Risk & Compliance

KFF brief says states may lean on providers to prove medical frailty

On October 22, 2026, KFF published a brief comparing how SNAP and Medicaid check ability to work. From January 2028, states may accept a person’s own statement of frailty only once during an enrollment period. KFF says states may need provider confirmation when claims data is missing, and the rule gives little detail on what to collect.

Justice Department and HHS open a civil False Claims Act self-disclosure pilot

On October 22, 2026, the Justice Department’s Civil Division and HHS launched a six-month False Claims Act self-disclosure pilot for healthcare companies. Companies repay with a 1.25 to 1.6 multiplier and get a civil release, and submissions are accepted through April 22, 2027. The release names no health centers.

Three Democratic senators ask CMS for tougher standards on Medicaid eligibility contractors

On October 20, 2026, three Democratic senators asked CMS to set mandatory standards for Medicaid eligibility system contractors, as KFF Health News reported. They warn that work requirements and eligibility checks every six months will land on systems with a history of errors. They also want CMS to publish contracts and performance data.

HRSA sends revised health center forms to OMB, comments due November 19

On October 20, 2026, HRSA sent the revised Health Center Program forms package to OMB for review. Comments are due November 19, 2026. HRSA reports no public comments on its 60-day notice and says the changes cut the yearly reporting burden by 1,621 hours.

DOJ and HHS-OIG set one door for criminal fraud self-disclosure

On October 15, 2026, the Justice Department's Fraud Division and HHS-OIG issued a joint policy. A company that reports possible criminal health care fraud to the Fraud Division's Health Care Fraud Section also gets the benefits of the OIG Self-Disclosure Protocol. A report made only to OIG generally will not earn a declination. The release names no health centers.

State Auditor flags DHCS oversight of Medi-Cal provider payments

On October 15, 2026, the State Auditor found the Department of Health Care Services at substantial risk of inappropriate Medi-Cal provider payments. The department had not investigated 26,000 providers ranked in the top 10 percent for risk. They billed at least $12 billion in 2024-25. The report names no health centers and makes no recommendations.

HHS gives CMS power to exclude providers from federal health programs

On October 14, 2026, HHS gave the CMS Administrator its permissive exclusion authority under section 1128(b) of the Social Security Act, effective immediately. Until now that power sat with the HHS Inspector General, who keeps it. CMS cannot hold hearings or write rules under it. No FQHC is named.

HRSA moves to collect NPIs and CMS certification numbers from grant applicants

On October 9, 2026, HRSA sent OMB a new Grants.gov form asking funding applicants for their organizational NPIs and CMS Certification Numbers. HRSA says this will link its awards to CMS claims and cost-report data, including for FQHCs, and help find duplicate funding. Organizations without these numbers can still apply. Comments are due November 9.

CMS telehealth FAQ says FQHCs may bill non-behavioral telehealth through 2027

On October 8, 2026, CMS updated its Medicare Telehealth FAQ. Through December 31, 2027, FQHCs and rural health clinics may keep billing non-behavioral telehealth, using individual codes instead of G2025. For behavioral visits where the patient is present virtually, in-person visit requirements do not apply until at least January 1, 2028.

AIDS Healthcare Foundation pays $1.44 million over Medicare Advantage coding

On October 6, 2026, the Justice Department said Los Angeles-based AIDS Healthcare Foundation will pay $1.44 million to settle False Claims Act allegations. DOJ alleged its Medicare Advantage plans were slow to delete unsupported diagnosis codes in 2017–2023 and made no finding of liability. Health centers in risk contracts can check that unsupported codes come out within 60 days.

Medicare FQHC telehealth claims now need individual codes instead of G2025

For dates of service from October 1, 2026, CMS requires FQHCs and rural health clinics to bill the individual CPT or HCPCS code for each distant-site telehealth service instead of G2025. Each claim needs a revenue code and modifier 93 for audio-only or 95 for video, and health centers can keep serving as distant sites until January 1, 2028.

CMS opens its Medicare Part D 340B claims repository to covered entities

CMS opened its Medicare Part D 340B claims repository on October 1, 2026, for voluntary submissions from covered entities or their administrators. Part D 340B claims from January 1 to September 30, 2026 are due December 31, 2026, then each quarter within three months. Health centers can ask their 340B administrator whether it will submit for them.

HHS civil rights office says when states can use substance use records

On September 29, 2026, the HHS Office for Civil Rights explained when 42 CFR Part 2 lets state Medicaid agencies use substance use disorder records. States may use them to verify who is excluded from the 80-hour monthly work requirement, such as people in certain treatment programs. Health centers with Part 2 programs can read the FAQ now.

DHCS withholds funds from four county behavioral health plans

On September 28, 2026, DHCS issued final notices of temporary withholds to the behavioral health plans of Merced, San Francisco, Santa Clara and Shasta counties. The plans missed timely-access and network-adequacy standards two years running. Six other counties fixed their findings and avoid withholds. Funds are released once the four show compliance. No health center is named.

CMS and 37 states pledge to judge Medicaid by health outcomes

On September 25, 2026, CMS launched Investing in Health Outcomes, with 37 states signing a voluntary Medicaid Quality Pledge. A May 2026 CMS review found about 450 reporting requirements covering roughly 260 quality measures in managed care. States will use the pledge to set outcome targets in quality strategies and upcoming procurements.

Geiger Gibson review finds health centers expect a heavy work-rule frailty burden

On September 24, 2026, GW's Geiger Gibson Program published a review of more than 120 public comments on CMS's Medicaid community-engagement rule. Commenters said documenting medical frailty pulls clinician time from patient care. They also said health centers will carry much of the cost as patients lose coverage and uncompensated care grows.

CMS seeks input on Part D pharmacy contract terms, including 340B claims

On September 24, 2026, CMS asked for input on the standard contract terms Part D plans must offer any qualifying pharmacy starting in plan year 2029. Comments are due November 23, 2026, and CMS asks how plans handle contract terms and claims for 340B patients.

Texas federal court vacates six parts of HHS’s Section 504 disability rule

On September 23, 2026, a Texas federal court vacated parts of HHS’s 2024 Section 504 disability rule. The order lists six provisions, including the definition of “most integrated setting,” and decides no other claims. The parties jointly asked for the judgment, and the order names no health centers.

CMS pauses new agent and broker registration in federal marketplaces

On September 23, 2026, CMS published an interim final rule pausing registration of agents and brokers without 2026 agreements in the federally facilitated marketplaces for plan year 2027. The pause runs to February 1, 2027 unless CMS changes it. Comments are due November 21, 2026.

CMS cancels Marketplace coverage for more than 760,000 people

CMS said on September 22, 2026 that it canceled about 315,000 federal Marketplace enrollments covering more than 760,000 people as unauthorized. The cancellations took effect August 31, and CMS expects about $2.2 billion in subsidies returned. Health centers in HealthCare.gov states can check patients' coverage at the next visit and help them reapply.

Justice Department limits False Claims Act cases built on agency guidance

The Justice Department revised its Justice Manual on September 18, 2026, so False Claims Act cases rest only on binding statutes, regulations or contracts. The change revives a 2017 policy and tells its lawyers to weigh dismissing whistleblower suits the department declines to join. Health center compliance teams can map which duties come from law and which from guidance.

Aesto vendor breach reaches two more health centers in NC and Maine

Breach letters posted by Massachusetts regulators on September 18 and 25, 2026 show the Aesto data-archiving breach reached Ocracoke Health Center in North Carolina and Health Access Network in Maine. Neither appears on Aesto's own list of affected clients, last updated September 8. Any health center that used Aesto to archive an old EHR should ask the vendor directly.

HHS civil rights office settles phishing breach case for $700,000

On September 17, 2026, the HHS Office for Civil Rights settled with Ambry Genetics over a 2020 phishing attack that exposed data on 225,370 people. Ambry paid $700,000 and accepted two years of monitoring over gaps in risk analysis, access removal and unique user logins. OCR urged every health care provider to keep its risk analysis current.

DHCS mails Medi-Cal work rule letters and adds them to applications

DHCS told counties on September 11, 2026 that it began mailing work and six-month renewal notices to New Adult Group members in late August. Counties must add the letter to application packets from October 1 through December 31, 2026. The member letter says the rules take effect in March 2027, and health center enrollment staff can expect questions.

Open Door stops starting puberty blockers and hormone therapy for under-19 patients

Open Door Community Health Centers CEO Tory Starr said in a September 10, 2026 letter that the health center will no longer start hormone therapy or puberty blockers for patients under 19. It cites revised HHS grant terms and says continuing could endanger resources that support care for more than 60,000 patients. Patients already in treatment keep their care.