim to be false under the FCA.  Because FCA defendants are liable for up to treble damages, plus substantial fines and penalties, for every false claim, this current state of flux has significant implications for the scope of damages in FCA cases predicated on violations of the AKS. In its 2016 decision in Universal Health Services v. United States ex rel. Escobar, the U.S. Supreme Court confirmed that a defendant could be liable under the FCA for what are commonly referred to as “legally false” claims; or, claims that, despite being factually accurate, are rendered false due to an underlying non-compliance with law that is material to the government’s decision to pay a claim.[3]  In the healthcare industry, non-compliance with the AKS became a quintessential predicate for FCA liability, with courts accepting that compliance with the AKS is material to the government’s decision to pay a claim. Less settled, however, was the requisite nexus between the AKS violation and a given claim for the claim to be considered false.  Some courts have accepted a broad “taint theory,” under which the entire relationship between two parties is considered tainted by a violation of the AKS.  Under this theory, any claim for services referred between the parties would be grounds for liability under the FCA.  Other courts have required that the AKS violation touch, with differing degrees of directness, the claims at issue.  In such cases, an FCA defendant would be liable only for claims that had the requisite degree of connectedness to an AKS violation. Then, in 2010, the Affordable Care Act codified in statute (the “ACA Amendment”) that a claim that includes items or services “resulting from” an AKS violation constitutes a false or fraudulent claim under the FCA.[4] This “resulting from” language has proven to be a major point of disagreement among courts, creating significant confusion regarding whether and to what extent an AKS violation must cause submission of a claim in order for such submission to violate the FCA. To further complicate matters, courts have far from settled the question of whether the same causation standard applies whether or not the government relies on the ACA Amendment’s per se falsity to plead that a defendant violated the FCA.  This is to say that it remains largely unsettled whether the causation standard that applies to pleadings that invoke the ACA Amendment also apply where the government instead (or also) invokes Escobar and pleads that compliance with the AKS is material to the government’s decision to pay a claim. So, what standard applies? Currently, it depends on the court. The Third Circuit has held that the ACA Amendment requires only some “link” or “connection” between the alleged kickback and the subsequent claims. In S. ex rel. Greenfield v. Medco Health Sols., Inc.[5], the court acknowledged that the Supreme Court had previously interpreted the plain meaning of the nearly identical phrase “results from” in the context of the Controlled Substances Act as requiring actual, or but-for causation.[6] However, without stating whether the plain meaning of “resulting from” was unclear, the court looked to legislative intent, finding that such a strict causation requirement would require proof that a kickback “actually influenced a patient’s or medical professional’s judgment,” which would be inconsistent with Congress’ apparent intentions to reach a “broad swath” of fraud and abuse.[7] The Sixth and Eighth Circuits have adopted a strict but-for causation standard, requiring that the government establish that the items or services would not have been submitted for payment if not for the AKS violation.[8] In Cairns, the court asserted that the “resulting from” language in the ACA Amendment is “unambiguously causal”, requiring but-for causation in accordance with the Supreme Court’s holding in Burrage.[9] Acknowledging that the Third Circuit came out differently on this issue in Greenfield, the court in Cairns rejected the Third Circuit’s approach, stressing that when the plain meaning of a term or phrase is unambiguous, review of legislative history is improper. The court further noted that it is not enough for the government to show that the defendant failed to disclose the AKS violation when submitting the claims at issue.[10] In S. ex rel. Fesenmaier v. Cameron-Ehlen Grp., Inc., the U.S. District Court for the District of Minnesota clarified that, under Cairns, but-for causation only applies to claims that rely on the ACA Amendment to show falsity.[11] Conversely, where the government had pled that compliance with the AKS was material to a decision to pay the claim, the District Court required that the government show only proximate causation (established if the misconduct was a substantial factor in submission of the claims and such submission was reasonably foreseeable or anticipated as a natural consequence of the misconduct).[12] In a seemingly contradictory opinion, the U.S. District Court for the District of Minnesota in S. ex rel. Louderback v. Sunovion Pharms., Inc. held that a plaintiff may not establish FCA liability premised on a violation of the AKS by simply showing that compliance with the AKS was material to the government’s decision to pay the claim (which, under Fesenmaier, requires only proximate causation).[13] In other words, a plaintiff must meet the ACA Amendment but-for causation standard. This holding is similar to the Sixth Circuit’s holding in Cairns, which also found that but-for causation is required to establish FCA liability on the basis of a violation of the AKS (although query whether the Sixth Circuit intended to limit this holding to pleadings that rely on the ACA Amendment). In the First Circuit, the U.S. District Court for the District of Massachusetts has created conflicting case law. In S. v. Regeneron Pharms. Inc. the court mixed concepts, creating an FCA causation standard that starts to merge with notions of intent under the AKS. While the court purportedly adopted the but-for causation standard from Cairns, it then stated that an AKS violation need only be a “substantial factor” in causing referrals, rather than the sole cause, in order for claims resulting from such referrals to be false.[14] Conversely, in U.S. v. Teva Pharms. USA, Inc., the court held that only a “sufficient causal connection” must exist between the AKS violation and a claim in order to render the claim false under the FCA.[15] As a result of these conflicting holdings, the causation standard issue is now under interlocutory appeal with the First Circuit.[16] In addition to being determinative of whether a violation of the FCA occurred at all, a court’s view of the appropriate causation standard can have a significant effect on the scope of damages.  If but-for causation is required, the number of affected claims will likely be limited to those claims for which there is evidence that the item or service would not have been referred absent the AKS violation.  At the other end of the spectrum, where there is no requirement to show any sort of causal connection between the alleged violation of the AKS and the submission of a purportedly-false claim, damages can grow to include any claim for an item or service referred between parties whose relationship can be said to be “tainted” by a violation of the AKS. In light of the FCA’s liability scheme—which includes treble damages and significant per-claim fines and penalties—the unsettled nature of this causation requirement can lead to significant uncertainty regarding a defendant’s potential exposure in FCA cases.  Defendants facing allegations that they are liable under the FCA as a result of non-compliance with the AKS may see potential damages balloon if courts loosen causation requirements.  If courts impose stricter causation requirements, on the other hand, the government may find it harder and harder to achieve the mammoth judgments and settlements that we have seen in the past.     [1] 42 U.S.C. § 1320a-7b(b). The Anti-Kickback Statute imposes criminal liability upon any person who knowingly and willfully solicits or receives remuneration (i.e., anything of value) in return for, or offers or pays any remuneration to induce, the referrals of items or services for which payment may be made in whole or in part under a federal health care program, including Medicare and Medicaid. [2] 31 U.S.C. §§ 3729-3733. The civil False Claims Act imposes liability upon any person who knowingly submits, or causes to submit, false or fraudulent claims to the government. [3] Universal Health Servs. v. United States ex rel. Escobar, 136 S. Ct. 1989 (2016) (noting that the FCA is not a “vehicle for punishing garden-variety breaches”, and emphasizing the importance of the government’s conduct in determining whether a particular AKS violation was material to the government’s decision to pay the claims). [4] 42 U.S.C. § 1320a-7b(g). [5] U.S. ex rel. Greenfield v. Medco Health Sols., Inc., 880 F.3d 89 (3rd Cir. 2018). [6] See Burrage v. U.S., 134 S. Ct. 881, 887-88 (2014). [7] Id. at 96-97. [8] See U.S. ex rel. Martin v. Hathaway, 63 F.4th 1043 (6th Cir. 2023), cert. denied, 144 S. Ct. 224 (2023); U.S. ex rel. Cairns v. D.S. Med. LLC, 42 F.4th 828 (8th Cir. 2022). [9] Cairns, 42 F. 4th at 834-36. [10] Cairns, 42 F.4th at 834. [11] U.S. ex rel. Fesenmaier v. Cameron-Ehlen Grp., Inc., No. 13-CV-3003, 2024 U.S. Dist. LEXIS 21897, at *8-9 (D. Minn. Feb. 8, 2024). This case is currently on appeal to the Eighth Circuit. [12] Id. at *10, 29 (noting that it was insufficient, by itself, to establish that the claims were submitted within one year of the alleged kickback). [13] No. 17-CV-1719, 2023 U.S. Dist. LEXIS 209990 (D. Minn. Nov. 27, 2023). [14] U.S. v. Regeneron Pharms., Inc., No. 20-11217-FDS, 2023 U.S. Dist. LEXIS 172618, at *31-34 (D. Mass. Sept. 27, 2023) (indicating that it would be sufficient to show that the defendant was giving copay assistance because it knew that patients would not fill prescriptions and/or physicians would not write prescriptions if such copay assistance were unavailable). [15] See U.S. v. Teva Pharms. USA, Inc., No. 20-11548-NMG, 2023 U.S. Dist. LEXIS 122272 (D. Mass. July 14, 2023). [16] See U.S. v. Regeneron Pharms., Inc., No. 20-11217-FDS, 2023 U.S. Dist. LEXIS 191418 (D. Mass. Oct. 25, 2023); U.S. v. Regeneron Pharms., Inc., No. 23-8046, 2023 U.S. App. LEXIS 33107 (1st Cir. Dec. 11, 2023).

On July 1, 2024, Indiana’s new health care transactions notification law takes effect.[1] The law is designed to increase government oversight of mergers and acquisitions involving health care entities. Indiana joins a growing number of states that have passed similar legislation implementing notice requirements and increasing antitrust evaluations for certain health care transactions.[2] The following provides a general overview of Indiana’s new law. General Purpose and Key Definitions Indiana’s health care transactions notification law grants the Indiana Attorney General (AG) the authority to review certain mergers and acquisitions between two health care entities if at least one of the entities is an Indiana health care entity.[3] To enforce this oversight power, the law establishes specific notice requirements for the transacting health care entities. Such notice must be provided to the Indiana AG at least ninety (90) days before the date of the merger or acquisition.[4] Upon reviewing a submission of notice, the Indiana AG may issue a civil investigative demand for more information regarding the merger or acquisition. Below are key definitions from Indiana’s law defining the applicable scope: Transactions affected by the new notification requirements include mergers and acquisitions. “Merger” is defined as any change of ownership including: An acquisition or transfer of assets, or The purchase of stock effectuated by a merger agreement. “Acquisition” is defined as any agreement, arrangement, or activity that results in a person acquiring, directly or indirectly, control of another person. Entities affected by the new law are those specifically falling within the statute’s definition of health care entities.[5] “Health care entity” is defined as: Any organization or business that provides diagnostic, medical, surgical, dental treatment, or rehabilitative care. An insurer that issues a “policy of accident and sickness insurance,”[6] which generally includes a policy or contract covering bodily injury, disablement by injury or illness, or death by accident or disease.[7] The statute provides specific exceptions for several types of coverage.[8] A health maintenance organization. A pharmacy benefit manager, which refers to an entity that performs certain administrative functions on behalf of a health plan, state agency, insurer, managed care organization, or other third party payor.[9] An administrator, meaning a person who, on behalf of an insurer, “underwrites, collects charges or premiums from, or adjusts or settles claims on residents of Indiana in connection with life, annuity, or health coverage offered or provided by an insurer.”[10] The statute provides several specific exclusions for persons not considered an administrator.[11] A private equity partnership, regardless of where the private equity partnership is located, seeking to enter a merger or acquisition with any entity described above.[12] If a transaction meets the definition of merger or acquisition, and the entities involved are “health care entities” under the statute, then the transaction may be subject to certain notification requirements. Notification Requirements Indiana’s health care transactions notification law requires an Indiana health care entity “involved in a merger or acquisition with another health care entity with total assets, including combined entities and holdings, of at least ten million dollars ($10,000,000)” to provide written notice to the Indiana AG at least ninety (90) days before the date of the merger or acquisition.[13] For notice to be required under Indiana’s health care transactions notification law, the transaction must: (1) satisfy the statute’s definition of either a merger or acquisition; (2) involve two or more “health care entities,” one of which must be based in Indiana; and (3) concern at least ten (10) million dollars in total assets. If these characteristics are met, then the transacting health care entities must submit notice as outlined below. If the transaction is subject to Indiana’s notice requirements, each health care entity involved in the transaction must submit written notice to the Indiana AG, which must include the following information: The entity’s business address and federal tax number. The name and contact information of a representative of the health care entity concerning the merger or acquisition. A description of the health care entity. A description of the merger or acquisition, including the anticipated timeline. A copy of any materials that have been submitted to a federal or state agency concerning the merger or acquisition.[14] Attorney General Obligations and Oversight Powers Following a health care entity’s compliance with the above notice requirements, the Indiana AG will review the information submitted and provide a written analysis of any antitrust concerns regarding the merger or acquisition. The Indiana AG must provide its analysis not later than forty-five (45) days following the health care entity’s submission of notice. The analysis is given to the representative of the health care entity that submitted notice. Additionally, the Indiana AG has the power to issue a civil investigative demand to collect further information regarding the merger or acquisition from the health care entities submitting notice. The civil investigative demand must be made pursuant to Indiana’s existing law, which, in part, requires the attorney general to have reasonable cause to believe a person has violated a statute enforced by the attorney general.[15] Finally, Indiana’s health care transactions notification law imposes certain confidentiality requirements. The Indiana AG must keep confidential all nonpublic information provided through the notice requirements. Furthermore, any information received or produced by the Indiana AG is also considered confidential. If you have any questions regarding Indiana’s health care transactions notification law and how your organization or transaction may be impacted, please contact the authors or your regular Dorsey attorney. Summer Associate Katelyn Tarrolly provided substantial assistance researching and drafting this blog post. [1] Burns Ind. Code Ann. §§ 25-1-8.5-1—25-1-8.5-4. [2] See Lillie Cox, Randall Hanson, Jamie McCarty & Neal Peterson, Minnesota Attorney General Notification of Health Care Transaction, Dorsey Health Law Blog (May 30, 2023), https://www.dorseyhealthlaw.com/minnesota-attorney-general-notification-of-health-care-transactions/ (noting several states have enacted or are considering similar legislation, including California, Connecticut, Delaware, Massachusetts, Minnesota, Nevada, New Jersey, New York, Oregon, Rhode Island, and Washington). [3] To trigger Indiana’s transactions notification requirements, both entities must be health care entities. Additionally, the law requires at least one of those entities to be an “Indiana health care entity.” The statute does not define “Indiana health care entity.” Currently, there is no guidance that clarifies the criteria for being considered an “Indiana health care entity” under the new law. Burns Ind. Code Ann. § 25-1-8.5-4. [4] The statute provides that notice shall be given “at least ninety (90) days prior to the date of the merger or acquisition[.]” This likely means notice must be given ninety (90) days prior to the closing date of the merger or acquisition; however, there is no guidance currently clarifying the correct interpretation of this provision. Burns Ind. Code Ann. § 25-1-8.5-4. [5] “Health care entity” does not include the Medicaid program or the Medicare program. Burns Ind. Code Ann. § 25-1-8.5-2(b). [6] Burns Ind. Code Ann. § 25-1-8.5-2. [7] See Burns Ind. Code Ann. § 27-8-5-1 (“‘[P]olicy of accident and sickness insurance’, as used in this chapter, includes any policy or contract covering one (1) or more of the kinds of insurance described in Class 1(b) or 2(a) . . . .”).; see also Burns Ind. Code Ann. § 27-1-5-1 (defining Class 1(b) and Class 2(a) insurance). [8] An insurer that issues one or more of the following types of coverage is explicitly excluded from the definition of health care entity: “(A) accident only, credit, dental, vision, long term care, or disability income insurance; (B) coverage issued as a supplement to liability insurance; (C) automobile medical payment insurance; (D) a specified disease policy; (E) a policy that provides indemnity benefits not based on any expense incurred requirements, including a plan that provides coverage for: (i) hospital confinement, critical illness, or intensive care; or (ii) gaps for deductibles or copayments.; (F) worker’s compensation or similar insurance; (G) a student health plan; (H) a supplemental plan that always pays in addition to other coverage. Burns Ind. Code Ann. § 25-1-8.5-2(a)(2). [9] A pharmacy benefit manager is an entity that: “(1) contracts directly or indirectly with pharmacies to provide prescription drugs to individuals; (2) administers a prescription drug benefit; (3) processes or pays pharmacy claims; (4) creates or updates prescription drug formularies; (5) makes or assists in making prior authorization determinations on prescription drugs; (6) administers rebates on prescription drugs; or (7) establishes a pharmacy network.” Burns Ind. Code Ann. § 27-1-24.5-12. [10] Burns Ind. Code Ann. § 27-1-25-1. [11] Administrator does not include: (1) an employer or wholly owned direct or indirect subsidiary of an employer acting on behalf of the employees of: (A) the employer; (B) the subsidiary; or (C) an affiliated corporation of the employer; (2) a union acting for its members; (3) an insurer; (4) an insurance producer licensed under IC 27-1-515.6 that has a life or accident and health or sickness qualification and whose activities are limited exclusively to the sale of insurance; (5) a creditor acting for its debtors; (6) a trust established under 29 U.S.C. 186 and the trustees, agents, and employees acting pursuant to that trust; (7) a trust that is exempt from taxation under Section 501(a) of the Internal Revenue Code; (8) a financial institution that is subject to supervision or examination by federal or state banking authorities to the extent that the financial institution collects and remits premiums to an insurance producer or an authorized insurer in connection with a loan payment; (9) a credit card issuing company that: (A) advances for; and (B) collects from, when a credit card holder authorizes the collection; credit card holders of the credit card issuing company, insurance premiums or charges; (10) a person that adjusts or settles claims in the normal course of the person’s practice or employment as an attorney at law and that does not collect charges or premiums in connection with life, annuity, or health coverage; (11) a health maintenance organization; (12) a limited health maintenance organization; (13) a mortgage lender to the extent that the mortgage lender collects and remits premiums to an insurance producer or an authorized insurer in connection with a loan payment; (14) a person that is licensed as a managing general agent and acts exclusively within the scope of activities under the license; (15) a person that (A) directly or indirectly underwrites, collects charges or premiums from, or adjusts or settles claims on residents of Indiana in connection with life, annuity, or health coverage provided by an insurer; (B) is affiliated with the insurer; and (C) performs the duties specified in clause (A) only according to a contract between the person and the insurer for the direct and assumed life, annuity, or health coverage provided by the insurer. Id. [12] The statute does not define “private equity partnership.” Currently, there is no guidance interpreting what is considered a “private equity partnership.” Burns Ind. Code Ann. § 25-1-8.5-2(a)(6). [13] Burns Ind. Code Ann. § 25-1-8.5-4(a). [14] Burns Ind. Code Ann. § 25-1-8.5-4(b). [15] Burns Ind. Code Ann. § 4-6-3-3.

The Dorsey Health Law blog team keeps readers up-to-date on relevant topics in the health care industry. In order to do so, the members of the blog team communicate regularly with other practice groups within the firm for applicable updates from client publications. For this post, we would like to thank Dorsey’s Nicholas J. Pappas and Andrew Holly for the following New York Law Journal article: Congress passed the Metal Health Parity and Addiction Equity Act of 2008 (the Parity Act) based upon its perception that employers who sponsor group health plans were improperly discriminating against mental health benefit coverage. Congress intended that the Parity Act would cause group health plans to cover treatments for mental health and substance abuse conditions in parity with medical/surgical treatments. Read more here.