Enforcement Briefing, week of Aug 30, 2026

DOJ announced on August 26 that The Villages Health System agreed to a $541.5 million False Claims Act settlement concerning diagnosis codes submitted to Medicare Advantage organizations during 2020 through 2024. CMS adjusts plan payments using beneficiaries’ diagnoses, and the provider’s risk-sharing arrangements could increase its own reimbursement when plan payments rose. The government alleged that codes lacked adequate medical-record support or relied on amendments not initiated by the rendering provider that were untimely or unapproved. These are the alleged coding mechanisms addressed by the settlement, not a determination that every chart amendment or risk-sharing arrangement is improper.

The resolution followed a December 27, 2024 submission under OIG’s Health Care Fraud Self-Disclosure Protocol and a July 3, 2025 Chapter 11 filing. DOJ says the bankruptcy court approved the settlement on August 25, before the announcement. It credited prompt remedial action, a detailed disclosure and cooperation. The affected Humana, UnitedHealthcare and GuideWell plans were also returning overpayments through invalid-code deletions and/or agreements with DOJ and CMS. That separates the provider’s settlement from the plans’ responses to their own CMS payments. The resolved claims remain allegations, with no determination of liability.

On August 24, DOJ announced that Monogram Health Professional Services PC and Monogram Health Inc., headquartered in Tennessee, agreed to pay $2.4 million to resolve False Claims Act allegations. Monogram provided in-home care and related services under contracts with Medicare Advantage organizations. Those risk-sharing arrangements made higher beneficiary risk scores financially relevant to both plan payments from CMS and Monogram’s reimbursement. The alleged conduct occurred from January 1, 2021 through December 31, 2023 and concerned codes that were clinically inaccurate, unsupported in the medical record and/or did not require or affect patient care, treatment or management.

The release identifies four Hierarchical Condition Categories: protein-calorie malnutrition, substance use disorder, coagulation defects and other specified hematological disorders, and angina pectoris. It explains that unsupported diagnoses can inflate risk scores and capitated payments without establishing an additional service-based entitlement. The settlement also resolves a former Monogram physician’s whistleblower action; DOJ says the relator will receive approximately $380,000 and that Monogram received cooperation credit. The announcement establishes the reported resolution, not a separately verified execution or completed-payment date. DOJ expressly states that the claims remain allegations and liability has not been determined.

OCR announced its 55th HIPAA Right of Access enforcement action on August 27, resolving a complaint involving Azul Vision, a California optometry and ophthalmology provider operating 31 clinics. The individual requested records on January 9, 2023, complained to OCR on April 27, and did not receive them until January 6, 2025. OCR identified a potential failure to provide timely access, while the agreement expressly disclaims an admission of liability. HHS’s release reports a $50,000 payment and a two-year corrective action plan. Azul signed on August 12 and HHS on August 13; the agreement becomes effective on the last signature, establishing August 13 as the resolution date rather than the later announcement.

The corrective plan requires a policy review within 30 calendar days, distribution within 60 days, and workforce training within 90 days and at least annually thereafter. It also requires recurring 90-day submissions listing access requests and response dates, annual reports, and retention of compliance records for six years. These are Azul’s negotiated duties, not automatic new reporting obligations imposed on every covered entity. The broader operational issue is whether a provider can follow a request from intake to actual delivery and detect unresolved cases before external intervention. The historical dates distinguish the underlying delay, agreement and public announcement without suggesting a new complaint or later outcome.

DEA’s August 28 announcement describes a $50 million settlement resolving allegations that Walmart pharmacies filled thousands of invalid prescriptions for opioids and other controlled substances. The government’s complaint was filed December 22, 2020 and amended in 2022; the alleged conduct began June 26, 2013. According to the release, pharmacists reported suspected pill-mill prescribers through thousands of refusal-to-fill forms, while compliance-team members and pharmacists allegedly filled invalid prescriptions despite that information. The warning signs included dangerous drug combinations, repeated high-dose prescriptions and recurring early-fill requests. These are the government’s allegations in the resolved case, not an adjudicated finding of liability.

In addition to the monetary resolution, Walmart entered a memorandum of agreement with DEA addressing future dispensing controls. The release describes a hotline for employees and patients, proactive monitoring of pharmacy dispensing patterns, and a process for evaluating prescribers suspected of illegal prescribing. Those commitments connect information gathered at individual pharmacies with corporate review and action. The settlement therefore illustrates both frontline dispensing judgment and what an organization does with warning reports it already receives. The monetary and monitoring commitments resolve allegations; the announcement does not independently document completed payment.

Four DMHC records identify August 26 administrative-penalty agreements totaling $331,000: L.A. Care matter 24-705 for $111,000, DentaQuest matter 23-768 for $150,000, Kaiser matter 24-704 for $45,000 and Community Care Health Plan matter 24-699 for $25,000. L.A. Care’s indexed record concerns timely-access reporting and methodology. Kaiser’s detailed letter describes 114 providers that remained in its measurement-year 2021 contact list despite being marked ineligible for at least three consecutive years. The Kaiser letter cites Health and Safety Code 1367.03(f)(2)/(3) and historical regulatory language under title 28 section 1300.67.2.2(g)(2)(B); it does not list every provision cited for L.A. Care. These are agreed penalties in specific matters, rather than verified receipts of payment or a complete weekly result set.

DentaQuest’s letter identifies 1,288 of 3,066 enrollees cancelled for nonpayment in 2023 who did not receive required grace-period or cancellation notices. Automated-card users received notices, while check or money-order users did not. It separately finds a failure to initiate a grievance after an enrollee complained about access and requested a refund, rather than finding that the entire grievance system lacked approval. Community Care’s indexed record addresses the number of payments to noncontracting providers at contracting facilities and related reporting data under Health and Safety Code 1371.31(a)(4), not a title 28 citation. Together, the matters illustrate how data preparation, notice generation and complaint classification can produce distinct compliance failures even when described under broad reporting categories.

Ten records in CDPH’s State Enforcement Actions export identify August 26 or 27 penalty issue dates and initial assessments totaling $73,750 across eight facilities. Professional Post Acute Center received two class A citations at $25,000 each. Seven class B citations account for $19,000: Northgate PostAcute Care, The Gardens of El Monte, two Long Beach Healthcare Center records, Astoria Healthcare Center, West Covina Healthcare Center and Able. Sierra Vista Hospital’s non-immediate-jeopardy administrative penalty is $4,750. These amounts describe the recorded initial assessments, not money collected, and the penalty issue dates are distinct from the earlier dates associated with the cited conduct.

The export records Patient Care for the two Professional Post Acute Center citations, Abuse/Facility Not Self Reported for the two Long Beach records, and other categories including Patient Rights, Physical Environment and Medication. Able’s facility type is an intermediate care facility for people with developmental disabilities; that classification does not by itself prove a habilitation-services violation. The rows provide associated legal citations and identifiers, but not the complete incident narratives. A later export’s Open disposition also cannot establish whether appeal periods had run as of this edition. The practical use is to locate the actual facility records for review while keeping assessment amounts, incident findings and procedural status separate.

DOJ announced September 4, 2026 sentences of 33 months for Kenneth Charles Kessler III and 24 months for Michael Andrew Gomez. Both had pleaded guilty in May to conspiracy to commit health care fraud. They owned and operated seven Florida durable medical equipment companies that billed Medicare for medically unnecessary orthotic braces, including braces beneficiaries neither needed nor requested. The $34.8 million figure describes the fraudulent billing scheme, rather than a statement that either individual received that amount personally.

According to the court-document account in the announcement, the operators paid kickbacks and bribes for fraudulent signed physician orders and used those orders to ship braces nationwide. They shifted billing among their companies to evade Medicare payment suspensions. DOJ reported that Kessler profited more than $1.4 million and Gomez more than $2.3 million. The related-company structure and order-generation process are distinct elements of the admitted scheme: checking only a supplier's current billing identity would not address the mechanism DOJ described. These are facts of the resolved criminal case, not a new rule changing DME coverage requirements.

Rebecca Fadanelli, owner of Skin Beaute Med Spa in Massachusetts, was sentenced September 2, 2026 to 46 months in prison and two years of supervised release, DOJ announced September 4. The court also ordered restitution and forfeiture, each $1,001,562. She had pleaded guilty in April to unlawful importation and selling or dispensing counterfeit drugs and devices.

DOJ reports more than 2,700 counterfeit botulinum-toxin and filler procedures affecting over 900 paying clients during roughly March 2021–June 2024. Fadanelli was an aesthetician without authority to administer the injections and falsely claimed to be a nurse. Products were imported from China and Brazil, and she changed delivery arrangements after seizures. Manufacturers identified seized products as counterfeit. Clients suffered serious adverse effects, including infections, facial or eye problems and hospitalizations. The case connects independent license checks, product provenance and response to patient complaints; a familiar brand label or claimed nursing credential did not establish legitimacy.

DOJ's September 2, 2026 release announced that Heuser Health, a Louisville provider of at-home wound care, agreed to pay $2,646,186.72 to resolve False Claims Act allegations involving Medicare and TRICARE skin-substitute claims. The settlement forms part of the department's broader Operation Skin Scam initiative. DOJ expressly states that the claims are allegations only and there was no determination of liability. The release establishes an agreement to pay, rather than independent proof of completed payment.

Heuser used advanced bioengineered or tissue-derived skin substitutes to treat chronic and acute wounds. According to DOJ, the federal rules applicable to these claims required billing based on actual invoice price, but the company allegedly submitted or caused claims using invoice amounts higher than its true purchase prices. The alleged mismatch concerned acquisition cost and reimbursement, rather than a finding that every wound-care service was unnecessary. Its operational relevance is to claims that actually use invoice-based reimbursement; the case does not establish one payment methodology for all products, payers or care settings.

On August 26, DOJ announced a False Claims Act resolution involving the former DermTech Inc., now DTech Liquidating Inc. after its June 2024 Chapter 11 filing. The United States received an Allowed Class Three General Unsecured Claim of $5,038,011 in the bankruptcy proceeding. That describes a recognized claim against the estate, not proof that the government collected the stated amount. The allegations concerned unreliable skin-cancer tests billed to Medicare and reported to patients. DOJ expressly distinguishes the bankrupt company from DermTech LLC, which purchased assets in 2024; the resolved claims do not pertain to that purchaser.

The release describes two separate testing problems. From October 2022 through March 2023, DermTech allegedly used an unvalidated positive-control range for one of two key melanoma markers. From January 2020 through February 2022, it allegedly generated positive or negative results despite insufficient patient RNA. DOJ also alleges that results were not retracted and Medicare was not adequately refunded when concerns arose. A former employee’s whistleblower action is included in the resolution; the relator is to receive 20% of the recovery actually received from bankruptcy. The payment mechanism, affected test periods and distinction between corporate entities limit what can be inferred from the headline amount. No liability determination was made.

The FTC announced on August 25 that it finalized a consent order addressing Ascension Health Alliance’s proposed $3.9 billion acquisition of AmSurg. The order requires seven ambulatory surgery center divestitures across Nashville, Panama City, Tulsa, Waco and Wichita. Six centers go to SC Affiliates and the Panama City center to Florida Gastroenterology Center. The FTC alleged harm to competition for specified gastroenterology, ophthalmology and orthopedic surgical services in those markets. The Commission’s vote was 2–0 after public comment. The final order itself was issued August 24; August 25 is the public announcement date, rather than the order’s issuance date.

Section X imposes a ten-year prior-notice duty for acquisitions of interests in ASCs performing the order-defined services in the order-defined areas. Notice must precede consummation by at least 30 days. A timely request for additional information triggers a further 30-day period after the response, subject to the order’s early-termination provision. The section excludes transactions for which the required Hart-Scott-Rodino notification has already been made. These limits are important: the obligation is neither a blanket notice rule for every ASC purchase nor a statement that every other health system has the same duty. The order also provides continuing compliance reports and restrictions on reacquiring the divested locations.

CDPH data identify citation 240024048, issued August 31, 2026 to Community Convalescent Center of San Bernardino, as a Class B Physical Environment citation with a $3,000 initial assessment. The row identifies July 24 as the violation date, separating the underlying conduct period from the penalty issue date. Initial assessment is distinct from money collected, and the available record does not establish the citation’s payment or appeal status by this edition’s coverage cutoff.

The row lists federal section 483.80 infection-control provisions and California Title 22 environmental/facility provisions. It supplies identifiers, categories and legal references but not a complete statement of factual deficiencies, resident impact or corrective measures. Those details require the citation and supporting records. Later database disposition, final-amount or balance fields cannot establish what was known or completed at an earlier issue date; they are not used here to infer payment, closure or successful remediation.

FDA's final order, applicable August 31, 2026, permanently debars Rahim Shafa from providing services in any capacity to a person with an approved or pending drug product application and separately bars him for 20 years from importing or offering any drug for import. FDA denied his hearing request because it did not raise a genuine and substantial factual issue. The order rests on federal felony convictions for three unlawful-importation counts and one receiving-and-delivering-misbranded-drug count. These are FDA drug-regulation debarments, distinct from exclusion from federal healthcare programs.

The notice describes unapproved disulfiram and naltrexone products imported under false shipping descriptions and administered to patients. FDA treated the services bar as mandatory and imposed four consecutive five-year periods for the import bar after considering statutory factors. It explained that a pending appeal did not postpone debarment because the statute treats an entered judgment as a conviction. The notice also warns that knowing use of Shafa's services by a person with an approved or pending application can trigger civil monetary penalties. No later appeal outcome is asserted.

Poul Thorsen pleaded guilty to wire fraud on September 1, 2026 after his extradition from Germany in May. DOJ's Northern District of Georgia release states that he diverted more than $1 million of CDC grant money. Sentencing was scheduled for December 1, which remained a future date as of the September 5 coverage cutoff; the release does not report an imposed sentence. The more than $11 million awarded to Danish agencies was the broader grant funding, not the amount identified as stolen.

Thorsen became principal investigator responsible for administering the grants in 2002. Between February 2004 and June 2008, he submitted over a dozen false reimbursement invoices bearing a forged CDC laboratory chief's signature. Aarhus University transferred money to accounts it believed belonged to the CDC, but the accounts were his personal accounts; the release also identifies diverted funds from Odense University Hospital. The mechanism highlights the importance of independently checking invoices, authorization and bank-account ownership across international research collaborations.

The U.S. Attorney's Office announced that Loretta Pyeatt pleaded guilty on September 4, 2026 to fraud in connection with access devices after stealing at least $321,000 from a care client. The release describes employment from roughly July 2023 through September 2025 and a client who received Social Security retirement and Veterans Affairs benefits. Sentencing was scheduled for December 9. That date was still future at the September 5 coverage cutoff, so the reported development is the guilty plea, not an imposed prison term.

The client gave Pyeatt debit cards to buy groceries, but she admitted using the access for cash withdrawals and other unauthorized purchases. Transactions increased from approximately 20 to 30 a month before her involvement to as many as 330 a month. The account had at least $232,026 when she began and less than $5,600 by July 2025. These details show how limited purchasing permission became repeated access to a vulnerable person's funds and incoming benefits. The release's maximum statutory penalty describes possible sentencing exposure only; it does not determine the sentence or establish that every transaction was independently adjudicated.

DOJ’s September 2 release reports that Adam Gentile was sentenced August 27, 2026 to four years in prison and four years of supervised release after a March guilty plea to three wire-fraud counts. The court ordered restitution of $3.8 million and $3.3 million to the two victim medical practices, respectively, plus $7.8 million forfeiture. These financial orders are distinct from the more than $4.5 million and more than $3.3 million losses described for the two employment periods.

Gentile had payroll and administrative responsibilities at the first practice and sole payroll responsibility at the second. DOJ describes extra paychecks sometimes labeled bonuses and personal credit-card payments from practice bank accounts during roughly 2015–November 2020 and April 2021–May 2024. The second practice’s funds also supported a home and a side business. The repeated mechanism across employers makes independent payroll-change approval and bank reconciliation pertinent; a practice manager’s recordkeeping role is not independent verification of their own compensation.

DOJ announced September 1, 2026 that Novum Pharmaceutical Research Services of Delaware, Inc. agreed to pay $3,345,000 to resolve False Claims Act allegations concerning a $2 million Second Draw Paycheck Protection Program loan. Novum received the loan and full forgiveness, but the government alleged that it was ineligible under the program's employee-based size standard. The settlement also resolves whistleblower claims. DOJ states that the resolved claims remain allegations, with no determination of liability; the announcement does not independently prove that the settlement payment was completed.

For the Second Draw program described in the release, eligibility required no more than 300 employees including domestic and foreign affiliates. Novum certified that it and its affiliates had fewer than 300, while DOJ says their combined workforce exceeded 300, including employees of its India-based ultimate parent, Lambda Therapeutic Research. The distinction is the applicant's consolidated eligibility calculation, rather than simply its own payroll. Although Novum is a research business, the case concerns SBA relief lending and forgiveness certifications, not reimbursement for healthcare services or a new Medicaid eligibility rule.

CPPA’s August 27, 2026 decision immediately adopted a stipulated final order against SalesIntel Research, Inc. concerning its failure to register in 2025 for data-broker activity during 2024. The order requires $36,400, including the $6,600 annual registration fee, with full payment within thirty days of the Board’s decision. It records the company’s engagement after enforcement contact and timely 2026 registration for 2025 activity. The amount is an ordered obligation, not proof that payment was completed.

Paragraphs 27–29 require timely registration for future years of data-broker operation, required privacy-request metrics and DROP deletion processing under the cited statutes when operating as a broker. SalesIntel admits specified findings and the 2024 broker activity requiring registration; it otherwise neither admits nor denies the remaining findings. The release is limited to the specified late-registration violation, and the case does not establish a healthcare-data misuse finding or impose SalesIntel’s thirty-day payment clock on unrelated organizations.