Each card leads with priority, lifecycle, applicability, and deadline, then the detail.
P1
NEW
Operationally relevant
Settled
- What changed
- The Justice Department announced that The Villages Health System LLC has agreed to a $541.5 million settlement resolving False Claims Act allegations. The government alleged that between 2020 and 2024 the organization knowingly submitted invalid diagnosis codes to Humana, UnitedHealthcare and GuideWell, which inflated the risk adjusted payments those Medicare Advantage organizations received from CMS. The codes were alleged to lack adequate medical record support, to rest on unapproved chart amendments, or to be untimely modifications not initiated by the rendering provider. The organization self disclosed to the HHS Office of Inspector General under the Health Care Fraud Self-Disclosure Protocol on December 27, 2024, filed for Chapter 11 protection on July 3, 2025, and the bankruptcy court approved the settlement on August 25, 2026. The claims resolved by the settlement are allegations only and there has been no determination of liability. Three official sources carry three different dates: the Justice Department Office of Public Affairs release is dated August 26, 2026, the Middle District of Florida release and the OIG enforcement listing are both dated August 27, 2026, and the bankruptcy court approval is dated August 25, 2026. This finding uses August 25, 2026 as the enforcement event date, because the project convention takes the date of the actual resolution where a source identifies it and reserves the earliest announcement date for matters where only announcement dates exist.
- Why it matters
- This is the largest provider side Medicare Advantage risk adjustment resolution of the year and the alleged conduct turns on three mechanics that exist in almost every risk adjustment program: documentation that does not support the code, chart amendments made outside an approved amendment policy, and diagnosis changes entered by someone other than the rendering provider. Any organization with a Medicare Advantage risk arrangement, a coding query process, or a retrospective chart review vendor has the same three exposure points, whether or not it is ever accused of anything.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- Federal, Florida
- Agencies
- U.S. Department of Justice, U.S. Attorney Office, Middle District of Florida, HHS Office of Inspector General
- Entities
- The Villages Health System LLC
- Action type
- Settlement
- Event date
- Aug 25, 2026
- Alleged conduct
- Alleged knowing submission of invalid diagnosis codes to three Medicare Advantage organizations between 2020 and 2024, where the codes were alleged to lack adequate medical record support, to rest on unapproved chart amendments, or to be untimely modifications not initiated by the rendering provider. The allegations were resolved without any determination of liability.
- Resolution
- A $541.5 million False Claims Act settlement, agreed to and approved by the bankruptcy court on August 25, 2026, following a December 27, 2024 self disclosure under the OIG protocol and a July 3, 2025 Chapter 11 filing. The claims are allegations only and there has been no determination of liability. Announcement dates differ across official sources: August 26, 2026 for the Justice Department Office of Public Affairs and August 27, 2026 for both the Middle District of Florida and the OIG enforcement listing. The August 25, 2026 court approval date is used as the event date because it is the date the resolution itself was effected.
Recommended actionTest the three failure modes directly. First, sample risk adjusting diagnoses submitted in the last twelve months and confirm the medical record supports each. Second, confirm the chart amendment policy names who may amend, on what basis, and inside what time limit, and that the electronic record enforces it. Third, confirm that no one other than the rendering provider can add or change a diagnosis without provider attestation. Report the sample size and the error rate to the compliance committee.
- Self disclosure did not eliminate the dollar exposure. No corporate integrity agreement for this entity appeared on the OIG corporate integrity agreement listing when that listing was reviewed on August 31, 2026, sorted by latest update, and neither official announcement referenced one. OIG can post an agreement after an announcement, so this describes the listing on that date rather than establishing that no agreement exists.
- A chart amendment policy that does not state who may amend, on what basis, and by when is a risk adjustment exposure, not only a records management gap.
- Diagnosis codes entered or changed by anyone other than the rendering provider need a provider attestation trail that survives audit.
- Retrospective chart review that only adds codes and never deletes them is the pattern the government reads as one directional.
Permalink: #villages-health-system-medicare-advantage-diagnosis-coding-settlement · Development ID GC-2026-0003
P2
NEW
Operationally relevant
Settled
- What changed
- The Justice Department announced on August 24, 2026 that Monogram Health agreed to pay $2.4 million to settle a False Claims Act suit alleging that it caused the submission of false diagnosis codes in order to increase Medicare Advantage payments. The matter was handled by the Civil Division Commercial Litigation Branch Fraud Section and the U.S. Attorney Office for the Central District of California, with HHS-OIG. The case originated as a qui tam action brought by a physician formerly employed by the company, who receives approximately $380,000. Neither official announcement referenced a corporate integrity agreement, and none for this entity appeared on the OIG corporate integrity agreement listing reviewed on August 31, 2026. The claims resolved by the settlement are allegations only and there has been no determination of liability.
- Why it matters
- The dollar figure is small. The pattern is not. This is the second federal resolution in the same week on unsupported risk adjustment coding, and the defendant here is a value based care provider organization rather than a plan, which places the exposure with the group that documents the encounter rather than the group that submits the risk score.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- Federal, California
- Agencies
- U.S. Department of Justice, U.S. Attorney Office, Central District of California
- Entities
- Monogram Health
- Action type
- Settlement
- Event date
- Aug 24, 2026
- Alleged conduct
- Alleged causing of the submission of false diagnosis codes in order to increase payments from the Medicare Advantage program. The allegations were resolved without any determination of liability.
- Resolution
- A $2.4 million False Claims Act settlement announced August 24, 2026, with approximately $380,000 to the relator. The claims are allegations only and there has been no determination of liability.
Recommended actionRead this alongside The Villages resolution rather than on its own. Where the organization sends diagnosis data into a Medicare Advantage risk pool through a value based or shared risk arrangement, confirm in writing which party is accountable for coding accuracy under the contract, and confirm that the accountable party actually audits.
- Risk adjustment liability follows the party that documents and submits the diagnosis, not only the plan that receives the risk score.
- A value based contract should name the party accountable for coding accuracy and give that party audit rights it actually uses.
- Two settlements on one theory in one week is the point at which a compliance committee should ask for a risk adjustment audit result rather than a policy.
Permalink: #monogram-health-medicare-advantage-diagnosis-coding-settlement · Development ID GC-2026-0004
P2
NEW
Directly applicable
Settled
- What changed
- OCR announced on August 27, 2026 a $50,000 settlement and a two year corrective action plan with Azul Vision, a California optometry and ophthalmology provider. An individual requested her protected health information in January 2023 and did not receive it until January 2025, after OCR opened its investigation. The corrective action plan requires the practice to review and revise its Privacy Rule policies and procedures, to train all workforce members on the right of access, and to send HHS periodic lists of access requests received and the dates they were completed. OCR identified this as the 55th action under its Right of Access Enforcement Initiative.
- Why it matters
- The Privacy Rule gives thirty days, with one thirty day extension. Two years is not a close call, and the corrective action plan shows what OCR asks for when an organization cannot show its own numbers: a log of every request and its completion date, sent to the agency. A California provider that cannot produce that log on demand today is one complaint away from producing it for two years under a resolution agreement.
- Response type
- Validate
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- Federal, California
- Agencies
- HHS Office for Civil Rights
- Entities
- Azul Vision, Inc.
- Action type
- Resolution agreement
- Event date
- Aug 27, 2026
- Alleged conduct
- Failure to provide an individual timely access to her protected health information, with the request made in January 2023 and filled in January 2025, well beyond the Privacy Rule deadline.
- Resolution
- A $50,000 settlement with a two year corrective action plan requiring policy revision, workforce training, and periodic reporting of access requests and completion dates to HHS.
Recommended actionPull the access request log for the trailing twelve months and compute the completion time distribution, not the average. Identify every request that passed thirty days and every request with no recorded completion date. Confirm that requests arriving outside health information management, at a clinic front desk, through a patient portal message, or to a provider directly, are captured in the same log. California providers should confirm the Confidentiality of Medical Information Act production timelines are met as well.
- Right of access remains the most frequently enforced HIPAA obligation, now at 55 actions.
- Requests that arrive outside health information management are the ones that fall out of the clock, so the intake log has to cover every channel.
- The remedy OCR imposed is a request level log reported to the agency, which is the same artifact that would have prevented the case.
- Practice size did not matter. A small specialty practice drew a five figure settlement and two years of monitoring.
Permalink: #ocr-azul-vision-right-of-access-settlement · Development ID GC-2026-0005
P2
NEW
Operationally relevant
Settled
- What changed
- The Justice Department and DEA announced on August 28, 2026 that Walmart agreed to pay $50 million to resolve allegations that its pharmacies filled thousands of invalid prescriptions for opioids and other controlled substances since June 26, 2013, in violation of the Controlled Substances Act. The government alleged that compliance staff knew certain prescribers operated as pill mills yet prescriptions continued to be filled, that pharmacists filled prescriptions despite dangerous drug combinations, excessive high dose refills and early refill requests, and that the compliance function prioritized driving sales and patient awareness over Controlled Substances Act compliance while thousands of internal refusal to fill reports went unused. The settlement includes a memorandum of agreement with DEA requiring a reporting hotline, proactive dispensing pattern monitoring, and a prescriber evaluation process. The claims are allegations only and there was no determination of liability.
- Why it matters
- The allegation that carries beyond retail pharmacy is the unused signal. Pharmacists filed refusal to fill reports and the organization had them. Any organization that collects a compliance signal it does not route, act on, or trend has the same exposure, whether the signal is a refusal to fill, a hotline report, a coding query, or a denied prior authorization pattern.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health systems
- Jurisdiction
- Federal
- Agencies
- U.S. Department of Justice, Civil Division, Drug Enforcement Administration
- Entities
- Walmart Inc.
- Action type
- Settlement
- Event date
- Aug 28, 2026
- Alleged conduct
- Filling thousands of invalid controlled substance prescriptions since June 26, 2013 despite known pill mill prescribers and documented pharmacist red flags, with internal refusal to fill reports left unacted upon.
- Resolution
- A $50 million payment and a memorandum of agreement with DEA requiring a reporting hotline, proactive dispensing pattern monitoring, and a prescriber evaluation process.
Recommended actionTreat the three obligations DEA imposed as a self assessment for outpatient and retail pharmacy operations: a reporting channel for suspected illegal dispensing, proactive monitoring of dispensing patterns, and a documented process for evaluating suspect prescribers. Then ask the broader question at the compliance committee: which compliance signals does the organization collect today that nobody reviews on a schedule.
- A compliance signal that is collected and not reviewed is worse evidence than a signal never collected.
- Prescriber level evaluation, not only prescription level review, is what the agreement requires going forward.
- Sales and patient access goals sitting inside the compliance function is the structural fact the government pointed at.
Permalink: #walmart-controlled-substances-dispensing-settlement · Development ID GC-2026-0006
P2
NEW
Operationally relevant
Settled
- What changed
- The Department of Managed Health Care recorded four letters of agreement with an action date of August 26, 2026, totaling $331,000 in administrative penalties. Local Initiative Health Authority for Los Angeles County, doing business as L.A. Care Health Plan, paid $111,000 in matter 24-705 on timely access reporting violations under 28 CCR 1300.67.2.2(g)(2)(B), 1300.67.2.2(g)(2)(C)(1) and Health and Safety Code section 1367.03(f)(2) and (f)(3). California Dental Network, doing business as DentaQuest of California, paid $150,000 in matter 23-768 on improper cancellation or rescission of coverage under 28 CCR 1300.65.2(a)(3)(A) and (a)(3)(E) and on grievance and appeals failures under 28 CCR 1300.68(a)(1) and Health and Safety Code section 1368(a)(1). Kaiser Foundation Health Plan paid $45,000 in matter 24-704 on the same timely access reporting provisions. Community Care Health Plan paid $25,000 in matter 24-699 for failing to report the number of payments made to noncontracting providers at contracting health facilities under 28 CCR 1371.31(a)(4), the surprise billing data provision.
- Why it matters
- Three of the four penalties are for reporting failures rather than for denying care. The department assessed $156,000 across two plans purely for timely access reports that were late, incomplete, or not prepared using the department's own methodology, and a fourth plan paid for an incomplete surprise billing data submission. For a health system that holds delegated risk, operates a restricted Knox-Keene licensed entity, or supplies network and encounter data to a plan, the exposure sits in the regulatory reporting calendar and in the accuracy of the underlying data, not in the clinical decision. The DentaQuest matter is the reminder that a grievance system the department has not approved, and coverage terminations sent without the required notices, remain a penalty category on their own.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- California
- Agencies
- California Department of Managed Health Care
- Entities
- Local Initiative Health Authority for Los Angeles County d.b.a. L.A. Care Health Plan, California Dental Network, Inc. d.b.a. DentaQuest of California, Kaiser Foundation Health Plan, Inc., Community Care Health Plan, Inc.
- Action type
- Settlement
- Event date
- Aug 26, 2026
- Alleged conduct
- Timely access reporting failures at two plans, improper cancellation or rescission of coverage and grievance and appeals failures at a third, and an incomplete surprise billing data submission at a fourth. Each matter resolved by a letter of agreement with an administrative penalty.
- Resolution
- Four letters of agreement with an action date of August 26, 2026: $111,000 (matter 24-705), $150,000 (matter 23-768), $45,000 (matter 24-704) and $25,000 (matter 24-699), totaling $331,000.
Recommended actionAsk who owns each recurring DMHC filing the organization or its delegated entities contribute to, and confirm that the last timely access report and the last surprise billing data submission were prepared using the department's stated methodology rather than an internal equivalent. Where the organization delegates utilization management or grievance handling, confirm the delegate's grievance system carries current department approval and that termination and grace period notices match the content the regulation requires.
- A regulatory report filed late, filed incomplete, or filed on an internal methodology is a penalty category in its own right, separate from any access or coverage failure.
- Timely access reporting accuracy is measured against the department's stated methodology, so a plan or delegate that computes compliance its own way is exposed even when access is adequate.
- Surprise billing data reporting under 28 CCR 1371.31(a)(4) reaches the proportion of noncontracting to contracting providers at a contracting facility, which is a data set the facility usually holds.
- A grievance system needs current department approval, not merely a written procedure.
Permalink: #dmhc-letters-of-agreement-august-26-2026 · Development ID GC-2026-0017
P2
NEW
Directly applicable
Announced
- What changed
- The California Department of Public Health State Enforcement Actions record carries ten citations and administrative penalties with a Penalty Issue Date of August 26 or August 27, 2026, totaling $73,750 across eight facilities in Sacramento, Marin and Los Angeles counties. Professional Post Acute Center, a Marin County skilled nursing facility, received two class A citations at $25,000 each on August 26 for violations of 42 CFR 483.25(d)(1) and (2), 42 CFR 483.21(b)(1) and (b)(3)(i), and title 22 sections 72311(a)(2) and 72313(a)(2), recorded under the Patient Care penalty category. Sierra Vista Hospital, an acute psychiatric hospital in Sacramento County, received a $4,750 non immediate jeopardy administrative penalty on August 26 under Health and Safety Code section 1280.3(b)(1) and title 22 section 71507(a)(9). Long Beach Healthcare Center received two class B citations of $3,000 each on August 27 in the Abuse, Facility Not Self Reported category, one of them citing Health and Safety Code section 1418.91(a) and (b) alongside 42 CFR 483.12(c)(1) and (4). Northgate PostAcute Care received a $3,000 class B citation on August 26 under the Patient Rights category, The Gardens of El Monte a $3,000 class B citation on August 26, Astoria Healthcare Center a $3,000 class B citation on August 27 for physical environment, West Covina Healthcare Center a $3,000 class B citation on August 27 in the Medication category citing 42 CFR 483.45(f)(2), and Able, an intermediate care facility for the developmentally disabled, a $1,000 class B citation on August 26. Every record carries a disposition of Open.
- Why it matters
- This is the state licensing layer that sits underneath federal survey enforcement, and it moves weekly whether or not anything federal happens. Two features of the week are worth a compliance committee's attention. First, both class A citations rest on care planning and care delivery provisions, 42 CFR 483.21(b) and 483.25(d), which is the pairing that appears when the plan of care and the care actually delivered do not match in the record. Second, the two Long Beach Healthcare Center citations sit in the Abuse, Facility Not Self Reported category, and one of them cites Health and Safety Code section 1418.91, the statute that requires a skilled nursing facility to report suspected abuse to the Department. A citation in that category is an enforcement finding about the reporting pathway itself, not only about the underlying incident, and the same reporting logic reaches any licensed facility a health system operates. The Sierra Vista Hospital penalty under Health and Safety Code section 1280.3 is the acute side of the same week and shows the administrative penalty track is not confined to long term care.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- California
- Agencies
- California Department of Public Health
- Entities
- Professional Post Acute Center, Sierra Vista Hospital, Inc., Long Beach Healthcare Center, Northgate PostAcute Care, The Gardens of El Monte, Astoria Healthcare Center, West Covina Healthcare Center, Able
- Action type
- Civil monetary penalty
- Event date
- Aug 26, 2026
- Alleged conduct
- Care planning and care delivery failures at a skilled nursing facility, drawing two class A citations. Abuse allegations the facility did not self report at a second skilled nursing facility. Patient rights, physical environment and medication violations at three further skilled nursing facilities. A habilitative services violation at an intermediate care facility for the developmentally disabled. A non immediate jeopardy administrative penalty at an acute psychiatric hospital under Health and Safety Code section 1280.3(b)(1).
- Resolution
- Ten citations and administrative penalties issued August 26 and 27, 2026, totaling $73,750 across eight facilities: two class A citations at $25,000 each, seven class B citations between $1,000 and $3,000, and one $4,750 administrative penalty. All ten records carry a disposition of Open, so appeal rights had not run at the close of the coverage window.
Recommended actionPull the current abuse and unusual occurrence reporting matrix for every licensed facility the organization operates and confirm, for each licence type, who reports, to which agency, and inside what clock, and that the last quarter's reports actually went out inside it. Separately, sample recent care plans in any skilled nursing or subacute unit against the care documented in the record for the same period, focusing on the change of condition pathway that 42 CFR 483.21(b)(3)(i) and title 22 section 72311(a)(2) sit on. Confirm the organization can produce the citation history for each of its own facilities from the CDPH enforcement record rather than relying on internal logs alone.
- Both class A citations pair a care planning provision with a care delivery provision, which is the combination that surfaces when the plan of care and the record of care given diverge.
- An Abuse, Facility Not Self Reported citation is an enforcement finding about the reporting pathway, so a facility can be cited for the reporting failure independently of the underlying allegation.
- Health and Safety Code section 1418.91 sets the skilled nursing facility abuse reporting duty to the Department, and it was cited alongside the federal abuse provisions in the same citation.
- The Health and Safety Code section 1280.3 administrative penalty track reaches acute and acute psychiatric hospitals, not only long term care, and it ran in the same week.
- CDPH publishes a per record Penalty Issue Date, so a facility's own citation history is verifiable from the state record rather than only from internal logs.
Permalink: #cdph-state-enforcement-actions-august-26-27-2026 · Development ID GC-2026-0018
P3
NEW
Operationally relevant
Settled
- What changed
- The Justice Department announced on August 26, 2026 a settlement of $5,038,011, allowed as a class three general unsecured claim in bankruptcy, resolving allegations that DermTech billed Medicare for skin cancer tests using an unvalidated positive control range for one of two key melanoma markers between October 2022 and March 2023, and billed for tests that lacked sufficient patient RNA yet still produced results reported to patients between January 2020 and February 2022. The case began as a qui tam action by a former employee, who receives twenty percent of the recovery. The company is liquidating following a June 2024 Chapter 11 filing. The claims resolved by the settlement are allegations only and there has been no determination of liability.
- Why it matters
- Two distinct failures are alleged and both are laboratory quality questions that became billing questions: a control range that was not validated, and results released on specimens that did not meet the assay input requirement. A hospital that performs, sends out, or resells molecular testing inherits the same question, and CMS separately announced large scale prepayment and enrollment action against laboratory billing this same week.
- Response type
- Assess
- Confidence
- High
- Applies to
- Health-tech, Health systems
- Jurisdiction
- Federal, California
- Agencies
- U.S. Department of Justice, Civil Division, U.S. Attorney Office, Southern District of California, Federal Bureau of Investigation, HHS Office of Inspector General
- Entities
- DermTech Inc., DTech Liquidating Inc.
- Action type
- Settlement
- Event date
- Aug 26, 2026
- Alleged conduct
- Alleged billing of Medicare for melanoma tests run against an unvalidated positive control range, and for tests performed on specimens with insufficient RNA whose results were nonetheless reported to patients. The allegations were resolved without any determination of liability.
- Resolution
- A settlement of $5,038,011 allowed as a class three general unsecured claim in the bankruptcy, with twenty percent to the relator. The claims are allegations only and there has been no determination of liability.
Recommended actionAsk the laboratory director, in writing, for the validation record behind the control ranges on the molecular assays the organization bills, and for the specimen sufficiency criteria and the rate at which results are released on insufficient specimens. Where testing is sent out, confirm the reference laboratory agreement lets the organization request those records.
- Assay validation records become billing records once a claim is submitted for the result.
- Specimen sufficiency criteria need a documented failure path, not a workaround that still releases a result.
- A former employee brought this case, which is the ordinary origin of laboratory quality qui tam actions.
Permalink: #dermtech-unvalidated-skin-cancer-test-settlement · Development ID GC-2026-0007
P3
NEW
Operationally relevant
Final
- What changed
- The Federal Trade Commission announced on August 25, 2026 that it approved the final consent order in the $3.9 billion Ascension Health and AmSurg transaction, docket 251-0093, on a 2 to 0 vote after the public comment period. The order requires divestiture of seven ambulatory surgery centers across Nashville, Panama City, Tulsa, Waco and Wichita, with six going to SC Affiliates and the Panama City center to Florida Gastroenterology Center, and it requires Ascension to give the Commission prior notice of any future ambulatory surgery center acquisition in the metropolitan areas surrounding the divested centers. The Commission alleged the deal would limit competition for outpatient surgical services in gastroenterology, ophthalmology and orthopedics.
- Why it matters
- The prior notice provision is the part with a long tail. A health system that accepts a consent order accepts a reporting duty that attaches to future transactions in named markets, which is a standing compliance obligation rather than a one time divestiture. For any system evaluating ambulatory surgery center acquisitions, the order is also the current statement of how the Commission draws outpatient surgical service markets.
- Response type
- Monitor
- Confidence
- High
- Applies to
- Health systems, Provider networks
- Jurisdiction
- Federal
- Agencies
- Federal Trade Commission
- Entities
- Ascension Health Alliance, AmSurg LLC
- Action type
- Consent order
- Event date
- Aug 25, 2026
- Alleged conduct
- That the $3.9 billion acquisition would limit competition for outpatient surgical services in gastroenterology, ophthalmology and orthopedics across five metropolitan areas.
- Resolution
- Final consent order approved 2 to 0 requiring divestiture of seven ambulatory surgery centers and prior notice to the Commission for future ambulatory surgery center acquisitions in the surrounding metropolitan areas.
Recommended actionIf the organization is evaluating ambulatory surgery center or physician practice acquisitions, read the market definitions in this order before the next transaction memo is written. If the organization is subject to any existing consent order, confirm that a named owner tracks its prior notice obligations and that transaction planning routes through that owner.
- A consent order creates an ongoing reporting obligation that outlives the divestiture and needs a named owner.
- The market definitions in a finalized order are the most current statement of how the agency will look at the next deal.
- Ambulatory surgery center concentration by specialty, rather than hospital concentration, is where the Commission focused here.
Permalink: #ftc-final-consent-order-ascension-amsurg · Development ID GC-2026-0008