Risk & Compliance in Federal

Section 1557 Language Access Annual Notice Year 1 Anniversary — July 5, 2026 Compliance Window

HHS Section 1557 Annual Notice of Availability (free language assistance services in English + 15 most common LEP languages in the state) has been in effect since July 5, 2025. Year 1 compliance review window approaching July 5, 2026. CA's 15 LEP languages include Spanish, Chinese, Vietnamese, Tagalog, Korean, Armenian, Russian, Persian, Arabic, Punjabi, Khmer, Hmong, Hindi, Japanese, Mon-Khmer. All FQHCs taking Medicare/Medi-Cal must have posted, distributed, and translated the Notice — pairs with the May 11, 2026 WCAG 2.1AA deadline as a compounding civil rights compliance window for FQHCs. Two HHS OCR rules with overlapping enforcement risk in the same 8-week window.

FTCA CY2027 redeeming applications due June 26 — miss it and your FQHC has a malpractice-coverage gap

HRSA Program Assistance Letter 2026-01 sets June 26, 2026 as the deadline for all currently-deemed health centers (and their sub-recipients) to submit CY2027 Federal Tort Claims Act redeeming applications — the annual filing that renews free federal medical-malpractice liability coverage. A lapse forces the center to buy private malpractice insurance to cover the gap for all of 2027. The risk is sharper this year because HRSA's EHB-to-GrantSolutions system migration is happening in the same window, making the deadline easier to miss. Compliance officers should confirm submission well before June 26.

Two Compliance Signals for FQHCs: HRSA's FY2026 340B Manufacturer-Audit Results Go Live, and OCR's Ransomware Settlements Preview a Tougher HIPAA Security Rule

Two federal compliance developments worth a calendar note. First, HRSA published its FY2026 340B Manufacturer Audit Results page (updated May 28, 2026) — the companion to the already-tracked FY2025 cycle (49% adverse findings); results are partially finalized, with corrective-action plans and any sanctions to be posted as HRSA approves them, and the agency advises covered entities not to contact audited manufacturers until CAPs post. FQHCs are the largest class of 340B covered entities, so this is a standing reference to monitor in OPAIS. Second, OCR's Risk Analysis Initiative has now completed 19 ransomware investigations with six 2026 settlements, and a June 1 Sidley analysis frames the recent settlements as a direct preview of the forthcoming HIPAA Security Rule amendments (which would make annual risk analyses, documented asset inventories, and demonstrated remediation mandatory rather than 'addressable'). No FQHC has been named, but FTCA-covered health centers are full HIPAA covered entities — meaning a center that hasn't completed a documented Security Risk Analysis is accumulating enforcement exposure ahead of a rule change, not just theoretical risk. (Affordable FQHC SRA tooling like Medcurity, added to our tech stack this cycle, exists precisely for this gap.)

Eli Lilly Gives ~50 Covered Entities Five Days to Hand Over 340B Claims Data — or Lose Their Discounts

On June 1, Eli Lilly escalated its 340B claims-data fight, warning roughly 50 covered entities that they have five days to submit comprehensive claims data or stop receiving 340B price breaks — the first time the manufacturer has issued outright termination threats rather than reminder letters. The demand follows Lilly's policy announced in January and effective Feb. 1, 2026, which requires claims-level data for all 340B dispenses (including in-house pharmacies, not just contract pharmacies); STAT reports more than 2,300 entities have complied while up to 1,000 larger systems have refused. The first round targets hospital systems, but the policy applies to all covered entities — FQHCs that dispense Lilly products (insulin, oncology, psychiatric drugs) and have not enrolled in the data platform face the same termination risk. With North Dakota's contract-pharmacy law struck down and other state shields in litigation, this is the manufacturer-side pressure on 340B savings that FQHC pharmacy directors must act on now.

Three health systems sue CVS/Caremark for ~$250M in alleged 340B savings diversion (RICO)

Mount Sinai, Michigan Medicine, and the University of Kansas Health System filed federal racketeering (RICO) suits on May 21, 2026 alleging CVS Health/Caremark secretly diverted roughly $250M in 340B program savings between 2020 and 2025 by paying covered entities artificially reduced reimbursement while concealing higher-rate claims. The cases target the contract-pharmacy and PBM machinery FQHCs depend on to convert 340B discounts into patient-care revenue. A win — or even discovery — could set precedent for FQHC 340B clawback claims and reshape contract-pharmacy economics just as manufacturer restrictions and the rebate-model fight already squeeze the program.

HHS Launches AERO — AI Re-Scores 5 Years of Audit Data for Every $1M+ Grantee, Including FQHCs

On May 21, 2026, HHS (Office of the Assistant Secretary for Financial Resources) launched AERO — the Audit Enforcement and Risk Oversight initiative — a department-wide program-integrity effort using next-generation AI tools (reportedly built in part with ChatGPT) to re-score at least five years of Single Audit Act compliance data for every entity receiving $1M+ in annual HHS funds. That threshold puts most Section 330 FQHCs squarely in scope. Initial findings: states and grantees have left serious internal-control issues unremedied for 3-5+ years, and hundreds of HHS grantees are late on required audits (some by 2+ years). Enforcement powers: temporarily withhold payments, hold back future funds, suspend or terminate awards, and pursue debarment. This is the operational teeth behind the Dec 2025 HHS AI Strategic Plan. Strategic implication for CA FQHCs: audit/compliance readiness just became materially higher-stakes — confirm Single Audit submissions are current, remediate any repeat findings now, and treat your audit-finding corrective-action history as a live enforcement risk. Pairs with the HRSA FY2025 340B audit results and the SocialRoots ComplAIance360 compliance-automation trend already tracked.

HRSA Section 504 Disability Rule — Medical Equipment Accessibility Deadline Aug 2026 (Distinct from WCAG Track)

RegLantern published a compliance brief reminding FQHCs that the HHS Section 504 Final Rule includes obligations beyond the already-tracked May 11, 2027 WCAG 2.1AA web accessibility deadline: accessible medical diagnostic equipment (height-adjustable exam tables, accessible weight scales — phased compliance by July 8, 2026); value assessment prohibitions (cannot use QALY-based clinical decision-support tools that disadvantage disabled patients); and effective communication requirements (ASL interpreters, accessible written materials). The medical equipment piece is the underdiscussed half — most FQHC compliance officers have focused on the website deadline and may have missed the physical exam-equipment phase-in. Average accessible exam table runs $4-8K replacement cost × typical 8-15 exam rooms per FQHC = $50-120K per site capital exposure. CA FQHCs with multiple sites should budget now. OCR complaint risk rises post-deadline.

HHS OCR Reorganizes Into 3 Program Divisions — New Health Information Privacy, Data & Cybersecurity Division Signals Sustained FQHC Breach Enforcement

HHS announced May 18, 2026 that Office for Civil Rights is restructuring into three program-based divisions: (1) Conscience & Religious Freedom Division, (2) Civil Rights Division, and (3) Health Information Privacy, Data & Cybersecurity Division. The dedicated cyber/HIPAA division formalizes OCR's continued focus on breaches at FQHCs and safety-net providers — particularly in light of recent FQHC ransomware events (Sandhills Medical Foundation 169K class action May 3, Good Samaritan Atlanta 10K Feb 9, Community Health Action Staten Island 60K HIV records Feb 13). Pairs with OCR's Risk Analysis Initiative (now 12+ enforcement actions, lack of documented risk analysis is OCR's #1 enforcement target). Strategic implication for FQHC CISOs/Privacy Officers: (1) Documented HIPAA Security Rule risk analysis must be current and on file — single biggest enforcement vector; (2) Ransomware tabletop exercise + IR plan refresh now an OCR audit-ready expectation; (3) Section 504 web accessibility deadline extended to May 11, 2027 (separate action — already tracked) does NOT relieve cyber posture; (4) Watch for new division leadership announcements and revised investigation priority list.

HRSA FY2025 340B Audit Results — 49% Adverse Findings, 75% OPAIS Errors, 50% Required to Repay Manufacturers

HRSA released full FY2025 340B program integrity audit results: 115 covered entities audited, 49% received adverse findings (improving from 64% in FY24 — still nearly 1 in 2). 75% of adverse-finding audits involved incorrect OPAIS records (master-data governance gap); 50% of adverse-finding entities required to repay manufacturers; 21% had site terminations. The 68% re-audit failure rate signals that remediation is sticking poorly. ~90% of FY2025 audits are now risk-targeted (vs. random), elevating exposure for entities with tips, OPAIS anomalies, contract-pharmacy complexity, or prior findings. Strategic implication: CA FQHCs running 340B contract pharmacy programs (often 30-50% of total revenue) face material exposure when OPAIS hygiene lapses. The 'risk-targeted' shift means CFOs can no longer treat HRSA audits as random — prior findings, tips (incl. disgruntled-employee complaints common in the current layoff climate), and contract pharmacy complexity are the trigger profile. 50% repayment rate × typical CA FQHC 340B program ($5-20M/yr) = 7-figure exposure for poorly governed programs. Pairs with already-tracked Lilly/Novo claims-data mandates and 4th Circuit contract pharmacy ruling.

CHAI (Co-Chaired by NACHC) Releases Responsible-AI Guides for Medicaid Eligibility — Ahead of the June 1 HHS Deadline

The Coalition for Health AI (CHAI) released two Best Practice Guides on May 11, 2026 for the responsible use of AI in Medicaid enrollment and eligibility adjudication — work co-chaired by NACHC alongside Centene, HealthTech 4 Medicaid, Pair Team, and 40+ organizations. The guides are timed ahead of the June 1, 2026 HHS guidance deadline and are built around H.R. 1's new community-engagement (work) requirements, which threaten to drop eligible patients during redetermination. They give states and providers role-based guardrails so AI-driven eligibility workflows don't inappropriately cut coverage. Strategic implication for FQHCs: the H.R. 1 redetermination wave is the single biggest threat to FQHC patient coverage — this framework helps FQHCs and their Medi-Cal managed-care partners prevent inappropriate, AI-accelerated coverage loss. NACHC's co-chair role signals FQHCs have a seat at the AI-governance table.

MAJOR PIVOT — HHS OCR Extends Section 504 / WCAG 2.1AA Deadline by One Year to May 11, 2027

On May 7, 2026 — four days before the original deadline — HHS Office for Civil Rights issued an Interim Final Rule extending the Section 504 digital accessibility compliance date by one year. FQHCs with 15+ employees now have until May 11, 2027 to make websites, mobile apps, patient portals, online scheduling, telehealth platforms, intake forms, and self-service kiosks WCAG 2.1 Level AA compliant. Recipients with fewer than 15 employees have until May 10, 2028. OCR cited concerns that FQHCs, hospitals, and primary care centers could not meet the original deadline. Comment period runs through July 6, 2026. CRITICAL: this is an extension, not a rescission — Section 504 has been enforceable since July 8, 2024, the private right of action remains active, and ADA-related healthcare litigation grew 11% YoY in 2025. FQHCs should use the 12-month runway to: (1) complete an accessibility audit, (2) publish accessibility statement + complaint intake procedure, (3) train front-desk staff, (4) document good-faith remediation milestones. For FQHCs that were sprinting to remediate, this is genuine relief; for those who deferred, the underlying obligation has not changed.

HHS Section 504 / WCAG 2.1AA Deadline 7 Days Away — DOJ Title II Extension Confirmed Not Mirrored by HHS

Today is May 4, 2026 — exactly 7 days from the May 11 HHS Section 504 enforcement date. Key clarification: legal advisories from Duane Morris (April 26) and Alston & Bird (March) confirm that the DOJ's April 20 Interim Final Rule extending Title II ADA web accessibility deadlines for state/local government agencies does NOT apply to HHS Section 504. Many FQHC executives have wrongly assumed the extension applied to them — it does not. The May 11 deadline holds. OCR enforcement focus: documented good-faith progress (not perfect WCAG 2.1 AA conformance). But Section 504 has been enforceable since July 8, 2024 — May 11 simply makes WCAG 2.1 AA the technical benchmark. Critical: private right of action begins May 12. ADA-related litigation against healthcare providers grew 11% year-over-year in 2025, much of it Section 504-based. Final-week priorities: confirm exam table + scale ≥10% of MDE accessibility (HRSA OSV will check this), publish accessibility statement, document remediation timeline, train front-desk staff on accessibility complaint intake.

Sandhills Medical Foundation Class Action Launched — 169K-Patient INC Ransom Breach First Major FQHC Ransomware Litigation of 2026

South Carolina FQHC Sandhills Medical Foundation (serving Chesterfield, Kershaw, Lancaster, Sumter Counties, SC — primary care, BH, immunizations) faces class action investigation announced May 3, 2026. INC Ransom ransomware group exfiltrated 169,017 patient records May 2-8, 2025; notification letters mailed April 28, 2026. Data included SSN, ITIN, DL#, passport#, financial info, PHI. CA FQHCs should note this is the largest FQHC ransomware breach reported in 2026 and sets a class-action precedent for safety-net providers — OCR investigation expected to follow given 169K exceeds the 500-patient OCR Breach Portal threshold. Pairs with Community Health Action Staten Island GENESIS ransomware (60K HIV testing records, Feb 13) and Good Samaritan Health Center Atlanta (10K, Feb 9) — three safety-net clinic ransomware breaches in Q1 2026 establish a clear pattern. Strategic implication for CA FQHC CISOs/Privacy Officers: (1) Cyber insurance limits and ransomware riders need re-audit against 2026 settlement floors; (2) Class action precedent in SC will inform NY/CA plaintiffs' bar appetite; (3) HHS OCR's new Health Information Privacy/Data & Cybersecurity Division (May 18) targets exactly this scenario.

HHS Section 504 / WCAG 2.1AA Deadline 9 Days Away — Final Sprint Week for Every CA FQHC With 15+ Employees

Today is May 2, 2026 — exactly 9 days from the May 11 HHS Section 504 enforcement date for digital accessibility (WCAG 2.1 Level AA). All FQHCs with 15+ employees must have remediated patient portals, public websites, mobile apps, online scheduling, telehealth platforms, intake forms, and self-service kiosks. The April 22 AHA News confirmation reiterated: the DOJ Title II web accessibility extension does NOT apply to HHS Section 504 — Section 504 enforcement window stays open. The April 22 Converge Accessibility 'Red Alert' speculated about regulatory contest, but no official rescission has occurred — assume the deadline holds. Final-sprint focus: confirm contrast ratios, alt text, keyboard navigation, ARIA roles, screen-reader compatibility, and accessibility statement publishing. Section 504 also provides a private right of action — even without OCR enforcement, lawsuits can begin May 12. Document remediation work and good-faith compliance posture even if 100% conformance is not yet complete.

Critical FQHC Compliance Fact: Eyeglasses Are NOT In HRSA Scope — Excluded from Sliding-Fee Mandate, NOT PPS-Encounter-Billable

Per HRSA Health Center Program Compliance FAQs and Compliance Manual Chapter 4: 'eyeglasses, hearing aids, and dentures' are explicitly excluded from in-scope services. Critical operational implications for FQHC vision programs: (1) Eyewear sales are NOT encounter-rate billable to PPS — only the OD exam visit is. (2) Eyeglasses are NOT subject to the HRSA sliding-fee discount mandate — FQHCs may set pricing flexibly. (3) HRSA grant funds CANNOT be used for eyewear inventory. (4) Optical dispensary is operationally a patient-experience amenity, not a PPS revenue line. The optometry exam itself is where the FQHC vision program makes its money — that's the PPS encounter for the visit. Many FQHC executives assume the PPS umbrella covers eyewear — it doesn't. This affects budgeting, pricing flexibility, and HRSA compliance reviews. NACHC notes vision is also non-mandatory under HRSA Section 330 — base grants cannot launch new vision lines, must come from expansion grants, 340B savings, or operating capital.

HRSA 340B Rebate Model ICR Burden Comment Window Closes April 27 — Second Window for FQHCs After April 20 Main Deadline

HRSA released a supplemental Information Collection Request (ICR) specifically on the administrative burden of the 340B Rebate Model Pilot Program. Comments on operational impact — pharmacy workflow, staff time costs, IT integration — are due April 27, 2026. This is a distinct window from the April 20 main rebate policy comment deadline. FQHCs that missed the April 20 deadline should use this second window to document pharmacy workflow and staff time cost impact. Burden comments can meaningfully shape the final rule's administrative mechanics.

OCR Settles 4 HIPAA Ransomware Cases — $1.165M Bundled Penalty, 427K Patients Exposed

On April 23, 2026, HHS Office for Civil Rights announced settlements with four healthcare entities (Regional Women's Health Group/Axia Women's Health, Assured Imaging, Consociate Health, and Star Group LP Health Benefits Plan) for HIPAA ransomware breaches affecting 427,000 patients. Total penalty: $1,165,000 + 2-year corrective action plans for each. Common root cause across all four: failure to conduct accurate Security Rule risk analysis. This is OCR's 19th ransomware investigation completed under its dedicated ransomware enforcement initiative, and the first time it bundled multiple settlements in a single press release — signaling a more aggressive, organized ransomware enforcement posture. Strategic implication for CA FQHCs: every FQHC running OCHIN Epic, eClinicalWorks, NextGen, or athenahealth is squarely in scope. Three protective actions are non-negotiable for FY26-27: (1) document a current Security Rule risk analysis (annual minimum), (2) inventory all Business Associate Agreements with PHI vendors, (3) confirm tested backup-restore procedures. Pairs with the May 11 Section 504 deadline as a one-two compliance hit — and arrives during the same week as the AltaMed cybersecurity incident class action investigation extends into May.

Section 504 / WCAG 2.1AA 'Red Alert' — Enforcement Interpretation May Be Contested in Final Weeks Before May 11

A Converge Accessibility 'Red Alert' published April 22 warns that HHS Section 504 Rule enforcement interpretation 'is in danger' of regulatory contest in the final weeks before the May 11, 2026 WCAG 2.1AA deadline. The underlying non-discrimination obligation has been in effect since July 8, 2024 — but the technical benchmark date is what enforcement hangs on. FQHCs with 15+ employees should NOT bet on a delay: remediate website/mobile accessibility now and document good-faith compliance in case enforcement posture shifts unfavorably mid-year.

HRSA 340B Rebate Pilot Comment Window Closes April 20 — AHA + NACHC File Opposition; Novartis Entresto Plan Active April 1

HRSA's 340B Rebate Model Pilot RFI comment period closed April 20, 2026 with thousands of comments filed — AHA and NACHC both filed formal opposition citing FQHC cash-flow risk. Separately, Novartis launched its Entresto rebate plan effective April 1, 2026 — the 10th drug-manufacturer rebate program implemented before the 4th Circuit's WV SB 325 ruling blocked further restrictions. Cash-flow impact: rebate model shifts FQHCs from upfront drug discount to retroactive reimbursement, requiring 30-90 days of working capital reserve to bridge. CA FQHCs heavily dependent on 340B revenue (AltaMed, FHCSD, San Ysidro, Vista, Asian Health Services) face material liquidity risk if rebate model returns post-rulemaking. HRSA must now reconcile comments before re-issuing.

DOJ Extends ADA Title II Web Accessibility 1 Year — But HHS Section 504 May 11 Deadline UNCHANGED

DOJ published an interim final rule April 20 extending ADA Title II web accessibility deadlines for state/local governments — to April 26, 2027 (50K+ population) and April 26, 2028 (under 50K). Critically, HHS did NOT match: the parallel HHS Section 504 rule still becomes enforceable May 11, 2026 (15 days). AHA News (April 22), Jackson Lewis, and Duane Morris all confirm HHS Section 504 deadlines 'remain unchanged.' Confusion risk: many FQHCs may incorrectly assume the DOJ extension applies to them — it does NOT. FQHCs are HHS-funded entities governed by Section 504, not Title II. Converge Accessibility published an April 22 'Red Alert' suggesting the HHS rule itself may be at risk of reconsideration, but legal advisors continue to recommend assuming the deadline holds.

HRSA Migrating Section 330 Grants From EHB to GrantSolutions — Operational Disruption Risk for All FQHCs

HRSA Bureau of Primary Health Care (BPHC) is migrating the core Section 330 grant lifecycle — submission, review, award, management — from the Electronic Handbook (EHB) to GrantSolutions throughout 2026. PAL 2025-05 documents the phased rollout. Affects every Section 330 grantee — SAC submissions, supplements, change-in-scope filings, post-award reporting, and progressive-action correspondence will all transition to new logins, templates, and workflows. Easy to miss until a deadline lapses. Strategic implication for FQHC operations and grants teams: (1) inventory which staff currently hold EHB credentials and assign GrantSolutions onboarding; (2) screenshot existing EHB submission templates before transition; (3) build a GrantSolutions credentialing checklist into the FY26-27 grants calendar; (4) test new system with a low-stakes filing before any high-stakes SAC or change-in-scope submission. CFO pairing point: parallel disruption with the May 14 May Revision means May–June operational bandwidth is at premium — frontload GrantSolutions onboarding now.

CMS V28 Risk Adjustment Model Fully Phased In 2026 — FQHCs in MA/ACO Contracts Face 10-20% Revenue Cliff Without Coding Upgrade

CMS's V28 risk adjustment model is fully phased in for 2026 — removing approximately 2,000 ICD-10 codes from HCC mapping. FQHCs participating in Medicare Advantage, ACO REACH, or APM contracts (including the new CA APM that went live January 2026) face 10-20% revenue decline if clinical documentation hasn't been retrained for V28-compliant coding. Audit risk if V24 codes still in active use. Compounds with the CA APM January 2026 go-live for global payments. Strategic implication: FQHCs running ECM, complex care management, or chronic disease populations need immediate V28 coding readiness assessment. Most FQHCs underperform on HCC capture vs. peer hospitals — the V28 transition widens that gap.

NCQA Issues Temporary Scoring Modifications to Health Equity Accreditation — REL/SOGI Data Requirements Paused

NCQA issued temporary scoring modifications in April 2026 (effective through June 30, 2026) to its Health Equity Accreditation program, narrowly focused on requirements organizations may struggle to meet under shifting federal policy on DEI programs and gender identity data. The modifications affect REL/SOGI demographic data collection, language services, and disparity-reduction requirements — all core CLAS-aligned standards. FQHCs pursuing or maintaining NCQA Health Equity Accreditation should review which scoring elements are paused and recalibrate compliance plans through June 30.

4th Circuit Rules for Pharma: Maryland's 340B Contract Pharmacy Access Law Vacated — State-Level Protections Weakened

The U.S. Court of Appeals for the Fourth Circuit vacated the lower court ruling that had upheld Maryland's 340B contract pharmacy access law, siding with AbbVie, Novartis, and AstraZeneca. The ruling weakens the state-law backstop strategy — where states pass their own 340B protections when federal enforcement stalls. A competing 5th Circuit ruling (upholding Mississippi's similar law) creates a circuit split that may push the issue to the Supreme Court. California FQHCs are protected by H.R. 7391 (340B FQHC Protection Act, 35 cosponsors) at the federal level, but this ruling signals pharma is winning in the courts against state-level protections nationally.

AbbVie Files Landmark Lawsuit to Narrow 340B 'Patient' Definition — Directly Targeting FQHC Contract Pharmacy Arrangements

AbbVie sued HRSA to challenge the 30-year-old 340B patient definition, proposing a four-part test requiring direct care connection, clinical encounter, active care management, and 12-month recency. AbbVie flagged Barrio Comprehensive Family Health Care Center (TX FQHC) — 340B purchases of Humira/Skyrizi/Rinvoq up 119% (2021-2022), 71% dispensed through out-of-state pharmacies. If successful, this would dramatically shrink FQHC 340B eligibility for contract pharmacy and telehealth prescribing. Post-Chevron (Loper Bright) makes this challenge viable for the first time.