Compliance Sweep, week of Sep 13, 2026

The federal departments responsible for independent dispute resolution corrected the June 4 IDR Operations rule on August 28, with the corrections applicable beginning August 3. The amendment repairs omitted text, drafting instructions and cross-references across the Treasury, Labor and HHS regulations. Because the HHS payment-determination paragraph contained incomplete text, the departments republished 45 CFR 149.510(c) in full. The preamble describes the corrections as restoring the policies addressed in the proposed and final rules, rather than opening a new policy consultation.

The restored binding-determination provision makes a certified IDR entity’s determination binding absent fraud or evidence of intentional misrepresentation of material facts presented about the claim. Judicial review is limited to the cases described in 9 USC 10(a)(1)–(4). These qualifications are part of the corrected text, alongside payment-determination procedures and related cross-reference repairs. An organization using a June publication or an older vendor template therefore needs to compare the actual corrected provisions; the correction does not itself announce a blanket reopening of previously resolved disputes.

CDPH’s August 27 AFL 26-28 explains the HHA licensure moratorium effective June 29, 2026 and the response required of applicants whose applications were pending that day. The moratorium covers new licenses, branch additions and specified service-area or out-of-area location changes. An exception requires CDPH’s written unmet-need finding; a change of ownership within five years of initial licensure has separate continuity-of-care or financial-hardship-plus-unmet-need grounds. Pending applicants must submit the applicable withdrawal intent, exception justification and documentation, or intent to continue a CHOW process by October 9. Failure to respond as specified results in automatic withdrawal.

The letter separately requires information for the administrator, administrator designee, director of patient care services and that director’s designee: HS 215 A or successor, résumé and current management affiliations. These filings accompany initial applications, changes within 10 business days, and a one-time submission by currently licensed agencies no later than March 31, 2027; branch offices of a parent HHA are exempt from these management-submission requirements. Private-HHA licensure applicants must provide fingerprints for owners holding at least 5 percent. The AFL also describes expanded licensing grounds, including an applicant or licensee’s LEIE listing and management noncooperation. It does not make every ownership interest a separate LEIE-based licensing ground.

California enacted AB 1760 as Chapter 167 on August 31. It revises dentistry licensure evidence and examination provisions, elective facial cosmetic surgery permit requirements, registered dental assistant provisions and radiation-safety course standards. These subjects do not share one immediate implementation date: the act follows ordinary January 1, 2027 commencement, while the course-approval transition identifies January 1, 2028. The chaptering event therefore establishes the final requirements without implying that every new provision was operative in September.

For radiation-safety courses, the enacted text requires at least 32 hours comprising eight didactic,12 laboratory and 12 clinical hours. Distance learning is permitted for didactic instruction with technology notice, assistance and completion before laboratory work; it does not replace required supervised laboratory or patient instruction. Existing approvals under the specified regulations remain until January 1, 2028, after which providers must apply under the new approval process. The act also preserves supervision, competency and scope conditions for dental-assistant duties. Credentialing and education programs need to map the relevant provision to their own role rather than treating a course certificate as expanded clinical authority.

AB 2341 became Chapter 170 on August 31 as an urgency statute effective immediately. GovernmentCode 7299.7 first asks whether at least 5 percent of everyone in a local jurisdiction speaks English less than very well. If that threshold is met, the local agency must provide emergency information in English and every language spoken by at least 5 percent of the jurisdiction’s population that speaks English less than very well. The second percentage therefore uses the limited-English population as its denominator, not the entire local population.

Agencies must use American Community Survey data or an equally reliable source and reassess language coverage every five years. Translated information must be as comprehensive, actionable and timely as English information, with culturally competent community assistance encouraged where feasible. The local-agency definition covers cities, counties, cities and counties, and their departments, including relevant emergency services. Starting January 1, 2027, the state Office of Land Use and Climate Innovation must survey a sample every three years. That later state oversight date does not defer the urgency law’s local translation duties or extend them to every private health care organization.

OCR’s September 3 letter explains how Title VI and Section 1557 apply to discrimination rooted in antisemitism in HHS-funded programs. It addresses actual or perceived Jewish ancestry or ethnic characteristics, Israeli national origin and other protected grounds, including patient care, clinical education, research and related covered operations. Recipients cannot accomplish through contractors or affiliations what the law prohibits directly. OCR distinguishes protected-status discrimination from individualized clinical, safety or operational judgments applied without discrimination.

The letter separately explains religious nondiscrimination in applicable programs and Medicare/Medicaid visitation protections, including reasonable clinical restrictions. It addresses harassment under the legal theory and facts involved, preserves First Amendment rights, and prohibits retaliation for protected complaints or participation. Its employment discussion recognizes limited Title VI jurisdiction rather than asserting general OCR authority over every employment dispute. Suggested measures include accessible reporting, responsible-staff training, consistent responses, restored access and follow-up; the letter creates no new universal implementation date.

DMHC’s September 3 APL 26-014 directs health care service plans to submit a Report/Other filing in eFiling on or before October 1, 2026 titled “Contracted PBMs and Pharmacy Delegations.” The required ExhibitE-1 covers each currently contracted PBM and any PBM whose contract will be effective January 1, 2027. It asks for the delegated functions and whether the plan intends to continue the contract beyond that date, making the filing a forward-looking contracting inventory as well as a current-provider list.

The fourth required item is whether the plan has confirmed that each contracted PBM submitted a DMHC licensure application. Application confirmation is distinct from the APL’s reminder that plans must ensure all contracted PBMs are licensed before January 1, 2027. The letter directs questions to the Office of Plan Licensing through the assigned reviewer. At the September 19 cutoff, both the October filing date and January licensing milestone remain ahead; the APL does not establish that any particular plan filed or any named PBM already received a license.

Governor Newsom signed AB 173 on September 18, and Chapter 252 records approval and filing that day. The health budget act takes effect immediately, while its Medi-Cal enrollment section carries specific implementation conditions. WIC 14043.2 directs denial or termination when an applicant or provider discloses an affiliation within the previous five years with a person or entity that experienced a disclosable event and DHCS determines an undue risk of fraud, waste or abuse. Federal definitions and the factors in 42 CFR 455.107(f) govern the affiliation and risk analysis.

Full and timely disclosure does not prevent DHCS from taking action when the affiliation poses the required undue risk. At the same time, legally protected health care activity cannot be treated as fraud, waste or abuse merely because of the nature of that activity. Implementation requires all necessary federal approvals and available federal financial participation without jeopardizing that funding. The section also preserves information-disclosure obligations, consequences for missing or false information and proceedings under Section 14043.65. The chapter therefore ends the bill’s pending status without proving that every new enrollment procedure was operational during this edition’s coverage.

AB 539’s enrolled proposal would require an approved prior authorization for a health care service requested by an in-network provider to remain valid for at least one year from approval, or for a shorter period requested by the treating provider. A plan or insurer could authorize a longer period. The proposed changes address both the Health and Safety Code and Insurance Code, alongside existing protections against rescinding an authorization after good-faith services have been rendered. The one-year rule was not an enacted requirement during this edition’s coverage.

The proposed minimum would not permit a prescription-drug authorization period longer than a period established by state or federal law or regulation. It also would not continue after the member’s coverage with the issuing plan or insurer ended consistently with law, except as otherwise required by specified continuity-of-care provisions or other applicable law. Those boundaries distinguish authorization duration from benefit expansion, uninterrupted coverage or a guarantee of payment in every circumstance. Utilization-management planning therefore needs the final disposition and precise product and treatment scope.

AB 1018’s retained proposal would regulate automated systems that profile people to make or facilitate consequential decisions, including health care, insurance, employment and patient financial assistance. Routine filters, calculators and databases are excluded, and a generative AI system is not covered merely because it generates content. The health-sector exclusion covers HIPAA entities doing business in California and business associates’ services to them, but preserves exceptions for employment, patient financial assistance and the pre-decision notice requirement. FDA-regulated devices and specified regulated laboratory, research and production uses have additional exclusions.

For covered uses, developers would provide instructions, fine-tuning information and technical documentation, with a specified financial-services exception. Deployers would provide pre-decision notice and adverse-outcome explanations, subject to medical-emergency and other specified exceptions. Correction and appeal opportunities would apply to deployers with more than 25 employees, with prescribed 30 business-day processes. The proposal also preserves relevant existing-law protections and does not authorize otherwise prohibited discrimination. These conditions make the roles, use and statutory exclusions central to applicability; the proposal does not establish a new duty for every AI deployment.

AB 1199’s retained enrolled proposal would change medical-staff reappointment and recurring competency provisions from the existing annual or biennial framework to at least every three years. It addresses medical-staff governance under the Medical Practice Act and the governing bodies of general acute care and acute psychiatric hospitals. The proposal would prohibit CDPH from requiring routine reappointments more frequently than every three years; it remained pending during the September 13–19 coverage window.

The proposed interval does not remove the requirement to demonstrate competence at the initial appointment or the medical staff’s responsibility for professional and ethical standards. The retained text preserves self-governance, periodic clinical review, accurate records and equal professional treatment of MD and DO licensees, subject to the stated provisions. A longer routine cycle therefore would not itself renew privileges, eliminate other credentialing obligations or resolve a specific competence concern. Hospitals would need to compare the final applicable law, bylaws and other governing requirements before extending a review cycle.

California chaptered AB 1405 on September 9 as Chapter 178. The act requires the Government Operations Agency to establish an AI Auditor Registry by January 1, 2029 and prohibits offering, selling or conducting a covered AI audit without registration beginning that day. An AI auditor assesses a system or model on behalf of a third party, and a covered audit assesses controls, processes or systems necessary for compliance with state law. That definition does not make every internal model review or every voluntary technical evaluation a covered audit.

The framework includes registration information, material updates within 90 days, auditee reports describing results and limitations, and at least 10 years of supporting-record retention. It addresses independence, self-review, recent employment, competence and protection for employee reporting. Qualifying accountancy professionals and firms have specified professional-standard routes for report and independence requirements, rather than a blanket exemption from registration. Removal involves notice and an opportunity to cure or contest, with a separate accountancy complaint process. Registration must not be presented as state endorsement, and the law does not delay audits required by other authority before its dates.

AB 1930’s retained proposal would require covered persons or entities conducting business in California to notify the Attorney General at least seven business days before producing records in specified investigations concerning legally protected abortion or gender-affirming health care. If a shorter response time were required by federal law or another federal obligation, including a contract, grant requirement or Medicare participation condition, notice would instead be due no later than contemporaneously with production. This was proposed legislation at the September 19 cutoff, not an operative new hold on every records request.

The proposal has four alternative exceptions: an order of a competent court, a California state or local agency request, an attestation meeting the statutory grounds, or protected-care information merely incidental to the investigation. It permits reliance on representations in a qualifying attestation and specifies Attorney General intervention and enforcement powers. False attestations and culpable notice violations have distinct penalty provisions. These features make the measure a qualified legal-process control rather than a universal prohibition on disclosure, and existing privacy and subpoena obligations would still need their own analysis.

AB 1979’s retained proposal would require covered health settings to take reasonable steps so a licensed professional can exercise independent judgment when patient care is informed by a clinical decision-support system. It would prohibit AI from independently performing a function legally reserved to a licensed person or directing unlicensed personnel to perform that function. Supervised trainees working toward licensure have a stated exception. Documentation and communications that do not apply professional judgment are outside the specified clinical decision-support restrictions.

Separately, the proposal would treat a business offering a defined consumer health-care chatbot for managing health information or diagnosing, treating or managing a medical condition as a provider for CMIA purposes. That privacy classification does not license the chatbot to practice a health profession. Enforcement and licensing-board authority remain tied to the particular provision and professional scope. During this edition’s coverage the bill remained proposed, so organizations must distinguish these suggested controls from existing AI communication, privacy and professional-practice requirements.

Chapter 299, signed September 18, adds a physician-employment exception for a health care district or specified district-controlled nonprofit that owns or controls a general acute care hospital. Qualification requires either a Distressed Hospital Loan awarded before January 1, 2025 or a combined Medicare/Medi-Cal payor mix greater than 75 percent under the specified January 2025 data. For the payor-mix route, both the hospital and its health system, if any, must meet the threshold. Medical staff must affirmatively concur under their bylaws, and the employer cannot direct professional judgment.

The employed positions must add to rather than supplant medical-staff positions existing January 1, 2026, although mutually agreed contract negotiations or amendments remain permitted. A prospective employee must also receive an affirmative option to contract instead. The employment authority runs until January 1, 2037; a separate section transition date should not be mistaken for that authorization period. Beginning January 2028, covered employers must post annual recruitment and retention reports by July 1, separating employment and contracted positions. Ordinary commencement is January 1, 2027, so qualification and staffing plans require review before using the exception.

AB 2448’s retained proposal would amend Civil Code 56.101 to require covered businesses described in Section 56.06 that electronically maintain sensitive-service information on behalf of specified entities to enable the security capabilities, policies and procedures in the statute. The features concern gender-affirming care, abortion-related services and contraception, including access limits, segregation, controls on out-of-state disclosure and the ability to disable access to segregated information from another state. The proposal remained pending during September 13–19.

The targeted subdivision expressly excludes contractors, health care service plans and providers as those terms are defined in Section 56.05, so the specified business duty cannot simply be assigned to every hospital or plan. Other confidentiality duties remain distinct. The retained text contains an existing July 1, 2024 date in the provision being amended; that is not a newly announced 2026 implementation deadline. Fees for compliance must remain consistent with the referenced federal information-blocking rule. Applicability and final commencement would need review before treating the proposed “enable” language as operative.

AB 2562’s retained proposal would require a licensed alcohol or other drug recovery or treatment facility to develop a suicide-prevention plan and a certified program to include such a plan in its operations manual. The manual already addresses admission and discharge, client rights, services, medications and conduct. For the licensed-facility provision, DHCS could implement the requirement through bulletins or provider/county letters after stakeholder input while regulations were developed.

The proposal gives DHCS a January 1, 2031 deadline to promulgate regulations for the suicide-prevention requirement. That agency rulemaking date is not a separately stated provider implementation deadline or a waiver of existing safety duties. The retained section also contains distinct relapse-planning and overdose-response requirements, including naloxone availability and trained staff; those should not all be described as newly created by this bill. The proposed text does not supply every detailed element of a future suicide-prevention plan, leaving final law and implementing instructions important to operational design.

AB 2575’s retained proposal would prohibit employer retaliation or discrimination based solely on a direct-care worker’s override of, or reliance on, clinical decision-support output when exercising professional judgment within scope. It preserves duties concerning the standard of care, independent judgment, licensure and applicable policies, while excluding a policy that demands deference to the system from the protected policy duties. The Labor Commissioner could review retaliation complaints, without deciding professional negligence or licensing discipline.

A separate proposed civil-liability provision would bar a system developer, modifier, selector or deployer from asserting that a worker’s failure to override the output was a superseding cause severing liability. It preserves other affirmative defenses, relevant causation and foreseeability evidence, comparative fault and reasonable-precaution evidence. It excludes specified professional-negligence actions against licensed or certified direct-care professionals. These distinctions do not automatically establish a defendant’s liability or excuse clinical responsibilities. The measure remained pending at the September 19 cutoff.

AB 2598’s retained proposal would require general acute care hospitals and skilled nursing facilities to make a documented good-faith effort to contact known next of kin within 72 hours of death using available contact information. It also addresses bodies transferred to a hospital after death. The notification requirement can be met through a designated resident representative in the specified circumstances, or a person’s prior written instruction against next-of-kin notification. The proposed scheme does not treat moving a body alone as equivalent to notifying the required recipient.

When the specified conditions for public-administrator notice are met, notice would be due within two business days. The proposed 200 dollar daily penalties, capped at 50000 dollars for each described violation, use separate clocks: the failed reasonable next-of-kin attempt and, for administrator notice, the fifth business day after death. A disputed assessment can be challenged within 10 working days of notice. Deaths in CDCR custody have an express exclusion, and other facilities retain a different Probate Code notice rule. These proposed duties had not become law by this edition’s cutoff.

DOJ announced September 18 revisions to the Justice Manual concerning sub-regulatory guidance and False Claims Act qui-tam actions. The first revision reinstates and builds on its 2017 policy that guidance cannot create legal obligations beyond statutes or regulations. DOJ says enforcement should focus on binding legal obligations and fair notice. This is an enforcement-policy announcement; it does not turn an existing contractual obligation into optional guidance or independently resolve an individual claim’s legal merits.

The second revision directs DOJ to consider its dismissal authority when it declines to intervene in a qui-tam case and to revisit the assessment as appropriate during litigation when it does not seek dismissal. DOJ describes a focus on meritless cases, efficient government resource use and the United States’ interests. Declination therefore does not automatically require dismissal, and the announcement promises no outcome for a particular defendant. Organizations still need to distinguish the underlying binding requirement, any guidance used to explain it and the case-specific basis for a dismissal request.

CMS Transmittal 247 revises AppendixW guidance for Critical Access Hospital emergency-services readiness, with both effective and implementation dates of September 18. It addresses 42 CFR 485.618(e), whose underlying readiness standard was effective July 1, 2025, and follows the earlierQSO 26-07 memorandum. Protocols must match nationally recognized, evidence-based guidance for medical, surgical and obstetrical emergencies, complications and immediate post-delivery care, consistent with the facility’s services and complexity.

Survey procedures focus on three elements: required protocol content, implementation and use as intended, and adequate provisions for emergency needs. The guidance discusses medical-staff and governing-body approval, staff access and roles, supplies, equipment, medications and blood products, with record review, interviews and observation supporting evaluation. Failure of any of the three elements can establish noncompliance. Surveyors are told to avoid evaluating clinical judgment and focus on documentation and protocol alignment. CMS supplies no additional funding; the new transmittal date does not erase the earlier underlying readiness obligation.

Chapter 306, signed September 18, adds electronic delivery alongside mailed notices for specified health-plan provider-group and general acute care hospital contract terminations. Plans must file the proposed enrollee notice with DMHC at least 75 days before termination and generally notify affected enrollees at least 60 days before. Text or email delivery applies when the enrollee opted into electronic communications and supplied the required contact information. The statute retains affected-population and geographic rules, a qualified exigent-circumstances waiver process, and a hospital-only termination-notice limit for PPO enrollees.

If the parties restore or renew a contract, the notice distinguishes an agreement reached before termination, preserving assignment, from one reached after termination, offering the option to return. Plans must submit the restoration notice within five business days of agreement and send it within 10 business days after DMHC approval, using mail plus qualifying electronic delivery. The 2025–2026 amendments do not apply to specified Medi-Cal managed-care contracts with DHCS. Ordinary commencement is January 1, 2027; September enactment does not itself establish that a particular termination or restoration has occurred.

AB 1907 became Chapter 204 following September 14 approval and filing. Its replacement Government Code 100503.4 becomes operative July 1, 2027 and adds intake through a complete Statewide Automated Welfare System application, alongside transferred electronic accounts. For people determined eligible for Exchange financial assistance, the options include the lowest-cost silver plan, a household member’s plan, a qualifying low-cost plan for an eligible Indian, or a plan offered by the person’s previous managed-care plan when the Exchange has the necessary information.

The statute retains notice before coverage begins, the right to choose another plan or decline enrollment, assistance and appeal information, and instructions to effectuate coverage by paying the premium or opting in when none is due. A premium cannot be due before the last day of the first enrollment month. Separately, for policy years beginning January 1, 2027, the enrollment-period and coverage-date provisions defer to 45 CFR 155.410 to the extent state provisions conflict. Those federal conditions and consumer choices prevent reading the act as unconditional automatic coverage in every available plan.

AB 1983 became Chapter 281 on September 18. It establishes terms for repayable-in-sequential-order continuing-care contracts, including an exclusive sequential repayment account and disclosures that repayment depends on sufficient funding and the assigned repayment position. For that contract type, the full amount owed is due within 14 calendar days after sufficient account funds exist to satisfy the assigned number. A resale-conditioned contract instead uses resale or reoccupancy as its 14 day trigger. Repayments after termination are not cancellation refunds and cannot be advertised as refunds.

The statute preserves interest rules for the applicable contract cohorts and adds sequential-account provisions for contracts entered on or after January 1, 2027. For those contracts, interest begins accruing 180 days after termination even if the account lacks sufficient funds, but accrual does not change repayment priority. Principal and interest are paid in sequence, and the account must have enough for both before repayment. Ordinary commencement is January 1, 2027. Providers must therefore distinguish contract type, termination timing, applicable interest cohort and account funding rather than using one general refund clock.

SB 16 became Chapter 314 on September 18. It requires a county behavioral-health director to include emergency physicians among the practice disciplines eligible for designation to perform Section 5150 functions. The definition covers physicians providing screening and treatment in a licensed general acute care hospital emergency department. Eligibility is distinct from actual designation: emergency physicians remain subject to the training, application, approval and revocation processes applicable to other eligible professionals.

The enacted section requires county procedures for eligibility, initial and ongoing training/testing, approval and renewal, and monitoring. A passive process responding to complaints and grievances as the county deems appropriate can satisfy the monitoring requirement. Denial or revocation requires written reasons to the requester and affected individual. Designated mobile-crisis team members and professionals cannot be prohibited from transporting a person taken into custody under 5150. Ordinary commencement is January 1, 2027; hospitals should coordinate with county procedures rather than treating professional licensure alone as the designation.

SB 1447 became Chapter 238 after September 14 approval and filing. The health omnibus addresses patient-safety plans, retail-food provisions and syndromic surveillance, with ordinary January 1, 2027 commencement and separate dates in particular provisions. Its patient-safety framework includes multidisciplinary oversight, event reporting and analysis, training and sociodemographic review. Retail-food changes include removing labeled frozen reduced-oxygen-packaged fish from its packaging before thawing. Those different subjects require review by the relevant operational owners rather than one undifferentiated implementation project.

Under HSC 131370, specified entities must report surveillance data as near real time as possible no later than December 31, 2028 or within one year of official CDPH notification, whichever is sooner. This is an entity-reporting timetable, not a deadline for CDPH to publish specifications. The local-health-department route depends on capacity and actual transmission of the required data to the state system; it is not an unconditional exemption. The statute also bars specified penalties for failure to report unless the requirements were published in regulation and the entity received at least six months’ notice. Both the reporting trigger and enforcement safeguards matter to interface planning.

HHS’s August 24 request for information asks whether federal vaccine recommendations should continue to use routine or universal, risk-based, and shared clinical decision-making categories, or adopt additional or different categories. DocketHHS-OS-2026-0332 sets September 20 as the date comments must be received to be assured consideration. That date remains ahead of this edition’s September 19 coverage cutoff. The notice seeks information to support the Task Force on Safer Childhood Vaccines; it does not itself reclassify a vaccine or create a new vaccination mandate.

The RFI describes routine recommendations as generally favoring vaccination for an age group absent contraindications, risk-based recommendations as directed to specified risks, and shared clinical decision-making as having no default recommendation for an individual. It seeks views on evidence strength, limited randomized-trial evidence, autonomy, religious freedom, communication, and the legal and programmatic consequences of category assignments. The notice records competing views about shared decision-making and distinguishes recommendations from mandates. Its consultation therefore offers an opportunity to explain operational effects without treating a possible future framework as already adopted.

The FCC’s August 31 notice in WC Docket 17-310 seeks comments on three groups of Rural Health Care Program changes: telecommunications support calculations, supported services and program processes. It asks how similar services and comparable rural areas should be defined and whether cost-study methods or evidentiary requirements should be improved or replaced. Initial comments are due September 30 and replies October 30, both after the September 19 coverage cutoff. The notice is a proposed rule rather than a final change to provider funding.

For supported services, the FCC asks about encouraging lower-cost backup technologies and establishing an eligible-services list similar in concept to the E-Rate list. For administration, it seeks views on performance metrics for processing funding requests and removing USAC approval of evergreen contracts and an annual reporting requirement. These questions could affect procurement, documentation and funding-request work in different ways. A rural provider’s response can therefore connect its service needs and administrative experience to the particular proposal instead of assuming that every suggested simplification has already been adopted.

OIG issued reportA-04-24-08105 on September 2 and posted it September 4, finding that CMS had not adequately overseen states’ use of contract nursing-home surveyors. States increasingly relied on contractors amid staffing shortages and survey backlogs. Although CMS had issued contracting guidance, OIG found it had not monitored whether state practices achieved that guidance’s objectives. All 14 states surveyed could improve policies or procedures to help ensure contractors met federal requirements.

OIG recommended that CMS record surveyor worker classification in its quality-improvement and evaluation system and confirm that state survey agencies have controls for contractor compliance. CMS concurred with both recommendations. The report identifies increased risk from insufficient oversight; it does not conclude that each contract surveyor was unqualified or that every contractor-led survey was invalid. Its recommendations are directed to CMS and state administration, without imposing a new facility implementation date in this notice.

HHS’s September 2 Privacy Act notice establishes a matching program comparing grant recipients and payments in the Payment Management System with Treasury’s Do Not Pay Working System. The purpose is to identify and prevent improper payments and support related recovery activities. The notice sets October 2 for comments and states that the program becomes effective 30 days after publication and continues through September 10, 2029. As of September 19, the stated comment date and effectiveness point remain ahead.

The notice treats PMS matching across HHS grants as a single agency-wide program and identifies a matching-agreement waiver under Treasury and OMB authority. Relevant identifiers can include names, taxpayer or entity identifiers, addresses, NPI and payment-related information. A potential match identifies the relevant database and goes to the grantor agency to decide whether further action is needed; it is not automatically a final adverse eligibility determination. The stated population is recipients of HHS grant funds paid through PMS, rather than all Medicare claims or every health care payee.

The FTC extended the public comment period on its proposed personalized-pricing enforcement statement by seven days, moving the September 18 date to September 25. The August 19 proposal concerns prices set using personal data to estimate what an individual is willing to pay, including situations where consumers reasonably expect a common price. The extension remains open as of the September 19 cutoff and changes the comment opportunity rather than adopting a final pricing rule.

The proposed statement says that, where consumers reasonably expect nonpersonalized prices, clear and conspicuous disclosure should explain the fact of personalization, its basis and the types of data used. It evaluates potential deception and unfairness under Section 5 and discusses data collection, use, disclosure and consent as separate concerns. Ordinary supply-and-demand price changes and markets where personal risk naturally affects price require their own analysis. The FTC does not claim authority to prohibit all personalized pricing, and a disclosure alone does not resolve every underlying data-practice or unfairness issue.

OLC’s September 1 opinion withdraws its 1998 reading of PRWORA Section 404 and concludes that “State” includes all component agencies, not just the agency administering TANF or SSI. For the TANF provision, the statute requires reporting at least four times annually and upon request; the SSI provision instead uses the timing set in the relevant agreements. These are different reporting formulations. The opinion concerns participating states and federal funding conditions, rather than a general instruction for every private hospital to disclose patient records.

OLC says its interpretation is prospective and cannot retroactively change TANF or SSI agreements made under the earlier understanding. It also states that federal agencies cannot claw back funding when states complied with the then-existing executive interpretation. Entity status, the statutory knowledge standard, applicable privacy protections and the actual funding arrangement still require analysis before a disclosure workflow changes. The opinion’s broader reading of “State” therefore should be evaluated with its prospective limits and the separate program provisions, rather than compressed into a universal quarterly reporting requirement.

CalPrivacy’s September 3 Enforcement Advisory 2026-01 warns data brokers to submit true and correct annual registration information, including the kinds of data collected and specified recipients during the preceding year. It states that incorrect information can trigger a 200 dollar fine for each day a broker fails to register as required. The advisory says the Delete Act does not distinguish an unintentional reporting error from an intentional misrepresentation when either produces incorrect registration information.

Its scenarios ask brokers to reconcile data categories, changing customer types, GenAI developer recipients and rights-request metrics with their disclosures. The advisory also describes annual registration and DROP-account requirements under existing law. It does not declare every health technology business a data broker, and its hypotheticals require analysis of the statutory definitions and actual activity. The document expressly creates no substantive policy, new rights, alternative relief or safe harbor; statutes and regulations control if an interpretation conflicts.

USPS’s September 1 final rule requires parcels mailed as Free Matter for eligible blind or other physically disabled users to bear both an Intelligent Mail package barcode and an Intelligent Mail matrix barcode beginning October 4. The revised DMM provision expressly covers outbound and return parcels and requires preparation under the referenced barcode standards. The rule explains that the barcodes improve tracking, processing visibility and hazardous-material handling through appropriate service-type codes. October 4 remains a future effective date at the September 19 cutoff.

The rule exempts qualifying Free Matter pieces from the Hazmat Handling Fee but leaves commercial mailers subject to the Hazmat Noncompliance Fee when hazardous materials are not properly declared and labeled. Commercial pieces that fail unique IMpb and IMmb requirements can also incur the Package Quality Noncompliance Fee. These distinctions preserve the underlying postage benefit while requiring accurate preparation; the handling-fee exemption does not excuse commercial hazardous-material or package-quality noncompliance.

SB 1410 became Chapter 327 on September 18. It amends four Health and Safety Code provisions governing email addresses of record for adult community care and specified residential care applicants and licensees. Written notice of an address change must be provided to the department within 12 business days under the enacted text, replacing the prior 10 business-day period. Ordinary commencement is January 1, 2027, so the signature identifies the future rule rather than immediately resetting an individual facility’s September deadline.

The amended residential-care-for-the-elderly application section contains other duties and reporting periods, which must not be collapsed into the email-change rule. Ownership, control, application information and other notices retain their separate statutory treatment. Maintaining a reliable email address also remains important for regulator communications even when the formal change period is longer. A facility should therefore identify the licensing provision that applies to it and update the specific email-change workflow without assuming every licensing update now uses 12 business days.