Healthcare Law Update – October 2026

On August 4, 2026, the U.S. Attorney’s Office for the District of New Jersey announced that a New Jersey man was sentenced to 30 months in prison for conspiring to purchase nearly $50 million worth of prescription medications under false pretenses and resell them for profit.
For several years, the man worked as an operations manager for a New Jersey wholesale drug distributor. He pled guilty to conspiring with others, including multiple physicians, to “straw-purchase” medications through the physicians’ medical practices and then illegally transfer and resell the medications. In purchasing the medications, he and his co-conspirators made numerous false and misleading representations to pharmaceutical manufacturers and authorized distributors, including that the physicians were purchasing the medications to treat their own patients and that the medications would not be resold or redistributed. The drugs primarily consisted of cold-chain biologic infusion medications commonly used to treat cancer, macular degeneration, and autoimmune diseases. This individual is the third defendant who has been sentenced in connection with this fraudulent scheme, in addition to two doctors.

On July 31, 2026, Governor Mikie Sherrill announced $83 million in grants as part of the first round of funding under the State’s five-year Rural Health Transformation Program, a federally funded initiative intended to improve healthcare access and health outcomes in rural communities. The grants will support 103 projects addressing five areas: recruiting and retaining healthcare professionals; strengthening hospitals, primary care practices and other healthcare facilities; expanding health technology and innovative care models; improving prevention; and managing chronic diseases. New Jersey received more than $147 million from the Centers for Medicare & Medicaid Services for the program’s first year, although funding for the remaining four years has not yet been determined. Approximately one in ten New Jersey residents live in rural communities, which the State reports are more likely to experience healthcare workforce shortages and other healthcare access challenges.
For healthcare providers and other organizations serving rural communities, the grants may provide opportunities to expand services, invest in facilities and technology, and develop new approaches to delivering care. The New Jersey Department of Human Services will oversee the program, while the New Jersey Department of Health will administer approximately $95 million in competitive grant funding. The state received more than 200 applications across six grant categories for the first round, and additional funding opportunities are expected as the program continues.

On August 25, 2026, the Drug Enforcement Administration (DEA) submitted a long-awaited final rule governing the prescribing of controlled substances through telemedicine to the Office of Information and Regulatory Affairs within the White House Office of Management and Budget for review. The rule follows the DEA’s January 2025 proposed rule, which received more than 6,400 public comments, and is intended to establish a permanent framework for prescribing controlled substances through telemedicine. The 2025 proposal included a “special registration” process that would allow certain DEA-registered practitioners to prescribe controlled substances through telemedicine without first conducting an in-person examination. The proposal addressed medications used to treat opioid use disorder as well as other controlled substances, including medications commonly prescribed for attention-deficit/hyperactivity disorder. For healthcare providers and organizations that rely on telehealth, the pending rule could provide greater certainty regarding the long-term ability to prescribe controlled substances remotely.

On August 26, 2026, the U.S. Department of Justice announced that The Villages Health System LLC (TVH), a healthcare provider group based in The Villages, Florida, agreed to a $541.5 million settlement to resolve allegations under the False Claims Act involving inaccurate diagnosis codes submitted in connection with Medicare Advantage. According to the DOJ, from 2020 through 2024, TVH submitted diagnosis codes to Medicare Advantage Organizations (MAOs) that were not adequately supported by patients’ medical records or were based on untimely or unauthorized amendments to those records. The codes allegedly resulted in higher risk-adjusted payments from the Centers for Medicare & Medicaid Services (CMS) to the MAOs and, in turn, higher payments to TVH. The MAOs are separately returning overpayments to CMS through deletion of invalid codes and agreements with the DOJ and CMS.
The case is also notable because of the credit TVH received for its cooperation. TVH self-disclosed the potentially invalid diagnoses to the HHS Office of Inspector General in December 2024, took remedial steps, provided a detailed written disclosure, and cooperated throughout the government’s investigation. The DOJ specifically identified those actions as factors in resolving the matter.

On June 30, 2026, the New Jersey Assembly passed Assembly Bill A3434, which would create the New Jersey Dialysis Patient Support Person Accommodation Act. The Bill would require licensed dialysis centers to permit patients receiving dialysis treatment to be accompanied by a designated support person. A support person would need to be at least 18 years of age and selected by the patient. The support person would be able to assist the patient with communication, mobility, and decision-making to facilitate care and treatment, but would not be authorized to make decisions on behalf of the patient unless the person is the patient’s next of kin, guardian, or legally authorized decision-maker. Dialysis centers would be required to obtain written patient consent before disclosing protected health information to a support person.

August marked the 30th anniversary of HIPAA. While the rules have undergone some revisions since enactment and we are currently awaiting publication of further amendments to both the HIPAA Privacy Rule and HIPAA Security Rule, the impetus behind HIPAA remains intact: protecting patient health information and ensuring individuals are given timely access to their health information. To mark the anniversary, the Director of the U.S. Department of Health & Human Services, Office for Civil Rights, Paula Stannard, recorded a YouTube video in which she reflects on the past 30 years of HIPAA.

On August 27, 2026, the U.S. Department of Health & Human Services, Office for Civil Rights (OCR) announced a settlement resolving its investigation of Azul Vision, Inc. regarding allegations it failed to provide timely access to an individual’s health information within 30 days, as required by HIPAA. The settlement marks the 55th enforcement action in the OCR’s “Right of Access” initiative and demonstrates the OCR’s commitment to enforcing timely access to requested patient information and records.
On September 17, 2026, the OCR announced a settlement of its allegations against Ambry Genetics Corporation of HIPAA violations relating to a successful phishing attack affecting more than 225,000 individuals. Among OCR’s allegations were that the organization failed to conduct an accurate and thorough risk analysis as required by the HIPAA Security Rule, failed to implement procedures for terminating access to electronic protected health information (ePHI) upon employment termination, and failed to assign a unique name and/or number for identifying and tracking user identity in electronic systems housing ePHI.