Risk & Compliance

OCR's 55th HIPAA access action adds a current records-request workflow warning

HHS OCR announced a $50,000 settlement and two-year corrective-action plan with Azul Vision after investigating a January 2023 medical-record request that was not fulfilled until January 2025. OCR says the HIPAA right-of-access standard generally requires action within 30 days, with one possible 30-day extension. The plan includes policy review, workforce training, and regular reporting of request and response dates. Azul Vision is a California optometry and ophthalmology provider; HHS does not identify it as an FQHC. This is an enforcement example for covered-entity access workflows, not a new rule, an FQHC enforcement action, or proof of liability beyond the settlement terms.

A vendor that archives the EHR you decommissioned was breached — at least seven health centers are affected, and its own client list is provably incomplete

Aesto Health migrates and archives patient data when a health center replaces its EHR. Its notice says the incident occurred "between on or about December 2, 2025, and December 18, 2025," was confirmed May 26, 2026, posted publicly June 24, and client notification began June 26 — with individual notifications landing from August 21. Data elements listed include names, dates of birth, medical information, driver's license numbers, financial account numbers, health insurance information, taxpayer identification numbers, government identification numbers, and Social Security numbers for a limited subset. THE FQHC FOOTPRINT, read off Aesto's own covered-entity page (stamped "Updated: 9-3-2026"): six confirmed health centers are named — Midtown Community Health Center (UT), Monroe Health Center (WV), Marana Health / MHC Healthcare (AZ), Park West Health Systems (MD), Sterling Health Solutions (KY), and Shenandoah Valley Medical System (WV). 🔑 BUT THAT LIST IS NOT COMPLETE. Kaniksu Community Health, an Idaho FQHC, is not on Aesto's page — yet its own breach-notification letter, filed with the California Attorney General, states: "Kaniksu Community Health (‘Kaniksu’) learned of a data incident involving Aesto, LLC, (‘Aesto’) a healthcare data management a service provider to Kaniksu" [sic]. So the real count is at least seven, and a health center should not treat absence from the vendor's list as evidence it was unaffected. WHY THIS ONE IS DIFFERENT FROM AN ORDINARY BREACH: Aesto's business is holding the system you retired. That means the exposed data often sits somewhere IT no longer counts as live and that may sit outside the current HIPAA Security Rule risk analysis. Any center that has switched EHRs — an OCHIN Epic migration, an eClinicalWorks conversion, a practice acquisition — should ask this week who holds its legacy archive, whether a current business associate agreement covers it, and whether that archive is inside the risk analysis. The notification lag is its own finding: roughly 190 days from incident to covered-entity notice, far outside the 60-day ceiling in 45 CFR 164.410. TWO LIMITS ON THE NUMBERS. The widely reported figure of 9,540,683 affected individuals is attributed to OCR by trade press and is not confirmed against the federal breach portal, so treat it as reported rather than established. Trade coverage also described Mineral Community Hospital and Holton Community Hospital as community health centers; both are hospitals, and the underlying list is a 340B covered-entity roster, which spans FQHCs, look-alikes and several hospital categories — it is not an FQHC roster. One organization, Lone Star Community Health Center, was listed as affected by one outlet but does not appear on Aesto's page. Separately and unrelated to Aesto, Boston Health Care for the Homeless Program — an FQHC funded under section 330(h) — sent its own breach letter dated August 7, 2026 for a direct network intrusion discovered June 8, 2026 that traces to a disruption first learned of November 11, 2025.

HHS asks clinicians whether federal vaccine-recommendation categories should change — comments due September 20; nothing changes yet

HHS announced Request for Information HHS-OS-2026-0332 on August 21; the Federal Register notice is document 2026-17250 (91 FR 54724). It asks whether the current routine, risk-based, and shared-clinical-decision-making/individual-based categories are clear and adequate, whether additional categories are needed, and how evidence, consent, autonomy, feasibility, trust, and program consequences should shape them. Comments are due September 20, 2026. The notice specifically invites clinicians, nurses, pharmacists, immunization providers, health plans, public-health officials, researchers, and community-based organizations; FQHC participation is therefore a direct audience inference, not an FQHC-specific mandate. The operational stakes are bounded but real: the notice says an adopted shared-decision recommendation currently triggers the same Affordable Care Act no-cost coverage and Vaccines for Children availability as a routine recommendation, and asks how any category changes should preserve access, predictable coverage, program eligibility, injury-compensation treatment, and state-law consistency. Most important boundary: this is an RFI, not a rule or recommendation, and it changes no existing vaccine recommendation, coverage requirement, or program obligation. Comments become public, including personal information placed in the comment or attachments; health centers should submit organization-approved evidence and never include patient information.

A final rule takes effect October 13 barring federal Medicaid and CHIP payment for a service line more than a dozen tracked health centers advertise — and the age cutoff is different in Medicaid than in CHIP

CMS-2451-F (RIN 0938-AV73) published August 13, 2026 at 91 FR 52406-52474 and is EFFECTIVE OCTOBER 13, 2026. It adds a new subpart N to 42 CFR part 441 and a new Sec. 457.476, and it was signed by Robert F. Kennedy, Jr., Secretary of Health and Human Services. WHAT IT REQUIRES, verbatim from Sec. 441.802: “a State plan must provide that the Medicaid agency will not make payment under the plan for sex-rejecting procedures for children under the age of 18,” and “FFP is not available in State expenditures” for those procedures. 🔑 THE OPERATIONAL TRAP IS THE AGE, AND IT IS NOT THE SAME NUMBER TWICE. Medicaid is under 18. Separate CHIP is under 19, because Sec. 457.476 ties it to the targeted low-income child definition at Sec. 457.310, and it applies “regardless of the type of health benefit coverage option described at Sec. 457.410.” A billing or eligibility workflow built on one threshold will be wrong for the other program. THE TAPER IS NARROWER THAN IT SOUNDS. Sec. 441.802(c) keeps FFP available for cross-sex hormone therapy “for a tapering period of up to 6 months from October 13, 2026, for beneficiaries who were receiving such therapy as of October 13, 2026.” Two limits are load-bearing: it covers hormone therapy only, and only patients already on therapy ON that date — a start after October 13 is not inside the taper. The window therefore runs to roughly April 13, 2027. THREE EXCLUSIONS SIT IN THE DEFINITION ITSELF at Sec. 441.801(3), and the third is the one clinicians will need most: the term does not include procedures undertaken “to treat an individual with a medically verifiable disorder of sexual development,” or “for purposes other than attempting to align an individual’s physical appearance or body with an asserted identity that differs from the individual’s sex,” or “to treat complications, including any infection, injury, disease, or disorder that has been caused by or exacerbated by the performance of sex-rejecting procedure(s).” Complications care remains payable. THE RULE DOES NOT NAME FQHCs AS A REGULATED PARTY. The obligation runs to STATE Medicaid and CHIP agencies and to federal financial participation, so it reaches a health center by operation as a Medicaid or CHIP provider rather than by name. Health centers turn up in the rule only inside CMS’s summary of public comments, where commenters argued the rule would be “especially financially harmful to rural hospitals and clinics, as well as Federally Qualified Health Centers and other safety net providers,” and that it “may place Federally Qualified Health Centers and Certified Community Behavioral Health Centers in conflict with State scope of practice laws.” CMS did not agree. WHY IT LANDS HERE ANYWAY: gender-affirming care is a named program at multiple health centers in our own California directory, including Los Angeles LGBT Center, and a payment prohibition with a 36-day runway is a revenue-and-workflow question regardless of how the underlying policy is judged. The rule publishes no patient count and no dollar figure. Implementation runs through each state plan, so confirm with your state Medicaid agency and your managed-care plans how your state operationalizes the prohibition, the age split, and the taper before changing a single workflow.

HRSA publishes the FINAL Health Center Program Scope of Project Policy Manual — effective on release, comment window already ran

HRSA published a Notice of Availability for the final Health Center Program Scope of Project Policy Manual (Federal Register document 2026-16348, 91 FR 51722, published August 11, 2026). Two features make this immediately operational. First, the notice states the final Scope Manual 'takes effect upon release' — it is operative now, with no phase-in period. The comment window on this policy already ran, on the December 9, 2024 draft. Second, it names its audience in words: the manual applies to 'all health centers that apply for and receive a federal award under the Health Center Program, as authorized by section 330 of the PHS Act, as well as section 330 subrecipient organizations, and health centers designated as Health Center Program look-alikes.' Subrecipients and look-alikes are explicitly in scope, not just direct grantees. The draft was released December 9, 2024; HRSA reports receiving 2,767 comments from 135 organizations and individuals and says it made a substantial number of updates in response. The notice itself makes no payment, PPS, FTCA, or 340B claim, so any consequence a scope change carries for billing, malpractice coverage, or drug pricing does not come from this document. It does interact directly with the HRSA Form 5A/5B information-collection reopening already in this feed (comments close September 28), since Forms 5A and 5B are the instruments that document scope. The implementation calendar has two edges. First, dates: HRSA is taking the EHBs Change in Scope module offline October 20 through November 19, 2026 (reopening November 20), with new CIS requests due by 11:59 p.m. ET October 19, returned Change Requests due by 11:59 p.m. ET October 24, and Health Center Program applications not submitted by 5:00 p.m. ET November 19 losing the data entered in Forms 5A, 5B and 5C, per HRSA's own EHBs What's New system alert. Second, an oversight gap worth planning around: HRSA has said centers should keep using the current Site Visit Protocol until the SVP is aligned to this manual in February, so for roughly six months health centers are governed by a manual their own site reviewers are not yet scoring against. And in 2027 HRSA intends to work with health centers to review and confirm approved scopes for accuracy — which HRSA says may produce corrections or changes to sites, services or activities. Treat 2027 as a scope-reconciliation year, not a quiet one. These operational details come from RegLantern's August 13, 2026 summary of PAL 2026-04 and are corroborated on the HRSA EHBs alert and, for the 2027 review, by Feldesman's August 12, 2026 analysis.

CMS activates Washington wildfire PHE flexibilities retroactive to August 1 — affected providers can request additional 1135 relief

CMS announced August 10 that resources, blanket waivers, and other flexibilities are available for Washington providers affected by the Fairview, Autumn Lane, and Old Trails fires near Spokane County. The fires began August 1 and continue; HHS declared the public health emergency August 7, and CMS made the provider flexibilities retroactive to August 1. The notice also points to the CMS 1135 request form for additional case-specific relief, the Medicaid/CHIP disaster toolkit, ESRD Network 16 dialysis coordination, replacement of Medicare durable medical equipment damaged or lost in the fires, and Part D out-of-network and refill-too-soon protections for displaced beneficiaries. Scope boundary: CMS refers to affected providers, hospitals, and other facilities generally; it does not name an FQHC or establish that every waiver applies automatically to every health-center service. The notice also does not grant HRSA scope-of-project, award, reporting, or site-visit relief; affected health centers must pursue any HRSA program or grant flexibility separately.

HRSA reopens Form 5A and Form 5B — every health center's scope-of-project documents — plus all six change-in-scope checklists; comments close September 28

HRSA published an information collection request revision on July 30, 2026 (Federal Register document 2026-15419, 91 FR 48170) proposing to modify eight approved Health Center Program Forms and add three new ones, with comments due September 28, 2026. The notice names its respondents: 'Likely Respondents: Health Center Program award recipients (those funded under section 330 of the Public Health Service Act) and Health Center Program look-alikes.' The forms being modified are the ones that define what a health center is allowed to do and where: Form 5A: Services Provided ('Update labels and categories of services'), Form 5B: Sites ('Modify fields collecting site information'), and all six change-in-scope checklists (Form 5A and 5B Scope Adjustments, Adding/Deleting a Service Site, Adding/Deleting a Service). Three new forms appear: a Checklist for Replacing a Service Site in Scope, a Quality Improvement Fund (QIF) Final Report, and a Loan Guarantee Progress Report. Burden totals are 27,769 respondents / 29,607 responses / 31,302.05 annual hours — a net REDUCTION of 1,483.50 hours against the package OMB approved on May 31, 2026, meaning HRSA is reopening an ICR it cleared only two months ago. The notice frames its purpose as program monitoring, scope documentation, and change-in-scope efficiency. It says nothing about payment. Any downstream consequence for PPS billing, FTCA coverage, or 340B eligibility that flows from a scope change comes from elsewhere, not from this document. This belongs in the same low-visibility, high-consequence category as the OMB Uniform Guidance rewrite: nobody will send a press release about a checklist, and it governs how you add a site.

CMS and CDC reopen the CLIA regulations with a request for information — comments close September 14

CMS and CDC published a Request for Information on the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations in the Federal Register on July 16, 2026 (CMS-3485-NC, docket CMS-2026-2345). In the document's own words, it 'seeks input from the public regarding various topics related to the CLIA regulations, including: breath testing; laboratory processes and procedures; emergency preparedness, biosafety and biosecurity, and cybersecurity; and specialty testing areas.' Comments close September 14, 2026. BE PRECISE ABOUT WHY THIS IS HERE: the RFI does not mention FQHCs, RHCs, community health centers, certificates of waiver, or physician office laboratories anywhere in its text — that was checked term by term. The health-center relevance is structural, not asserted by the document: essentially every health center holds a CLIA certificate (most commonly a Certificate of Waiver or PPM) for in-clinic testing, so any rulemaking that follows would reach them the way it reaches every other CLIA-certified site. This is the first substantive regulatory reopening of CLIA since the 1992 implementing rules, which makes the comment window unusually consequential for small-volume testing sites that rarely get represented in lab policy. Do not read any FQHC-specific certification or billing change into this document — there is none yet, only a question-asking stage.

Eli Lilly's 340B Termination Turns Into Litigation and Congressional Pushback — Tampa General Sues in Federal Court, 72 House Members Demand HHS Act

Eli Lilly's June 1 five-day ultimatum escalated on June 18, 2026, when the manufacturer cut off 340B pricing for covered entities that refused to share in-house pharmacy claims data — Lilly directed wholesaler McKesson to end Tampa General Hospital's discounts after it missed the deadline, per the hospital's complaint. Tampa General sued Lilly on July 2 in the U.S. District Court for the Middle District of Florida, alleging the cutoff raised its average costs for Lilly medications 25-50% — losses the complaint pegs at roughly $24.7 million a year, including a 35.9% jump on Mounjaro. Separately, 72 bipartisan U.S. House members — led by Reps. Doris Matsui (D-CA) and Jack Bergman (R-MI) — signed an early-July letter to HHS Secretary Kennedy and HRSA Administrator Engels urging use of 'any enforcement mechanisms available' against Lilly's move and restoration of 340B pricing. Coverage so far documents hospitals as the entities cut off; no health-center termination has been confirmed, but FQHCs dispensing Lilly products face the same claims-data condition documented in the June 1 ultimatum item and should confirm their data-sharing posture now.

OIG declines to sanction an FQHC's produce-box and voucher program — a favorable outcome, but one that legally protects only the health center that asked

HHS-OIG issued Advisory Opinion 26-16 on July 9, 2026 (posted July 14) to a requestor it describes in its own words as 'designated as a federally qualified health center, consistent with Section 330 of the Public Health Service Act.' The arrangement: a six-month food-as-medicine program for 50 financially needy patients with diabetes or hypertension, half receiving weekly $30 produce boxes delivered to their homes and half receiving weekly $20 vouchers redeemable for healthy food at grocery chains and farmers markets, wrapped in dietician assessments, physician oversight and lab testing. READ THE HOLDING CAREFULLY — it is narrower than 'approved.' OIG found the arrangement WOULD generate prohibited remuneration under the anti-kickback statute if the requisite intent were present, and that it DOES generate prohibited remuneration under the Beneficiary Inducements CMP; it then exercised enforcement discretion and declined to impose administrative sanctions, citing safeguards (voucher-redemption tracking, retailer MOUs limiting eligible items, free provision of produce, billing under the health center's sliding fee discount policy per HRSA Compliance Manual Ch. 9, no laboratory remuneration, grant funding). CRITICAL LIMITATION, in the opinion's own words: 'This advisory opinion is issued only to Requestor. This advisory opinion has no application to, and cannot be relied upon by, any other person.' It also expressly reserves any opinion on Stark or the False Claims Act. So this is a genuinely encouraging signal about how OIG views structured food-as-medicine programs — and it is NOT legal cover for another health center to launch one. Treat it as a template for the safeguards to build in and a reason to seek your own counsel, not as permission.

$3.3M California Billing-Fraud Settlement Turns on Rendering-Provider NPIs and Uncredentialed NPs/PAs — an Adjacent-Sector Warning FQHCs Should Read Closely

Circle Medical Care of California, Circle Medical Technologies, and its chief medical officer agreed to pay $3,325,000 ($2.85M to California, $475K federal) to resolve False Claims Act allegations announced by San Francisco DA Brooke Jenkins with the California Department of Insurance and the U.S. Attorney for the Northern District of California. The alleged conduct: submitting claims under the National Provider Identifiers of physicians who did not render the service, where care was actually delivered by contracted nurse practitioners and physician assistants who had not been credentialed by the payer — producing a higher reimbursement rate. Notably, the complaint states there was no evidence of billing for services that were not provided; the fraud theory is purely about WHO was named as the rendering provider. Circle Medical is a San Francisco telehealth company, NOT an FQHC — but the enforcement theory maps directly onto a top-tier FQHC billing risk: heavily NP/PA-staffed panels, credentialing and payer-enrollment gaps, and rendering-provider accuracy on claims. It is also a California action assembled from a state qui tam plus the Department of Insurance — the same enforcement stack that reaches Medi-Cal providers. Compliance officers should treat this as a prompt to audit rendering-provider mapping and payer-credentialing status, not as an FQHC case.

Section 1557 Language Access Annual Notice Year 1 Anniversary — July 5, 2026 Compliance Window

HHS Section 1557 Annual Notice of Availability (free language assistance services in English + 15 most common LEP languages in the state) has been in effect since July 5, 2025. Year 1 compliance review window approaching July 5, 2026. CA's 15 LEP languages include Spanish, Chinese, Vietnamese, Tagalog, Korean, Armenian, Russian, Persian, Arabic, Punjabi, Khmer, Hmong, Hindi, Japanese, Mon-Khmer. All FQHCs taking Medicare/Medi-Cal must have posted, distributed, and translated the Notice — pairs with the May 11, 2026 WCAG 2.1AA deadline as a compounding civil rights compliance window for FQHCs. Two HHS OCR rules with overlapping enforcement risk in the same 8-week window.

DOJ Stands Up National Fraud Enforcement Division — Healthcare Billing Now Has a Dedicated Litigating Division

Acting U.S. Attorney General Todd Blanche announced (April 7, 2026) the National Fraud Enforcement Division (NFED) — a stand-alone DOJ litigating division consolidating the Tax Section, Health Care Fraud Unit, and Market/Government/Consumer Fraud Unit under one assistant attorney general. Each U.S. Attorney's office must designate a prosecutor to NFED within 21 days. A new National Fraud Detection Center generates investigative leads from federal financial data — meaning billing anomalies can trigger investigation independent of whistleblower complaints. Combined with FY2025 record $6.8B FCA recoveries (84% from healthcare = $5.7B), 2026 enforcement risk is structurally elevated for FQHCs. PPS billing, incident-to claims, telehealth FQHC distant-site billing, 340B claim integrity, and Anti-Kickback/Stark exposure are all in scope. Strategic action items for CFOs and compliance officers in May–June: (1) refresh PPS encounter documentation review, (2) audit incident-to billing for NP/PA visits, (3) reconfirm 340B contract pharmacy patient-definition compliance, (4) tighten BAA inventory and breach-response runbook (pairs with the OCR ransomware sweep enforcement posture).

DOJ’s 2026 National Health Care Fraud Takedown charges 455 defendants in $6.5B of alleged fraud — community mental health among named targets

On June 25, 2026 the U.S. Department of Justice, HHS-OIG, and partner agencies announced the 2026 National Health Care Fraud Takedown: criminal charges against 455 defendants (including about 90 licensed medical professionals) tied to more than $6.5 billion in alleged false claims, with over $182 million in cash, luxury vehicles, jewelry, and other assets seized. Community mental health and behavioral health services were explicitly named among targeted billing categories. No health center is named, but FQHCs that bill integrated behavioral health face heightened audit and documentation scrutiny; the takedown signals where Medicaid and Medicare program-integrity enforcement is concentrating in 2026.

Rhode Island BVCHC Proposed Data-Incident Settlement Has a $525K Benefits Cap; Approval Outcome Not Posted

The official settlement-administrator site for Perez v. Blackstone Valley Community Health Care, Inc., pending in Rhode Island Superior Court, says the parties agreed to a proposed settlement over the November 2023 cyberattack. Its benefits FAQ sets a $525,000 aggregate cap and lists the claim deadline as June 1, 2026. The site still describes court approval as pending and lists a final-approval hearing for June 23, 2026. As reviewed August 1, 2026, the site does not post the hearing outcome or a final-approval order, so this record must be treated as proposed/pending rather than a finalized $525,000 payment.

FTCA CY2027 redeeming applications due June 26 — miss it and your FQHC has a malpractice-coverage gap

HRSA Program Assistance Letter 2026-01 sets June 26, 2026 as the deadline for all currently-deemed health centers (and their sub-recipients) to submit CY2027 Federal Tort Claims Act redeeming applications — the annual filing that renews free federal medical-malpractice liability coverage. A lapse forces the center to buy private malpractice insurance to cover the gap for all of 2027. The risk is sharper this year because HRSA's EHB-to-GrantSolutions system migration is happening in the same window, making the deadline easier to miss. Compliance officers should confirm submission well before June 26.

Two Compliance Signals for FQHCs: HRSA's FY2026 340B Manufacturer-Audit Results Go Live, and OCR's Ransomware Settlements Preview a Tougher HIPAA Security Rule

Two federal compliance developments worth a calendar note. First, HRSA published its FY2026 340B Manufacturer Audit Results page (updated May 28, 2026) — the companion to the already-tracked FY2025 cycle (49% adverse findings); results are partially finalized, with corrective-action plans and any sanctions to be posted as HRSA approves them, and the agency advises covered entities not to contact audited manufacturers until CAPs post. FQHCs are the largest class of 340B covered entities, so this is a standing reference to monitor in OPAIS. Second, OCR's Risk Analysis Initiative has now completed 19 ransomware investigations with six 2026 settlements, and a June 1 Sidley analysis frames the recent settlements as a direct preview of the forthcoming HIPAA Security Rule amendments (which would make annual risk analyses, documented asset inventories, and demonstrated remediation mandatory rather than 'addressable'). No FQHC has been named, but FTCA-covered health centers are full HIPAA covered entities — meaning a center that hasn't completed a documented Security Risk Analysis is accumulating enforcement exposure ahead of a rule change, not just theoretical risk. (Affordable FQHC SRA tooling like Medcurity, added to our tech stack this cycle, exists precisely for this gap.)

Eli Lilly Gives ~50 Covered Entities Five Days to Hand Over 340B Claims Data — or Lose Their Discounts

On June 1, Eli Lilly escalated its 340B claims-data fight, warning roughly 50 covered entities that they have five days to submit comprehensive claims data or stop receiving 340B price breaks — the first time the manufacturer has issued outright termination threats rather than reminder letters. The demand follows Lilly's policy announced in January and effective Feb. 1, 2026, which requires claims-level data for all 340B dispenses (including in-house pharmacies, not just contract pharmacies); STAT reports more than 2,300 entities have complied while up to 1,000 larger systems have refused. The first round targets hospital systems, but the policy applies to all covered entities — FQHCs that dispense Lilly products (insulin, oncology, psychiatric drugs) and have not enrolled in the data platform face the same termination risk. With North Dakota's contract-pharmacy law struck down and other state shields in litigation, this is the manufacturer-side pressure on 340B savings that FQHC pharmacy directors must act on now.

OMB Proposes the Biggest Rewrite of the Federal Grant Rulebook Since 2013 — Every Section 330 Grantee Would Have to Run E-Verify; Comments Closed July 13

OMB has proposed a government-wide rewrite of the Uniform Guidance (2 CFR Part 200) — the rulebook every Section 330 grant, subaward, and Single Audit runs on ('Regulation for Federal Financial Assistance,' 91 FR / FR doc 2026-10817, published May 29, 2026, joined by HHS and 49 other agencies). The provision with the sharpest operational edge for health centers: recipients AND subrecipients would be required to enroll in DHS's E-Verify system for employees and contractors working under federal awards, and to report employees found not authorized to work. The proposal also expands termination and pre-issuance review authority and rewrites the equal-opportunity award terms. Feldesman — the law firm most FQHCs use for Section 330 compliance — confirms the rule reaches 'Ryan White clinics, federally qualified health centers (FQHCs), Indian Health Service facilities, and other 340B grantees,' with partner Steve Kuperberg warning the workforce provisions 'could ultimately affect the delivery of patient care' and senior counsel Jesi Carlson noting E-Verify would be a wholly new compliance obligation for many grantees. The comment period closed July 13, 2026; OMB is expected to issue a final rule later this year (no effective date is set in the proposed rule). For an FQHC this is an unbudgeted HR and compliance lift — E-Verify enrollment, I-9 workflow changes, and subrecipient flow-down — landing in the same window as the December 31 Community Health Center Fund cliff.

California AB 3030 + SB 1120 Are Active FQHC AI Compliance Triggers — AI-Communication Disclaimers + UM Restrictions in Effect

A May 2026 Holland & Knight legal review highlights two California laws that are now operational compliance triggers for any FQHC running AI: (1) AB 3030 (Health & Safety Code 1339.75) — where generative AI produces written or verbal patient communications about clinical information, those communications must carry a disclaimer saying so, plus clear instructions for reaching a human; the requirement does not apply when a licensed or certified human provider reads and reviews the communication first. The statute contains no consent requirement — the duty to obtain consent before recording a conversation comes from CIPA (Penal Code 632), not AB 3030; (2) SB 1120 — restrictions on AI in utilization management and prior-authorization decision-making (human clinician must make the final medical-necessity call). Compliance obligations apply now to any FQHC running AI scribes (Abridge, Nabla, Suki, Heidi), AI patient-outreach (Artera Squads, healow Genie), or AI-assisted UM/prior-auth (eClinicalWorks AI Workbench). Federal preemption push is underway in Washington but no enacted preemption yet. Pairs with already-tracked CHAI/NACHC Medicaid-eligibility AI Best Practice Guides — CHAI gives the governance scaffolding, AB 3030 + SB 1120 are the legal floor. Strategic implication: FQHC CIOs and Compliance Officers should audit current AI deployments for AB 3030 patient-disclosure scripts and SB 1120 UM-decision pathways before mid-2026.

Three health systems sue CVS/Caremark for ~$250M in alleged 340B savings diversion (RICO)

Mount Sinai, Michigan Medicine, and the University of Kansas Health System filed federal racketeering (RICO) suits on May 21, 2026 alleging CVS Health/Caremark secretly diverted roughly $250M in 340B program savings between 2020 and 2025 by paying covered entities artificially reduced reimbursement while concealing higher-rate claims. The cases target the contract-pharmacy and PBM machinery FQHCs depend on to convert 340B discounts into patient-care revenue. A win — or even discovery — could set precedent for FQHC 340B clawback claims and reshape contract-pharmacy economics just as manufacturer restrictions and the rebate-model fight already squeeze the program.

HHS Launches AERO — AI Re-Scores 5 Years of Audit Data for Every $1M+ Grantee, Including FQHCs

On May 21, 2026, HHS (Office of the Assistant Secretary for Financial Resources) launched AERO — the Audit Enforcement and Risk Oversight initiative — a department-wide program-integrity effort using next-generation AI tools (reportedly built in part with ChatGPT) to re-score at least five years of Single Audit Act compliance data for every entity receiving $1M+ in annual HHS funds. That threshold puts most Section 330 FQHCs squarely in scope. Initial findings: states and grantees have left serious internal-control issues unremedied for 3-5+ years, and hundreds of HHS grantees are late on required audits (some by 2+ years). Enforcement powers: temporarily withhold payments, hold back future funds, suspend or terminate awards, and pursue debarment. This is the operational teeth behind the Dec 2025 HHS AI Strategic Plan. Strategic implication for CA FQHCs: audit/compliance readiness just became materially higher-stakes — confirm Single Audit submissions are current, remediate any repeat findings now, and treat your audit-finding corrective-action history as a live enforcement risk. Pairs with the HRSA FY2025 340B audit results and the SocialRoots ComplAIance360 compliance-automation trend already tracked.

HHS Section 504 Disability Rule — Medical Equipment Accessibility Deadline July 8, 2026 (Distinct from the WCAG 2027 Track)

RegLantern published a compliance brief reminding FQHCs that the HHS Section 504 Final Rule includes obligations beyond the already-tracked May 11, 2027 WCAG 2.1AA web accessibility deadline: accessible medical diagnostic equipment (height-adjustable exam tables, accessible weight scales — phased compliance by July 8, 2026); value assessment prohibitions (cannot use QALY-based clinical decision-support tools that disadvantage disabled patients); and effective communication requirements (ASL interpreters, accessible written materials). The medical equipment piece is the underdiscussed half — most FQHC compliance officers have focused on the website deadline and may have missed the physical exam-equipment phase-in. Average accessible exam table runs $4-8K replacement cost × typical 8-15 exam rooms per FQHC = $50-120K per site capital exposure. CA FQHCs with multiple sites should budget now. OCR complaint risk rises post-deadline.

HHS OCR Reorganizes Into 3 Program Divisions — New Health Information Privacy, Data & Cybersecurity Division Signals Sustained FQHC Breach Enforcement

HHS announced May 18, 2026 that Office for Civil Rights is restructuring into three program-based divisions: (1) Conscience & Religious Freedom Division, (2) Civil Rights Division, and (3) Health Information Privacy, Data & Cybersecurity Division. The dedicated cyber/HIPAA division formalizes OCR's continued focus on breaches at FQHCs and safety-net providers — particularly in light of recent FQHC ransomware events (Sandhills Medical Foundation 169K class action May 3, Good Samaritan Atlanta 10K Feb 9, Community Health Action Staten Island 60K HIV records Feb 13). Pairs with OCR's Risk Analysis Initiative (now 12+ enforcement actions, lack of documented risk analysis is OCR's #1 enforcement target). Strategic implication for FQHC CISOs/Privacy Officers: (1) Documented HIPAA Security Rule risk analysis must be current and on file — a leading enforcement vector; (2) Ransomware tabletop exercise + IR plan refresh now an OCR audit-ready expectation; (3) Section 504 web accessibility deadline extended to May 11, 2027 (separate action — already tracked) does NOT relieve cyber posture; (4) Watch for new division leadership announcements and revised investigation priority list.

HRSA FY2025 340B Audit Results — 49% Adverse Findings, 75% OPAIS Errors, 50% Required to Repay Manufacturers

HRSA released full FY2025 340B program integrity audit results: 115 covered entities audited, 49% received adverse findings (improving from 64% in FY24 — still nearly 1 in 2). 75% of adverse-finding audits involved incorrect OPAIS records (master-data governance gap); 50% of adverse-finding entities required to repay manufacturers; 21% had site terminations. The 68% re-audit failure rate signals that remediation is sticking poorly. ~90% of FY2025 audits are now risk-targeted (vs. random), elevating exposure for entities with tips, OPAIS anomalies, contract-pharmacy complexity, or prior findings. Strategic implication: CA FQHCs running 340B contract pharmacy programs (often 30-50% of total revenue) face material exposure when OPAIS hygiene lapses. The 'risk-targeted' shift means CFOs can no longer treat HRSA audits as random — prior findings, tips (incl. disgruntled-employee complaints common in the current layoff climate), and contract pharmacy complexity are the trigger profile. 50% repayment rate × typical CA FQHC 340B program ($5-20M/yr) = 7-figure exposure for poorly governed programs. Pairs with already-tracked Lilly/Novo claims-data mandates and 4th Circuit contract pharmacy ruling.