Health Law Advisor

On October 14, 2026, U.S. Department of Health and Human Services (HHS) Secretary Robert F. Kennedy, Jr., published a notice (the “Publication”) in the Federal Register formalizing the delegation to the administrator of the Centers for Medicare & Medicaid Services (CMS) of the power to exclude individuals and entities, including providers, from participation in federally funded health care programs—effective immediately.

The Publication follows the Secretary’s July 21, 2026, announcement that he would be giving CMS permissive exclusion authority under section 1128(b) of the Social Security Act—which was, until now, within the exclusive domain of the HHS Office of Inspector General (HHS-OIG) (see Epstein Becker Green’s previous blog post here). The July announcement was made during an HHS press conference covered by C-SPAN.

Although the Publication purports to “reduc[e] redundancy” by “align[ing] investigative and enforcement responsibilities within a single operating division,” it does not clarify the extent and scope of the delegated authority, how it could be exercised jointly with HHS-OIG, and what impact it has on False Claims Act (FCA) cases.

On October 2, 2026, the Centers for Medicare & Medicaid Services (CMS) issued its Final Rule (“Final Rule”) implementing the “Global Benchmark for Efficient Drug Pricing Model” (“GLOBE Model”)—a new mandatory Medicare payment model under section 1115A of the Social Security Act.

Healthcare organizations face unprecedented cybersecurity challenges in an increasingly hostile threat environment. In response to major breaches and security incidents affecting the industry, the Health Infrastructure Security and Accountability Act (HISAA) has been re-introduced and the U.S. Senate has advanced the Health Care Cybersecurity and Resiliency Act (HCCRA). This blog post summarizes the key provisions of these bills.

On October 1, 2026, the Department of Justice (DOJ) National Fraud Enforcement Division (NFED) issued clear directives regarding the priorities of its Corporate Enforcement Section (CES) in a memorandum (the “CES Memo”). Assistant Attorney General Colin M. McDonald announced that prosecutors will take “an aggressive, all-tools approach” to investigating fraud priorities, with health care fraud at the top of the list. The CES Memo follows an August 24, 2026, assignment of criminal health care investigations to NFED, and McDonald’s August 13, 2026, announcement of NFED fraud enforcement priorities—in which health care and corporate misconduct made the top five (see Epstein Becker Green blog post here).

On September 30, 2026, the attorneys general of Louisiana, Arkansas, and Alabama filed two coordinated federal lawsuits targeting the interstate telehealth medication abortion infrastructure that has grown since Dobbs v. Jackson Women’s Health Organization. Health care organizations, telehealth providers, and health systems operating in or adjacent to the reproductive health space should understand what these suits seek, who is named, and what the implications may be.

On September 24, 2026, the Centers for Medicare & Medicaid Services (CMS) issued a request for information (RFI) seeking input from stakeholders for purposes of establishing “reasonable and relevant” pharmacy contract terms and conditions between pharmacies and Part D plan sponsors under the Medicare prescription drug benefit, effective for plan years starting after January 1, 2029. This RFI was mandated by Congress in Section 6223(a) of the Consolidated Appropriations Act of 2026 (the “CAA”).

On September 10, 2026, Congresswoman Diana Harshbarger (R-TN) introduced H.R. 10336—the Dietary Supplement Innovation Act—which would modernize the U.S. Food and Drug Administration’s (FDA) drug preclusion provision to encourage pharmaceutical innovation while increasing and protecting consumer access to dietary supplements. Harshbarger asserts in a Fact Sheet that the drug preclusion provisions of the federal Food, Drug, and Cosmetic Act (the “FD&C Act”) “have created regulatory uncertainty for dietary supplement and drug manufacturers alike.”

States across the country are intensifying efforts to restrict minors’ access to weight loss and muscle building dietary supplements, with over a dozen state legislatures having introduced such legislation in 2025 and 2026. What began with New York—the first state to ban the sale of weight loss and muscle building supplements to minors, effective in 2024—has evolved into a broader movement attempting to address public health concerns without the scientific research to support such initiatives.

On September 11, 2026, California’s Office of Health Care Affordability (OHCA) Department of Health Care Access and Information (HCAI) released advance notification of proposed emergency regulatory action (the “Proposed Emergency Regulations”) regarding material change health care transactions. The Proposed Emergency Regulations—subsequently submitted to the state’s Office of Administrative Law (OAL)—further implement California’s AB 1415[1] respecting state oversight of private equity (PE) groups, hedge funds, and management services organizations (MSOs) operating in the health care space. As EBG wrote at the time of signing in 2025, AB 1415, which took effect January 1, 2026, represented a significant change for PE groups, hedge funds, and MSOs in the state by expanding OHCA’s notice requirements.

[1] Cal. Stats. 2025, ch. 641

On September 18, 2026, the U.S. Department of Justice (DOJ) announced revisions to two sections of the Justice Manual (JM) in an effort to strengthen the “fight against fraud” in False Claims Act (FCA) and other civil enforcement matters. The revisions clarify and reinforce limits on the use of sub-regulatory guidance in DOJ litigation and on when DOJ will seek dismissal of qui tam actions.