Risk & Compliance

Section 1557 Language Access Annual Notice Year 1 Anniversary — July 5, 2026 Compliance Window

HHS Section 1557 Annual Notice of Availability (free language assistance services in English + 15 most common LEP languages in the state) has been in effect since July 5, 2025. Year 1 compliance review window approaching July 5, 2026. CA's 15 LEP languages include Spanish, Chinese, Vietnamese, Tagalog, Korean, Armenian, Russian, Persian, Arabic, Punjabi, Khmer, Hmong, Hindi, Japanese, Mon-Khmer. All FQHCs taking Medicare/Medi-Cal must have posted, distributed, and translated the Notice — pairs with the May 11, 2026 WCAG 2.1AA deadline as a compounding civil rights compliance window for FQHCs. Two HHS OCR rules with overlapping enforcement risk in the same 8-week window.

URGENT: HHS Section 504 WCAG 2.1 AA Digital Accessibility Deadline Hits FQHCs May 11, 2026 — 3 Weeks Away

HHS's first major update to Section 504 regulations in ~50 years imposes two hard deadlines for every FQHC with 15+ employees: (1) All web content and mobile apps must meet WCAG 2.1 Level AA by May 11, 2026 — covering screen reader compatibility, color contrast, keyboard navigation, form labeling. (2) At least one accessible exam table and one accessible weight scale must be in place by July 8, 2026. Non-compliance creates civil rights enforcement exposure and jeopardizes HRSA grant eligibility. Note: state/local governments received a DOJ extension to 2027 — FQHCs did NOT.

HRSA 340B Rebate Model ICR Burden Comment Window Closes April 27 — Second Window for FQHCs After April 20 Main Deadline

HRSA released a supplemental Information Collection Request (ICR) specifically on the administrative burden of the 340B Rebate Model Pilot Program. Comments on operational impact — pharmacy workflow, staff time costs, IT integration — are due April 27, 2026. This is a distinct window from the April 20 main rebate policy comment deadline. FQHCs that missed the April 20 deadline should use this second window to document pharmacy workflow and staff time cost impact. Burden comments can meaningfully shape the final rule's administrative mechanics.

Section 504 / WCAG 2.1AA 'Red Alert' — Enforcement Interpretation May Be Contested in Final Weeks Before May 11

A Converge Accessibility 'Red Alert' published April 22 warns that HHS Section 504 Rule enforcement interpretation 'is in danger' of regulatory contest in the final weeks before the May 11, 2026 WCAG 2.1AA deadline. The underlying non-discrimination obligation has been in effect since July 8, 2024 — but the technical benchmark date is what enforcement hangs on. FQHCs with 15+ employees should NOT bet on a delay: remediate website/mobile accessibility now and document good-faith compliance in case enforcement posture shifts unfavorably mid-year.

DOJ Extends ADA Title II Web Accessibility 1 Year — But HHS Section 504 May 11 Deadline UNCHANGED

DOJ published an interim final rule April 20 extending ADA Title II web accessibility deadlines for state/local governments — to April 26, 2027 (50K+ population) and April 26, 2028 (under 50K). Critically, HHS did NOT match: the parallel HHS Section 504 rule still becomes enforceable May 11, 2026 (15 days). AHA News (April 22), Jackson Lewis, and Duane Morris all confirm HHS Section 504 deadlines 'remain unchanged.' Confusion risk: many FQHCs may incorrectly assume the DOJ extension applies to them — it does NOT. FQHCs are HHS-funded entities governed by Section 504, not Title II. Converge Accessibility published an April 22 'Red Alert' suggesting the HHS rule itself may be at risk of reconsideration, but legal advisors continue to recommend assuming the deadline holds.

NCQA Issues Temporary Scoring Modifications to Health Equity Accreditation — REL/SOGI Data Requirements Paused

NCQA issued temporary scoring modifications in April 2026 (effective through June 30, 2026) to its Health Equity Accreditation program, narrowly focused on requirements organizations may struggle to meet under shifting federal policy on DEI programs and gender identity data. The modifications affect REL/SOGI demographic data collection, language services, and disparity-reduction requirements — all core CLAS-aligned standards. FQHCs pursuing or maintaining NCQA Health Equity Accreditation should review which scoring elements are paused and recalibrate compliance plans through June 30.

4th Circuit Rules for Pharma: Maryland's 340B Contract Pharmacy Access Law Vacated — State-Level Protections Weakened

The U.S. Court of Appeals for the Fourth Circuit vacated the lower court ruling that had upheld Maryland's 340B contract pharmacy access law, siding with AbbVie, Novartis, and AstraZeneca. The ruling weakens the state-law backstop strategy — where states pass their own 340B protections when federal enforcement stalls. A competing 5th Circuit ruling (upholding Mississippi's similar law) creates a circuit split that may push the issue to the Supreme Court. California FQHCs are protected by H.R. 7391 (340B FQHC Protection Act, 35 cosponsors) at the federal level, but this ruling signals pharma is winning in the courts against state-level protections nationally.

AbbVie Files Landmark Lawsuit to Narrow 340B 'Patient' Definition — Directly Targeting FQHC Contract Pharmacy Arrangements

AbbVie sued HRSA to challenge the 30-year-old 340B patient definition, proposing a four-part test requiring direct care connection, clinical encounter, active care management, and 12-month recency. AbbVie flagged Barrio Comprehensive Family Health Care Center (TX FQHC) — 340B purchases of Humira/Skyrizi/Rinvoq up 119% (2021-2022), 71% dispensed through out-of-state pharmacies. If successful, this would dramatically shrink FQHC 340B eligibility for contract pharmacy and telehealth prescribing. Post-Chevron (Loper Bright) makes this challenge viable for the first time.

California's Largest-Ever Medi-Cal Hospice Fraud Takedown — $267M State + $50M Federal Indictments Signal Enforcement Posture Shift

California DHCS and DOJ announced the largest-ever Medi-Cal hospice fraud takedown: 14 fraudulent hospice providers, $267M in improper claims, plus a parallel US Attorney (Central District) federal indictment of 8 defendants for $50M. No FQHCs named, but the signal matters: transnational criminal networks used stolen patient identities to enroll people in Medi-Cal — meaning FQHCs may see duplicate/fraudulent enrollees that trigger downstream eligibility disputes. DHCS is now investigating 300+ hospices. The House Oversight Committee has demanded documents from Gov. Newsom on hospice oversight. FQHCs should expect heightened DHCS audit activity and re-verify Medi-Cal eligibility at the point of service for 2026.

California AG Dismantles $267M LA Hospice Fraud Ring — 21 Charged; DHCS Signals Intensified Audit Activity for All Medi-Cal Providers

California AG and DHCS dismantled a transnational fraud ring operating 14 fraudulent hospice providers in LA that used stolen Medi-Cal identities to bill $267M in false claims, with 21 charged and $70M+ recovered. While unrelated to FQHCs, this action is fueling federal scrutiny of all California Medi-Cal providers and signals DHCS will intensify audit and identity verification requirements — legitimate FQHCs should expect tighter claims review on crossover claims and dual-eligible billing.

DOJ Launches National Healthcare Fraud Enforcement Division — FQHC PPS Billing, Incident-To, and Telehealth Documentation Now Higher-Risk Audit Targets

The Department of Justice announced a new National Healthcare Fraud Enforcement Division consolidating FBI, OIG, and DEA healthcare fraud resources under a single coordinated unit. The announcement follows DOJ's record $6.8B False Claims Act recovery in FY2025. For FQHCs, the division signals intensified scrutiny on PPS visit documentation, incident-to billing, and telehealth documentation completeness — three areas with common compliance gaps in community health settings. The timing coincides with reduced HRSA oversight staffing, creating a 'compliance paradox' where federal enforcement is scaling up while federal technical assistance is scaling down.

DOJ Federal Hospice Fraud Takedown: 8 Arrests, $50M Alleged Billing — Medi-Cal Enforcement Intensifies

U.S. Attorney's Office (Central District of California) announced an April 2 takedown — 8 defendants arrested for $50M in fraudulent hospice billing using stolen identities to enroll in Medi-Cal. Coordinated DHCS + DMFEA + federal action. State enhanced identity verification and multifactor authentication for Medi-Cal applicants in 2026. Over 300 hospices currently under DHCS investigation for license revocation. While hospice-specific, signals stepped-up Medi-Cal billing scrutiny across all enrolled providers — FQHCs should review identity verification, beneficiary attestation, and billing documentation.

HRSA Being Absorbed into New 'Administration for a Healthy America' — 25% of Staff Already Departed

HRSA is being merged into the new Administration for a Healthy America (AHA) alongside SAMHSA, ATSDR, and NIOSH. Approximately 700+ employees (25% of staff) have departed since February, including grant managers, auditors, and compliance analysts. The FY2026 budget proposes eliminating HRSA as a standalone agency. This directly impacts OSV scheduling, 340B audits, and Health Center Program compliance oversight. FQHCs may face delayed operational site visits, slower conditions-of-award processing, and reduced technical assistance.

Eli Lilly + Novo Nordisk 340B Claims-Data Mandates Now Live — FQHCs Must Submit Within 45 Days or Risk Losing 340B Access

Eli Lilly (effective February 1) and Novo Nordisk (effective April 1) both implemented policies requiring all 340B covered entities, including FQHCs, to submit claims-level data for every drug dispense within 45 days or risk losing 340B access. The AHA has urged HRSA to use civil monetary penalties to halt both policies, but HRSA has not acted. FQHCs with high GLP-1/diabetes (Mounjaro, Trulicity, Ozempic, Fiasp) and insulin utilization face the greatest immediate risk. This is a separate compliance burden from the rebate model pilot fight.

4th Circuit Blocks West Virginia's 340B Contract Pharmacy Law — First Federal Appeals Win for Drugmakers, Deepens Circuit Split, Weakens CA AB 1460 Path

The U.S. Court of Appeals for the Fourth Circuit upheld a preliminary injunction blocking West Virginia's SB 325, which sought to prohibit manufacturers from restricting 340B contract pharmacy access and require claims/utilization data sharing. The court found the law likely preempted because it 'impermissibly rewrites the bargain Congress struck with manufacturers.' This is the first federal appeals court win for drugmakers on state 340B contract pharmacy laws — and it deepens a circuit split with the 5th (LA) and 8th (AR) Circuits, which upheld similar state laws. AHA, WV Hospital Association, 340B Health, and ASHP petitioned for en banc review on April 17, 2026. The ruling materially weakens the legal footing of California AB 1460 and Washington SB 5981, both of which mirror WV SB 325's approach.

Ninth Circuit Opens Door to FCA Liability for 340B Overcharges — New Legal Pathway for FQHCs

The Ninth Circuit unanimously reversed a dismissal in United States ex rel. Adventist Health System v. AbbVie, ruling that qui tam False Claims Act suits can proceed against pharmaceutical manufacturers that allegedly overcharge 340B covered entities above the statutory ceiling price. This creates a new private enforcement mechanism — previously only HRSA could enforce 340B ceiling price compliance. FQHCs can now pursue treble damages against manufacturers overcharging on 340B drugs.

HRSA Expands FY2026 340B Audit Scope with 'Furnished' Language Change

HRSA's updated Data Request List for FY2026 340B audits now includes 'furnished' alongside 'administered or dispensed,' broadening how covered entities must document drug transactions. Additional changes indicate increased scrutiny on locations receiving 340B-priced drugs and demonstration of covered entity ownership. FQHCs should update internal documentation and audit preparation procedures.

La Clínica de La Raza Reports Data Breach Affecting Patient Records

La Clínica de La Raza, one of the Bay Area's largest FQHCs serving 90,000+ patients across Alameda, Contra Costa, and Solano Counties, disclosed a data breach involving unauthorized access to patient health records. The breach was discovered in late February and reported to HHS. La Clínica is offering credit monitoring to affected patients. The incident highlights the growing cybersecurity threat to FQHCs — 73% of health centers reported a cyber incident in the past 2 years per NACHC surveys.

HRSA Accelerates Operational Site Visits: 30% More FQHCs Audited in FY2026

HRSA's Bureau of Primary Health Care has increased OSV frequency, with 30% more site visits scheduled in FY2026 compared to FY2025. Focus areas include governance documentation (42 CFR 330.304), sliding fee compliance, and clinical quality reporting. FQHCs with incomplete board policies or missing conflict-of-interest disclosures face progressive compliance actions including conditions of award and potential scope reductions.

HHS OCR Settles with Dental Software Company MMG Fusion — 15M PHI Records Exposed; FQHCs Using This Software Must Verify BAAs

HHS OCR settled with MMG Fusion LLC (dental practice management software) for an impermissible disclosure of PHI affecting approximately 15 million individuals — OCR's 11th enforcement action under its Security Risk Analysis Initiative. Penalty: $10,000 + 3-year corrective action plan. Any FQHC using MMG Fusion must verify its BAA and reassess vendor risk. OCR's SRA Initiative is now 12+ enforcement actions in: organizations without documented annual security risk analyses face real enforcement risk.

Federal Court Overturns HRSA 340B Child Site Registration Requirement — Expands Satellite Location Purchasing

A federal district court vacated HRSA's requirement that off-site facilities (child sites) must appear on a hospital's Medicare cost report and be registered in OPAIS before purchasing drugs at 340B prices. This effectively restores flexibilities that existed during the pandemic era, potentially expanding 340B purchasing eligibility for FQHCs with satellite locations or off-site services. The ruling is part of a broader wave of judicial pushback against HRSA 340B program administration in early 2026.

Federal Court Overturns HRSA 340B Child Site Registration Requirement

A federal district court vacated HRSA's requirement that off-site facilities (child sites) must appear on a hospital's Medicare cost report and be registered in OPAIS before purchasing drugs at 340B prices. This effectively returns pandemic-era flexibilities and may expand 340B purchasing eligibility for FQHCs with satellite locations.

HRSA Expands FY2026 340B Audit Scope — New 'Furnished' Language Signals Broader Scrutiny of Drug Transactions

HRSA's updated Data Request List (DRL) for FY2026 340B audits now includes the word 'furnished' alongside 'administered or dispensed,' broadening the scope of how covered entities must document drug transactions. Additional changes indicate increased scrutiny on locations receiving 340B-priced drugs and demonstration of covered entity ownership for applicable locations (e.g., CE-owned pharmacies). FQHCs participating in the 340B program should update internal documentation and audit preparation procedures to reflect the expanded language.

OCR Settles $1.5M HIPAA Breach Case with Community Health Network

HHS Office for Civil Rights reached a $1.5M settlement with a multi-site community health center for a breach affecting 28,000 patient records. Root cause: unencrypted email containing PHI sent to third-party vendor without a current Business Associate Agreement. Settlement requires 3-year corrective action plan including annual risk assessments, workforce training, and BAA remediation. Pattern consistent with FQHCs that lack formalized HIPAA compliance programs.

DHCS Files Formal H.R. 1 Implementation Plan with California Senate — Authoritative Timeline for All Medi-Cal Changes

DHCS filed a formal implementation plan with the California Senate Budget and Fiscal Review Committee detailing how California will implement H.R. 1's Medicaid provisions. The document lays out the exact timeline: asset test reinstatement (Jan 2026), enrollment freeze (Jan 2026), dental benefit elimination for undocumented adults (July 2026), 6-month redetermination cycles (Dec 2026), work requirements (Jan 2027), and copayment implementation (Oct 2028). This is the authoritative state-level planning document FQHCs need for operational preparation.