Health Care

On April 8, 2026, the Department of Health and Human Services’ Office for Civil Rights (OCR) released an educational video, Risk Management Under the HIPAA Security Rule, detailing the risk management requirements under HIPAA as well as findings and conclusions from OCR’s investigations. While framed as an educational outreach video, it sends a clear enforcement message: risk management is mandatory, ongoing, and increasingly scrutinized by OCR. Drawing on recent investigations, OCR emphasized that risk management is not a one-time compliance exercise or paperwork obligation. Rather, regulated entities must implement, maintain, and document security measures that actually reduce risks to electronic protected health information (ePHI). When entities are aware of risks but do not act on them, they are left exposed, both to cyberattacks and enforcement actions. In this blog post, we provide an overview of the HIPAA Security Rule risk management requirements and highlight key takeaways from OCR’s video.

The April 2026 edition of FDA in Flux highlights significant developments shaping the regulatory landscape for medical, life sciences, and consumer product sectors.

In McKee Foods Corp. v. BFP Inc., decided April 7, 2026, the Sixth Circuit affirmed that ERISA preempts two Tennessee laws intended to prevent pharmacy benefit managers (PBMs) from steering patients to affiliated pharmacies. The court reasoned that the laws constituted impermissible interference with ERISA plan design and administration, a conclusion it reached by distinguishing the Tennessee statutes from the state laws the Supreme Court found permissible in Rutledge v. PCMA (2020). This case raises questions about the enforceability of the growing body of state legislation regulating PBMs. 

While federal and state legislators contemplate the next wave of PBM and drug pricing reform, legislatures in Virginia and Ohio have already sent significant legislation addressing prescription drug pricing and pharmacy benefit manager oversight to their respective governors in early 2026. 

Despite the flurry of reform activity throughout the first quarter of 2026, the pace of new PBM regulation and drug pricing reforms shows no sign of tapering off. Instead, both federal and state legislatures continue to target PBMs and drug pricing practices.

Washington’s Governor signed House Bill 2548 (Chapter 222, Laws of 2026) into law on March 25, 2026, to take effect June 11, 2026, to amend the state’s health care transaction review law at Chapter 19.390. The current law requires pre-transaction notice for certain material transactions involving hospitals, hospital systems, or provider organizations. 

Federal Trade Commission (FTC) Chairman Andrew Ferguson announced the launch of a Healthcare Task Force on March 20, 2026, signaling a significant escalation in the FTC’s approach to healthcare oversight. The directive aligns with President Trump’s February 25, 2025 Executive Order, Making America Healthy Again by Empowering Patients with Clear, Accurate, and Actionable Healthcare Pricing Information (Executive Order), and reflects FTC’s intent to institutionalize and broaden healthcare enforcement while shaping policy moving forward. 

The first week of March 2026 brought coordinated congressional oversight targeting the Trump administration's most-favored-nation (MFN) drug pricing initiative. Congressional leaders sent several letters to President Trump and pharmaceutical manufacturers requesting details about the MFN agreements such manufacturers struck with the administration, demonstrating the budding congressional scrutiny of the MFN pricing initiatives, where the impact on patients and state budgets still remains uncertain.

PBM Reform 2026 explained. Watch this webinar on CAA 2026 PBM changes, DOL proposed rules, FTC enforcement, and compliance priorities.

The March 2026 edition of FDA in Flux highlights significant developments shaping the regulatory landscape for medical, life sciences, and consumer product sectors.

The Second Circuit weighs materiality under New York Executive Law Section 63(12), the scope of FTC injunctions, and the NYAG’s bid for damages in the Prevagen case.

HHS OCR launches civil enforcement of the Part 2 Final Rule. Learn key compliance updates for SUD records, HIPAA alignment, consents, notices, and breaches.

The Federal Bar Association’s 2026 Qui Tam Conference featured two sets of remarks from Deputy Assistant Attorney General of the U.S. Department of Justice’s (DOJ) Commercial Litigation Branch, Brenna Jenny (DAAG Jenny).  In her keynote address, DAAG Jenny offered insights into the current administration’s False Claims Act (FCA) enforcement philosophy and priorities. DAAG Jenny also addressed “Illegal DEI” FCA enforcement during a panel discussion and offered the Trump administration’s view of discrimination as a basis for potential FCA liability. Various other current and former DOJ officials offered insights on wide-ranging topics.  Below, we summarize the top 10 highlights from the Qui Tam Conference.

The February 2026 edition of FDA in Flux highlights significant developments shaping the regulatory landscape for medical, life sciences, and consumer product sectors.

Legal battle over Prevagen heads to the Second Circuit as FTC and NYAG dispute nationwide injunction, state authority, and standards for dietary supplement claims.

On January 30, 2026, the Department of Labor released a proposed rule (Proposed Rule) that would end long‑running confusion about how ERISA disclosure obligations apply to PBMs under the Consolidated Appropriations Act, 2021, and give fiduciaries of ERISA‑covered self‑insured group health plans significantly expanded visibility into PBM services and compensation. The proposal pairs broad compensation transparency with comprehensive audit rights covering PBMs and their affiliates, agents, and subcontractors, including PBM‑affiliated brokers and consultants.

The Proposed Rule and the Consolidated Appropriations Act, 2026, both of which were announced last week, will materially impact the PBM industry, particularly PBM’s arrangements with their plan clients. Below we provide an initial summary of the Proposed Rule’s key provisions and discuss its anticipated impact on PBMs, self-insured group health plans, and other stakeholders. 

On February 3, 2026, Congress passed – and the President signed – the Consolidated Appropriations Act, 2026 (2026 CAA). The legislation includes a long‑anticipated and far‑reaching package of PBM reforms. These reforms draw from the PBM Reform Act of 2025 and other legislative proposals and will significantly reshape PBM operations across the commercial market and Medicare Part D beginning in 2028–2029.

On January 22, 2026, the Department of Justice (DOJ or the Department) Criminal Fraud Section issued its 2025 Year in Review summary (YIR Summary). Our more detailed analysis of the full YIR Summary can be found here. DOJ’s Health Care Fraud Unit (the HCF Unit) is focused on “prosecuting complex health care fraud matters and cases involving the illegal prescription, distribution, and diversion of controlled substances.” To carry out its mission, in 2025, the HCF Unit operated 8 Health Care Fraud Strike Forces in 26 federal judicial districts across the nation. The HCF Unit’s reported average return on investment is $106.76 per $1 spent. 

As the telehealth industry is acutely aware, Medicare’s telehealth flexibilities and the Acute Hospital Care at Home Program, both of which have been in place since 2020, expired on January 31, 2026. While on that day the Senate passed a bipartisan minibus legislative package funding several federal agencies including the Department of Health and Human Services, the House was unable to immediately pass the legislation. As such, there has been a partial government shutdown – until now.