Regulatory Compliance Sweep, Week of September 20, 2026

The federal departments’ August 28 correcting amendment repairs typographical errors and omissions in the June 4 Federal Independent Dispute Resolution Operations rule. It took effect August 28 but makes the corrections applicable beginning August 3, the underlying rule’s effective date. The changes include omitted text, inaccurate cross-references and amendatory instructions across the parallel Treasury, Labor and HHS regulations; the notice republishes the HHS payment-determination paragraph 149.510(c) in full because the earlier text was incomplete.

One restored provision states that an IDR determination is binding absent fraud or evidence of intentional misrepresentation of material facts presented about the claim, with judicial review limited to the specified grounds in 9 U.S.C. 10(a)(1)–(4). That is narrower than an unrestricted merits appeal and does not mean every allegation of disagreement sets aside a determination. The departments describe the correction as implementing the previously adopted policies rather than starting a new substantive policy process, and waive notice and comment and delayed effectiveness on that basis. Teams reviewing post-August 3 submissions need the corrected language and applicable procedural provisions, not an assumption that August 28 restarts every case.

CDPH’s August 27 AFL 26-28 explains SB 164’s June 29 moratorium on new home-health-agency licenses, including branch additions and specified service-area/location changes. It lasts until no later than 90 days after the effective date of revised HHA regulations. An unmet-need finding can support an exception. A separate five-year prohibition on changes of ownership runs from initial license issuance, with specified continuity-of-care or financial-hardship/unmet-need exceptions. Pending June 29 applicants must respond to CAB by October 9 with withdrawal intent or the required justification/documentation or CHOW continuation; otherwise the application is automatically withdrawn.

Currently licensed HHAs separately must submit management-personnel information by March 31, 2027 and within ten business days of a change. The listed roles are administrator, administrator designee, director of patient-care services and that director’s designee, with HS 215A, résumé and current management-facility information; parent-HHA branch offices are exempt from those management submission requirements. Private-HHA initial applicants also have the specified 5-percent-owner fingerprint obligation. Expanded license-denial, suspension or revocation grounds address prior termination, violation patterns, the applicant/licensee’s exclusion-list status, management noncooperation and unreported changes. Ordinary renewal and other specified changes remain outside the moratorium, while provisional-license standards and future regulations require separate attention.

California chaptered AB 1760 on August 31. Its dentistry amendments address eligibility and documentary evidence for licensure, including recognized foreign-school accreditation and alternative out-of-state practice pathways; elective facial cosmetic surgery still requires the specified permit, training, experience and privileges. The act also revises registered dental assistant provisions. Its enactment is distinct from commencement: the ordinary January 1, 2027 effective-date rule applies, while the radiation-course transition names a later date.

Radiation-safety instruction must retain theory, laboratory and patient-clinical components, with at least 32 hours divided into eight didactic, twelve laboratory and twelve clinical hours. Distance delivery is allowed for didactic instruction with technology assistance and completion before laboratory work; it does not turn the whole course into remote instruction. Previously approved courses retain approval only until January 1, 2028 and must apply under the new provision to offer courses on or after that date. Extended-function assistant duties remain tied to direct supervision, appropriate education and the dentist’s determination of competence for contemporary techniques and materials.

AB 2341 became Chapter 170 on August 31 as an urgency statute effective immediately. Government Code 7299.7 first asks whether at least 5 percent of the local jurisdiction’s population speaks English less than very well, using American Community Survey data or an equally reliable source. If that threshold is met, emergency information must be supplied in English and each language accounting for at least 5 percent of the jurisdiction’s population that speaks English less than very well. The second calculation therefore uses that limited-English population as its denominator.

The local agency must reassess the language data every five years and provide translated information as comprehensive, actionable and timely as English information. It should endeavor to use culturally competent community members and fluent native speakers where feasible. The statute defines local agency as a city, county, city and county, or their department, and emergency response services as police, fire or EMS; it does not impose this specific duty on every private hospital. It preserves Emergency Services Act responsibilities and allows broader local standards. A separate state sampling survey starts January 1, 2027 and recurs every three years.

OCR’s September 3 letter explains how Title VI and Section 1557 apply to antisemitic conduct in covered HHS-funded programs when the facts show discrimination based on actual or perceived Jewish ancestry or ethnic characteristics, Israeli national origin or another protected ground. Examples reach care access and administration, training, research and contractual arrangements. The letter preserves individualized clinical, safety and operational judgments applied without discrimination and states that use of antisemitism-related evidence must not infringe federal or First Amendment rights.

The letter distinguishes harassment theories and the recipient’s own conduct or response, rather than applying one private-damages test universally to administrative enforcement. It also addresses retaliation against people who invoke protected rights and separate religious nondiscrimination in visitation, subject to appropriate restrictions. It does not assert general OCR employment-discrimination jurisdiction: Title VI’s employment reach has a statutory primary-purpose limitation, while staff and trainees may be covered program participants. Suggested measures include accessible reporting, consistent response, restoration of access and follow-up; these are fact-specific compliance measures rather than a new uniform implementation deadline.

DMHC’s September 3 APL26-014 directs health care service plans to file contracted-PBM information on or before October 1, 2026. The filing goes through eFiling as Report/Other with the title Contracted PBMs and Pharmacy Delegations and must include at least Exhibit E-1. The letter separately reminds plans to ensure all contracted PBMs are licensed before January 1, 2027. At the September 26 coverage end, the October filing deadline is still upcoming; filing an application and holding a license are distinct states.

Exhibit E-1 must identify each currently contracted PBM and each PBM whose contract will be effective January 1, 2027, list delegated functions, state whether the plan intends to continue contracting beyond that date, and say whether the plan confirmed each contracted PBM submitted a licensure application. Those questions require reconciliation between pharmacy contracting, delegation inventories and the plan’s regulatory filing. The APL points questions to the assigned licensing reviewer; it does not state that merely naming a PBM or confirming an application satisfies the separate January licensing requirement.

AB 173 became Chapter 252 on September 18 as a health budget measure with an immediate-effect clause. Its Medi-Cal enrollment provisions direct DHCS to deny an application or terminate enrollment when a disclosed affiliation within the preceding five years involves a person or entity with a disclosable event and DHCS determines that the affiliation poses an undue risk of fraud, waste, or abuse. The statute uses the federal definitions of affiliation and disclosable event and the risk factors in 42 CFR 455.107(f). An affiliation alone does not establish the required risk determination.

Welfare and Institutions Code 14043.2 also permits action up to denial or termination despite full and timely disclosure when the affiliation poses that undue risk. Legally protected health care activity cannot constitute fraud, waste, or abuse by virtue of the nature of that activity alone. Although the budget act takes effect immediately, implementation of this section requires all necessary federal approvals and availability of federal financial participation without jeopardizing that funding. The section preserves provider-agreement and ownership/control disclosure requirements, consequences for missing or false information, and proceedings under Section 14043.65. These conditions distinguish enactment from proof that every enrollment change was already operational.

AB 1018’s retained proposal would regulate covered automated decision systems that profile people to make or facilitate consequential decisions. Its definition reaches machine learning, statistical modeling, data analytics, or AI that produces a score, classification, recommendation, or similar simplified output with a material effect on people. Consequential decisions include health care and health insurance, alongside employment, education, housing, financial services and other listed areas. The text excludes routine tools such as spam filters, firewalls, calculators and databases, and does not make every generative AI application a covered profiling system. The exclusion for HIPAA covered entities doing business in California and business associates’ services to those entities retains exceptions for employment, patient financial assistance and the pre-decision notice requirement. FDA-regulated devices and specified regulated research, laboratory and production uses have separate exclusions.

Developers would supply use instructions, fine-tuning information and technical documentation to deployers, with a specified financial-services exception. Deployers would provide notice before finalizing a decision, subject to the medical-emergency exception, and a written explanation within 30 days after an adverse outcome, with emergency and specified résumé-sorting exceptions. For deployers with more than 25 employees, the proposal provides correction and appeal opportunities within 30 business days, followed by specified review and response procedures. Implementation of these proposed controls would depend on enactment and the applicable commencement provisions.

AB 1199 proposes revising medical-staff rules so reappointments occur at least every three years rather than under the existing annual or biennial framework. The proposal also changes the specified competency-demonstration interval to three years and would bar CDPH from requiring routine reappointments more often than every three years at general acute care and acute psychiatric hospitals. This is proposed legislation during the covered week, not authority to extend an individual appointment immediately.

The text still requires proof of competent performance at initial appointment and subsequent review to the satisfaction of the appropriate medical-staff committee. It retains self-governance, periodic clinical review and accurate records, alongside professional and ethical standards and nondiscrimination between qualified M.D. and D.O. physicians. A proposed routine interval does not itself grant privileges, establish an individual’s competence or displace another applicable requirement. Medical staff and counsel should compare the actual proposed intervals and affected facility types with bylaws and other governing obligations before planning any change.

AB 1405 was chaptered September 9 as Chapter 178. By January 1, 2029 the Government Operations Agency must establish an AI Auditor Registry, cost-based annual fees and a misconduct-reporting channel; from that date a person may not offer, sell or conduct a covered AI audit without registration. The definition reaches audits of controls, processes or systems necessary for compliance with state law, performed on behalf of a third party. It is not a general registration requirement for every organization that uses AI or every internal technology review.

Registered auditors must supply business and service information, applicable-law and credential details, and a standard procedure explaining their standards and the basis for accuracy or reliability claims, subject to reasonable trade-secret redactions. They must update materially changed registry information within 90 days, provide supported audit reports addressing scope, findings, remedies and limitations, retain reports and supporting records at least ten years, and follow independence and competence standards. The law includes specified accountancy-professional alternatives, a reasonable chance to cure or contest removal, and protection for employee reporting. Registration expressly does not constitute state endorsement; the January 2029 registry milestone does not delay earlier audit duties under other law.

Governor Newsom’s September 26 announcement lists AB 1930 among the bills he signed, and Chapter 468 records approval and filing that day. The enacted text requires covered persons and entities conducting business in California to notify the Attorney General at least seven business days before producing records in specified legal-process investigations concerning legally protected abortion or gender-affirming health care. A shorter federal-law or federal-obligation response period, including a contract, grant requirement or Medicare participation condition, changes that timing: notice must be given no later than contemporaneously with production. Ordinary commencement is January 1, 2027; signature does not make the notice duty immediately operative.

The notice requirement has four alternative exceptions: a competent court’s order, a California state or local agency’s request, an attestation meeting the statutory conditions, or protected-care information that is merely incidental to the investigation. The statute specifies permissible attestation grounds and allows reliance on its representations. It also authorizes Attorney General intervention and enforcement, with distinct penalties for false attestations and specified culpable violations. The framework is therefore a qualified legal-process control rather than a universal prohibition on record production. The edition’s implementation discussion also appears in GC-2026-0125.

AB 1979 proposes requiring covered facilities, clinics and physician/group offices to take reasonable steps to preserve a licensed provider’s independent professional judgment when care is informed by clinical decision support. It would prohibit AI from independently performing a clinical function legally requiring a professional license or directing unlicensed personnel in that function. The proposal preserves a supervised training exception and the applicable licensing-board enforcement framework. For this covered week, those proposed controls are not reported as an enacted AI practice rule.

The text distinguishes clinical decision support from appointment management, reminders, education and payment activities to the extent their independent performance does not require licensure. It also excludes documentation and communication that does not apply professional judgment from the relevant section. Separate CMIA amendments would deem a business offering a defined healthcare chatbot for personal information management or diagnosis, treatment or condition management a healthcare provider for CMIA purposes only, with confidentiality and improper-disclosure consequences. That designation does not confer a professional license or make every general chatbot subject to the same rule regardless of purpose.

AB 2311, enacted September 18, creates a temporary physician-employment and professional-service charging pathway for a health care district or nonprofit with a district as sole corporate member that owns or controls a qualifying general acute care hospital. It is limited to a hospital that received a Distressed Hospital Loan before January 1, 2025 or satisfies the stated greater-than 75 percent combined Medicare/Medi-Cal payor-mix test as calculated at the January 1, 2025 reference point. For the payor-mix route, both the hospital and any health system to which it belongs must qualify. This is not a general corporate-practice exemption for every district-owned hospital.

The medical staff must affirmatively concur under its bylaws, and the district, nonprofit and controlled hospital must not direct the physician’s professional judgment. Employed positions must be additional to rather than supplant the specified January 2026 medical-staff positions, subject to the mutual-contract amendment provision; prospective employees must be offered a contracting alternative. From January 1, 2028 the entity must publish the specified recruitment and retention report by July 1 each year. The employment authorization lasts until January 1, 2037, while the statutory section has separate July 2037 replacement timing. Teams should prepare for the ordinary January 2027 commencement without assuming eligibility or an executed employment arrangement.

AB 2448 proposes changing CMIA’s sensitive-record system provision from developing capabilities that enable specified features to requiring those features actually be enabled. The functions address access limits, segregation of gender-affirming, abortion-related and contraception information, interstate disclosure controls and the ability to disable access from another state. The proposal refers to the existing July 2024 framework; that historical date is not presented here as a new 2026 implementation deadline. The measure remains proposed during the covered week.

The subsection reaches the specified businesses under Civil Code 56.06 storing or maintaining sensitive-service information on behalf of listed entities. It expressly does not apply to a contractor, health plan or healthcare provider as defined in section 56.05, so the particular business role matters. Existing general confidentiality, record-integrity and access rules remain separate. Teams assessing a vendor should distinguish a promised feature from evidence it is enabled, while checking the proposed statutory scope and other applicable disclosure law rather than assuming every provider itself has this new subsection duty.

AB 2562 proposes adding suicide-prevention plans to the requirements for licensed alcohol/drug recovery or treatment facilities and certified programs. A certified program would include the plan in its operations manual; a licensed facility would develop a plan under the separate license provision. DHCS could implement the latter requirement through a bulletin or all-county/all-provider letter after stakeholder input pending regulations, with rulemaking by January 1, 2031. That agency rulemaking date is not a statement that providers may defer every applicable safety duty until 2031.

The proposed additions sit within a broader existing service framework, including admission/discharge and client-rights procedures, relapse planning and overdose preparedness. Those surrounding provisions should not all be described as newly created by the suicide-plan proposal. The text also retains separate withdrawal-management and detox-only transition language with its own timing. For this September 20–26 account, a proposed plan requirement is not a final DHCS implementation instruction, and the additions do not specify detailed plan contents or a separate provider implementation date. Teams should track the final requirements and actual DHCS implementation.

AB 2575’s retained proposal would protect a worker providing direct patient care from employer retaliation or discrimination based solely on the worker’s override of, or reliance on, clinical decision-support output while exercising professional judgment within the appropriate scope of practice. Workers would retain duties concerning the standard of care, independent judgment, scope and applicable policies; a policy demanding deference to the system would not qualify as one of those preserved duties. A worker could complain to the Labor Commissioner, whose retaliation determination would not decide malpractice liability or professional discipline. These provisions remained proposed as of September 26.

A separate proposed Civil Code provision would prevent a defendant that developed, modified, selected or deployed a clinical decision-support system from asserting that a health professional’s or worker’s failure to override its output was a superseding cause that severed the defendant’s liability. Other affirmative defenses, causation and foreseeability evidence, comparative-fault evidence and reasonable-precaution evidence would remain available. The provision excludes specified professional-negligence actions against licensed or certified direct-care professionals. The proposal therefore would not automatically establish a vendor’s liability, eliminate all defenses or excuse a worker from clinical responsibilities.

AB 2598 proposes requiring general acute care hospitals and skilled nursing facilities to make reasonable attempts to notify known next of kin of a death, including specified post-death transfers to a hospital. The proposed definition is a documented good-faith contact effort within seventy-two hours using available contact information. It recognizes the designated resident-representative route and a person’s prior written request against notification. If the specified conditions require county public-administrator notice, the text gives a separate two-business-day requirement and identifies information to assist the administrator.

The proposed penalties distinguish failure to attempt known-next-of-kin notification from failure to notify the public administrator. Each has a 200-dollar daily amount and 50,000-dollar maximum, but the latter’s penalty measurement begins on the fifth business day after death; that does not erase the separate two-business-day notice requirement. A licensee can request a hearing within ten working days of penalty notification. Known next of kin is defined, and incarcerated people in state corrections custody are excluded under the specified rules. During the covered week these are proposed duties, not a new enacted penalty assessed against a facility.

DOJ announced two Justice Manual revisions September 18. The first reinstates and expands its policy that sub-regulatory guidance cannot create legal obligations beyond those established by statute or regulation, while the release emphasizes enforcement of binding legal or contractual obligations. It is an enforcement-policy statement, not a repeal of underlying statutes, regulations, contracts or every operational practice described in guidance. Organizations still need to identify the binding basis for a duty rather than assuming guidance alone supplies it.

The second revision says DOJ should consider dismissal authority when it declines to intervene in a qui tam action and revisit that assessment as appropriate during litigation if it does not seek dismissal. The release describes judicious use focused on meritless matters and the interests of the United States. Declining intervention is therefore not an automatic dismissal and does not establish the outcome of a particular whistleblower case. Counsel evaluating an active matter should separate the Department’s policy, its actual litigation decision and any court action.

CMS Transmittal 247 revised State Operations Manual Appendix W effective and implemented September 18, 2026. It supplies interpretive guidance and survey procedures for 42 CFR 485.618(e), whose cited emergency-readiness standard dates to July 1, 2025. The revision emphasizes protocols consistent with nationally recognized, evidence-based practice for medical, surgical and obstetrical emergencies, complications and immediate post-delivery care, taking account of the CAH’s service scope and complexity. A new guidance date should not be described as the first effective date of the underlying condition.

Surveyors are directed to examine three elements: required protocol content, whether protocols are actually used, and whether adequate provisions meet emergency needs. The guidance addresses medical-staff/governing-body approval, accessible current protocols, staff roles, equipment, medications, blood products and escalation/transfer processes. Record review, staff interviews and observation test implementation rather than a binder’s existence alone; surveyors should focus on documentation and protocol alignment rather than evaluating clinical judgment. The transmittal states that only its revised material changes and provides no additional funding. These instructions are already in effect by the September 26 coverage end.

California enacted AB 2613 on September 18, adding electronic delivery to health-plan notices about specified provider-group and general acute care hospital contract terminations. From January 1, 2027, email or text supplements mailed notice when the enrollee opted into electronic delivery and supplied the relevant contact information. The section retains the plan’s block-transfer filing at least 75 days before termination, department approval before notice, and the ordinary notice requirement at least 60 days before termination. The affected population depends on provider assignment, hospital use and the section’s geographic and plan-type rules.

A renewed or restored contract triggers a separate sequence after the first notice. The plan submits the follow-up notice to DMHC within five business days of reaching agreement and sends mail plus the qualifying electronic notice within ten business days after approval. An agreement before termination tells affected enrollees they remain assigned; an agreement after termination offers a return to the provider. The text preserves continuity-of-care language, limits PPO notices under the stated rule to a terminating general acute care hospital, and allows specified exigent-circumstance waivers. The 2025–2026 amendments exclude Medi-Cal managed care contracts with DHCS.

AB 1907, chaptered September 14, changes Covered California’s transition-enrollment process in stages. From July 1, 2027, receipt of a qualifying electronic account or a complete insurance-affordability application through the Statewide Automated Welfare System triggers enrollment for individuals determined eligible for Exchange financial assistance. The Exchange determines the applicable option: the lowest-cost silver plan, a plan covering other members of the modified adjusted gross income household, the lowest-cost plan for an Indian eligible for the specified reduced cost sharing, or an available prior managed-care plan supported by the required information.

The new options do not make enrollment unconditional or remove the individual’s choice. The notice must arrive before the effective date and explain the selected plan, alternative selection and assistance, the right not to enroll, appeal information and steps to effectuate coverage. A premium cannot be due before the last day of the first enrollment month; a no-premium plan requires opt-in instructions. Separate amendments for policy years beginning January 1, 2027 preserve state open-enrollment and coverage-effective-date rules except where inconsistent with the cited federal rule, in which case that federal rule controls. The existing and July 2027 versions of Government Code 100503.4 therefore need separate implementation checks.

California enacted AB 1983 on September 18 to distinguish two repayable continuing-care contract models. A resale-conditioned contract links repayment to resale or reoccupancy of the former resident’s unit; a sequential-order contract links payment to the chronological order in which repayable contracts terminate. A provider offering or maintaining sequential-order contracts must establish an exclusive repayment account and make repayments in the prescribed sequence from the specified entrance-fee proceeds. The enacted framework takes effect January 1, 2027, with provisions that expressly distinguish contract cohorts.

The full lump sum, including applicable interest, is due within 14 calendar days after resale or reoccupancy for the resale model, or after sufficient account funds exist to satisfy the assigned repayment number for the sequential model. Disclosures for sequential contracts explain funding dependency, termination order, five-year repayment timing and contract counts. The interest provisions preserve their stated applicability limits: for sequential contracts entered on or after January 1, 2027, accrual begins 180 days after termination regardless of account sufficiency and does not change payment priority. A post-termination repayable lump sum cannot be advertised as a refund; the separate cancellation and refund rules remain distinct.

SB 16, chaptered September 18 and effective January 1, 2027, requires county behavioral health designation procedures to include emergency physicians among eligible practice disciplines for Welfare and Institutions Code 5150 functions. The definition covers a physician and surgeon providing screening and treatment in the emergency department of a licensed general acute care hospital. Eligibility does not itself designate every emergency physician: the law expressly retains the training, application, approval and revocation process applicable to other eligible professionals.

The section requires county procedures to address eligible licenses and experience, initial and continuing training and testing, designation and renewal, and monitoring and review. A complaint-responsive passive review process can satisfy the stated monitoring provision. Written reasons for denial or revocation must go to both the requesting person and the subject individual. Counties retain authority to establish consistent criteria and procedures, while designated mobile-crisis members and professional persons are not prohibited from transporting a person taken into custody under 5150. Hospitals should therefore plan around the actual county process rather than treating statutory eligibility as an automatic privilege.

California’s September 14 health omnibus, SB 1447, amends patient-safety, retail-food and syndromic-surveillance provisions. For surveillance, specified entities must collect and report as near to real time as possible no later than December 31, 2028 or within one year of official CDPH notification, whichever is sooner. That is an entity reporting trigger, rather than a deadline for CDPH to issue specifications. CDPH may implement or modify data elements, standards, schedules and instructions in collaboration with local health departments, using the statutory filing and publication process.

An entity can use the qualifying local health department route where the local system can transmit its required data to the state on the specified timetable and the entity supplies the data locally; this does not excuse the underlying data flow. The text also conditions penalties and licensing consequences on publication of the required elements, standards and schedule and at least six months’ prior notification. Patient-safety provisions retain committee review, reporting, analysis of demographic disparities and a process to address racism and discrimination; food amendments include removal of frozen fish from reduced-oxygen packaging before thawing. As of September 27, the general law’s January 2027 commencement and the separate surveillance implementation triggers should be planned independently.

The Governor signed AB 1930 on September 26, adding Civil Code 1798.309 for covered persons or entities located, headquartered, incorporated or conducting business in California. From the law’s January 1, 2027 commencement, a covered recipient of a subpoena, discovery request or other legal-process information request concerning an investigation of legally protected abortion or gender-affirming care generally must notify the Attorney General at least seven business days before producing records. Notice includes the request, with permitted redaction of identifying or confidential information. The duty concerns specified investigations and protected activities, rather than every request containing health information.

The text exempts requests ordered by a competent court, issued by a California state or local agency, accompanied by a qualifying nonprohibited-use attestation, or containing protected-care information merely incidental to the investigation. A shorter federal legal or other federal obligation, expressly including a contract, grant or Medicare participation condition, changes the advance-notice timing to no later than production. The Attorney General may intervene in a protective civil action and enforce the section; false attestations and specified knowing or reckless violations carry distinct penalties. Records teams need counsel to apply those boundaries and other disclosure law, not a blanket rule to block all subpoenas or warrants.

The Governor signed SB 934 on September 26. Effective January 1, 2027, the amended Business and Professions Code prohibits covered mental-health providers from sexual-orientation or gender-identity change efforts with patients under 18 and makes attempted efforts unprofessional conduct subject to licensing discipline. The definition addresses practices during mental-health services that direct a patient toward a predetermined orientation or identity outcome, regardless of the direction of intended change. It includes efforts to increase or reduce specified attractions or to suppress or constrain gender identity or expression.

The enacted definition expressly excludes nondirective psychotherapy supporting coping, exploration and self-understanding without a predetermined outcome; age-appropriate intervention for unlawful conduct or unsafe practices that does not direct orientation or identity; and supportive care consistent with applicable standards that respects the patient’s experienced and defined gender identity. The provider definition names multiple licensed, associate, trainee and other legally designated mental-health roles. Those scope and care distinctions should guide policy and supervision rather than treating every discussion of identity as prohibited or extending the specific under 18 disciplinary provision to every adult service.

SB 1023, signed September 26, updates coverage protections for medically necessary HIV/AIDS-prevention antiretroviral drugs, devices and products, including PrEP and PEP. For contracts or policies issued, amended or renewed on or after January 1, 2027, an FDA-approved non-self-administered prevention product must be covered under both the medical and prescription-drug benefits. A product obtained through the drug benefit must be dispensed and administered by a provider acting within the provider’s license. The rule is not limited to self-administered tablets or a single delivery channel.

The amended sections prohibit prior authorization or step therapy for the covered preventive products, but preserve the therapeutic-equivalent exception when at least one FDA-approved equivalent is available without those restrictions. They also protect pharmacist furnishing, related services and ordered testing within the stated authority and network-benefit conditions; the law does not require an out-of-network pharmacy benefit where none exists. Dental-, mental-health- or vision-only products and Medicare supplements are excluded. For Medi-Cal managed care, the section’s exclusion is tied to services excluded under the DHCS contract, rather than an unqualified statement that every Medi-Cal service is outside the law.

The Governor signed SB 1114 on September 26 to change collection, use and disclosure of sexual-orientation, gender-identity and intersex/sex-characteristic information, or SOGISC. The named state entities include DHCS, CDPH, Social Services and other specified departments; this is not a universal direct collection rule for every private provider. The disclosure protection reaches information reasonably usable to infer transgender or intersex status, including specified marker records and medical information not otherwise protected by HIPAA or CMIA. Voluntary self-identification and statutory collection exceptions remain important, including the express limit on compelling providers or other third parties to supply information not voluntarily provided.

Identifiable disclosure outside California state or local government or its authorized agent is limited to listed exceptions, including mandatory federal/interstate participation terms, valid California-enforceable warrants or orders, public-health functions, protected necessary vendor services, the Information Practices Act and Civil Rights Department statutory work. Disclosures must be minimized. Shared-system separation has an entity-specific automation-notice trigger; Social Services has a separate January 2028 timing provision and CDPH’s stated third-party collection milestone is March 28, 2029. The act also creates a public-records confidentiality provision with deidentification/Information Practices Act exceptions and express vehicle-record/Civil Rights Department exclusions. The January 2027 effective date therefore does not make every provision operative for every data holder at once.

AB 2150 was signed September 20 as Chapter 384. Effective January 1, 2027 under the ordinary constitutional rule, an employer operating in California that requires employee CPR certification must also require an EMSA-approved online video module on naloxone use and pay the training cost. The module is separate from the CPR curriculum and must cover overdose recognition, appropriate response and administration of naloxone or another FDA-approved opioid antagonist. EMSA’s assigned role is approval of content, rather than administration, enforcement or ongoing monitoring of employer compliance.

An employee’s existing CPR, first-aid or other training can satisfy the requirement if EMSA determines it meets or exceeds the minimum content and the employer keeps documentation. Clinical staffing levels or internal medication policies alone do not exempt an employer. The law expressly limits the module to education and preparedness: it creates no independent duty, authorization or expectation to administer naloxone and does not enlarge professional scope or override medication-administration and delegation rules. It is a minimum floor; a broader or more protective applicable training rule may still control.

SB 1302, signed September 20 as Chapter 429, revises nursing practice, education and credentialing provisions. The registered-nursing definition recognizes medication orders from specified nurse practitioners and certified nurse-midwives and directions from advanced practice registered nurses within the relevant licensure and practice scope. Nursing-education changes address approval and inspection criteria, simulation standards and conditional requests to adjust medical-surgical clinical hours. These changes do not confer unlimited medication-order authority or waive the applicable professional scope, program approval or standardized-procedure requirements.

The statute has separate timing and qualification rules. For nurse-practitioner transition-to-practice experience from another state, BRN must identify qualifying states by January 1, 2028, publish a list and maintain a process for reviewing changes; the certification, experience and permitted-setting conditions still apply. Beginning January 1, 2029, renewal requires submission of continuing-education completion documentation for the stated renewal period or preceding two years. The ordinary January 1, 2027 commencement of the enacted framework therefore should not be confused with those later BRN and licensee milestones or treated as immediate recognition of every out-of-state experience.

On September 25, California’s Attorney General reaffirmed enforcement of disability-integration and access protections. The official release reports that a federal court entered a September 23 order in Texas v.Kennedy vacating integration references in HHS’s Section 504 regulations and closing that case after a proposed resolution. This article reports the California enforcement announcement and its account of the order; the order itself is not retained or independently interpreted here. The announcement distinguishes the reported regulatory action from the ADA, Section 504 and longstanding integration precedent.

The Attorney General states that unnecessary segregation and isolation remain unlawful in California and points to community-based services and the rights of people with disabilities. The release also describes an August emergency-access guidance letter and a separate ongoing Eaton Fire response investigation, without establishing a finding in that investigation. Providers should not infer that the reported federal regulatory change eliminates every integration, access or nondiscrimination obligation. A policy change based on the litigation requires counsel’s review of the actual order and the applicable federal and California duties.

The FCC’s August 31 notice summarizes its Third Further Notice of Proposed Rulemaking for the Rural Health Care Program. It seeks comment on comparable rural areas and similar services, possible changes or alternatives to cost studies for rural telecommunications rates, and burdens of the supporting evidence. Initial comments are due September 30 and replies October 30 in WC Docket 17-310. Both dates remain future at the September 26 coverage end, and the notice’s proposed status does not change current funding or procurement requirements by itself.

The notice also asks about lower-cost backup technologies, a program eligible-services list, funding-request processing metrics, elimination of USAC approval for evergreen contracts and an annual Healthcare Connect Fund report. These are distinct proposed service and administrative changes, not already granted exceptions or a new entitlement for every technology purchase. The stated policy aims are lower burdens and costs while protecting program funds against waste, fraud and abuse. Applicants can use actual service needs and administrative experience to evaluate the proposals while continuing existing procedures pending authoritative final action.

HHS-OIG’s report A-04-24-08105, issued September 2 and posted September 4, assessed CMS oversight of states’ use of contract surveyors for nursing-home surveys. CMS had supplied a memo about contracting practices but did not monitor whether state agencies implemented practices meeting its objectives. All fourteen surveyed states using contract surveyors could have improved their policies and procedures. OIG describes an increased risk of inadequate controls, rather than concluding that every contractor or every resulting survey failed federal standards.

OIG recommended recording surveyor worker classification in iQIES and confirming that state survey agencies have policies and procedures ensuring contract surveyors meet federal requirements; CMS concurred with both. Those recommendations target federal and state oversight, not a new reporting deadline imposed on a nursing home. Facilities should retain ordinary survey-response evidence and verify the authority of actual requests. The mere use of a contractor does not invalidate a survey.

HHS’s September 2 Privacy Act notice establishes a matching program comparing grantees paid through its Payment Management System with Treasury’s Do Not Pay Working System. The purpose is to prevent or identify and recoup improper grant payments using payment-eligibility information and identifiers such as names, taxpayer/entity/provider identifiers and other relevant record fields. The notice sets October 2 for comments and states effectiveness thirty days after publication through September 10, 2029; those October milestones are still upcoming at this edition’s September 26 coverage end.

A possible match is returned to the submitting HHS system with the relevant database identity, after which the grantor agency reviews whether further action is needed; a match is not an automatic adverse eligibility determination. HHS describes one agencywide PMS/DNP program and explains its reliance on the statutory Do Not Pay initiative and the defined Treasury/OMB waiver of matching-agreement requirements. This is grant-payment integrity work, rather than a general Medicare claims edit. Grant recipients need accurate payee information and a response route for inquiries while preserving applicable privacy and procedural safeguards.

OLC’s September 1 opinion withdraws its 1998 interpretation of PRWORA section 404 and reads State to include all component agencies of a participating state, rather than only the agency administering the covered TANF or SSI program. The opinion quotes TANF’s reporting requirement as at least four times annually and upon request, not an evenly spaced quarterly schedule. SSI reporting is tied to the specified agreement and timing provisions. This is an executive-branch statutory interpretation directed to HHS, rather than a general instruction for every private healthcare provider to disclose patient records.

The opinion also argues that the statutory knowledge standard does not invariably require a formal removal order and identifies circumstances that, in OLC’s view, can establish knowledge. It discusses privacy-law conflicts but does not replace a particular entity’s analysis of actual records, law and applicable program agreements. Its concluding part states that the interpretation is prospective, cannot retroactively alter TANF/SSI agreements entered under the prior understanding, and does not support clawback where states complied with then-existing executive interpretations. State-operated health or human-services entities therefore need counsel to evaluate entity status, knowledge and the relevant funding terms before changing a disclosure workflow.

CalPrivacy’s September 3 Enforcement Advisory 2026-01 warns that data brokers must give true and correct annual registration information, including data types, recipients and required rights-request metrics. The advisory says the Delete Act does not distinguish an accidental error from an intentional misstatement when the resulting entry is incorrect, and describes a 200-dollar fine for each day of failure to register as required. Examples include reproductive-health, citizenship, precise-location and other sensitive data and sharing with specified government, foreign-actor or GenAI-developer categories.

The advisory’s scenarios ask businesses to reconcile disclosures when their collected fields or customers change and to compare registry and privacy-policy rights-request metrics. It also recites the annual January 31 registration and January 2026DROP-account requirements. Those statements concern businesses actually qualifying as data brokers, not every health-tech company or healthcare record holder. The document expressly says it creates no substantive policy, alternative relief or safe harbor; statutes and regulations control and enforcement is assessed case by case. Organizations need their actual data and recipient inventory to determine whether a registration statement is accurate.

USPS’s September 1 final rule requires parcels mailed as Free Matter for qualifying blind or other physically disabled users to carry both an Intelligent Mail package barcode and an Intelligent Mail matrix barcode from October 4. The enacted mailing-standard text applies to outbound and return parcels, with preparation under the referenced DMM standards. The agency links the change to tracking, processing visibility and safer handling, including the appropriate hazardous-material service-type codes.

Free Matter pieces are exempt from the Hazmat Handling Fee, but commercial mailers remain subject to the Hazmat Noncompliance Fee for hazardous material not appropriately declared and labeled. Commercial pieces failing the unique package/matrix barcode requirements also face the separate Package Quality Noncompliance Fee. The rule changes preparation standards for this postal category rather than declaring every healthcare shipment eligible for free postage. At September 26, the October 4 effective date remains future, so applicable fulfillment and return-label arrangements need validation before the change.

SB 1410, chaptered September 18, changes the written notice period for an email address of record to 12 business days in the covered adult community-care and residential-care licensing provisions. Applicants and licensees must maintain an email address with the department and notify it in writing of that address and a change. The bill amends Health and Safety Code 1509.56,1509.6,1568.023 and 1569.15; under the ordinary constitutional effective-date rule, implementation begins January 1, 2027.

The email clock does not replace every other licensing-update period. Section 1569.15 retains a general 30-calendar-day update rule unless a shorter period applies, as well as specified annual,30-day and six-month rules for information about out-of-state facilities. Its distinct email subdivision uses 12 business days. The same section preserves material-information, disciplinary-disclosure and licensing consequences. Facilities need a written-notice record and a business-day calculation tied to the email change, while keeping ownership, disciplinary and other application changes on their separate schedules.