Compliance Sweep, week of Aug 30, 2026

An August 28 correcting amendment addresses omissions and typographical errors in the June 4 federal Independent Dispute Resolution Operations rule. Treasury, Labor, HHS and OPM identify errors in regulatory text, amendatory instructions and cross-references, including missing payment-determination provisions. The correction is effective August 28 and applicable beginning August 3, the underlying final rule’s effective date. HHS republished 45 CFR 149.510(c) in full because incomplete text affected that paragraph.

The restored binding-determination language preserves exceptions for fraud or evidence of intentional material misrepresentation about the claim presented to the certified IDR entity. It limits judicial review to the specified grounds in 9 USC 10(a)(1)–(4). The departments explain that the amendment aligns the published regulation with policies already addressed through rulemaking. Correcting the text therefore requires attention to applicable disputes and templates, but does not announce that every completed determination must be reopened or that the original final rule’s substantive policy was abandoned.

CDPH’s August 27 AFL 26-28 describes SB 164’s HHA licensing moratorium beginning June 29. New initial licenses and branch additions are barred during the moratorium, with written unmet-need exceptions. Changes of ownership within five years of initial licensure have separate continuity-of-care or financial-hardship-and-unmet-need exceptions. Applicants pending as of June 29 must respond as specified by October 9, choosing withdrawal or providing the required continuation/exception material; failure to respond results in automatic withdrawal. Neither the October deadline nor the eventual end of the moratorium had occurred by the September 5 cutoff.

For currently licensed agencies, management-personnel forms, résumés and current affiliations have a separate one-time March 31, 2027 deadline, alongside initial-application and 10 business-day change submissions. The roles are administrator and designee, and director of patient care services and designee; branch offices of parent HHAs are exempt from these submissions. Private-HHA licensure applicants must provide fingerprints for owners with at least 5 percent interests. Expanded licensing grounds include the applicant/licensee’s LEIE listing and failure of management to cooperate with inspections, rather than a blanket assertion that each management or ownership person independently triggers the stated LEIE ground.

AB 1760 became Chapter 167 on August 31 and addresses dentistry licensure evidence and examinations, elective facial cosmetic surgery permits, dental-assistant provisions and radiation-safety course approval. The final chapter establishes the law’s content, while ordinary commencement is January 1, 2027. Existing radiation-safety course approvals have a separate transition ending January 1, 2028. Signature should therefore be distinguished from permission to apply every new requirement immediately.

The course provision requires at least 32 hours: eight didactic,12 laboratory and 12 clinical. Distance learning may supply didactic instruction with the stated technology and assistance safeguards and must be completed before laboratory instruction. Required supervised laboratory and clinical practice remains separate. Providers with existing approvals must apply under the new process to offer courses on or after January 1, 2028. Dental-assistant duties also retain supervision, education and competency conditions, so the different licensing and course provisions need role-specific review rather than a single blanket scope expansion.

AB 2341 became Chapter 170 on August 31 with an urgency clause taking effect immediately. Government Code 7299.7 requires emergency-information translation when at least 5 percent of the jurisdiction’s population speaks English less than very well. It then requires translation into each language spoken by at least 5 percent of that limited-English population. The second threshold uses a smaller, specifically defined denominator rather than all residents.

Local agencies must use American Community Survey data or an equally reliable source, reassess every five years, and provide translated information that is as comprehensive, actionable and timely as English information. The law encourages culturally competent community participation and defines local agencies as cities, counties, cities and counties and their departments. A separate state sampling/reporting process begins January 1, 2027. That later oversight date does not defer the urgency law or impose the local-agency duty on every private hospital or provider.

OCR’s September 3 letter describes Title VI and Section 1557 protections when antisemitic discrimination involves actual or perceived Jewish ancestry, ethnic characteristics, Israeli national origin or another protected ground. It addresses HHS-funded health care, clinical training, education, research and other covered operations. Recipients cannot use contractor or affiliation arrangements to accomplish prohibited discrimination indirectly. Individualized clinical or safety judgments applied without protected-status discrimination remain distinct from unlawful unequal treatment.

The letter discusses harassment under applicable legal theories, retaliation and restoration of equal access while preserving First Amendment protections. Religious nondiscrimination and Medicare/Medicaid visitation rules have their own bases and reasonable clinical restrictions. OCR also states the statutory limits on its Title VI employment jurisdiction rather than claiming authority over every employment-discrimination matter. Suggested measures include accessible complaints, staff training, consistent documented responses and follow-up. The letter gives no new universal implementation deadline or automatic answer to every disputed incident.

APL 26-014 requires health care service plans to submit a Report/Other item through eFiling on or before October 1, 2026 using the title “Contracted PBMs and Pharmacy Delegations.” Its ExhibitE-1 must identify currently contracted PBMs and PBMs with contracts effective January 1, 2027, list delegated functions and state whether contracting will continue beyond that date. The filing is therefore both a current inventory and a forward-looking contract review.

The exhibit also asks whether the plan confirmed that each contracted PBM submitted a DMHC license application. That confirmation is separate from ensuring all contracted PBMs are licensed before January 1, 2027, as the APL reminds plans. Questions go through the assigned Office of Plan Licensing reviewer. Both dates remain future at the September 5 cutoff; the letter does not prove that a plan has filed or that a particular PBM holds a license.

DHCS’s August 31 stakeholder update announced a draft Children and Youth Data Sharing Authorization Guidance toolkit for comments through September 9. It describes practical scenarios and workflows for care partners coordinating behavioral health, physical health, social services, housing and other supports. The feedback opportunity remains ahead of the September 5 cutoff; the announcement does not present the draft as final guidance or change underlying consent requirements.

The update says the toolkit builds on previous DSAG and state information-sharing resources to explain when consent may be needed and which state and federal laws apply. It invited comments in the document and emailed responses. The retained announcement does not establish the legal answer to a specific scenario in the underlying draft. Organizations should distinguish that limited announcement from an authoritative permission to share an individual child’s information or a claim that all cross-sector disclosures have the same consent basis.

The September 1 enrolled version of AB 173 proposes denial or termination of Medi-Cal enrollment when an applicant or provider discloses a preceding-five-year affiliation involving a disclosable event and DHCS finds an undue risk of fraud, waste or abuse. It uses the federal affiliation/event definitions and 42 CFR 455.107(f) risk factors. The original history record shows August 31 concurrence and enrollment processing; no later presentation or signing event is part of this edition’s September 5 cutoff.

The proposal allows risk-based action despite full and timely disclosure, but says legally protected health care activity cannot establish fraud, waste or abuse merely by its nature. Implementation of the section depends on all necessary federal approvals and available federal financial participation without jeopardizing funding. Existing provider information obligations, consequences for missing or false disclosures and the Section 14043.65 proceeding route remain in the proposed framework. It does not make an affiliation automatically disqualifying or establish that federal approval has been obtained.

The August 30 enrolled AB 539 would generally keep an approved prior authorization for an in-network provider’s service valid for one year from approval, unless the treating provider requested a shorter period. Plans and insurers could authorize longer periods. The proposal amends both regulated-plan and insurer provisions while retaining existing protections for authorized services already rendered in good faith. At the September 5 cutoff, the proposed one-year duration is not an operative new obligation.

A prescription-drug authorization could not exceed a validity period established by state or federal law or regulation. The one-year period also would end with a lawful termination of coverage under the issuing plan or insurer, except where the identified continuity provision or other applicable law required otherwise. Those conditions separate the duration of an approval from continuing coverage, expanded benefits or a general payment guarantee. Implementers would need to identify the actual product, service and coverage circumstances if a final law were adopted.

The August 28 amended Senate AB 1018 would regulate systems that profile people to make or facilitate consequential decisions, including health care, insurance and employment. Its AI/automated-system definition excludes routine tools and does not cover every generative AI use. HIPAA covered entities doing business in California and business associates’ services to them have a stated exclusion, with exceptions for employment, patient financial assistance and the pre-decision notice duty. FDA-regulated devices and specified regulated research, laboratory and production uses have separate exclusions.

For covered uses, developers would provide use, tuning and technical documentation, while deployers would give pre-decision notice and adverse-outcome explanations under the stated emergency and other exceptions. Deployers with more than 25 employees would provide specified correction and appeal opportunities with 30 business-day processes. The proposal retains applicable privacy and discrimination protections and does not authorize otherwise unlawful uses. It therefore calls for use- and role-specific analysis, rather than treating every hospital AI tool as subject to the same proposed obligations.

AB 1199’s September 4 enrolled proposal would revise hospital medical-staff reappointment and recurring competency provisions to at least every three years. It addresses medical-staff governance and general acute care and acute psychiatric hospital controls. It would also prohibit CDPH from requiring routine reappointments more often than every three years. That pending text does not itself extend an individual appointment, and no final enactment is included within this edition’s September 5 boundary.

Initial competency demonstration, professional and ethical controls, self-governance and periodic review of clinical experience remain part of the framework. The retained provisions also preserve accurate medical-record review and equal treatment of MD and DO qualifications subject to the stated conditions. A routine cycle is therefore distinct from ongoing quality oversight, a particular practitioner’s competence review or other applicable accreditation and contractual requirements. Hospitals would need to reconcile the final law with bylaws and those other obligations before changing reappointment dates.

The September 3 enrolled AB 1405 proposes an AI Auditor Registry and prohibits offering, selling or conducting a covered audit without registration beginning January 1, 2029 if enacted. A covered audit assesses controls, processes or systems necessary for compliance with state law, and the auditor acts for a third party. Those definitions distinguish the proposal from every internal or voluntary technical review. By the September 5 cutoff, the available version was enrolled legislation, so the 2029 date was a proposed target rather than an enacted compliance deadline.

The proposed framework includes registration disclosures, material updates within 90 days, auditee reports addressing results and limitations, and at least 10 years of supporting records. It provides independence and competence safeguards, protection for employee reporting, and specific professional-standard routes for qualifying accountancy professionals and firms. Removal involves notice and a reasonable opportunity to cure or contest, with separate accountancy complaint procedures. Registration is expressly not state endorsement. These proposed conditions require final legislative and agency action before an organization can rely on an operational registry or registration obligation.

The September 1 enrolled AB 1930 would generally require a person or entity located, headquartered, incorporated or doing business in California to notify the Attorney General at least seven business days before producing records under specified legal-process investigations of legally protected abortion or gender-affirming care. The notice would include the demand, with permitted confidentiality redactions. A shorter federal-law or federal-obligation response time, including a contract, grant or Medicare participation condition, instead permits notice no later than contemporaneous production and triggers the stated best-efforts production timing.

The notice rule would not apply to court-ordered demands, California state/local agency demands, qualifying attestations or records where the protected-care information is incidental to the investigation. The attestation alternatives cover nonpunitive protected-care use, identified conduct unlawful under California law or identified California professional-discipline grounds; recipients may rely on representations. The bill provides Attorney General intervention and enforcement mechanisms, including a $15,000 false-attestation penalty. At the September 5 cutoff this was proposed legal-process control, not a universal prohibition on producing care records.

The September 1 enrolled AB 1979 would require covered health facilities, clinics and medical offices to take reasonable steps to preserve a licensed provider’s independent professional judgment when clinical decision-support output informs patient care. It would prohibit AI from independently performing a legally licensed clinical function or directing unlicensed personnel to perform it. Supervised trainees working toward licensure have an exception. Documentation and communication that do not involve professional judgment, and specified administrative systems, are outside the identified clinical requirements.

The proposal separately would classify businesses offering defined consumer health care chatbots for information management or diagnosis, treatment or management as providers under CMIA. The chatbot definition includes adaptive natural-language responses, health-service marketing and use of collected, generated or inferred health information. This privacy classification carries confidentiality and improper-use/disclosure rules but does not make the business a provider under other laws. At the September 5 cutoff, both the clinical and chatbot changes remained proposed.

The August 30 enrolled AB 2311 would authorize qualifying health care districts and sole-member district nonprofits owning or controlling a general acute care hospital to employ physicians and charge for services until January 1, 2037. The hospital must have received a Distressed Hospital Loan before January 1, 2025 or meet the greater-than-75-percent combined Medicare/Medi-Cal payor test, measured as specified; under the payor route both hospital and any system must qualify. Medical-staff approval by a bylaws-compliant affirmative vote would also be required. This route remained proposed on September 5.

The district, nonprofit and controlled hospitals could not direct professional judgment. Positions would be additional to, rather than supplant, January 1, 2026 medical-staff positions, while mutually agreed contract amendments remain possible; prospective employees must be offered contracting instead. Beginning in 2028, qualifying employers would publish annual recruitment/retention reports by July 1. The employment authority ends January 1, 2037 even though the broader temporary section becomes inoperative July 1, 2037 and is repealed January 1, 2038.

The August 27 enrolled AB 2343 would condition specified treatment-program certification and facility licensure or renewal on participation in a DHCS-designated or designed consumer protection platform. The platform would publicly describe evidence-based practices, services and patient/family reviews, validate submissions and refer quality concerns. Participation would be required only if DHCS determined sufficient dedicated funding was secured; costs could not be shifted through increased existing licensing/certification fees or other departmental fee structures. At September 5 the bill remained pending.

The proposed categorical exemptions cover programs/facilities contracted for Medi-Cal treatment or with DHCS, county behavioral health or county substance-use divisions, or receiving state, county or federal substance-use program funding. Those entities could participate voluntarily. The independent public resource must meet conflict, no-provider-payment and public-access conditions, and platform participation could not be used to evaluate publicly funded treatment bids, networks, reimbursement or contract performance. Applicability would therefore depend on funding and program relationships as well as eventual enactment.

The August 30 enrolled AB 2448 would add an express requirement to enable the sensitive-service security capabilities addressed in Civil Code 56.101(c), rather than only develop capabilities, policies and procedures to enable them. The provision covers specified Section 56.06 businesses electronically storing or maintaining sensitive-service medical information on behalf of listed entities. The proposed text retains the July 1, 2024 date in the existing framework; it is not a newly announced future implementation deadline. The amendment remained pending as of September 5.

The listed controls limit authorized access, prevent specified out-of-state handling, segregate gender-affirming, abortion-related and contraceptive information, and provide automatic disabling of out-of-state access to segregated records. Fees must be consistent with the cited federal rule. Subdivision (c) expressly excludes contractors, health plans and providers as defined in Section 56.05, so this business requirement cannot simply be assigned to every provider with an EHR. The broader confidentiality and record-integrity provisions remain distinct.

The September 3 enrolled AB 2562 would add a suicide-prevention plan to the required operation-manual contents for alcohol or other drug programs and expressly require a licensed recovery/treatment facility to develop a plan. The proposal permits DHCS implementation of the facility requirement through bulletins or county/provider letters after stakeholder input until regulations are promulgated. The specified January 1, 2031 deadline is DHCS’s regulation milestone, not a facility compliance deadline. The bill remained pending at the September 5 cutoff.

The amended framework also retains admission protections for prescribed treatment medication and substance use, individualized relapse planning and continuity considerations, and on-site opioid-antagonist availability with trained staff and personnel-file documentation. Those retained controls provide context for incorporating suicide prevention, rather than proving all the provisions were newly created by this bill. The text separately addresses withdrawal-management services and the existing regulatory implementation schedule; licensed-facility planning and certified-program manual duties must be matched to the actual setting.

The September 4 enrolled AB 2575 would prohibit retaliation or discrimination based solely on a direct-care worker’s override of, or reliance on, clinical decision-support output when using professional judgment within scope. It preserves duties concerning care standards, licensing, independent judgment and lawful operating policies; a policy requiring deference to AI would not count as such a duty. The Labor Commissioner could investigate and enforce retaliation protections, without its determination deciding malpractice or professional-license proceedings. These changes were proposed, not enacted, on September 5.

The proposal also would prevent a defendant that developed, modified, selected or deployed a clinical decision-support system from arguing that a worker’s failure to override its output was a superseding cause severing liability for alleged harm. It does not foreclose other causation/foreseeability defenses, comparative-fault evidence or evidence of reasonable precautions and disclosures. The provision excludes the specified professional-negligence actions against licensed/certified direct-care practitioners. These limits distinguish a particular defense restriction from automatic vendor liability or immunity for clinical decisions.

The September 3 enrolled AB 2598 would require a general acute care hospital or skilled nursing facility to make documented, good-faith attempts to contact known next of kin within 72 hours of death using available contact information. The provision also covers a body transferred to a hospital after death. Notification of a designated resident representative or the person’s prior written instruction against next-of-kin notification can satisfy the specified alternative; transferring the body alone is not that alternative. The requirements remained proposed as of September 5.

When the stated unsuccessful-search or alternative-notice conditions apply, notice to the county public administrator would be due within two business days, accompanied by available identifying information. The proposed $200-per-day, $50,000-capped civil penalties have distinct clocks: next-of-kin notice uses the reasonable-attempt-to-actual-knowledge period, while administrator notice runs from the fifth business day after death. A disputed penalty has a ten-working-day hearing-request period. CDCR-custody deaths are excluded, and other facilities retain the separate immediate-notice rule for deaths without known kin.

HHS’s August 24 RFI asks whether routine or universal, risk-based and shared clinical decision-making categories adequately describe federal vaccine recommendations. It also asks whether other categories should be used and which considerations should guide future recommendations. Comments identified by docketHHS-OS-2026-0332 must be received by September 20 to be assured consideration. The consultation remains open at the September 5 coverage cutoff and does not itself amend any vaccine recommendation.

The notice distinguishes routine recommendations, where vaccination is generally the default absent contraindications, from risk-based recommendations for specified circumstances and shared decision-making, which has no default for an individual. It asks about evidence, uncertainty, informed choice, religious freedom, communication and consequences for legal and program requirements. Its discussion records both criticisms and defenses of shared decision-making. HHS describes recommendations as distinct from mandates; an RFI about the framework does not require an organization to replace existing clinical orders or coverage communications before a later decision.

The FCC’s August 31 proposed-rule notice in WC Docket 17-310 seeks input on the Rural Health Care Program. Initial comments are due September 30 and replies October 30. One group of questions concerns how to compare similar services and rural areas when calculating telecommunications support, including the burden and possible replacement of existing cost studies. These are possible changes for consultation, not newly finalized funding formulas.

The notice also asks about lower-cost backup services, an eligible-services list, performance metrics for processing funding applications, and removing evergreen-contract approval and annual-report requirements. Providers may experience these proposals differently depending on their service arrangements and documentation burdens. The notice’s three-part organization separates support calculations, supported services and program processes, allowing comments to identify a specific procurement, continuity or administrative effect rather than treating every option as an adopted program change.

OIG issued its contract-surveyor audit on September 2 and posted it September 4. ReportA-04-24-08105 examines CMS oversight as states increasingly relied on contractors amid staffing shortages and survey backlogs. OIG found that CMS had issued guidance but had not monitored whether state practices achieved its objectives. Every one of the 14 states surveyed could improve policies or procedures for ensuring contract surveyors met federal requirements.

The recommendations call for CMS to include worker classification in its quality-improvement/evaluation system and confirm that state agencies have contractor-compliance controls. CMS agreed with both. The report describes increased oversight risk, not a finding that every contractor failed qualifications or every resulting survey was invalid. It directs administrative improvements to CMS and states and does not announce a new nursing-home implementation deadline or a facility exemption from responding to a survey.

A September 2 Privacy Act notice announces comparison of HHS Payment Management System grant-recipient and payment records with Treasury’s Do Not Pay Working System. The purpose is preventing or identifying improper payments and supporting recovery. The notice sets October 2 for public comments, effectiveness 30 days after publication and an end date of September 10, 2029. At the September 5 cutoff, these are announced future program dates, not evidence that the matching process already affected a particular recipient.

A potential match identifies the relevant database and is sent for grantor-agency review to determine whether further action is warranted. Identifiers may include names, taxpayer/entity identifiers, addresses, NPI and payment information. The program covers HHS grants paid through PMS as one agency-wide matching program and describes a matching-agreement waiver under the stated Treasury/OMB framework. A match is not automatically an adverse eligibility ruling, and the grant-payment scope should not be converted into a general Medicare claims edit.

The FTC announced a seven-day extension of the comment period for its August 19 personalized-pricing proposal, moving the date from September 18 to September 25. The proposal addresses personal-data-based pricing that estimates an individual consumer’s willingness to pay, particularly where consumers expect a commonly offered price. The extension supplies additional consultation time; it does not finalize the policy or establish a general health care pricing rule.

Where consumers reasonably expect nonpersonalized prices, the proposed statement calls for clear disclosure of personalization, its basis and the data types used. It discusses potential unfairness and deception under Section 5, including misleading explanations and underlying data practices. Ordinary supply-and-demand changes and settings where individual risk affects price are distinct. The statement does not claim power to ban personalized pricing in all circumstances, and adequate disclosure of price personalization does not by itself settle separate concerns about collection, use or consent.

OLC’s September 1 opinion withdraws its 1998 interpretation limiting PRWORA Section 404 reporting to the state agency administering the particular benefit program. It now reads “State” to include all component agencies in participating states. The TANF provision requires reporting at least four times annually and upon request, while SSI reporting uses the applicable agreements’ timing. The opinion does not make the two formulations identical or direct every private health care organization to provide patient records.

OLC characterizes the interpretation as prospective: it cannot retroactively alter TANF or SSI agreements made under the earlier reading, and agencies cannot recover funds where states complied with then-existing executive interpretations. The opinion addresses the statutory knowledge standard and privacy-related arguments, leaving actual entity status and funding arrangements important to implementation. State health and human-services organizations therefore need a legal assessment of the affected agreement and disclosure authority, rather than assuming either a universal quarterly rule or unrestricted disclosure.

CalPrivacy’s September 3 Enforcement Advisory 2026-01 says data brokers must provide true and correct annual registration information. It warns that inaccurate responses can trigger a 200 dollar daily fine for failing to register as required, and that the law does not distinguish inadvertent mistakes from intentional misrepresentations when both produce incorrect information. The advisory concerns compliance with existing registration requirements, not a new general registration duty for every health technology company.

The examples ask brokers to check collected data types, changes in recipients, GenAI developer relationships and rights-request metrics against their filings and privacy disclosures. The advisory also describes DROP-account requirements and the registry’s role in helping consumers exercise deletion rights. It expressly supplies no safe harbor, new substantive policy or alternative relief; statutes and regulations control any conflict. Applicability still depends on the actual business activity and statutory definitions rather than the sensitivity of health-related data alone.

USPS’s September 1 final rule requires both an Intelligent Mail package barcode and an Intelligent Mail matrix barcode for Free Matter parcels used by eligible blind or other physically disabled users, effective October 4. The revised DMM provision expressly covers outbound and return parcels and refers to the applicable preparation and uniqueness standards. The rule explains that the barcodes support tracking, processing visibility and hazardous-material handling through the correct service-type codes.

Qualifying Free Matter remains exempt from the Hazmat Handling Fee, but commercial mailers can incur the Hazmat Noncompliance Fee for improperly declared or labeled hazardous materials. Commercial pieces that fail the unique-barcode requirements can also incur the Package Quality Noncompliance Fee. The rule therefore separates a fee exemption from compliance with mailing preparation and safety controls. At the September 5 cutoff, the October 4 changes remain a future preparation milestone.