Health Care

In 2024, the HHS Office of Inspector General added the University of Colorado Health d/b/a/ UCHealth, an established provider, to the Heightened Scrutiny list after UCHealth settled an FCA case for $23 million, without an admission of wrongdoing.

In 2024, the FTC and state attorneys general pursued various theories of liability against a diverse array of entities offering health care or health care–related services, and employed numerous different enforcement tools and partnerships. We expect that the agencies will continue developing these strategies in 2025.

In 2024, the COVID-19 Fraud Enforcement Task Force, in conjunction with five COVID Fraud Enforcement Strike Forces and other government agencies, has resolved many significant criminal and civil pandemic fraud cases. More civil pandemic fraud enforcement actions and continuing criminal actions are expected in 2025.

Our 2025 edition of EnforceMintz reflects on health care enforcement trends, predicts how health care enforcement may evolve, and offers practical guidance about what these trends and predictions mean for health care providers, payors, and other stakeholders.

Over the past two years, the Department of Justice has actively incentivized companies to voluntarily self-disclose potential civil and criminal violations. This article explores the DOJ’s new policies, the benefits of self-disclosure, and the challenges companies face in complying with these initiatives.

In 2024, federal courts issued significant False Claims Act decisions for the health care and life sciences industries. These decisions further develop the FCA scienter standard addressed by the Supreme Court in its 2023 SuperValu decision and reexamine the constitutionality of the FCA’s qui tam provisions. A circuit split on the interpretation of “causation” for FCA suits based on alleged violations of the Anti-Kickback Statute (AKS) has also emerged.

In 2024, DOJ and the OIG expanded telehealth enforcement beyond traditional telefraud schemes, addressing compliance with state corporate practice and telehealth-specific billing codes. Two cases, including the first criminal telemedicine prosecution, signal a trend of heightened regulatory scrutiny for the maturing telehealth industry.

Following the Supreme Court’s decision in Securities and Exchange Commission v. Jarkesy, holding that the Seventh Amendment entitles defendants to a jury trial when the SEC seeks to impose civil monetary penalties for a securities fraud violation, parties are starting to assert Jarkesy-based arguments in appealing administrative actions of the Department of Health and Human Services.

As opioid-related enforcement efforts continued across the opioid supply chain in 2024, the government pursued criminal charges in two matters that resulted in significant settlements. Additionally, a number of recent cases against pharmacies involve a common theory of liability based on the Controlled Substances Act, which served as the basis for civil liability under the False Claims Act.

In 2024, DOJ resolved several noteworthy False Claims Act cases against hospitals and health systems, obtaining numerous large recoveries in cases where Stark Law and federal Anti-Kickback Statute violations served as a predicate for FCA claims.

In 2024, the Department of Justice ramped up cybersecurity enforcement under the Civil Cyber-Fraud Initiative (CCFI), targeting entities that failed to safeguard PHI and PII in federally funded contracts. Key cases highlight trends in False Claims Act litigation and underscore the importance of cybersecurity compliance heading into 2025.

In 2024, the Department of Justices and Centers for Medicare & Medicaid Services intensified enforcement in Medicare Advantage and Part D, with a focus on risk adjustment audits and Star Ratings disputes. Key developments, including litigation and regulatory changes, signal heightened scrutiny for MAOs, PDP Sponsors, and their vendors in 2025.

The latest entrant in a national wave of policymakers enacting health care market oversight laws that have a significant impact on providers and investors, Massachusetts Governor Maura Healey has signed into law House Bill 5159, “An Act enhancing the health care market review process” (the Act). The product of nearly five months in conference committee following disagreeing votes of the House and Senate, the Act substantially broadens the applicability of one of the oldest state health care market review laws in the country.  The changes brought about by the Act will increase financial transparency and the Commonwealth’s ability to examine both the anticipated and long-term impact of health care transactions. The Act expands the authority of the Massachusetts Attorney General’s Office (AGO), the Center for Health Information and Analysis (CHIA), and the Health Policy Commission (HPC) to require financial, structural, and operational information from a wide array of health care providers and those seeking to provide them with investment, management, and other services. 

Last fall at the Safeguarding Health Information: Building Assurance Through HIPAA Security 2024 conference, U.S. Department of Health & Human Services Office for Civil Rights (OCR) promised that before year’s end, it would publish amendments to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule. On December 27, 2024, OCR made good on that promise and released an unpublished version of the Security Rule amendments proposal.

Governor Newsom signed over 1300 bills and vetoed almost 190 bills in 2024.  Consistent with prior years, in 2024, California enacted multiple laws significantly impacting the health care industry.  From artificial intelligence (AI) to providers to health plans, these new laws require proactive efforts to ensure on-going compliance.

We highlight below the most important of the heath care-focused bills passed during this year.  Unless otherwise noted, these new laws are effective January 1, 2025.

As part of its Modernization Initiative, the Department of Health and Human Services’ Office of Inspector General (OIG) recently published its first industry-segment specific Compliance Program Guidance, which focuses on skilled nursing facilities (SNFs) (SNF ICPG). Since 1998, the OIG has issued voluntary compliance program guidance documents, each tailored to a specific segment of the health care industry and providing important insights on specific risk areas and tips for implementing an effective compliance program.  In April 2023, the OIG announced a long overdue modernization of these compliance program guidance documents and rolled out its General Compliance Program Guidance the following November.  

A year after announcing its first-in-the-nation effort to increase access to pregnancy-related healthcare, New York’s “paid prenatal leave” law is officially set to take effect on January 1, 2025.  Employers will be required to begin offering New York employees 20 hours of paid leave during a 52-week period to attend to prenatal medical needs, which is in addition to existing sick/safe leave already required in New York.  The New York State Department of Labor recently released an FAQ document to assist employers in implementing this new leave.  We detail some of the most pertinent guidance below.

Telehealth companies and other industry stakeholders have had a watchful eye towards the end of 2024 and the impending “telehealth cliff” as COVID-era Drug Enforcement Agency (DEA) flexibilities and Medicare expanded telehealth coverage are set to expire. Although a recent temporary joint rule from the DEA and the Department of Health and Human Services (HHS) along with the 2025 Medicare Physician Fee Schedule final rule has provided some hope, questions regarding telehealth access in 2025 and under a new Administration remain unclear. Further, calls continue for increased oversight of telehealth services. 

Building upon prior issues and summarizing activity from July through September, the Fall 2024 PBM Update highlights federal legislative activity and oversight, state legislative activity and oversight, and other noteworthy events and trends affecting the PBM industry.

On November 12, 2024, the drug manufacturer Johnson & Johnson (J&J) filed a lawsuit against the Health Resources and Services Administration (HRSA) in the U.S. District Court for the District of Columbia. The lawsuit relates to J&J’s proposal to require certain 340B covered entities – specifically, disproportionate share hospitals (DSH) – that purchase J&J’s drugs Stelara and Xarelto under the 340B Drug Pricing Program to do so under a rebate model. J&J is challenging HRSA’s threatened enforcement action against the drug maker.