This post was co-authored by Aarathi Kallur, Legal Intern in Robinson+Cole’s Health Law Group. Aarathi is not permitted to practice law.

On October 13, the American Medical Association (AMA) released a governance framework for the use of agentic artificial intelligence (AI) that performs clinical functions in health care. The framework rests on a central principle: “[C]linical authority should be earned through evidence and maintained through demonstrated performance. Authority and oversight can evolve as evidence, performance, risk or the technology itself changes.” The AMA guidance is not binding on any health care providers, though it may provide a useful template as health care providers increasingly seek to implement agentic AI in their clinical practices.

The AMA’s framework outlines four topics and related questions for health care providers to ask while implementing agentic AI in clinical practice. The AMA’s framework and recommendations are summarized as follows:

  1. Function: What Clinical Function Does the AI Perform?
    The AMA suggests that clinicians should identify the AI’s task, intended use, patient population, and clinical setting. Functions may include documenting, monitoring, triaging, providing care recommendations, and diagnosing.
  1. Evidence and Risk: What Shows that the AI Can Perform the Function, and What Happens if it Fails?
    The AMA recommends that clinicians should evaluate the AI’s performance, safety, clinical benefit, population fit, and uncertainty. The rigor of that review should reflect the potential consequences of the AI’s failure.
  1. Authority and Oversight: What May the AI Do, and Under What Conditions?
    Under the AMA framework, providers should define the AI’s permitted scope of action and the human or institutional oversight required for its safe use.
  1. Accountability: Who Is Responsible for the AI’s Risks and Outcomes?
    Importantly, the AMA framework directs providers to assign accountability based on each participant’s authority, control, knowledge of the risks, and ability to prevent or mitigate harm.

The AMA recommends that steps 2 and 3 be frequently reviewed and refined through monitoring and reassessment. 

The framework follows the AMA’s creation of the Center for Digital Health and AI, which seeks to help physicians shape how AI is developed, implemented, and regulated. That work has become more urgent as claims about AI’s clinical capabilities grow. The AMA’s agentic AI framework offers a practical standard to assist clinicians in adopting agentic AI together with appropriate planning, oversight, and clear accountability.

New policy offers companies single-disclosure path to seek the benefits of both DOJ’s criminal corporate enforcement policy and HHS-OIG’s Self-Disclosure Protocol; appropriate path depends on whether conduct may be criminal. Separately, DOJ announced the Fraud Whistleblower Incentive Program, which offers expedited payments of up to $30,000 for information that leads to criminal charges in specified areas.

This post is co-authored with Government Enforcement + White-Collar Defense team members Edward Heath, Seth Orkand and Victor R. Salgado.

On October 15, 2026, the U.S. Department of Justice’s National Fraud Enforcement Division (“Fraud Division”) and the Office of Inspector General for the U.S. Department of Health and Human Services (HHS-OIG) announced a joint policy for coordinating voluntary self-disclosures involving potential criminal healthcare fraud, and HHS-OIG released a revised Health Care Fraud Self-Disclosure Protocol (SDP) to conform to the DOJ policy.

The policy is intended to help companies navigate voluntary disclosures involving possible misconduct that could lead to overlapping criminal, civil, and administrative actions. Under the new policy, a company that makes a qualifying disclosure of potential criminal conduct to the Fraud Division’s Health Care Fraud Section may receive the benefits of both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s SDP without submitting a separate disclosure under the SDP.

More broadly, the policy underscores the growing importance of the recently established Fraud Division and the consolidation of criminal enforcement authority within it. The announcement builds on the Fraud Division’s earlier guidance regarding its enforcement priorities, corporate enforcement policy, and approach to investigating, disrupting, and prosecuting fraud.

Separately, on October 20, 2026, the Fraud Division launched the Fraud Whistleblower Incentive Program. The program offers discretionary awards of $10,000 to $30,000 for original information leading to criminal healthcare charges and fraud involving programs and benefits administered by certain federal agencies. Because DOJ may pay an award as soon as charges are filed, whistleblowers could receive money sooner than they would under many other government reward programs. Receiving an award under this program generally does not prevent a whistleblower from seeking an award through another program, so a whistleblower may be able to receive an earlier payment without waiving the possibility of receiving a larger recovery later.

Choosing the Appropriate Disclosure Channel

Potential criminal conduct. Under the new policy, a company seeking the benefits of both DOJ’s CEP and HHS-OIG’s SDP first discloses potentially criminal healthcare conduct to DOJ’s Health Care Fraud Section. DOJ will notify HHS-OIG, so the company need not make a separate HHS-OIG submission to seek SDP benefits. By contrast, a disclosure made only to HHS-OIG generally will not qualify as a voluntary self-disclosure under the CEP or satisfy the CEP’s requirements for a full declination. DOJ may still consider, however, a disclosure to HHS-OIG as evidence of cooperation or remediation.

The coordinated policy applies to qualifying disclosures made to the Fraud Division on or after the policy’s effective date, October 15, 2026, that involve potential federal crimes affecting one or more federal health care programs. Because the joint policy focuses on companies, it cannot be assumed that its coordinated benefits or the CEP’s treatment automatically extends to individuals.

Potential civil or administrative matters. HHS-OIG’s revised SDP does not cover federal crimes, which should be disclosed to DOJ. The SDP remains available to providers, suppliers, and others who remain subject to HHS-OIG’s civil monetary penalty (“CMP”) authority and who reasonably believe that their conduct may have violated federal law. It is not intended for simple overpayments or errors that do not involve a federal law violation, which are to be reported through the appropriate Centers for Medicare & Medicaid Services channel or another applicable refund process. Nor is the SDP the right path to disclose arrangements that may violate exclusively the physician self-referral law or for conduct covered by HHS-OIG’s Grant Self-Disclosure Program or Contractor Self-Disclosure Program.

Practical Steps for Companies and Individuals

  • Assess the conduct promptly. Determine at the outset whether the facts indicate potential criminal conduct, possible CMP liability, or some other violation of federal law. Companies may want to involve legal counsel early to assess the facts and, where appropriate, conduct an investigation in a manner designed to protect attorney-client privileged communications before deciding whether, when, and to whom to disclose.
  • Preserve evidence, stop ongoing conduct, and prepare for a full investigation. Take immediate corrective and mitigating actions. In criminal matters, DOJ emphasizes prompt disclosure to protect program funds, patients, consumers, and investors and to prevent evidence concerning culpable individuals from becoming stale. HHS-OIG similarly expects misconduct to have ended. For an improper kickback arrangement, corrective action must be taken and the arrangement terminated within 90 days after the SDP submission. HHS-OIG also requires the disclosing party to complete its internal investigation and damages calculation within 90 days after the initial submission.
  • Strengthen compliance, detection, and escalation mechanisms. Maintain effective controls for identifying potential misconduct early, including a well-publicized hotline and other confidential reporting channels, risk-based auditing and monitoring, and clear procedures for escalating concerns to compliance, legal, and senior leadership. Companies may want to also protect internal reporters from retaliation, document how concerns are investigated and resolved, and periodically test whether these mechanisms are working as intended.
  • Assess individual exposure separately. The joint policy’s single-disclosure mechanism benefits companies—not individuals—and does not provide individual immunity from prosecution. Individuals who may have been involved in potential criminal conduct can retain separate legal counsel and independently assess their exposure. Do not assume that a company’s disclosure, cooperation credit, or full or partial declination under the CEP will protect them individually from investigation or prosecution.

Bottom line: DOJ’s Fraud Division is now the first stop for a company seeking coordinated resolution of potentially criminal health care misconduct. The SDP remains a separate path for eligible civil or administrative CMP matters. Whatever the nature of the conduct, companies may want to retain experienced counsel and act quickly to investigate, stop ongoing misconduct, preserve evidence, and take corrective measures.

This post was co-authored by Aarathi Kallur, Legal Intern in Robinson+Cole’s Health Law Group.

On October 5, 2026, the Federal Trade Commission (FTC) Chairman sent a warning letter to 24 of the country’s largest health care organizations, and published an anonymized version of the letter, reminding the organizations of their ongoing obligation to “provide patients with timely, accurate, and complete pricing” information related to the receipt of health care services.

The FTC letter warns that (1) it is closely scrutinizing the practices of healthcare organizations with respect to price transparency, and (2) compliance with Centers for Medicare and Medicaid Services (CMS) price transparency rules does not “provide a safe harbor from liability” under Section 5 of the Federal Trade Commission Act. The letter particularly identifies pricing practices for “non-emergency services” scheduled in advance as an area of FTC focus.

In the letter, the FTC reiterates its authority to regulate alleged deceptive, unfair and anticompetitive business practices in health care under Section 5 of the FTC Act, and references its establishment of a Healthcare Task Force earlier in 2026. The FTC acknowledges the price transparency requirements enacted by CMS starting in 2021, as well as regulations and processes established by CMS under the No Surprises Act intended to protect patients and other consumers from surprise medical bills. The FTC takes the position that the CMS price transparency rules establish a “regulatory floor” and that compliance with CMS requirements does not necessarily mean that an organization meets its obligations under Section 5 of the FTC Act. The letter states that “the price of healthcare services is a material term” under the FTC Act, and “clear and conspicuous disclosures” of pricing terms are necessary to prevent deception of consumers. The letter related warns that even where pricing terms are disclosed, they may still be deceptive if incomplete, “such as when they omit certain charges like physician fees or facility fees…” The letter continues to explain that incomplete or inaccurate pricing is also unfair to consumers where it causes or is likely to cause substantial injury to consumers, and may occur where patients are unable to compare pricing between providers and make informed decisions.

The FTC concludes the letter by encouraging all health care organizations to “conduct a comprehensive review of” pricing practices to ensure patients and the public are provided with timely, accurate, and complete pricing for services, particularly those that can be scheduled in advance.

Based on past enforcement activities, it would not be surprising if this letter and coordinated warning to systems precedes enhanced scrutiny of pricing and “good faith estimate” practices of health care organizations across the country by the FTC. Organizations would therefore be well-advised to audit their own price transparency practices and processes for providing consumers with pricing information, and to address any issues which may arise.

This post is co-authored by Seth Orkand, co-chair of Robinson+Cole’s Government Enforcement + White-Collar Defense Team.

On August 28, 2026, the Centers for Medicare & Medicaid Services (CMS) announced that recent enforcement actions have stopped more than $1.6 billion in potentially improper Medicare payments to diagnostic laboratories since the beginning of the current administration. The announcement highlights a significant increase in CMS’s reliance on data analytics and artificial intelligence to detect potential fraud. And, critically, it signals a stark departure from CMS’s “pay and chase” model to the “protect and deploy” strategy announced by Vice President J.D. Vance, HHS Secretary Robert F. Kennedy, Jr., and CMS Administrator Mehmet Oz in February 2026. Under that strategy, CMS makes more proactive use of payment suspensions to freeze funds while enforcement agencies investigate potentially improper billing.

The announcement also signals heightened compliance and enforcement risks for laboratories and affiliated providers participating in Medicare. It underscores the importance of accurate billing, documented medical necessity, operational readiness, and effective oversight of relationships among laboratories, ordering providers, consultants, marketers, and beneficiaries.

Breakdown of the Announced Enforcement Activity

According to CMS, the $1.6 billion in potentially improper payments resulted from: $732 million in savings associated with the revocation of 157 laboratory providers’ Medicare enrollment; more than $500 million in potentially fraudulent payments halted through 185 payment suspensions arising from CMS’s investigation of 600 laboratories; more than $276 million recouped from 442 allegedly suspect overpayments previously paid to laboratories; and $127 million in potentially fraudulent payments prevented through 85 law enforcement referrals made by CMS contractors.

How CMS is Changing Its Enforcement Approach

The announcement does not specify the methodology used to calculate each category of savings, whether any categories overlap, or whether every identified provider received a final administrative or judicial determination of fraud. Nevertheless, CMS’s use of payment suspensions and enrollment revocations before investigations are complete is a departure from prior approach. CMS now uses data analytics to flag high-risk billing patterns and may hold or deny claims before Medicare pays them. It may then suspend payments and/or revoke enrollment before making a law enforcement referral.

Conduct Drawing CMS Scrutiny

CMS has targeted several forms of suspected laboratory fraud, including billing for services not rendered, billing for services that laboratories cannot demonstrate are medically necessary, upcoding, and billing for tests for beneficiaries who had no established relationship with the ordering provider. The latter is often unknown to the laboratory. CMS indicated that these concerns may arise in connection with pathogen-detection testing (i.e., molecular PCR testing), high-complexity drug testing, genetic testing, and other laboratory services.  This announcement is consistent with increased audit activity involving molecular and genetic testing, particularly in light of OIG data published in January 2026 (see our prior blog here).

CMS attributed its enforcement results in part to advanced analytics, including artificial intelligence and machine-learning models used to review Medicare fee-for-service claims. CMS primarily uses these tools to identify suspect billing patterns or outliers. According to the agency, these tools establish baselines for ordinary billing and laboratory activity and flag unusual combinations involving testing, results, billing, documentation, or provider relationships. For example, CMS’s data analytics may flag a claim for genetic testing ordered by a provider whom the beneficiary has not previously seen. Such high-risk billing patterns may prompt CMS to hold, reject, or deny claims before Medicare funds are released. This approach can expose a provider to substantial operational and financial pressure before CMS has fully analyzed the underlying issues, or the issues have been finally resolved. And CMS often provides only limited information about claim denials, leaving labs uncertain about why their claims have not been paid.

To avoid such outcomes, laboratories should:

  • communicate documentation requirements to ordering providers and consistently enforce those requirements;
  • confirm that all billed tests were ordered, performed, documented, and medically necessary;
  • review coding practices for potential upcoding or unsupported billing;
  • verify and document relationships between beneficiaries and ordering providers to ensure ordering providers are actually treating the beneficiaries for whom they are ordering tests;
  • monitor for abrupt changes in claim volume, test mix, ordering patterns, and reimbursement;
  • know their referral sources by conducting diligence on consultants, marketers, ordering providers, and other business partners;
  • confirm that each enrolled location is operational and that information supplied to Medicare is accurate;
  • retain records relevant to claim reviews, payment suspensions, overpayment demands, and enrollment actions; and
  • conduct routine internal reviews of analytical outliers.

CMS’s laboratory initiative is one component of its broader fraud-prevention program. The agency reported $42 billion in Medicare fraud prevention savings during fiscal year 2025. CMS stated that in FY2016, it identified $1.8 billion in Medicare overpayments through medical reviews collected $378 million through post-payment reviews and suspended more than $539 million in suspected fraudulent payments. CMS further reported that, since January 1, 2026, its Fraud Defense Operations Center (which CMS announced in March 2025) had accounted for the suspension of more than $371 million in Medicare payments involving 267 providers and suppliers. That amount included more than $226 million in suspect durable medical equipment billing, more than $53 million in skin substitute claims, and more than $23 million involving hospice providers.

Key Considerations for Laboratories

The announcement reflects CMS’s continued focus on technology-assisted detection and rapid administrative intervention to prevent inappropriate Medicare payments. Unusual billing patterns, questionable provider relationships, unsupported medical necessity, enrollment discrepancies, and indications that services were not rendered are likely to draw scrutiny from CMS. At the same time, analytics and artificial intelligence may not fully account for the operational realities of laboratories or their distinct role in the healthcare delivery system. Laboratories rely on ordering providers for information about the provider-patient relationship, medical necessity, and supporting clinical documentation—as the First Circuit Court of Appeals recently determined they can do—even though deficiencies in that information may expose the laboratory’s claims to review or administrative action. CMS’s approach therefore places an increased practical burden on laboratories to coordinate with ordering providers, establish clear documentation expectations, and monitor whether information received from those providers supports Medicare billing requirements. The announcement does not explain how CMS’s analytical models account for information outside a laboratory’s possession or control, distinguish provider-level documentation failures from laboratory misconduct, or incorporate those considerations before claims are held, denied, or referred for further action. CMS’s continued reliance on data analytics, payment suspensions, enrollment actions, overpayment recoveries, and law enforcement referrals appears likely.

On July 16, 2026, the Centers for Medicare & Medicaid Services (CMS) and the Centers for Disease Control and Prevention (CDC) published a Request for Information (RFI) concerning potential updates to the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations. The RFI (CMS-3485-NC) reflects the agencies’ effort to assess whether the CLIA framework should be updated to account for significant changes in laboratory technology, operations, and risk management since the regulations were implemented in 1992. Comments are due September 14, 2026. The agencies may use the responses to inform future notice-and-comment rulemaking or sub-regulatory guidance, but the RFI itself does not amend existing requirements.

CMS and CDC explain that laboratory medicine has evolved substantially since the current framework was adopted. The RFI therefore seeks practical information from laboratories and other interested parties regarding four broad areas: (1) breath testing; (2) laboratory processes and procedures; (3) emergency preparedness, biosafety, biosecurity, and cybersecurity; and (4) specialty testing. This article focuses on the laboratory process, artificial intelligence (AI), data-only facility, performance-specification, and cybersecurity issues most likely to affect laboratory operations.

  1. Laboratory Processes and Procedures

In the commentary, CMS addresses several operational and technical issues, including: retention of pathology specimen blocks beyond the current two-year minimum; specimen-preparation activities and the qualifications and competency of personnel performing them; testing and reporting of suboptimal specimens; calibration verification for factory-calibrated, nonadjustable devices; artificial intelligence and software-assisted post-analytic interpretation; data-only facilities; and remote direct-observation competency assessments.

  1. Artificial Intelligence and Data-Only Facilities

The agencies are particularly interested in how laboratories use artificial intelligence , machine learning, and other software tools to interpret test results, verify software performance, and manage technologies such as automation and cloud analytics. As they noted, “CMS has received multiple inquiries regarding which post-analytic activities CMS considers part of the testing process. Test systems are becoming increasingly complex and integrated with advanced technology and AI systems.” Accordingly, CMS is seeking information about facilities that process analytical data, interpret genetic data or digital images, or calculate risk factors without handling physical specimens.

Two issues are central: (1) how laboratories use AI and software; and (2) what constitutes a laboratory or specimen, including where data analysis fits within the current regulatory framework. These questions concern how CLIA should apply when software materially influences the interpretation or reporting of laboratory information, even if the underlying analytical testing occurs elsewhere. The RFI continues a policy discussion developed by the 2022 CLIA Regulations Assessment Workgroup of the Clinical Laboratory Improvement Advisory Committee (CLIAC). The workgroup examined where CLIA oversight should begin and end within the total testing process, how CLIA should address AI and other emerging technologies, whether data and digital images should qualify as materials derived from human specimens, and whether entities providing informatics or interpretive services should be subject to CLIA when they do not handle physical specimens. The workgroup recognized that AI may influence test selection, analytical processing, image analysis, variant classification, result interpretation, and reporting. It also observed that the definition of a test system may need to encompass an algorithm or software component that helps generate a test result or information used for a clinical decision. The RFI now gives stakeholders an opportunity to explain which AI activities should fall within CLIA, when an algorithm should be considered part of a regulated test system, and how oversight should apply when separate entities perform different parts of an integrated testing workflow.

The workgroup also distinguished between static and adaptive AI. Static models may fit within the current framework if laboratories appropriately validate them and revalidate material changes. Adaptive models, by contrast, may require continuing revalidation or specifically defined quality-control and proficiency-testing requirements because their performance can change as they receive new data. CMS and CDC are now seeking information that could translate those concerns into workable requirements for initial validation, change control, re-verification, and continuing oversight. Commenters may wish to address how laboratories should establish baseline performance, define material changes, detect performance drift, set monitoring intervals and acceptance thresholds, investigate anomalous results, and determine when an AI tool should be corrected, retrained, revalidated, or removed from clinical use.

Professional laboratory organizations have emphasized that oversight should be proportionate to an AI tool’s intended use and potential effect on patient care. Tools that directly influence diagnosis, treatment, risk classification, or test interpretation may warrant more rigorous validation, transparency, and monitoring than software used only for administrative or operational functions. Consistent with this risk-based approach, modernization of CLIA could build upon laboratories’ existing quality-management responsibilities rather than establish a separate, duplicative oversight framework. Any updated requirements may also start delineating the respective responsibilities of laboratories, software developers, vendors, contractors, and health care organizations for implementation, validation, updates, corrective action, and ongoing monitoring.

The RFI’s questions about facilities that analyze data without handling physical specimens also echo the workgroup’s consideration of “data as a specimen.” The workgroup agreed that images and data may constitute materials derived from the human body and supported CLIA oversight of sites that perform informatic analysis or interpretation for patient care. Comments responding to the RFI can help CMS and CDC determine when a remote location should be treated as an extension of an existing laboratory, when a contractor or software company should be independently regulated, and how responsibility should be allocated across a distributed testing process. These questions are especially important for next-generation sequencing, digital pathology, and other services in which cloud-based tools or outside organizations may perform bioinformatic processing, variant classification, image analysis, or other steps that materially affect the reported result. Stakeholders may also wish to address vendor qualification, contractual access to validation information, audit rights, software-version controls, incident reporting, data integrity, and the laboratory director’s ability to investigate errors across the entire workflow.

Data quality and harmonization are central to reliable AI performance. The 2022 workgroup also identified personnel qualifications and competency as areas requiring modernization. It considered whether CLIA should recognize emerging roles such as data scientists, bio-informaticians, variant scientists, image technicians, and other professionals who perform or support post-analytic data analysis. The workgroup recommended broadly defining new personnel roles and establishing appropriate education, training, and competency expectations. Comments on the RFI may help CMS and CDC determine which AI-related activities require qualified laboratory personnel, what expertise laboratory directors need to oversee those activities, and how laboratories should assess competency when work is performed remotely or by an outside entity.

The workgroup further observed that proficiency testing may need to extend across a distributed testing process so that quality is evaluated through data transfer, algorithmic analysis, interpretation, and reporting and not solely at the site performing the physical assay. The RFI therefore moves the discussion from the conceptual and technical concerns examined by the 2022 CLIAC workgroup toward possible regulatory policy. It allows laboratories, professional organizations, developers, vendors, and data-analysis entities to explain how the workgroup’s recommendations could function in practice. Detailed comments can help CMS and CDC determine how CLIA can support responsible innovation while ensuring that AI-assisted laboratory services remain accurate, reliable, equitable, secure, transparent, and subject to appropriate professional and regulatory oversight.

  1. What Laboratories Should Consider Now

The RFI devotes specific attention to the establishment of performance specifications for tests that are not cleared or approved by the Food and Drug Administration (FDA), including modifications to FDA-cleared or approved test systems. CMS and CDC ask laboratories to identify technical challenges, test-specific acceptance criteria, performance characteristics not adequately addressed by existing regulations or guidance, in-house reagent practices, and common modifications to FDA-authorized systems. The RFI asks whether methods such as toxicology and next-generation sequencing present unique characteristics that warrant additional regulatory treatment. Examples include stability, carry-over, internal standards, ionization, and clinical validity. Responses could influence how CMS approaches laboratory-developed tests, modified test systems, and emerging methodologies in future policy.

  1. Cybersecurity Moves to the Forefront of Laboratory Oversight

The RFI recognizes the growing reliance on laboratory information systems, electronic health record integrations, automated diagnostic devices, and remote access. It asks about access controls, user verification, access from outside the United States and its territories, restrictions on ports and internet protocol addresses, incident-response planning, personnel responsibilities, training, and laboratories’ experiences managing cyber threats. Respondents are cautioned not to submit proprietary or confidential information.

Comments may be submitted electronically through regulations.gov under docket CMS-2026-2345, or by one of the mail methods specified in the notice. Commenters should use file code CMS-3485-NC, and select only one submission method. Because submitted comments generally will be made publicly available, commenters should avoid including personally identifiable, proprietary, or confidential business information.

What Laboratories Should Consider Now

The RFI does not change laboratories’ current CLIA obligations, but it continues a long-running debate over the scope and modernization of laboratory oversight. Laboratories may wish to review their experience with the technologies and operational issues identified in the RFI, coordinate input from technical, quality, compliance, information-security, and clinical personnel, and consider submitting comments by September 14, 2026. The breadth of the RFI suggests that CMS and CDC are evaluating substantial modernization of the CLIA framework. Laboratories and other stakeholders now have an opportunity to help shape how future requirements address emerging technologies while preserving the accuracy, reliability, and safety of clinical testing.

This post is co-authored by Seth Orkand, co-chair of Robinson+Cole’s Government Enforcement + White-Collar Defense Team, and Abigail Salcedo, a 2026 Summer Associate at Robinson+Cole. Abigail is not admitted to practice law.

On June 23, 2026, the U.S. Department of Justice (DOJ) announced that it charged 11 defendants in connection with over two billion dollars in fraudulent claims for amniotic wound allografts as part of its 2026 National Health Care Fraud Takedown. Prosecutors allege that the schemes involved illegal kickbacks, medically-unnecessary allograft procedures, and exploitation of elderly Medicare beneficiaries and hospice patients.

Allografts and Rising Costs

The need for wound care is widespread. An estimated 10.5 million Medicare beneficiaries, roughly one in every six, live with chronic wounds, and skin substitutes are used to treat wounds that have failed to heal with standard care. Amniotic allografts are made from human donor tissue and treat recipients’ wounds by acting as a replacement layer of skin.

Prior to 2026, allografts were paid as “biologicals” under Medicare’s average sales price methodology, which gave each product a billing code and payment limit of the average sales price plus 6%. Allograft prices soared to $2,000 per square centimeter by 2025, driving a dramatic increase in federal spending. Between 2019 and 2025, Medicare Part B spending on allografts and other skin substitutes rose from $252 million to over $14 billion.

Wound Care Under Scrutiny

The Department of Health and Human Services’ Office of Inspector General investigated the spike in spending and attributed rising costs to an increased number of Medicare claims for allografts, potentially fraudulent reporting by manufacturers that artificially inflated average sales price data, and high rates of allografts application in hospice, home care and other settings. It also found that Medicare’s reimbursement policy incentivized providers to identify the allografts with high profit margins and bill for as many as possible.

The Centers for Medicare & Medicaid Services (CMS) addressed the provider billing incentive by restructuring how wound treatment is paid, reducing Medicare’s reimbursement to $127.14 per square centimeter effective January 1, 2026.

Anatomy of the Alleged Schemes

DOJ often concentrates its enforcement resources on areas in which there have been sharp increases in reimbursement, and medically unnecessary use of allografts and fraudulent billing has become a primary target. DOJ reported charges against individuals allegedly engaged in wound care schemes involving inflated sales prices, kickbacks to medical providers, and medically unnecessary use of allografts.

In the District of Arizona, DOJ indicted a former Vice President of Sales for an amniotic wound allograft company in connection with an alleged $1.2 billion scheme, of which approximately $614 million was paid by Medicare, TRICARE, CHAMPVA, and commercial insurers. Sales representatives and providers allegedly targeted elderly patients, many in hospice care, and billed for allografts that were not medically reasonable or necessary. The company also allegedly supplied sham invoices overstating the true sales price for its allografts and directed providers to bill Medicare using the inflated amount. The indictment came several months after the company’s owners pleaded guilty to conspiracy to commit health care fraud and wire fraud.

In another case, filed in the Southern District of Texas, a nurse practitioner (NP) who operated four mobile wound clinics in four states was indicted in connection with $906 million in claims, of which approximately $297 million was paid by Medicare and TRICARE. Prosecutors allege the defendant caused allografts to be unnecessarily applied to infected wounds without proper treatment, healed wounds, superficial wounds, and to areas exceeding the wound size, then falsified medical records to make those applications appear medically reasonable and necessary. It is also alleged in the indictment that the NP targeted certain hospice patients who died within days of application. The indictment also alleges that to “conceal and disguise the lack of medical necessity for the allografts,” she directed and emailed the falsification of documents to attempt to substantiate medical necessity. DOJ alleges the unnecessary allografts resulted in billings of more than $1 million per patient. The charges also allege that the provider facilitated kickbacks to induce patient referrals and solicited kickbacks tied to allograft purchases.

How the Government Connected the Dots

The DOJ’s Health Care Fraud Unit and Data Fusion Center detected suspicious wound care billing patterns in the spike in allograft payments. Fraud indicators included unusually high per-beneficiary billing, claims showing that the purported rendering provider was elsewhere at the time of service (such as in prison), and allograft use rates far above those of similarly situated providers. Other recurring red flags included targeting elderly Medicare beneficiaries in hospice, use of unlicensed practitioners, and suspicious relationships between skin substitute suppliers and providers.

Looking Forward

Starting with calendar year 2026, CMS modified its allograft reimbursement methodology from average sales price-based payment to incident-to supplies, which is expected to cut Medicare spending on these products by nearly 90%. CMS indicated that it plans to propose rates that group products based on relevant product characteristics consistent with their FDA regulatory status.

Implications and Action Items for Healthcare Organizations

Documentation will be central to substantiating the medical necessity of the products used. Patient records should indicate the more conservative treatments that were utilized first, particularly where DOJ’s allegations repeatedly focused on allografts applied to infected wounds, superficial wounds, healed wounds, or wounds that allegedly did not warrant the product.

CMS is likely to scrutinize other procedures where financial incentives appear to drive disproportionate growth without corresponding clinical benefits. For example, medical researchers have identified ocular amniotic membrane grafts for dry eye treatment as one area of concern, citing increased use, mixed clinical evidence, and high reimbursement rates. Although the vast majority of medical providers base treatment decisions on clinical judgment, high profit margins may improperly influence some care decisions.

Health care entities would be well-served by having a deep understanding of their customers and their sources of business, and wary of third-party intermediaries such as marketers and recruiters who may obtain patient referrals through the use of unlawful kickbacks. Healthcare organizations should review contracts with allograft manufacturers and distributors for compliance with federal and state anti-kickback statutes. In the current enforcement focused space, CMS remains focused on preventing suspicious payments before they occur by issuing payment suspensions, rather than pursuing fraud after payment.

Compliance teams should use data analytics to detect unusual billing patterns and sudden increases in high-reimbursement services, mirroring the approach taken by CMS and private insurers. Doing so will enable healthcare organizations to detect and correct suspect billing practices, ensure documentation of medical necessity, and address utilization increases that Medicare and other health insurers’ data analytics programs may flag as potentially fraudulent.

This post is co-authored by Seth Orkand, co-chair of Robinson+Cole’s Government Enforcement + White-Collar Defense Team, and Abigail Clarke, a 2026 Summer Associate at Robinson+Cole. Abigail is not admitted to practice law.

The Justice Department’s (DOJ) June 23, 2026, announcement of its annual Health Care Fraud Takedown makes clear that Medicaid and state health care programs have become central to the government’s health care enforcement strategy.

DOJ described the takedown as ushering a “new era” of enforcement, citing a record number of Medicaid fraud charges, and the largest number of participating states in its history. Among the 455 defendants charged, 295 are accused of defrauding Medicaid out of more than $518 million in alleged false claims. DOJ also emphasized the breadth of the takedown: cases were brought in 56 judicial districts and 45 states and territories, with participation from 50 of 54 state Medicaid Fraud Control Units (MFCU) the highest level of MFCU participation in DOJ history.

For health care providers, the announcement is significant because the Medicaid issues highlighted in the takedown are not limited to obviously fraudulent conduct. They reach operational areas that providers manage every day, including enrollment disclosures, documentation practices, medical necessity support, managed care billing, transportation arrangements, and relationships with vendors, marketers, and referral sources.

Medicaid Enforcement Is Often State-Specific

Medicaid’s federal-state structure makes enforcement more complex: the program is jointly funded, but each state administers its own program within federal requirements.

Given this federal-state structure, enforcement often turns on program-specific requirements, including those related to:

  • Provider type and enrollment status;
  • Medicaid managed care requirements;
  • Waiver authority and other program-specific rules;
  • Provider manuals and state agency guidance; and
  • Prior authorization and medical necessity standards.

Although the schemes included in this year’s takedown involve many of the same themes familiar from Medicare enforcement matters, including medical necessity, falsification of records, and improper recruitment of beneficiaries, the legal analysis often depends on state-specific rules. Providers should understand how applicable state Medicaid rules, managed care requirements, provider manuals, and guidance affect their enrollment, billing, documentation, medical necessity requirements, and relationships with Medicaid managed care plans. A billing practice, referral arrangement, or documentation process that may be commonplace in one state may raise legal issues under another state’s Medicaid program, particularly for providers operating across state lines or billing Medicaid managed care plans.

Medicaid Schemes Scrutinized in the Takedown

The Medicaid cases described by DOJ illustrate several recurring enforcement themes, including:

  • Medically unnecessary services;
  • Claims for services allegedly not provided;
  • Beneficiary targeting, recruitment, and kickbacks;
  • Incomplete or false enrollment disclosures;
  • Fraudulent transportation arrangements;
  • Overlapping time entries; and
  • Records that allegedly did not support the services billed.

Because Medicaid covers a broad population, including eligible low-income adults, children, pregnant women, older adults, and people with disabilities, Medicaid enforcement can reach a wide range of provider types and services. The takedown reflects that breadth, with cases involving behavioral health, home- and community-based services, personal care, social adult day care, transportation, and laboratory services.

For example, a Connecticut reference laboratory and its owner settled with the federal government to resolve allegations that they omitted material information from its Medicaid enrollment application. The lab allegedly failed to disclose its relationship with another Medicaid provider that was under payment suspension and investigation. The related laboratory was owned by the defendant’s husband, was located at the same address, and had the defendant as its chief operating officer. This matter illustrates that ownership, control, management, and operational relationships can create enforcement exposure in Medicaid enrollment and revalidation submissions.

In New York, prosecutors charged defendants in an alleged Medicaid social adult day care scheme involving claims for services not provided, services that were medically unnecessary, and kickbacks to Medicaid recipients and patient recruiters. The government alleges that the defendants submitted more than $38 million in claims to New York Medicaid for social adult day care services that were not provided or were induced by kickbacks. 

In Arizona, prosecutors charged an owner/operator of an outpatient treatment center that provided services for alcohol and drug addiction for services that were not provided, not provided as billed and were “so substandard that they failed to serve a treatment purpose,” were not used as part of an integrated treatment plan, and paid kickback and bribes.

Not all Medicaid fraud cases involve such high alleged damages. For example, in Massachusetts cases, the government alleges that personal care attendants billed for services not provided, including when the attendants were out of state, working at other jobs, incarcerated, or not at the patient’s home at the time the billed services were allegedly performed.

Other Medicaid-related cases involved personal care, home care, transportation, and similar services, where allegations often turned on personnel scheduling, timesheets, supervision of aides, the location of services provided, beneficiary eligibility, and recordkeeping.

Federal-State Coordination Remains a Key Enforcement Theme

Participation by 50 of 54 MFCUs is one of the most significant takeaways from the 2026 takedown.

Medicaid fraud investigations have long involved state enforcement authorities, but DOJ’s announcement reflects continued coordination among multiple federal and state actors, including MFCUs, federal prosecutors, state attorneys general, state Medicaid agencies, federal oversight agencies, and Medicaid managed care organizations.

The coordinated approach was aided by the government’s improved data analytics capabilities. Last year, DOJ’s Health Care Fraud Unit announced the creation of a Data Fusion Center staffed with data analytics experts from HHS-OIG, the FBI, and other agencies. This year’s takedown shows that those tools are now central to the government’s enforcement strategy. DOJ and CMS announced expanded access to CMS data infrastructure, allowing prosecutors to use additional advanced analytics and artificial intelligence tools. CMS also announced new claims-processing safeguards, including electronic attestation, identity verification, and capture of IP addresses at login, and is working to standardize data fields across Medicare, Medicaid, and managed care to strengthen its ability to detect suspicious patterns.

For providers, a Medicaid billing concern may carry consequences well beyond reimbursement adjustments, including threats to enrollment status and/or managed care participation, exclusion, civil monetary penalties, False Claims Act exposure, and criminal enforcement.

DOJ’s focus on Medicaid aligns with its broader emphasis on patient harm and the protection of public health care programs. The government framed the alleged fraud as not only financial harm to the government, but also a diversion of limited Medicaid resources. That framing is especially significant in the Medicaid context, where enforcement agencies often emphasize the protection of funds intended to support vulnerable patient populations.

Compliance Considerations for Medicaid Providers

For providers participating in Medicaid, the takedown underscores the need for Medicaid-specific compliance efforts. Providers should not assume that a compliance program focused primarily on Medicare requirements will address all Medicaid risk areas, particularly when the provider operates in multiple states or participates in Medicaid managed care.

Providers should consider several practical Medicaid compliance priorities, including:

  • Verifying that enrollment applications and revalidation submissions accurately disclose ownership, control, management, service locations, and operational relationships;
  • Ensuring that documentation supports the services billed, including the date and location of service, number of units billed, provider qualifications, beneficiary eligibility, medical necessity, and any required prior authorization;
  • Evaluating compliance with Medicaid managed care plan requirements and underlying state Medicaid rules governing coverage and payment, particularly as it relates to the managed Medicaid payor policies;
  • Reviewing relationships with marketers, referral sources, transportation vendors, billing companies, and other third parties to ensure proper compensation and referral arrangements; and
  • Auditing Medicaid-specific claims data to identify high-volume billing, unusual utilization patterns, overlapping services, repeated documentation gaps, compliance with payor policy, or claims that appear inconsistent with applicable state Medicaid requirements.

Non-compliance with utilization, documentation, and billing requirements may be visible to government enforcement agencies, managed care plans, and whistleblowers. For that reason, Medicaid compliance should be tailored to actual Medicaid operations, including the states in which the provider participates, the provider types under which it is enrolled, the managed care plans with which it contracts, the services it furnishes, and the documentation required to support those services.

Takeaway

Although Medicaid enforcement has often been viewed as following the lead of Medicare fraud enforcement, the 2026 National Health Care Fraud Takedown suggests that Medicaid will remain a central and distinct part of health care fraud enforcement. The government’s emphasis on state MFCU participation, reliance on data analytics, and use of administrative tools reflects a move toward earlier detection and faster intervention, rather than reliance only on post-payment investigations.

Medicaid enforcement risk is both state-specific and increasingly coordinated. Compliance teams should proactively review provider enrollment submissions, documentation practices, third-party relationships, Medicaid managed care billing processes, and internal monitoring capabilities before billing patterns draw external scrutiny.

Connecticut Governor Ned Lamont recently signed into law Public Act No. 26-68 (the Act), which makes targeted but significant changes to the Department of Public Health’s (DPH) enforcement authority for health care licensure and certification violations by increasing potential fines and creating criminal liability for certain unlicensed operation of health care institutions and unlicensed provision of professional health care services. These changes take effect October 1, 2026.

Expanded Penalties for Operating Without Required Licensure or Certification

The Act revises the penalty framework for a person who establishes, conducts, manages or operates a health care institution (such as a hospital, urgent care center or nursing home) without the required license or certificate. Beginning October 1, 2026, such conduct will be a class D felony, and violators may be fined up to $5,000 per day, an increase from the current maximum of $100 per day.

The Act creates a new penalty for property owners on whose property a health care institution is established, conducted, managed, or operated without the required license or certificate. These property owners may be fined up to $100 per day.

There is a narrow exception to the above penalties for any institution that applied for a license renewal within 60 days after its license lapsed.

Increased Civil Penalties

The Act adds a separate civil penalty mechanism, under which DPH may, after a hearing, impose a civil penalty of up to $25,000 per day on any person establishing, conducting, managing or operating a health care institution without the required license or certificate. Under current law, DPH may, upon the advice of the Attorney General, seek an injunction to restrain the offending institution’s operation.

The Act also authorizes DPH (or the applicable health care service licensing board or commission) to issue a temporary order to stop a person performing unlicensed activities while a formal order is pending if such activities pose an imminent risk to public health, safety or welfare. After a hearing, DPH may also impose a civil penalty of up to $25,000 for each day that a person provides professional health care services without the required DPH license or certificate.

Key Takeaways

Under the Act, DPH has much greater authority to enforce its institution and individual licensing and certification requirements. Institutions and individuals licensed or certified by DPH should review their current licenses, certificates, and renewal tracking processes before October 1, 2026.

Connecticut Governor Ned Lamont recently signed Public Act No. 26-68 (the Act), which includes changes to the state’s medical orders for life-sustaining treatment (MOLST) program. Shortly after the Act was signed into law, the Connecticut Department of Public Health (DPH) issued policies and procedures regarding the MOLST program, which will operate as regulations in the interim until DPH promulgates final regulations. The statutory changes to the MOLST program became effective May 26, 2026, and the DPH policies and procedures became effective June 8, 2026.

Background

MOLST is Connecticut’s framework for documenting medical orders concerning life-sustaining treatment for individuals who are approaching the end stage of a serious, life-limiting illness or who are in a condition of advanced chronic progressive frailty. The purpose of the program is to support patients’ preferences regarding treatment at such point in their disease progression. MOLST is implemented through medical orders that can guide treatment decisions across care settings.

Statutory Changes to the MOLST Program

The Act redefines a “medical order for life-sustaining treatment” to now mean a set of orders established by DPH and specific to the MOLST program. Previously, a MOLST was an order made by a physician, advanced practice registered nurse (APRN) or physician assistant. The Act further specifies that a MOLST will be valid only if it is completed on a form prescribed by DPH. Pursuant to this change, DPH published a form which providers must now use to effectuate patients’ wishes for life-sustaining treatment.

The Act also allows physician assistants, in addition to APRNs and physicians, to determine that a patient’s condition has progressed to the point appropriate for a MOLST.

MOLST Policies and Procedures

DPH’s policies and procedures operationalize the MOLST changes made by the Act. The policies include training-related requirements for providers who are authorized to execute a MOLST form. Each eligible provider must complete DPH-approved MOLST training, which will focus on conditions that qualify a patient for participation in the MOLST program. No provider may sign a MOLST form without first completing the required DPH-approved training.

The new DPH policies require that a provider conduct a MOLST discussion with the patient or the patient’s legally authorized representative before executing a MOLST form. During this discussion, the provider must discuss the patient’s goals for care and treatment and the benefits and risks of various methods for documenting the patient’s wishes for end-of-life treatment. The MOLST discussion must be completed again as clinically appropriate to review goals of care and treatment preferences according to disease progression, when the patient is transferred to a different care setting or level of care, or if the patient’s preferences change. The provider must document these discussions in the patient’s medical record. Once the MOLST form is executed, it must be made available for the patient to review.

The policies also address revocation, amendment and treatment requests that differ from a valid MOLST form. A patient or their legally authorized representative may request and receive treatment that differs from the patient’s valid MOLST form at any time, without revoking the MOLST form. A patient or legally authorized representative may revoke or amend a valid MOLST form at any time.

Each health care provider must follow the orders on a valid MOLST form, unless instructed otherwise by the patient or legally authorized representative. The policies also provide that valid MOLST forms must be recognized by any receiving health care provider or institution.

Key Takeaways

The Act and related DPH policies result in a more detailed and standardized operational framework for the MOLST program, and place new training requirements on providers. Health care providers involved in end-of-life care should be aware of these new changes to the MOLST program and may need to update their processes and forms to comply with the new state-mandated MOLST program requirements.