On September 9, 2026, the Federal Trade Commission (“FTC”) rescinded its 2021 policy statement which extended the Health Breach Notification Rule (“HBNR”) to health apps and connected devices outside the reach of the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations (collectively “HIPAA”). In its recent press release, the FTC called that prior guidance “obsolete” and “unnecessary,” concluding it provided minimal benefit and had been superseded by rulemaking. This is not a minor course correction at a moment when the Centers for Medicare and Medicaid Services (“CMS”) is actively steering seniors toward health apps that require collection and processing of identifiable consumer health information outside the reach of HIPAA.
* * * *
If you have questions, please reach out to the author(s).
The Health Law Advisor blog is currently edited by Emily Chi Fogler.
Almost two years after Judge Kathryn Kimball Mizelle of the U.S. District Court for the Middle District of Florida became the first federal judge in the country to declare the qui tam provisions of the False Claims Act (FCA) unconstitutional, the U.S. Court of Appeals for the Eleventh Circuit vacated Judge Mizelle’s September 30, 2024, order and held that the FCA’s qui tam provisions do not violate the Appointments Clause of the U.S. Constitution. The case now returns to the District Court.
On September 1, 2026, a unanimous panel of the Eleventh Circuit concluded in United States ex rel. Zafirov v. Florida Medical Associates LLC that qui tam whistleblowers, or relators, who bring a case under the federal FCA in the name of the U.S. government are not “officers of the United States” occupying a “continuing position established by law.”
However, the lower court considered only the Appointments Clause; on remand, the Middle District of Florida must consider, in the first instance, whether the same qui tam provisions violate the Constitution’s Vesting and Take Care clauses.
Bill Gates published an essay this week arguing that the AI transition will be one of the most turbulent periods in modern history. And critically, neither governments nor industry have a plan to manage it. While the essay has far-reaching implications for all industries and humanity generally, three key risk categories emerge for health care and life sciences organizations. It is a useful moment to connect his framing to what is actually showing up in legislative bodies, enforcement actions, and litigation.
On August 12, 2026, U.S. Department of Health and Human Services (“HHS”) Secretary Robert F. Kennedy Jr. sent a letter (“Referral Letter”) to HHS Inspector General T. March Bell, targeting more than 250 health care entities providing gender-affirming care to minors “for investigation into possible violation of federal statutes.”
On July 21, 2026, Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. announced (the “July 21 announcement”) that he would be providing to the Centers for Medicare & Medicaid Services (CMS) the exclusion authority currently within the exclusive domain of the HHS Office of Inspector General (HHS-OIG)—that is, the power to exclude individuals and entities from participation in federally funded health care programs.
When a provider or supplier of services bills the Medicare program and receives payment, but at a later date the program audits the claim and denies it, can the provider or supplier be relieved of any financial liability if it had a good faith belief that the service met all relevant coverage requirements, even when that belief is incorrect? In a recent decision, the U.S. Court of Appeals for the Sixth Circuit ruled that this relief is possible, and that administrative adjudicators must conduct an analysis under the “hold harmless” provision of the Social Security Act (the “Act”).[1]
[1] In Home Health, LLC v. Kennedy, 2026 WL 2147418 (6th Cir., July 27, 2026); also available at: https://www.opn.ca6.uscourts.gov/opinions.pdf/26a0205p-06.pdf.
On August 13, 2026, Senior U.S. District Judge B. Lynn Winmill of the District of Idaho issued a ruling in Seyb v. Members of the Idaho Board of Medicine, holding that Idaho’s near-total abortion ban is unconstitutional to the extent it prohibits abortions necessary to protect the health—not just the life—of the pregnant patient. Along with that holding, the court entered an injunction barring enforcement of the ban in those circumstances. The ruling is the first federal district court decision since Dobbs v. Jackson Women’s Health Organization to hold that the U.S. Constitution affirmatively protects a right to health-preserving abortion.
On July 31, 2026, the Health Resources and Services Administration (“HRSA”) announced a revised 340B Rebate Model Pilot Program (“2026 Pilot”) to provide a rebate mechanism through which qualifying manufacturers may effectuate the 340B ceiling price for certain drugs sold to covered entities—as opposed to an upfront discount, which has been the longstanding model. The 2026 Pilot, which is limited to the drugs selected for negotiation under Medicare, is open to qualifying manufacturers that submit plans meeting specific criteria.
On August 13, 2026, the Assistant Attorney General for the U.S. Department of Justice (“DOJ”) National Fraud Enforcement Division (the “NFED”), Colin M. McDonald, released a memorandum outlining NFED’s enforcement priorities. The memorandum is the first memo of this kind from NFED. The establishment of NFED earlier this year represented a watershed moment for federal fraud prosecution, as it established DOJ’s first-ever division dedicated exclusively to combating fraud against taxpayer dollars and taxpayer-funded programs. With a stated goal of having 500 prosecutors and staff by August 24, NFED seeks to deploy “cutting-edge data analysis” across a “whole-of-government” effort. The establishment of NFED signals a fundamental shift in federal fraud enforcement, one that seeks to compress investigation timelines and narrow the window for voluntary disclosures. Breaking down data barriers, eliminating silos, and establishing partnerships with U.S. Attorneys’ Offices, federal agencies, and state and local partners, the NFED’s priorities are a warning call to companies to expect more efficient detection, investigation, and prosecution than in the past. The creation of the NFED signals a desire on the part of the Trump administration (“Administration”) to meaningfully escalate federal fraud enforcement sophistication and resources.
On August 7, 2026, Epstein Becker Green attorneys Thomas J. Jaworski and Caitlin Carlton joined podiatrists from across the country at the American Podiatric Medical Association’s (APMA) 2026 Annual Scientific Meeting for a discussion on a subject that has become increasingly difficult for providers to ignore: federal health care fraud enforcement.
Recent Updates
- FTC Reverses Course on Health App Privacy
- The Battle Continues: No Appointments Clause Problem, BUT Eleventh Circuit Directs District Court to Consider Whether False Claims Act Qui Tam Provisions Violate Take Care, Vesting Clauses
- Bill Gates Gazes into the AI Crystal Ball: What are the Implications on the Healthcare and Life Sciences Industry
- 250+ Health Care Entities Targeted by HHS, DOJ Over Gender-Affirming Care for Minors
- Exclusion Authority (It’s Not Just the HHS-OIG Anymore …)