Health Law Advisor

When a senior living or skilled nursing facility gets into financial trouble, restructuring professionals and lenders must account for the structural pressures faced by all long-term care facilities. At the American Bankruptcy Institute’s Healthcare Program in Washington, D.C., in October 2026, Ryan Cochran moderated a panel, “Structural Pressures Driving Distress,” with senior living operators that discussed outside forces that strain all operators.

On October 20, 2026, the Centers for Medicare & Medicaid Services (CMS) published a Proposed Rule (the “Proposed Rule”) to amend regulations pursuant to the mandates of Section 6224 of the Consolidated Appropriations Act of 2026 (CAA), signed into law on February 3, 2026. Section 6224 adds new and enhanced requirements under the Medicare Part D program aimed at pharmacy benefit managers (PBMs) and their affiliates, addressing issues such as how PBMs are compensated and how much data they must share about their operations.  Procedurally, Section 6224 amends section 1860D–12 of the Social Security Act (42 U.S.C. § 1395w–112) to add these new and enhanced requirements. With its Proposed Rule, CMS is codifying these changes in regulation. 

On October 19, 2026, the U.S. Food and Drug Administration (FDA) issued final guidance (the “Final Guidance”) on identity and safety information for New Dietary Ingredient Notifications (NDINs). FDA’s New Dietary Ingredient (NDI) Notifications and Related Issues; Identity and Safety Information About the NDI finalizes the identity, history of use, and safety summary sections of FDA’s 2016 revised Draft Guidance.[1] For companies preparing to bring a new ingredient to market, it is the most concrete statement yet of what FDA expects to see in a notification. Industry has long asked for that clarity, and this release is a meaningful step toward it. However, the Final Guidance still fails to address fundamental questions regarding when an NDIN is even required, leaving the industry still a bit perplexed on how to navigate the field.

In the latest from the U.S. Department of Justice (DOJ), the National Fraud Enforcement Division (NFED) announced on October 20, 2026, the creation of a Fraud Whistleblower Incentive Program (WHIP)[1] paying between $10,000 and $30,000 for information leading to criminal charges—to be handed out at the charging stage of a criminal case, as opposed to after the final resolution. This program further incentivizes private whistleblowers to voluntarily disclose potential fraudulent activity. Health care companies, in particular, need to be aware of what this may mean for their businesses.

In the latest wave of press releases ramping up the new National Fraud Enforcement Division (NFED), the Department of Justice (DOJ) and the Department of Health and Human Services Office of Inspector General (HHS-OIG) announced a new policy (the “Coordination Policy”) on October 15, 2026, directing that companies seeking to voluntarily self-disclose potential criminal conduct relating to health care should now make self-disclosures to NFED.

Such disclosures will automatically trigger both DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP) and HHS-OIG’s Health Care Fraud Self-Disclosure Protocol (SDP).

A company disclosing only to HHS-OIG generally will not receive the benefits of DOJ’s CEP covering criminal conduct and will not be deemed to have made a voluntary self-disclosure to DOJ. This is critical, since a voluntary self-disclosure to DOJ could qualify a company for a declination. Consequently, companies seeking the benefits of both programs should disclose potentially criminal conduct to NFED first.

What You Need to Know

• A new civil False Claims Act (FCA) Self-Disclosure Pilot Program (SDPP) was announced on October 22, 2026.
• The SDPP, which will run for six months, encourages health care entities to self-disclose potential violations of the FCA and reach resolution on civil liability as well as various administrative penalties.
• The SDPP offers several favorable terms for entities participating in the SDPP, including a lower multiplier and non-claims based calculation methodology for disclosed Anti-Kickback Statute (AKS) violations.

It was an invigorating conference at Horizons: Perspectives on Psychedelics, October 15–17, 2026, in New York, which featured important views on the health care industry, federal agency preparation for psychedelic drug regulation, reimbursement, and incorporating psychedelics into patient care protocols.

This post shares insights that the Epstein Becker Green team took away from sitting in on these discussions.

On October 14, 2026, U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr., published a notice (the “Publication”) in the Federal Register formalizing the delegation to the administrator of the Centers for Medicare & Medicaid Services (CMS) of the power to exclude individuals and entities, including providers, from participation in federally funded health care programs—effective immediately.

The Publication follows the Secretary’s July 21, 2026, announcement that he would be giving CMS permissive exclusion authority under section 1128(b) of the Social Security Act—which was, until now, within the exclusive domain of the HHS Office of Inspector General (HHS-OIG) (see Epstein Becker Green’s previous blog post here). The July announcement was made during an HHS press conference covered by C-SPAN.

Although the Publication purports to “reduc[e] redundancy” by “align[ing] investigative and enforcement responsibilities within a single operating division,” it does not clarify the extent and scope of the delegated authority, how it could be exercised jointly with HHS-OIG, and what impact it has on False Claims Act (FCA) cases.

On October 2, 2026, the Centers for Medicare & Medicaid Services (CMS) issued its Final Rule (“Final Rule”) implementing the “Global Benchmark for Efficient Drug Pricing Model” (“GLOBE Model”)—a new mandatory Medicare payment model under section 1115A of the Social Security Act.

Healthcare organizations face unprecedented cybersecurity challenges in an increasingly hostile threat environment. In response to major breaches and security incidents affecting the industry, the Health Infrastructure Security and Accountability Act (HISAA) has been re-introduced and the U.S. Senate has advanced the Health Care Cybersecurity and Resiliency Act (HCCRA). This blog post summarizes the key provisions of these bills.