Weekly healthcare intelligenceRegulation · Enforcement · Government payersNews & Sweeps →
Complete approved report · Enforcement Briefing

Enforcement Intelligence Briefing, Week of September 20, 2026

Published September 27, 2026 Coverage Sep 20, 2026 to Sep 26, 2026 Listed sources reviewed through Sep 26, 2026 Last modified Oct 16, 2026 Version 2

Read this edition’s coverage note ↓

Read corrections to this edition (version 2). The original publication date is unchanged.

Archived editionThis edition is archived. It reflects the record as of its coverage dates and may not reflect current requirements. See the current Enforcement Briefing edition.

Executive triage

Federal and California actions reinforce medical-necessity, prescription, and claims-integrity controls.

  • A skilled-nursing settlement focuses on therapy unsupported by individual patient need and record changes made without clinical authority.
  • A DME settlement focuses on medical necessity and valid prescriptions.
  • A California guilty plea shows continued focus on false Medi-Cal and IHSS claims.
  • The refreshed CDPH export supplies fourteen in-window facility citations, including higher-value patient-care and reporting penalties.

What changed since last week

Compare with the previous published edition, Sep 20, 2026. Labels describe each development's lifecycle; absence from this list does not mean an obligation closed.

Findings, highest priority first

Each card leads with priority, lifecycle, applicability, and deadline, then the detail.

P1 CARRYOVER Operationally relevant Settled

NYU and UPMC agree to end specified pediatric services and pay $9.45 million to resolve federal investigations

What changed

DOJ announced September 18, 2026 agreements with NYU Langone Hospitals and the University of Pittsburgh Medical Center resolving investigations of potential federal violations associated with gender-affirming care for minors. According to the announcement, the institutions will cease providing puberty blockers, cross-sex hormones and surgical procedures to minors. NYU agreed to pay $8.5 million and UPMC $950,000, a combined $9.45 million. These are the institutions' reported resolution commitments; the announcement does not establish that every other provider is subject to the same terms.

The release connects the investigations to potential Food, Drug, and Cosmetic Act, False Claims Act and other federal health care-law violations, including allegedly false diagnosis codes used for reimbursement. DOJ credited both institutions for cooperation, including ongoing cooperation concerning other entities. It expressly states that the resolved claims are allegations only, no liability determination was made and NYU and UPMC denied all allegations. Those distinctions matter when using the event to review billing support or service governance: a settlement is different from an adjudication of the allegations. Counsel should assess the executed terms and applicable state and federal obligations before drawing operational conclusions for a particular organization.

Why it matters
The resolutions put diagnosis support, reimbursement representations and service-line oversight in the same risk review, while retaining entity-specific and disputed-claim limits.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal, New York, Pennsylvania
Agencies
U.S. Department of Justice, HHS Office of Inspector General, Food and Drug Administration Office of Criminal Investigations
Entities
NYU Langone Hospitals, University of Pittsburgh Medical Center
Action type
Resolution agreement
Event date
Sep 18, 2026
Alleged conduct
Potential violations involving pediatric services and allegedly false diagnosis codes used to obtain federal program and private-insurer payment. The institutions denied the allegations, and there was no determination of liability.
Resolution
NYU agreed to pay $8.5 million, UPMC agreed to pay $950,000, and both agreed to cease the specified services for minors.
First seen
Sep 20, 2026
Last materially changed
Sep 20, 2026
Why it is still here
Retained for the case-informed control review described in the recommended action, based on the dated resolution agreement matter and its operational mechanism.

What to do nextHave counsel review relevant agreements and current legal duties. Validate diagnosis and claim support, pharmacy and consent controls, and document oversight of any proposed service-line decision.

  • Service-line decisions require coordinated legal, coding, pharmacy, and executive oversight.
  • Diagnosis codes used to support payment need contemporaneous clinical support.
  • Cooperation can materially shape a resolution even when allegations are denied.
P1 CARRYOVER Operationally relevant Settled

Abbott agrees to pay about $385 million over alleged WIC and Medicaid product-quality misrepresentations

What changed

A September 2026 settlement agreement provides for Abbott to pay $384,999,040.12 plus interest in connection with disputed claims involving powdered infant formula and nutritional products. The government contends that, from January 2018 through December 2022, Abbott failed to comply with federal and state manufacturing obligations at its Sturgis, Michigan and Casa Grande, Arizona facilities and misrepresented compliance to WIC and Medicaid programs. The agreement is a compromise, not an admission of facts or liability. Abbott denies the allegations, and the United States does not concede that its claims lack merit. DOJ announced the resolution September 14; this tracked event date is an announcement date, not proof of the agreement’s last-signature effective date.

The payment provisions separate $348,700,868 for the United States, $35,491,288.40 for participating Medicaid states and $806,883.72 for Massachusetts's supplemental WIC appropriation, with specified interest terms. The agreement conditions relevant releases on receipt of payment and reserves categories including criminal liability, certain administrative enforcement, individual liability and conduct outside the defined covered conduct. It also addresses unallowable settlement-related costs previously claimed from federal programs. Its effective date is the date of the last signature, rather than an assumption that every payment or release occurred when one government representative signed. These terms connect manufacturing compliance representations to government-program claims while keeping the settlement's scope and unresolved rights intact.

Why it matters
Government-program suppliers need traceable support for product-quality and eligibility representations, including when manufacturing deviations may undermine continued claims or rebates.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal, California
Agencies
U.S. Department of Justice, U.S. Department of Agriculture, HHS Office of Inspector General, State Medicaid programs
Entities
Abbott Laboratories
Action type
Settlement
Event date
Sep 14, 2026
Alleged conduct
Alleged failure to manufacture covered formula and nutritional products in compliance with requirements and alleged misrepresentations to WIC and Medicaid programs. Abbott denied the allegations.
Resolution
Agreement to pay $384,999,040.12 plus interest, with federal, Medicaid-state and Massachusetts allocations. Specified releases depend on payment and reserved claims remain; completed payment and exact last-signature effective date are not established.
First seen
Sep 20, 2026
Last materially changed
Sep 20, 2026
Why it is still here
Retained for the case-informed control review described in the recommended action, based on the dated settlement matter and its operational mechanism.

What to do nextMap program and contract quality representations to manufacturing evidence and escalation records. Review continued submissions after deviations, settlement-cost allowability where applicable, and the exact scope of any release with counsel.

  • Product-quality deviations can create payment-integrity exposure.
  • Program eligibility representations need continuing support.
  • Unallowable settlement costs must be separated from government-program claims and cost reporting.
P1 CARRYOVER Operationally relevant Final

OIG hospital audits identify Medicare overpayments and recurring claim-control failures

What changed

OIG's September 2026 hospital audits reported different scales of overpayment. At Methodist, 27 of 100 reviewed claims did not fully meet billing requirements, producing $256,926 in sampled net overpayments. OIG estimated at least $12.4 million in net overpayments across selected types of services within $62 million in Medicare payments. At McLeod Regional Medical Center, 17 of 115 reviewed claims produced $38,676 in net overpayments. Both summaries identify January 2020 through December 2021 as the audit period. Methodist's estimate should therefore be distinguished from its sample error amount, and neither audit is a finding about every hospital claim.

OIG attributed the errors primarily to failures to follow policies and procedures in the selected risk areas and recommended refunds, consideration of later-period internal audits and additional training. Methodist did not concur with the refund and internal-audit recommendations but expressed willingness to provide education. McLeod agreed with most findings, did not state concurrence or nonconcurrence with the recommendations, and said it would refund agreed overpayments and described corrective steps. Those responses are not equivalent admissions. The reports are dated September 17 for Methodist and September 16 for McLeod.

Why it matters
The audits support testing actual claim controls and distinguishing sample findings, estimates, recommendations and provider responses before quantifying an organization's own exposure.
Response type
Validate
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
HHS Office of Inspector General
Entities
Methodist Hospital, McLeod Regional Medical Center
Action type
Audit
Event date
Sep 17, 2026
Alleged conduct
OIG identified sampled Medicare claim errors and estimated or calculated overpayments.
Resolution
OIG issued audit findings and recommendations for repayment and strengthened controls.
First seen
Sep 20, 2026
Last materially changed
Sep 20, 2026
Why it is still here
Retained for the case-informed control review described in the recommended action, based on the dated audit matter and its operational mechanism.

What to do nextReview the full reports' risk categories before selecting claims for audit. Quantify any identified overpayment, obtain counsel's repayment-timing analysis where required and document control changes and follow-up.

  • Use targeted claim audits to identify systemic payment risk.
  • Escalate credible overpayment findings promptly.
  • Document coding, billing, and repayment corrective actions.
P1 NEW Operationally relevant Settled

Skilled-nursing company and executives agree to pay $1 million to resolve therapy overbilling allegations

What changed

The September 23, 2026 RegalCare announcement concerns a $1 million settlement with RegalCare entities, Eliyahu Mirlis and Hector Caraballo. The signed agreement provides $880,000 for the United States and $120,000 for Massachusetts, plus specified interest, and includes admitted facts about Medicare and MassHealth billing. Its Medicare admissions cover April 2018 through September 2019, while its Medicaid admissions cover April 2018 through September 2023; the broader government contentions are separately stated. Some Ultra High RUG claims lacked support from individual patient need and should have been billed lower. The historical RUG model described in the agreement should not be mistaken for the current Medicare payment methodology.

The agreement identifies Caraballo as a licensed practical nurse and reimbursement executive. It states that accurate MDS modifications were permitted regardless of professional licensure, while applicable assessments required registered-nurse certification. Caraballo made changes without visibly assessing or speaking to patients; some changes occurred without clinician discussions, others after clinician discussions and/or medical-record review, and an RN signed the completed MDS afterward at his request. It also records some billing before assessments were fully finalized and describes MMQ reviews that increased MassHealth reimbursement. The lesson is not that an executive could never modify an assessment, but that patient support, certification and billing readiness must be verified. These specific admissions should remain distinct from all broader disputed government allegations.

Why it matters
Assessment-change controls need patient-specific support, accurate RN certification and billing readiness, without imposing an unsupported clinician-only editing rule.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
U.S. Attorney Office, District of Massachusetts
Entities
RegalCare Management Group LLC and executives
Action type
Settlement
Event date
Sep 23, 2026
Alleged conduct
Government contentions concern unnecessary or overstated SNF services. Specific admitted facts include some unsupported Ultra High RUG claims, qualified MDS changes by an LPN executive with subsequent RN certification, some pre-finalization billing and MMQ reviews increasing reimbursement; broader contentions remain distinct.
Resolution
The entities and executives agreed to $1 million plus interest and specified factual admissions. The agreement conditions specified government monetary releases and dismissal on receipt of payment and preserves reserved claims; the announcement is not proof of completed payment or universal release.

What to do nextReview assessment change history, supporting records, RN certification and claim-release timing. Test patient-specific support for reimbursement levels and distinguish historical RUG/MMQ mechanisms from current payment rules.

  • Verify patient-specific support for assessment changes and reimbursement levels.
  • Preserve applicable RN certification and complete assessment evidence before billing.
  • Accurate MDS editing is distinct from assessment certification and is not categorically limited by professional licensure under the cited agreement.
P2 CARRYOVER Operationally relevant Settled

Walmart agrees to $50 million opioid-prescription settlement and dispensing safeguards

What changed

DEA’s August 28 announcement describes a $50 million settlement resolving allegations that Walmart pharmacies filled thousands of invalid prescriptions for opioids and other controlled substances. The government’s complaint was filed December 22, 2020 and amended in 2022; the alleged conduct began June 26, 2013. According to the release, pharmacists reported suspected pill-mill prescribers through thousands of refusal-to-fill forms, while compliance-team members and pharmacists allegedly filled invalid prescriptions despite that information. The warning signs included dangerous drug combinations, repeated high-dose prescriptions and recurring early-fill requests. These are the government’s allegations in the resolved case, not an adjudicated finding of liability.

In addition to the monetary resolution, Walmart entered a memorandum of agreement with DEA addressing future dispensing controls. The release describes a hotline for employees and patients, proactive monitoring of pharmacy dispensing patterns, and a process for evaluating prescribers suspected of illegal prescribing. Those commitments connect information gathered at individual pharmacies with corporate review and action. The settlement therefore illustrates both frontline dispensing judgment and what an organization does with warning reports it already receives. The monetary and monitoring commitments resolve allegations; the announcement does not independently document completed payment.

Why it matters
Collecting refusal-to-fill reports is only one part of a dispensing-control system. Pharmacy compliance teams need a process to review patterns, escalate concerns and document decisions while preserving legitimate patient access.
Response type
Assess
Confidence
High
Who this affects
Health systems
Jurisdiction
Federal
Agencies
U.S. Department of Justice, Civil Division, Drug Enforcement Administration
Entities
Walmart Inc.
Action type
Settlement
Event date
Aug 28, 2026
Alleged conduct
Alleged unlawful filling of controlled-substance prescriptions despite pharmacist reports, suspected pill-mill prescribers and prescription red flags; the complaint describes conduct beginning June 26, 2013.
Resolution
$50 million settlement and DEA memorandum of agreement announced August 28, 2026. Agreement includes an employee/patient hotline, proactive dispensing monitoring and suspected-prescriber evaluation. Claims remain allegations with no liability determination; completed payment not separately established.
First seen
Aug 30, 2026
Last materially changed
Aug 30, 2026
Why it is still here
Retained for review of dispensing-warning reports, prescriber escalation and reporting routes described in the August 28 resolution.

What to do nextPharmacy leaders should trace a sample of warning reports from receipt through review and documented action, test prescriber-pattern escalation and review employee/patient reporting routes. These are operational recommendations informed by the agreement, not a claim that every pharmacy has Walmart’s negotiated obligations.

  • Review and act on refusal-to-fill reports rather than treating collection as completion.
  • Link pharmacy dispensing patterns with prescriber-review escalation.
  • Provide reporting routes for employees and patients and retain evidence of follow-up.
P2 CARRYOVER Operationally relevant Final

Florida DME operators sentenced in $34.8 million brace fraud scheme

What changed

DOJ announced September 4, 2026 sentences of 33 months for Kenneth Charles Kessler III and 24 months for Michael Andrew Gomez. Both had pleaded guilty in May to conspiracy to commit health care fraud. They owned and operated seven Florida durable medical equipment companies that billed Medicare for medically unnecessary orthotic braces, including braces beneficiaries neither needed nor requested. The $34.8 million figure describes the fraudulent billing scheme, rather than a statement that either individual received that amount personally.

According to the court-document account in the announcement, the operators paid kickbacks and bribes for fraudulent signed physician orders and used those orders to ship braces nationwide. They shifted billing among their companies to evade Medicare payment suspensions. DOJ reported that Kessler profited more than $1.4 million and Gomez more than $2.3 million. The related-company structure and order-generation process are distinct elements of the admitted scheme: checking only a supplier's current billing identity would not address the mechanism DOJ described. These are facts of the resolved criminal case, not a new rule changing DME coverage requirements.

Why it matters
DME fraud review needs to connect ownership, order sources and beneficiary receipt across related supplier identities, especially after payment suspensions.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ
Entities
Kenneth Charles Kessler III, Michael Andrew Gomez
Action type
Criminal resolution
Event date
Sep 4, 2026
Alleged conduct
Medicare billing for unnecessary braces using kickbacks and fraudulent orders; billing shifted between supplier entities.
Resolution
Prison sentences announced following guilty pleas; the $34.8 million figure is scheme billing, not the amount of a fine.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated criminal resolution matter and its documented operational mechanism.

What to do nextReview DME supplier relationships, paid referral arrangements, individualized order authenticity and beneficiary receipt. Investigate billing shifts among related entities when suspension or other fraud alerts arise.

  • Validate referrals and orders independently.
  • Monitor related supplier entities and payment suspension evasion.
P2 CARRYOVER Operationally relevant Final

Med spa owner sentenced for counterfeit injections

What changed

Rebecca Fadanelli, owner of Skin Beaute Med Spa in Massachusetts, was sentenced September 2, 2026 to 46 months in prison and two years of supervised release, DOJ announced September 4. The court also ordered restitution and forfeiture, each $1,001,562. She had pleaded guilty in April to unlawful importation and selling or dispensing counterfeit drugs and devices.

DOJ reports more than 2,700 counterfeit botulinum-toxin and filler procedures affecting over 900 paying clients during roughly March 2021–June 2024. Fadanelli was an aesthetician without authority to administer the injections and falsely claimed to be a nurse. Products were imported from China and Brazil, and she changed delivery arrangements after seizures. Manufacturers identified seized products as counterfeit. Clients suffered serious adverse effects, including infections, facial or eye problems and hospitalizations. The case connects independent license checks, product provenance and response to patient complaints; a familiar brand label or claimed nursing credential did not establish legitimacy.

Why it matters
The source documents patient harm alongside counterfeit supply and false credentials, requiring controls that connect procurement, clinical authorization and adverse-event escalation.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ
Entities
Rebecca Fadanelli, Skin Beaute Med Spa
Action type
Criminal resolution
Event date
Sep 2, 2026
Alleged conduct
Counterfeit botulinum toxin and dermal fillers were administered while the owner falsely claimed to be a nurse.
Resolution
September 2, 2026 sentence: 46 months imprisonment, two years supervised release, and separate restitution and forfeiture orders each $1,001,562, after guilty plea.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated criminal resolution matter and its documented operational mechanism.

What to do nextVerify injector licenses through the issuing board and trace products through authorized sources. Quarantine suspect stock and promptly escalate adverse-event reports.

  • Verify licensure with the issuing board.
  • Trace injectable products to authorized sources and preserve lot records.
P2 CARRYOVER Operationally relevant Settled

Heuser Health settles skin-substitute overbilling allegations

What changed

DOJ's September 2, 2026 release announced that Heuser Health, a Louisville provider of at-home wound care, agreed to pay $2,646,186.72 to resolve False Claims Act allegations involving Medicare and TRICARE skin-substitute claims. The settlement forms part of the department's broader Operation Skin Scam initiative. DOJ expressly states that the claims are allegations only and there was no determination of liability. The release establishes an agreement to pay, rather than independent proof of completed payment.

Heuser used advanced bioengineered or tissue-derived skin substitutes to treat chronic and acute wounds. According to DOJ, the federal rules applicable to these claims required billing based on actual invoice price, but the company allegedly submitted or caused claims using invoice amounts higher than its true purchase prices. The alleged mismatch concerned acquisition cost and reimbursement, rather than a finding that every wound-care service was unnecessary. Its operational relevance is to claims that actually use invoice-based reimbursement; the case does not establish one payment methodology for all products, payers or care settings.

Why it matters
Invoice-supported claims must reconcile to actual acquisition costs under the applicable payment rule, including relevant credits and discounts.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ
Entities
Heuser Health
Action type
Settlement
Event date
Sep 2, 2026
Alleged conduct
Claims allegedly used invoice amounts above the true purchase price.
Resolution
Agreement to pay $2,646,186.72 to resolve civil False Claims Act allegations; no determination of liability or proof of completed payment in the release.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated settlement matter and its documented operational mechanism.

What to do nextReconcile applicable skin-substitute claims to purchase records and actual costs, review credits or discounts, and document the payer rule used for the claim.

  • Reconcile invoice-supported claims to actual acquisition costs.
  • Review credits and discounts before finalizing claims.
P2 CARRYOVER Operationally relevant Pending litigation

DOJ sues former laboratory executives over $13.7 million in allegedly unnecessary Medicare testing

What changed

DOJ's September 2026 announcement describes a False Claims Act complaint against former Capstone Diagnostics executives and associated entities involving approximately $13.7 million in Medicare payments from 2019 through 2021. The government alleges two schemes: genetic testing at church-sponsored health fairs and religious conferences without physician requests, and medically unnecessary respiratory panels added to COVID-19 testing for senior-living communities. DOJ intervened September 4 in the whistleblower case brought by a former laboratory manager. The civil allegations remain unproven; the announcement does not report a judgment against these defendants.

The alleged order-generation methods included using physicians' identities and copied signatures without permission, community-wide or chain-wide standing orders, standardized diagnosis codes, sales personnel entering orders and remuneration tied to test volume. DOJ separately identified settlements with Capstone and its owner and with its billing company; those resolutions do not adjudicate the pending defendants' liability. The release also states that criminal charges against one former executive were pending. An operational review should therefore focus on the identified control patterns without treating either the civil complaint or indictment as a conviction: individualized clinical authorization, valid signatures, medical necessity and separation of sales activity from ordering.

Why it matters
The complaint links multiple laboratory safeguards that can fail together, especially when standardized ordering and marketer incentives replace patient-specific clinical support.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal, Georgia
Agencies
U.S. Department of Justice, HHS Office of Inspector General, Federal Bureau of Investigation
Entities
Former Capstone Diagnostics executives and associated entities
Action type
Civil complaint
Event date
Sep 17, 2026
Alleged conduct
Alleged medically unnecessary genetic and respiratory panel testing generated through mass events, copied signatures, standing orders, standardized diagnoses, sales ordering, and kickbacks.
Resolution
Complaint filed. Liability has not been determined.
First seen
Sep 20, 2026
Last materially changed
Sep 20, 2026
Why it is still here
Retained for the case-informed control review described in the recommended action, based on the dated civil complaint matter and its operational mechanism.

What to do nextSample genetic and respiratory claims for treating-provider authorization, signature validity, patient-specific diagnoses and necessity. Review standing orders, sales access and marketer compensation, escalating copied-signature or volume-linked patterns.

  • Laboratory tests need individualized treating-provider orders.
  • Sales personnel should not create clinical orders.
  • Standing orders and copied signatures require focused monitoring.
  • Marketer compensation must not reward federally reimbursed test volume.
P2 CARRYOVER Operationally relevant Settled

Long-term care pharmacy agrees to pay over $5.3 million to resolve prescription-billing allegations

What changed

DOJ announced September 17, 2026 that Remedi SeniorCare Holding Corporation agreed to pay more than $5.3 million to resolve False Claims Act allegations involving drugs dispensed without valid prescriptions. The government alleged false Medicare and Medicaid claims from January 1, 2015 through March 31, 2021 for drugs supplied to assisted-living residents in various states. The release says the settlement reflects Remedi's ability to pay and will be paid over time. It does not establish that the full amount had already been collected by this edition’s coverage cutoff.

The resolution includes claims raised by two former employees under the False Claims Act's whistleblower provisions, with a share of payments to be paid to them over time. The announcement expressly says the settled claims are allegations only and there has been no determination of liability. The case therefore supports a focused review of prescription-validity and billing safeguards rather than a conclusion that every resident's prescription was invalid or that the company was convicted. Facilities and pharmacy partners should distinguish the resident's need for continued medication from the separate requirement to retain a valid, timely prescribing basis for dispensing and reimbursement.

Why it matters
Long-term care medication workflows need reliable prescriber-order evidence and claim controls when prescriptions are missing, expired or otherwise invalid.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal, Maryland
Agencies
HHS Office of Inspector General
Entities
Remedi SeniorCare
Action type
Settlement
Event date
Sep 17, 2026
Alleged conduct
Billing federal healthcare programs for drugs allegedly dispensed without valid prescriptions.
Resolution
Agreement to pay more than $5.3 million based on ability to pay and in installments over time, resolving disputed civil False Claims Act allegations; no liability determination or completed collection established.
First seen
Sep 20, 2026
Last materially changed
Sep 20, 2026
Why it is still here
Retained for the case-informed control review described in the recommended action, based on the dated settlement matter and its operational mechanism.

What to do nextAudit prescription-validity checks, order retention, emergency and refill workflows, and claim edits. Resolve missing or expired orders with clinical and pharmacy teams without inferring that operational recommendations are new settlement-wide rules.

  • Validate prescription authority before dispensing and billing.
  • Retain accessible prescriber-order evidence.
  • Use claim edits to stop billing when required order data is missing.
P2 NEW Operationally relevant Settled

Crown Medical Solutions and owners agree to pay $825,000 over DME billing allegations

What changed

DOJ announced September 21, 2026 that Crown Medical Solutions LLC and owners Michelle and Philanzo King agreed to pay $825,000 to resolve False Claims Act allegations. Crown supplied durable medical equipment, including knee and back braces and heel stabilizers. The government alleged that, from November 2017 through April 2019, the company and owners billed Medicare for equipment that was not medically necessary and/or properly prescribed. The release expressly says the claims are allegations only and there was no determination of liability.

The settlement amount reflects the defendants' ability to pay, so it should not be equated with a judicial calculation of all alleged loss. The resolution includes a whistleblower action, with the relator to receive approximately $123,750. The reported conduct centers on the medical necessity and physician-prescribing basis for DME claims. It does not establish that the equipment was never delivered, that every Crown claim was invalid or that a court convicted the owners. Supplier review should therefore compare each claim's order and clinical support with the actual case scope, with the clinical and order evidence relevant to the DME supplied.

Why it matters
DME claim integrity depends on valid prescribing and patient-specific necessity; ability-to-pay settlements and unresolved allegations should be interpreted separately.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
U.S. Department of Justice
Entities
Crown Medical Solutions LLC and its owners
Action type
Settlement
Event date
Sep 21, 2026
Alleged conduct
Alleged Medicare billing for durable medical equipment that was not medically necessary or was not properly prescribed.
Resolution
Crown Medical Solutions and its owners agreed to pay $825,000 to resolve False Claims Act allegations. The claims resolved are allegations only, with no determination of liability.

What to do nextSample DME claims for physician prescribing and medical-necessity support. Review ownership oversight and escalation of unsupported orders, and have counsel assess case relevance without treating allegations as adjudicated facts.

  • Verify DME medical necessity and valid physician prescribing before billing.
  • Test supplier and owner oversight of order-support exceptions.
  • Distinguish disputed allegations and ability-to-pay settlement amounts from adjudicated loss.
P2 NEW Operationally relevant Final

California secures guilty plea and prison sentence in $400,000 Medi-Cal fraud case

What changed

California's Attorney General announced September 21, 2026 that Maki Martinez-Gruninger pleaded guilty to one felony count of Medi-Cal false claims and would serve two years in state prison. The investigation identified $413,643.30 in false IHSS and respite-care claims. The case involved a disabled family member whose actual caregiver reported discovering the scheme. This is a criminal resolution, rather than an unresolved civil allegation or an administrative audit.

According to the release, the complainant discovered in December 2019 that Martinez-Gruninger had secretly applied in November 2007 to act as the family member's IHSS provider. The resulting false claims continued for more than a decade. The Attorney General reports that investigators found intentional taking of Medi-Cal funds and presentation of false claims. Those details point to service-provider identity, enrollment and verification of who actually delivered care. Family relationships should not substitute for independent confirmation of provider status and delivered services.

Why it matters
Long-running personal-care fraud can depend on inaccurate provider enrollment and weak confirmation of the actual caregiver, even within a family.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
California
Agencies
California Department of Justice
Entities
Maki Martinez-Gruninger
Action type
Criminal resolution
Event date
Sep 21, 2026
Alleged conduct
False IHSS and respite-care claims totaling $413,643.30 were submitted over more than a decade using a disabled family member services.
Resolution
The defendant pleaded guilty to one felony count of Medi-Cal false claims and received a two-year state-prison sentence.

What to do nextReview IHSS or respite provider enrollment, beneficiary/caregiver confirmation and service documentation. Escalate conflicting caregiver identities or claims inconsistent with actual care and preserve an independent reporting route.

  • Confirm provider enrollment and who actually delivers authorized personal-care services.
  • Reconcile claims with beneficiary and caregiver evidence.
  • Investigate conflicting caregiver identities and maintain independent complaint channels.
P2 NEW Operationally relevant Announced

CDPH records fourteen in-window facility citations, including patient-care and unreported-abuse penalties

What changed

CDPH records identify fourteen citations issued September 21–25, 2026 across thirteen facilities, with two at Intercommunity Care Center. The recorded initial assessment amounts total $115,500. They include $60,000 for one Intercommunity patient-care citation, $25,000 for Sunnyside Nursing Center and $3,500 for Coral Cove Post Acute’s Willful Material Falsification citation. These are initial amounts attached to dated issuance records, not collections or proof of final appeal outcomes. A later export does not establish the historical Open/Closed status, balances or timing of any increases.

Six Abuse/Facility Not Self Reported rows concern Lindsay Gardens, Solaria Care–Auburn, Southland, Capital Post Acute, Intercommunity and Sharon Care Center. The facilities include skilled nursing, pediatric day health/respite and intermediate care for people with developmental disabilities, so this is not fourteen nursing-home cases. Violation dates predate the issue dates. Categories and legal references support targeted review but do not supply complete incident narratives, resident outcomes or corrective plans; those require the underlying citations.

Why it matters
Initial assessments and dated categories identify care, reporting and record-integrity review priorities across different facility types without proving detailed incidents or historical final status.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
California
Agencies
CDPH
Entities
Creekside Healthcare Center, Lindsay Gardens Nursing & Rehabilitation, Solaria Care - Auburn, SOUTHLAND, Fairbanks House, Capital Post Acute, INTERCOMMUNITY CARE CENTER, SHARON CARE CENTER, Northvine Postacute Care, Sunnyside Nursing Center, Palos Verdes Health Care Center, Coral Cove Post Acute, Los Feliz Healthcare & Wellness Centre, LP
Action type
Civil monetary penalty
Event date
Sep 25, 2026
Alleged conduct
Export categories include patient care, abuse not self-reported and willful material falsification. Full citation narratives were not retrieved.
Resolution
Fourteen citations issued September 21–25 across thirteen facilities, initial amounts totaling $115,500. Historical disposition, collection, final amounts, appeal outcomes and timing of later adjustments are not established.

What to do nextObtain the individual citations, track appeal status separately from amounts assessed, and review patient-care escalation, required reporting and record accuracy at the relevant facility types.

  • Verify timely abuse reporting and patient-care escalation.
  • Maintain accurate facility records and obtain complete citation documents.
P3 CARRYOVER Operationally relevant Announced

CDPH issues $3,000 Class B citation to San Bernardino nursing facility

What changed

CDPH data identify citation 240024048, issued August 31, 2026 to Community Convalescent Center of San Bernardino, as a Class B Physical Environment citation with a $3,000 initial assessment. The row identifies July 24 as the violation date, separating the underlying conduct period from the penalty issue date. Initial assessment is distinct from money collected, and the available record does not establish the citation’s payment or appeal status by this edition’s coverage cutoff.

The row lists federal section 483.80 infection-control provisions and California Title 22 environmental/facility provisions. It supplies identifiers, categories and legal references but not a complete statement of factual deficiencies, resident impact or corrective measures. Those details require the citation and supporting records. Later database disposition, final-amount or balance fields cannot establish what was known or completed at an earlier issue date; they are not used here to infer payment, closure or successful remediation.

Why it matters
The initial amount and dated citation identify a targeted environmental/infection-prevention review without proving the incident narrative or disposition.
Response type
Assess
Confidence
Moderate
Who this affects
Health systems, Provider networks
Jurisdiction
California
Agencies
CDPH
Entities
Community Convalescent Center of San Bernardino
Action type
Civil monetary penalty
Event date
Aug 31, 2026
Alleged conduct
The export categorizes the citation as Physical Environment and lists federal infection-control and California facility provisions. The full factual statement was not retrieved.
Resolution
Class B citation 240024048 issued August 31, 2026, with $3,000 initial assessment. Historical appeal, payment, final amount and disposition are not established.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated civil monetary penalty matter and its documented operational mechanism.

What to do nextObtain citation 240024048 and supporting disposition records. Compare environmental and infection-prevention evidence with the cited provisions before drawing case-specific conclusions.

  • Review citation details before attributing specific conduct.
  • Maintain evidence of environmental and infection prevention controls.
P3 CARRYOVER Operationally relevant Effective

FDA orders permanent services debarment and 20-year import debarment

What changed

FDA's final order, applicable August 31, 2026, permanently debars Rahim Shafa from providing services in any capacity to a person with an approved or pending drug product application and separately bars him for 20 years from importing or offering any drug for import. FDA denied his hearing request because it did not raise a genuine and substantial factual issue. The order rests on federal felony convictions for three unlawful-importation counts and one receiving-and-delivering-misbranded-drug count. These are FDA drug-regulation debarments, distinct from exclusion from federal healthcare programs.

The notice describes unapproved disulfiram and naltrexone products imported under false shipping descriptions and administered to patients. FDA treated the services bar as mandatory and imposed four consecutive five-year periods for the import bar after considering statutory factors. It explained that a pending appeal did not postpone debarment because the statute treats an entered judgment as a conviction. The notice also warns that knowing use of Shafa's services by a person with an approved or pending application can trigger civil monetary penalties. No later appeal outcome is asserted.

Why it matters
Drug-development and import screening must consider the applicable FDA debarment scope, which differs from healthcare-program exclusion screening.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
FDA
Entities
Rahim Shafa
Action type
Exclusion
Event date
Aug 31, 2026
Alleged conduct
Federal felony convictions relating to drug regulation and importation formed the basis of FDA's order.
Resolution
Permanent drug-application services debarment and 20-year import debarment; the controlled Exclusion category here denotes FDA debarment, not an OIG exclusion.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated exclusion matter and its documented operational mechanism.

What to do nextCheck FDA debarment controls for relevant services and imports, including contractors serving drug applicants, and verify the order’s exact scope before engaging a screened person.

  • Screen the relevant FDA debarment list as well as healthcare exclusion sources.
P3 CARRYOVER Operationally relevant Final

Researcher pleads guilty to diverting CDC grant funds

What changed

Poul Thorsen pleaded guilty to wire fraud on September 1, 2026 after his extradition from Germany in May. DOJ's Northern District of Georgia release states that he diverted more than $1 million of CDC grant money. Sentencing was scheduled for December 1, which remained a future date as of the September 26 coverage cutoff; the release does not report an imposed sentence. The more than $11 million awarded to Danish agencies was the broader grant funding, not the amount identified as stolen.

Thorsen became principal investigator responsible for administering the grants in 2002. Between February 2004 and June 2008, he submitted over a dozen false reimbursement invoices bearing a forged CDC laboratory chief's signature. Aarhus University transferred money to accounts it believed belonged to the CDC, but the accounts were his personal accounts; the release also identifies diverted funds from Odense University Hospital. The mechanism highlights the importance of independently checking invoices, authorization and bank-account ownership across international research collaborations.

Why it matters
Investigator-supplied invoices and payment instructions need independent checks, particularly where collaborators believe a personal account belongs to a government agency.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ, HHS-OIG
Entities
Poul Thorsen
Action type
Criminal resolution
Event date
Sep 1, 2026
Alleged conduct
False invoices and forged authorization diverted research grants into personal accounts.
Resolution
Guilty plea entered; sentence has not been imposed. The $1 million describes diverted funds, not a fine.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated criminal resolution matter and its documented operational mechanism.

What to do nextVerify payee-account ownership and invoice authorization independently of the investigator, separate research approval from payment release, and investigate unusual reimbursement instructions.

  • Independently verify beneficiary bank accounts.
  • Separate investigator approval from reimbursement release.
P3 CARRYOVER Operationally relevant Final

Caregiver admits diverting client funds

What changed

The U.S. Attorney's Office announced that Loretta Pyeatt pleaded guilty on September 4, 2026 to fraud in connection with access devices after stealing at least $321,000 from a care client. The release describes employment from roughly July 2023 through September 2025 and a client who received Social Security retirement and Veterans Affairs benefits. Sentencing was scheduled for December 9. That date was still future at the September 26 coverage cutoff, so the reported development is the guilty plea, not an imposed prison term.

The client gave Pyeatt debit cards to buy groceries, but she admitted using the access for cash withdrawals and other unauthorized purchases. Transactions increased from approximately 20 to 30 a month before her involvement to as many as 330 a month. The account had at least $232,026 when she began and less than $5,600 by July 2025. These details show how limited purchasing permission became repeated access to a vulnerable person's funds and incoming benefits. The release's maximum statutory penalty describes possible sentencing exposure only; it does not determine the sentence or establish that every transaction was independently adjudicated.

Why it matters
Client-fund safeguards need to distinguish authorized purchases from unrestricted withdrawal access and identify changes in transaction frequency or balances.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ
Entities
Loretta Pyeatt
Action type
Criminal resolution
Event date
Sep 4, 2026
Alleged conduct
Debit cards entrusted for groceries were used for unauthorized purchases and cash withdrawals.
Resolution
Guilty plea entered; no sentence or fine has yet been imposed.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated criminal resolution matter and its documented operational mechanism.

What to do nextReview client-fund permissions, independent reconciliations, receipts and transaction alerts. Provide a complaint route outside the caregiver's control and escalate unexplained withdrawals or rapid balance declines.

  • Limit financial access to documented authorized tasks.
  • Escalate unexplained transaction spikes and reconcile receipts.
P3 CARRYOVER Operationally relevant Settled

Novum settles PPP affiliate-size allegations

What changed

DOJ announced September 1, 2026 that Novum Pharmaceutical Research Services of Delaware, Inc. agreed to pay $3,345,000 to resolve False Claims Act allegations concerning a $2 million Second Draw Paycheck Protection Program loan. Novum received the loan and full forgiveness, but the government alleged that it was ineligible under the program's employee-based size standard. The settlement also resolves whistleblower claims. DOJ states that the resolved claims remain allegations, with no determination of liability; the announcement does not independently prove that the settlement payment was completed.

For the Second Draw program described in the release, eligibility required no more than 300 employees including domestic and foreign affiliates. Novum certified that it and its affiliates had fewer than 300, while DOJ says their combined workforce exceeded 300, including employees of its India-based ultimate parent, Lambda Therapeutic Research. The distinction is the applicant's consolidated eligibility calculation, rather than simply its own payroll. Although Novum is a research business, the case concerns SBA relief lending and forgiveness certifications, not reimbursement for healthcare services or a new Medicaid eligibility rule.

Why it matters
Relief-program certifications require the affiliate calculation specified by that program, including relevant foreign affiliates.
Response type
Assess
Confidence
High
Who this affects
Health systems, Provider networks
Jurisdiction
Federal
Agencies
DOJ
Entities
Novum Pharmaceutical Research Services of Delaware, Inc.
Action type
Settlement
Event date
Sep 1, 2026
Alleged conduct
Second Draw eligibility and forgiveness were allegedly obtained despite aggregate affiliate headcount exceeding the program threshold.
Resolution
Agreement to pay $3,345,000 resolving allegations involving a $2 million Second Draw PPP loan and forgiveness; no determination of liability.
First seen
Sep 6, 2026
Last materially changed
Sep 6, 2026
Why it is still here
Retained for the organizational control review described in the recommended action, informed by the dated settlement matter and its documented operational mechanism.

What to do nextRetain contemporaneous affiliate and workforce calculations supporting application and forgiveness certifications, and investigate unresolved discrepancies with finance and counsel.

  • Include relevant domestic and foreign affiliates in eligibility analysis.
  • Retain evidence supporting application and forgiveness certifications.

Rolling 90-day corporate integrity agreement trend

Window: Jun 29, 2026 to Sep 27, 2026. Older activity informs the trend without remaining an active finding.

Themes

  • The OIG program page lists recent effective agreements for Advanced Pathology Solutions (June 17), EyePoint (July 13) and Veloxis (August 7) inside this 90-day window.
  • The full agreement inventory and text review remain incomplete; no comprehensive trend or no-change conclusion is asserted.

Operational implications

  • Use the applicable agreement text before adopting entity-specific terms as a broader compliance expectation.

Forward regulatory horizon

What is coming, what triggers it, and what to do before it lands.

Gugava healthcare-fraud money-laundering indictment

Expected timing
Next material court action; no resolution date established
Applicability
Operationally relevant
Trigger
DOJ announced September 4 charges alleging laundering of proceeds from a $1.3 billion healthcare scheme. Charges remain unproven.
Prepare now
Monitor case developments and assess beneficial-ownership and bank-account controls for DME counterparties. Do not characterize the indictment as a conviction or settlement.

Closed this week

These appear once and then leave the current narrative. They stay in the canonical tracker.

  • CLOSED · The Villages Health System agrees to a $541.5 million settlement over invalid Medicare Advantage diagnosis codes after self disclosing: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Compliance and coding leaders should sample submitted diagnoses against encounter records, examine rendering-provider involvement and amendment timing/approval, and trace identified invalid codes through plan communication and repayment review. Assign an owner to track corrective actions and legal advice on any disclosure.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P1 CLOSED Operationally relevant Settled

    The Villages Health System agrees to a $541.5 million settlement over invalid Medicare Advantage diagnosis codes after self disclosing

    What changed

    DOJ announced on August 26 that The Villages Health System agreed to a $541.5 million False Claims Act settlement concerning diagnosis codes submitted to Medicare Advantage organizations during 2020 through 2024. CMS adjusts plan payments using beneficiaries’ diagnoses, and the provider’s risk-sharing arrangements could increase its own reimbursement when plan payments rose. The government alleged that codes lacked adequate medical-record support or relied on amendments not initiated by the rendering provider that were untimely or unapproved. These are the alleged coding mechanisms addressed by the settlement, not a determination that every chart amendment or risk-sharing arrangement is improper.

    The resolution followed a December 27, 2024 submission under OIG’s Health Care Fraud Self-Disclosure Protocol and a July 3, 2025 Chapter 11 filing. DOJ says the bankruptcy court approved the settlement on August 25, before the announcement. It credited prompt remedial action, a detailed disclosure and cooperation. The affected Humana, UnitedHealthcare and GuideWell plans were also returning overpayments through invalid-code deletions and/or agreements with DOJ and CMS. That separates the provider’s settlement from the plans’ responses to their own CMS payments. The resolved claims remain allegations, with no determination of liability.

    Why it matters
    Risk-sharing providers can face payment-data exposure alongside the plans receiving CMS payments. This resolution connects record support, the provenance and timing of chart amendments, disclosure and subsequent code correction.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    Federal, Florida
    Agencies
    U.S. Department of Justice, U.S. Attorney Office, Middle District of Florida, HHS Office of Inspector General
    Entities
    The Villages Health System LLC
    Action type
    Settlement
    Event date
    Alleged conduct
    Alleged invalid diagnosis submissions during 2020–2024, including inadequate record support and specified untimely or unapproved chart amendments not initiated by the rendering provider.
    Resolution
    A $541.5 million FCA settlement approved by the bankruptcy court August 25, 2026 and announced by DOJ August 26. The resolved claims are allegations; no determination of liability. The announcement also describes separate plan code-deletion and/or repayment agreements.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionCompliance and coding leaders should sample submitted diagnoses against encounter records, examine rendering-provider involvement and amendment timing/approval, and trace identified invalid codes through plan communication and repayment review. Assign an owner to track corrective actions and legal advice on any disclosure.

    • Reconcile diagnosis submissions with the underlying encounter record.
    • Preserve amendment authorship, timing and approval evidence.
    • Trace identified coding errors through the plan’s correction and repayment process; disclosure credit does not erase exposure.
  • CLOSED · Monogram Health agrees to $2.4 million settlement over Medicare Advantage diagnosis codes: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Review responsibility for diagnosis accuracy under MA contracts. Sample the four named categories for encounter support, clinical accuracy and effect on care, and document how errors are communicated to plans and evaluated for correction. Treat this as a case-based audit recommendation, not a finding against another provider.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P2 CLOSED Operationally relevant Settled

    Monogram Health agrees to $2.4 million settlement over Medicare Advantage diagnosis codes

    What changed

    On August 24, DOJ announced that Monogram Health Professional Services PC and Monogram Health Inc., headquartered in Tennessee, agreed to pay $2.4 million to resolve False Claims Act allegations. Monogram provided in-home care and related services under contracts with Medicare Advantage organizations. Those risk-sharing arrangements made higher beneficiary risk scores financially relevant to both plan payments from CMS and Monogram’s reimbursement. The alleged conduct occurred from January 1, 2021 through December 31, 2023 and concerned codes that were clinically inaccurate, unsupported in the medical record and/or did not require or affect patient care, treatment or management.

    The release identifies four Hierarchical Condition Categories: protein-calorie malnutrition, substance use disorder, coagulation defects and other specified hematological disorders, and angina pectoris. It explains that unsupported diagnoses can inflate risk scores and capitated payments without establishing an additional service-based entitlement. The settlement also resolves a former Monogram physician’s whistleblower action; DOJ says the relator will receive approximately $380,000 and that Monogram received cooperation credit. The announcement establishes the reported resolution, not a separately verified execution or completed-payment date. DOJ expressly states that the claims remain allegations and liability has not been determined.

    Why it matters
    The case concerns provider-generated diagnoses under risk-sharing contracts, so coding controls need to connect clinical documentation with the data sent to plans. The four named categories give audit teams a concrete scope rather than a general instruction to review risk adjustment.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    Federal, California
    Agencies
    U.S. Department of Justice, U.S. Attorney Office, Central District of California
    Entities
    Monogram Health Professional Services PC, Monogram Health Inc.
    Action type
    Settlement
    Event date
    Alleged conduct
    Alleged inaccurate, unsupported and/or non-care-affecting diagnosis submissions in four HCCs during January 1, 2021 through December 31, 2023 under MA risk-sharing arrangements.
    Resolution
    Agreement to pay $2.4 million, announced August 24, 2026, with approximately $380,000 stated for the whistleblower and cooperation credit. Exact execution and completed payment are not separately established; no liability determination.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionReview responsibility for diagnosis accuracy under MA contracts. Sample the four named categories for encounter support, clinical accuracy and effect on care, and document how errors are communicated to plans and evaluated for correction. Treat this as a case-based audit recommendation, not a finding against another provider.

    • Connect provider coding oversight with MA contract data obligations.
    • Test record support, clinical accuracy and relevance to care in the four named categories.
    • Retain correction and communication evidence; do not infer a CIA’s existence or absence from announcement silence.
  • CLOSED · OCR settles its 55th right of access case for $50,000 over a records request that took two years: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Privacy leaders should test request intake, escalation, completion evidence and any extension documentation against applicable access requirements. Compare local training and overdue-request monitoring with the practical controls described in this case. Do not apply Azul’s negotiated reporting dates to unrelated organizations.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P2 CLOSED Directly applicable Settled

    OCR settles its 55th right of access case for $50,000 over a records request that took two years

    What changed

    OCR announced its 55th HIPAA Right of Access enforcement action on August 27, resolving a complaint involving Azul Vision, a California optometry and ophthalmology provider operating 31 clinics. The individual requested records on January 9, 2023, complained to OCR on April 27, and did not receive them until January 6, 2025. OCR identified a potential failure to provide timely access, while the agreement expressly disclaims an admission of liability. HHS’s release reports a $50,000 payment and a two-year corrective action plan. Azul signed on August 12 and HHS on August 13; the agreement becomes effective on the last signature, establishing August 13 as the resolution date rather than the later announcement.

    The corrective plan requires a policy review within 30 calendar days, distribution within 60 days, and workforce training within 90 days and at least annually thereafter. It also requires recurring 90-day submissions listing access requests and response dates, annual reports, and retention of compliance records for six years. These are Azul’s negotiated duties, not automatic new reporting obligations imposed on every covered entity. The broader operational issue is whether a provider can follow a request from intake to actual delivery and detect unresolved cases before external intervention. The historical dates distinguish the underlying delay, agreement and public announcement without suggesting a new complaint or later outcome.

    Why it matters
    A multi-clinic specialty provider needs a request-tracking process that can identify prolonged delays across locations. The corrective plan makes intake dates, completion dates, training and oversight observable; it does not create a universal Azul-specific reporting duty.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    Federal, California
    Agencies
    HHS Office for Civil Rights
    Entities
    Azul Vision, Inc.
    Action type
    Resolution agreement
    Event date
    Alleged conduct
    Potential failure to provide timely access to PHI requested January 9, 2023; fulfilled January 6, 2025 after an April 27, 2023 complaint. The agreement is not an admission of liability.
    Resolution
    $50,000 payment reported by HHS and two-year CAP. Azul signed August 12 and HHS August 13, 2026; last-signature effective date August 13; public announcement August 27.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionPrivacy leaders should test request intake, escalation, completion evidence and any extension documentation against applicable access requirements. Compare local training and overdue-request monitoring with the practical controls described in this case. Do not apply Azul’s negotiated reporting dates to unrelated organizations.

    • Track each access request through actual fulfillment and retain response-date evidence.
    • Escalate unresolved requests across all clinic locations.
    • Distinguish generally applicable access requirements from case-specific CAP training/reporting clocks.
  • CLOSED · DermTech resolution provides a $5.04 million bankruptcy claim over unreliable test allegations: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health-tech, Health systems

    Archived recommended action: Laboratory and compliance leaders should trace significant quality-control concerns to test-result review, clinician/patient communication and any claim correction or refund assessment. Counsel should distinguish the settling legal entity, purchaser and actual recovery terms before using this case in training or risk analysis.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P3 CLOSED Operationally relevant Settled

    DermTech resolution provides a $5.04 million bankruptcy claim over unreliable test allegations

    What changed

    On August 26, DOJ announced a False Claims Act resolution involving the former DermTech Inc., now DTech Liquidating Inc. after its June 2024 Chapter 11 filing. The United States received an Allowed Class Three General Unsecured Claim of $5,038,011 in the bankruptcy proceeding. That describes a recognized claim against the estate, not proof that the government collected the stated amount. The allegations concerned unreliable skin-cancer tests billed to Medicare and reported to patients. DOJ expressly distinguishes the bankrupt company from DermTech LLC, which purchased assets in 2024; the resolved claims do not pertain to that purchaser.

    The release describes two separate testing problems. From October 2022 through March 2023, DermTech allegedly used an unvalidated positive-control range for one of two key melanoma markers. From January 2020 through February 2022, it allegedly generated positive or negative results despite insufficient patient RNA. DOJ also alleges that results were not retracted and Medicare was not adequately refunded when concerns arose. A former employee’s whistleblower action is included in the resolution; the relator is to receive 20% of the recovery actually received from bankruptcy. The payment mechanism, affected test periods and distinction between corporate entities limit what can be inferred from the headline amount. No liability determination was made.

    Why it matters
    Laboratory quality concerns can create linked obligations around result validity, patient communication and billing review. Bankruptcy claim value must be distinguished from cash recovery, and an asset purchaser should not be identified as the settling entity when the release excludes it.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health-tech, Health systems
    Jurisdiction
    Federal, California
    Agencies
    U.S. Department of Justice, Civil Division, U.S. Attorney Office, Southern District of California, Federal Bureau of Investigation, HHS Office of Inspector General
    Entities
    DermTech Inc., now DTech Liquidating Inc.
    Action type
    Settlement
    Event date
    Alleged conduct
    Alleged billing/reporting of tests using an unvalidated positive-control range during October 2022 through March 2023 and insufficient RNA during January 2020 through February 2022, followed by alleged failures to retract results or adequately refund Medicare.
    Resolution
    Allowed Class Three General Unsecured Claim of $5,038,011 in bankruptcy, announced August 26, 2026; cash recovery not established. Relator receives 20% of recovery actually received. Claims do not pertain to 2024 asset purchaser DermTech LLC, and liability was not determined.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionLaboratory and compliance leaders should trace significant quality-control concerns to test-result review, clinician/patient communication and any claim correction or refund assessment. Counsel should distinguish the settling legal entity, purchaser and actual recovery terms before using this case in training or risk analysis.

    • Connect test-quality escalation with result validity, communication and billing review.
    • Distinguish an allowed bankruptcy claim from money recovered.
    • Identify the actual settling entity and preserve express purchaser exclusions.
  • CLOSED · DMHC issues four letters of agreement totaling $331,000 against California health plans: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Plans and delegates should identify owners for each relevant filing, validate source-data methodology, sample required notices across payment channels, and test whether expressions of dissatisfaction become grievances when appropriate. Verify each applicable statutory/regulatory citation and the organization’s actual role rather than assigning all four plans identical violations.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P2 CLOSED Operationally relevant Settled

    DMHC issues four letters of agreement totaling $331,000 against California health plans

    What changed

    Four DMHC records identify August 26 administrative-penalty agreements totaling $331,000: L.A. Care matter 24-705 for $111,000, DentaQuest matter 23-768 for $150,000, Kaiser matter 24-704 for $45,000 and Community Care Health Plan matter 24-699 for $25,000. L.A. Care’s indexed record concerns timely-access reporting and methodology. Kaiser’s detailed letter describes 114 providers that remained in its measurement-year 2021 contact list despite being marked ineligible for at least three consecutive years. The Kaiser letter cites Health and Safety Code 1367.03(f)(2)/(3) and historical regulatory language under title 28 section 1300.67.2.2(g)(2)(B); it does not list every provision cited for L.A. Care. These are agreed penalties in specific matters, rather than verified receipts of payment or a complete weekly result set.

    DentaQuest’s letter identifies 1,288 of 3,066 enrollees cancelled for nonpayment in 2023 who did not receive required grace-period or cancellation notices. Automated-card users received notices, while check or money-order users did not. It separately finds a failure to initiate a grievance after an enrollee complained about access and requested a refund, rather than finding that the entire grievance system lacked approval. Community Care’s indexed record addresses the number of payments to noncontracting providers at contracting facilities and related reporting data under Health and Safety Code 1371.31(a)(4), not a title 28 citation. Together, the matters illustrate how data preparation, notice generation and complaint classification can produce distinct compliance failures even when described under broad reporting categories.

    Why it matters
    Different reporting failures need different controls. A provider contact list, payment-method-dependent cancellation notices, grievance intake and noncontracting-provider payment data cannot be tested through a single generic filing-calendar check.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    California
    Agencies
    California Department of Managed Health Care
    Entities
    Local Initiative Health Authority for Los Angeles County d.b.a. L.A. Care Health Plan, California Dental Network, Inc. d.b.a. DentaQuest of California, Kaiser Foundation Health Plan, Inc., Community Care Health Plan, Inc.
    Action type
    Settlement
    Event date
    Alleged conduct
    Distinct matters: L.A. Care timely-access reporting; Kaiser repeated retention of ineligible providers in the MY 2021 contact list; DentaQuest missing notices and grievance-initiation failure; Community Care surprise-billing data reporting.
    Resolution
    Four August 26, 2026 action records/agreements with penalties of $111,000, $150,000, $45,000 and $25,000, totaling $331,000. Completed payment is not separately established; selected named records do not establish exhaustive weekly coverage.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionPlans and delegates should identify owners for each relevant filing, validate source-data methodology, sample required notices across payment channels, and test whether expressions of dissatisfaction become grievances when appropriate. Verify each applicable statutory/regulatory citation and the organization’s actual role rather than assigning all four plans identical violations.

    • Test each filing against its own actual data requirements and methodology.
    • Sample cancellation notices across payment methods rather than only automated-card workflows.
    • Test grievance initiation, not an unsupported claim that a whole system was unapproved.
    • Keep Health and Safety Code 1371.31(a)(4) distinct from title 28 regulatory citations.
  • CLOSED · CDPH issues ten California facility citations and penalties totaling $73,750, including two class A citations: Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Facility compliance and quality leaders should obtain their underlying citation documents, map the actual findings to the correct license-specific obligations, and test relevant reporting and care processes. Treat care-plan comparisons as a recommended audit approach, not a fact about an incident established solely by the CSV.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P2 CLOSED Directly applicable Announced

    CDPH issues ten California facility citations and penalties totaling $73,750, including two class A citations

    What changed

    Ten records in CDPH’s State Enforcement Actions export identify August 26 or 27 penalty issue dates and initial assessments totaling $73,750 across eight facilities. Professional Post Acute Center received two class A citations at $25,000 each. Seven class B citations account for $19,000: Northgate PostAcute Care, The Gardens of El Monte, two Long Beach Healthcare Center records, Astoria Healthcare Center, West Covina Healthcare Center and Able. Sierra Vista Hospital’s non-immediate-jeopardy administrative penalty is $4,750. These amounts describe the recorded initial assessments, not money collected, and the penalty issue dates are distinct from the earlier dates associated with the cited conduct.

    The export records Patient Care for the two Professional Post Acute Center citations, Abuse/Facility Not Self Reported for the two Long Beach records, and other categories including Patient Rights, Physical Environment and Medication. Able’s facility type is an intermediate care facility for people with developmental disabilities; that classification does not by itself prove a habilitation-services violation. The rows provide associated legal citations and identifiers, but not the complete incident narratives. A later export’s Open disposition also cannot establish whether appeal periods had run as of this edition. The practical use is to locate the actual facility records for review while keeping assessment amounts, incident findings and procedural status separate.

    Why it matters
    The state licensing record covers different facility types and enforcement pathways. Its dates, categories and initial amounts can guide a targeted review, but a summary CSV is not a substitute for the underlying citation or evidence of final procedural status.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    California
    Agencies
    California Department of Public Health
    Entities
    Professional Post Acute Center, Sierra Vista Hospital, Inc., Long Beach Healthcare Center, Northgate PostAcute Care, The Gardens of El Monte, Astoria Healthcare Center, West Covina Healthcare Center, Able
    Action type
    Civil monetary penalty
    Event date
    Alleged conduct
    The official rows identify Patient Care, Abuse/Facility Not Self Reported, Patient Rights, Physical Environment, Medication and other categories with associated citations. They do not provide a complete incident narrative or establish a habilitation-services violation from facility type alone.
    Resolution
    Ten penalty issue records dated August 26–27, 2026 across eight facilities; initial amounts total $73,750: two class A $25,000 assessments, seven class B assessments totaling $19,000 and a $4,750 administrative penalty. Collections, final appeal outcomes and historical appeal deadlines are not established.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical resolution and its control lessons remain available; this does not establish completion of payment, remediation, monitoring or other obligations.

    Archived recommended actionFacility compliance and quality leaders should obtain their underlying citation documents, map the actual findings to the correct license-specific obligations, and test relevant reporting and care processes. Treat care-plan comparisons as a recommended audit approach, not a fact about an incident established solely by the CSV.

    • Separate penalty issue dates from earlier conduct dates.
    • Review the underlying citation before translating a category into a detailed incident finding.
    • Do not equate an initial assessment or later Open status with collection or an expired/unexpired appeal period.
  • CLOSED · Medical-practice manager sentenced for payroll embezzlement: Closed as an active weekly narrative item under the existing aging policy. The historical event remains available; closure does not establish completed payment, sentencing, remediation or monitoring.

    Who this affects: Health systems, Provider networks

    Archived recommended action: Review payroll changes, bonus authorization and bank/card reconciliations independently of the employee receiving payments. Investigate unusual self-payments and restrict incompatible payment duties.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P3 CLOSED Operationally relevant Final

    Medical-practice manager sentenced for payroll embezzlement

    What changed

    DOJ’s September 2 release reports that Adam Gentile was sentenced August 27, 2026 to four years in prison and four years of supervised release after a March guilty plea to three wire-fraud counts. The court ordered restitution of $3.8 million and $3.3 million to the two victim medical practices, respectively, plus $7.8 million forfeiture. These financial orders are distinct from the more than $4.5 million and more than $3.3 million losses described for the two employment periods.

    Gentile had payroll and administrative responsibilities at the first practice and sole payroll responsibility at the second. DOJ describes extra paychecks sometimes labeled bonuses and personal credit-card payments from practice bank accounts during roughly 2015–November 2020 and April 2021–May 2024. The second practice’s funds also supported a home and a side business. The repeated mechanism across employers makes independent payroll-change approval and bank reconciliation pertinent; a practice manager’s recordkeeping role is not independent verification of their own compensation.

    Why it matters
    Payroll access and bank-payment authority need independent review even when a trusted practice manager controls the records.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health systems, Provider networks
    Jurisdiction
    Federal
    Agencies
    DOJ
    Entities
    Adam Gentile
    Action type
    Criminal resolution
    Event date
    Alleged conduct
    Guilty-plea case involving extra payroll payments, purported bonuses and personal spending from two medical practices during separate employment periods.
    Resolution
    August 27 sentence of four years imprisonment and four years supervised release; restitution to two victims $3.8 million/$3.3 million and separate $7.8 million forfeiture, announced September 2. No completed recovery inferred.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical event remains available; closure does not establish completed payment, sentencing, remediation or monitoring.

    Archived recommended actionReview payroll changes, bonus authorization and bank/card reconciliations independently of the employee receiving payments. Investigate unusual self-payments and restrict incompatible payment duties.

    • Require independent review of payroll changes and bonuses.
    • Reconcile bank and credit-card payments outside the payroll manager’s control.
    • Distinguish losses, restitution and forfeiture amounts.
  • CLOSED · CalPrivacy orders SalesIntel to pay $36,400 for late registration: Closed as an active weekly narrative item under the existing aging policy. The historical event remains available; closure does not establish completed payment, sentencing, remediation or monitoring.

    Who this affects: Health-tech

    Archived recommended action: Assess whether a business or vendor meets the applicable data-broker definition, verify relevant registration and rights-request controls, and track only the obligations that apply to that entity and period.

    Read full archived article →

    Full archived analysis

    This is the approved analysis recorded for this closed finding in this edition.

    P3 CLOSED Operationally relevant Final

    CalPrivacy orders SalesIntel to pay $36,400 for late registration

    What changed

    CPPA’s August 27, 2026 decision immediately adopted a stipulated final order against SalesIntel Research, Inc. concerning its failure to register in 2025 for data-broker activity during 2024. The order requires $36,400, including the $6,600 annual registration fee, with full payment within thirty days of the Board’s decision. It records the company’s engagement after enforcement contact and timely 2026 registration for 2025 activity. The amount is an ordered obligation, not proof that payment was completed.

    Paragraphs 27–29 require timely registration for future years of data-broker operation, required privacy-request metrics and DROP deletion processing under the cited statutes when operating as a broker. SalesIntel admits specified findings and the 2024 broker activity requiring registration; it otherwise neither admits nor denies the remaining findings. The release is limited to the specified late-registration violation, and the case does not establish a healthcare-data misuse finding or impose SalesIntel’s thirty-day payment clock on unrelated organizations.

    Why it matters
    Vendor data enrichment and marketing services warrant a broker-scope review, but this registration case does not prove misuse of medical information.
    Response type
    Close
    Confidence
    High
    Who this affects
    Health-tech
    Jurisdiction
    California
    Agencies
    California Privacy Protection Agency
    Entities
    SalesIntel Research, Inc.
    Action type
    Administrative order
    Event date
    Alleged conduct
    Failure to register in 2025 for admitted 2024 data-broker activity; specified findings admitted, remaining factual findings neither admitted nor denied.
    Resolution
    August 27 immediately effective decision adopts stipulated order: $36,400 including $6,600 registration fee, payment within 30 days, and specified future registration/metrics/DROP duties. Limited release; completed payment not established.
    Closed because
    Closed as an active weekly narrative item under the existing aging policy. The historical event remains available; closure does not establish completed payment, sentencing, remediation or monitoring.

    Archived recommended actionAssess whether a business or vendor meets the applicable data-broker definition, verify relevant registration and rights-request controls, and track only the obligations that apply to that entity and period.

    • Assess broker status using actual activities and applicable definitions.
    • Verify registration, privacy-request metrics and applicable deletion processing.
    • Separate case-specific payment clocks from generally applicable duties.

Corrections to this edition

These corrections revise this dated edition. Its original publication date and permanent link stay the same.

  1. Version 2 · Oct 16, 2026

    Expanded source-grounded reporting and clarified material context, scope and operational implications. Removed one article at the owner’s direction.

Privacy preferences

Where enabled for this site, Cloudflare Web Analytics can send page-use and performance measurements to Cloudflare. This panel provides information and does not turn analytics on or off.

This panel stores no tracking choice and does not change your tool saves, screening, resets, reports or exports. Other sites have separate settings.

Read Privacy & Cookies