What Happened

Aetna has agreed to pay $117.7 million to resolve allegations that it violated the False Claims Act by submitting inaccurate diagnosis codes for its Medicare Advantage enrollees in order to inflate the risk-adjusted payments it received from CMS.

Under the Medicare Advantage program, CMS pays insurers a fixed monthly amount per enrollee that is adjusted based on how sick that enrollee is. The sicker the patient, the higher the payment. The government alleges that Aetna exploited this system in two ways:

1. For payment year 2015, Aetna ran an internal “chart review” program in which it hired diagnoses coders to review patient medical records. When those reviews identified diagnoses that could generate additional payments, Aetna submitted them to CMS. But when the same reviews showed that previously submitted codes were unsupported and Aetna was overpaid, Aetna did not delete those codes or return the money.
2. For payment years 2018 through 2023, Aetna submitted or failed to withdraw inaccurate diagnosis codes for morbid obesity for patients whose recorded BMI did not meet the clinical threshold for that diagnosis.

The Whistleblower

The morbid obesity portion of the case was brought by a former Aetna risk-adjustment coding auditor under the qui tam provisions of the False Claims Act. Qui tam allows private individuals with knowledge of fraud against the government to file suit on the government’s behalf and share in any recovery. The whistle blower in this case received approximately $2 million of the settlement.

This is a reminder that False Claims Act cases frequently originate from inside an organization from employees who see something, report it, and are entitled to a significant financial reward for doing so.

What this Means for Physicians and Medical Practices

While this case targeted a major insurer rather than a physician practice, there are important takeaways for anyone billing Medicare Advantage:

• Diagnosis coding must be supported by documentation. Whether you are submitting codes directly or working with a Medicare Advantage plan that conducts chart reviews, the diagnoses billed to CMS need to be accurate and clinically supported.
• Knowing about an error and failing to correct it creates liability. The False Claims Act does not require intentional fraud. Reckless disregard or deliberate ignorance of a known problem is enough.
• The government is actively looking. The DOJ-HHS Working Group has explicitly identified Medicare Advantage risk adjustment as a priority enforcement area, and it is using data analytics and AI to identify billing patterns that trigger investigations.

The Bigger Picture

The Aetna settlement is one of the largest False Claims Act healthcare recoveries announced so far in 2026, but it is unlikely to be the last. Medicare Advantage now covers more than half of all eligible Medicare beneficiaries and accounts for over $530 billion in annual federal spending. That level of spending, combined with a payment model that rewards higher diagnoses, makes it a natural enforcement target.

If you have questions about False Claims Act compliance, Medicare Advantage billing, or your practice’s exposure, feel free to reach out.

Artificial Intelligence continues to move quickly into the clinical workflow.

WVU Medicine recently announced that it is expanding its use of Abridge, an AI-powered transcription platform designed to generate clinical documentation during patient encounters. What began as a small pilot program in 2025 has now grown to more than 1,200 physicians, nurse practitioners, and physician assistants using the system across the organization, with more than 1,600 additional clinicians eligible to adopt the technology across WVU Medicine’s network of hospitals and outpatient facilities.

The platform works by recording the conversation between a clinician and a patient and then generating a draft clinical note that can be integrated directly into the Epic EHR system.

According to WVU Medicine leadership, clinicians using the platform save an average of approximately 11 minutes per day that would otherwise be spent converting rough notes into finalized documentation. Some clinicians have also reported lower stress levels and reduced burnout associated with the administrative burden of charting.

From an operational standpoint, tools like this have obvious appeal. Documentation requirements continue to grow, and anything that allows physicians to spend less time charting and more time interacting with patients is likely to gain traction across healthcare systems.

But while the technology may be new, the legal expectations surrounding physician responsibility remain unchanged.

AI Tools Do Not Replace Physician Responsibility

As I discussed in my recent article to recap my presentation at PBI’s Health Law Institute, artificial intelligence tools should be understood as assistive technologies, not decision-makers.

Even when AI is used to generate clinical notes or assist with documentation, the physician remains responsible for the accuracy of the medical record.

In practice, that means clinicians still need to carefully review AI-generated documentation before finalizing the chart. These systems can dramatically improve efficiency, but they are not perfect, and errors in the medical record can create both clinical and legal risk. Courts evaluating malpractice claims will ultimately focus on the physician’s conduct, not the performance of the software.

In other words, if an AI-generated note contains inaccurate information that contributes to an adverse outcome, the question will not be whether the software made a mistake. The question will be whether the physician exercised appropriate professional judgment in reviewing and approving the documentation.

Compliance and Privacy Still Apply

There are also important compliance considerations when AI tools are integrated into patient encounters.

Because platforms like Abridge process sensitive patient conversations, healthcare systems must ensure that appropriate HIPAA protections, Business Associate Agreements, and patient consent procedures are in place. WVU Medicine has indicated that patient consent is required before recording begins and that the transcriptions are protected under HIPAA in the same way as any other medical documentation.

These safeguards are essential as healthcare organizations increasingly rely on AI-powered platforms to assist with clinical operations.

The Bottom Line

AI documentation tools like Abridge may meaningfully reduce administrative burden and allow physicians to reclaim time during the clinical day. That is a positive development in a healthcare system where documentation requirements have steadily increased for years.

However, the presence of artificial intelligence does not change the fundamental legal expectations placed on physicians.

Technology can assist with documentation and workflow, but the physician ultimately remains responsible for the accuracy in the final chart and the clinical decisions reflected in it.

As these tools become more common, the most prudent approach for healthcare providers is to view AI as a powerful assistant, but not a substitute for careful review and professional judgment.

Healthcare law is entering a period of rapid change. Telehealth, artificial intelligence, and remote care models are reshaping how physicians deliver care, while legislatures, regulators, and courts are working to adapt older legal frameworks to new technologies. Although the tools are changing quickly, the core legal issues remain familiar: licensure, standard of care, supervision, privacy, and contractual risk.

Below is a recap of the key issues I discussed.

1. Telehealth Is No Longer a Temporary Workaround

Pennsylvania’s Telemedicine Act (Act 42 of 2024) helped move telehealth from a pandemic-era necessity into a more permanent statutory framework. For policies filed on or after March 31, 2025, insurers, Medicaid, and CHIP must cover medically necessary services delivered through telemedicine when those same services would be covered in person.

But the most important legal point is this: the standard of care in a telehealth encounter is the same as it is in person. Telehealth does not reduce a physician’s duty of care. If the technology does not allow for a clinically meaningful evaluation, the physician may need to direct the patient to an in-person visit.

2. Patient Location Still Matters for Licensure

One of the most common telehealth traps is licensure. In most cases, a physician is considered to be practicing medicine where the patient is physically located at the time of the encounter, not where the physician is sitting.

Pennsylvania’s full implementation of the Interstate Medical Licensure Compact (IMLC) in 2025 made multi-state licensure easier, but it did not create a national license. Physicians still need to ensure they are properly licensed in the state where the patient is located. That makes something as simple as confirming patient location at the start of a telehealth visit an important compliance step.

3. Multi-State Practice Also Creates Multi-State Risk

The IMLC expands opportunity, but it also expands exposure. A disciplinary action in a physician’s principal state can trigger reciprocal consequences in other Compact states. For physicians building multi-state telehealth practices, administrative diligence becomes critically important.

4. Remote Practice Does Not Eliminate Supervision Requirements

Telehealth also complicates supervision of Advanced Practice Providers (APP) such as physician assistants and nurse practitioners. Written supervisory or collaborative agreements still matter, but regulators will focus on whether supervision is meaningful in practice. If an APP encounters a complex case during a telehealth visit, there must be a reliable way to escalate that issue to the supervising physician in real time.

5. Artificial Intelligence Does Not Replace Clinical Judgment

AI tools are increasingly being used for documentation, triage, analytics, and decision support. But under Pennsylvania’s existing liability framework, the physician remains responsible for the final clinical decision.

That means AI should be treated as a decision-support tool, not a decision-maker. If a physician follows an AI-generated recommendation that later proves wrong, the legal analysis is likely to focus on whether the physician exercised independent professional judgment. Likewise, ignoring widely adopted AI tools may eventually raise different standard-of-care questions. In both situations, documentation will matter.

6. AI Raises Significant HIPAA and Data Governance Issues

As practices use more AI-driven vendors and digital tools, patient data often passes through multiple third parties. That creates growing compliance concerns around:

• Business Associate Agreements;

• Downstream subcontractors;

• Breach notification responsibilities;

• Secondary use of clinical data; and

• Vendor access to protected health information.

In my view, traditional BAAs are no longer enough in many AI arrangements. Physicians and healthcare organizations should understand how vendors use, store, and potentially train on clinical data before those tools are integrated into practice workflows.

7. Pennsylvania’s Fair Contracting For Health Care Practitioners Act Changed the Non-Compete Landscape

I also discussed Pennsylvania’s Fair Contracting for Health Care Practitioners Act (Act 74 of 2024), which significantly changed how non-competes operate for physicians and some APPs, as previously discussed on this blog (previous article here).

For any physician employment agreement signed after January 1, 2025, non-compete restrictions are limited to one year, and the statute significantly restricts enforcement when the practitioner is terminated by the employer. Telehealth adds another layer of complexity, because traditional radius-based restrictions can be difficult to apply in a remote practice model. As more care moves online, employers may increasingly rely on narrower patient non-solicitation provisions instead of broad geographic restrictions.

Final Takeaway

The central theme of the presentation was simple: technology is changing physician practice quickly, but the legal principles governing physician responsibility remain familiar.

Telehealth, AI, and digital platforms may create new factual scenarios, but they do not eliminate the importance of:

• Licensure;

• Documentation;

• Supervision;

• Privacy compliance; and

• Independent clinical judgment.

For physicians, healthcare organizations, and the attorneys who advise them, the challenge is not just understanding the new technology. It is understanding how longstanding legal rules apply when that technology becomes part of everyday care delivery.

The announcement is a signal of Medicare’s continued push toward value-based care models, in which physician reimbursement is increasingly tied to quality metrics and cost management rather than just the volume of services provided.

Overview of the Ambulatory Specialty Model

The ASM is designed to improve the prevention and management of chronic diseases in outpatient settings, with an initial focus on heart failure and lower back pain. CMS has indicated that the program is intended to reduce avoidable hospitalizations, improve care coordination, and lower overall Medicare spending.

Heart failure represents a particularly significant target for cost containment efforts. Estimates suggest that heart failure care costs the U.S. healthcare system approximately $179.5 billion annually, making it one of the most expensive chronic conditions treated within the Medicare population.

Under the ASM, certain specialists who frequently treat Medicare patients with these conditions will be required to participate in the program if they meet specified eligibility criteria.

Who Will Be Required to Participate

CMS has released a list identifying approximately 2,600 cardiologists who will be required to participate in the heart failure portion of the ASM. See the full list here.

Physicians were selected based on several criteria, including:

• Billing under the Medicare Physician Fee Schedule
• Practicing in CMS-designated geographic regions
• Having a specialty designation in general cardiology
• Historically treating at least 20 heart failure episodes per year

CMS will evaluate eligibility using data from two years prior to a performance year. For example, CMS will use 2025 claims data to determine eligibility for the 2027 performance year.

The program will also include more than 4,000 physicians treating lower back pain, reflecting CMS’s broader effort to target high-cost chronic conditions.

Payment Adjustments Under the Model

Beginning in 2028, participating physicians will have their Medicare Part B payments adjusted based on their performance within the model.

For the first two payment years (2028 and 2029), payment adjustments will range from –9% to +9%, with the potential for larger adjustments in later years.

Notably, these adjustments apply at the individual physician level and affect all of the physician’s Medicare Part B claims, not just claims associated with heart failure treatment.

How Performance Will Be Measured

The ASM builds upon the existing Merit-based Incentive Payment System (MIPS) framework and evaluates physicians across several performance domains, including:

• Quality of care
• Care improvement activities
• Cost of care
• Interoperability and data sharing

A significant portion of a physician’s performance score (reportedly 50%) will be tied to an episode-based cost measure related to heart failure treatment.

Questions and Concerns Raised by Professional Societies

Several cardiology organizations have raised questions about the design and implementation of the program.

The American College of Cardiology (ACC) has submitted comments to CMS identifying potential operational challenges, including concerns about the program’s focus on individual physician performance rather than team-based care models that are common in cardiology.

The American Society of Nuclear Cardiology (ASNC) has also encouraged members to review the CMS participant list and report whether they were included, noting that the organization is still working to understand the program’s full impact on its membership.

Professional organizations have also requested additional transparency from CMS regarding the data that will be used to determine physician performance under the model.

What This Means for Physicians

Although the ASM initially targets cardiologists and physicians treating lower back pain, the model reflects a broader policy trend within Medicare.

Over the past decade, CMS has steadily expanded value-based payment models, shifting reimbursement toward programs that emphasize cost control, prevention, and measurable outcomes.

Physicians should expect that similar programs will continue to expand across specialties as CMS pursues its long-term goal of transitioning a larger share of Medicare spending into value-based payment arrangements.

For physicians identified as ASM participants, reviewing the program requirements and monitoring future CMS guidance will be important as implementation approaches.

In addition to in-depth articles here on Med Law Blog, Tucker Arensberg healthcare attorney Adam Appleberry provides regular legal updates and practical guidance on social media:

• Instagram: @the.doctors.lawyer
• TikTok: @thedoctorslawyer

Through short, focused videos and posts, Adam addresses real-world issues facing medical practices, including compliance, reimbursement, credentialing, peer review, HIPAA, telehealth, and risk management. His goal is to make healthcare law understandable and accessible for busy providers.

If you prefer quick, practical insights alongside our longer-form legal analysis, we encourage you to follow along on Instagram and TikTok for ongoing updates tailored specifically to healthcare professionals.

The underlying rules are not new. However, the compliance deadline is approaching, and for many organizations, the required updates will touch more than just the notice itself.

Why This Update Is Required

In February 2024, the U.S. Department of Health and Human Services (“HHS”) finalized revisions to 42 C.F.R. Part 2, aligning portions of the SUD confidentiality regulations with the HIPAA Privacy Rule pursuant to the CARES Act.

While the rule expanded certain permitted uses and disclosures of SUD records for treatment, payment, and health care operations, it retained heightened confidentiality protections and introduced additional notice obligations. As part of that framework, covered entities that handle Part 2 records must ensure their NPP accurately reflects these requirements.

The deadline to comply with the notice-related provisions is February 16, 2026.

Who This Applies To

The NPP update requirement applies to any HIPAA covered entity that creates, receives, maintains, or transmits SUD records protected by Part 2, even if the entity is not a SUD treatment program.

This can include:

• Health care providers
• Group health plans
• Employer-sponsored health plans
• Health plans and insurers
• Care coordination and integrated care arrangements
• Digital health platforms and vendors operating within covered entity workflows

Importantly, some organizations may be subject to Part 2 notice obligations simply because SUD records pass through their systems, even if SUD treatment is not their primary function.

That said, not all group health plans are required to issue their own NPP. Fully insured plans may generally rely on their insurer’s NPP if they do not receive PHI beyond enrollment data or summary health information. Plans that receive more extensive PHI remain responsible for maintaining and updating their own notice.

What the Updated NPP Must Address

An updated NPP must accurately describe how SUD records are used and disclosed under Part 2 and must reflect the more stringent protections that apply to those records.

At a high level, the revised NPP should address:

• Uses and disclosures of SUD records, including when written patient consent is required
• Patient rights specific to SUD information
• The covered entity’s legal duties with respect to Part 2 records
• A clear statement that SUD records and related testimony cannot be used or disclosed in civil, criminal, administrative, or legislative proceedings against the patient, absent a written consent or qualifying court order
• Fundraising opt-out rights, if applicable

Part 2 patient notice requirements may be incorporated into a HIPAA NPP, provided all required disclosures are included.

Practical Compliance Considerations

For many covered entities, this update should be treated as more than a document refresh.

As the deadline approaches, organizations should consider:

• Whether their current NPP accurately reflects Part 2 handling in practice
• How SUD records move through internal systems and workflows
• Whether vendors or business associates handle Part 2 records
• Whether business associate agreements need to be updated to address Part 2 obligations
• Whether workforce training or subpoena response procedures need adjustment

While updating the NPP alone does not automatically require changes to business associate agreements, BAAs should be reviewed if vendors create, receive, or maintain Part 2 records on the covered entity’s behalf.

Bottom Line

This is not a new requirement, but February 16 is a firm compliance date. Covered entities that handle SUD records should confirm now whether Part 2 applies to their operations and ensure their NPP updates are underway and that policies, vendor relationships, and operational practices are all aligned.

This article will discuss the CMS’s finalized framework, identify the participating states, and provide details of the operational guidance. ASCs and physicians practicing in affected states should understand how the program works, what services are included, and what happens if prior authorization is bypassed.

What Is the ASC Prior Authorization Demonstration?

The ASC Prior Authorization Demonstration is a five-year CMS initiative that requires participating ASCs to obtain prior authorization for selected procedures before services are rendered to Medicare Fee-for-Service beneficiaries.

The goal is not to create new medical necessity standards. Instead, CMS is shifting the timing of review earlier in the process so that compliance issues can be identified before claims are submitted and paid.

IF an ASC chooses not to submit a prior authorization request, the claim will be subject to prepayment medical review, increasing the risk of denial and delay.

When Does the Demonstration Apply?

CMS is implementing the program in two phases:

Phase One

ASCs in the following states may submit prior authorization requests starting on January 5, 2026, for dates of service on or after January 19, 2026:

• California
• Florida
• Tennessee
• Pennsylvania
• Maryland
• Georgia
• New York

Phase Two

ASCs in the following states may submit prior authorization requests starting on February 2, 2026, for dates of service on or after February 16, 2026:

• Texas
• Arizona
• Ohio

Only Medicare Fee-for-Service claims are affected. Medicare Advantage claims are excluded.

Which Services Are Covered?

The demonstration applies to five service categories that CMS has identified as having a higher risk of improper utilization:

1. Blepharoplasty and related eyelid procedures
2. Botulinum toxin (Botox) injections
3. Panniculectomy and related services
4. Rhinoplasty and related services
5. Vein ablation procedures

CMS has published a detailed list of affected HCPCS and CPT codes, which ASCs should review carefully (full list can be found here). Some codes have already been removed from the list as incidental or packaged services, and CMS has indicated that the list may continue to evolve.

How the Prior Authorization Process Works

Submitting a Prior Authorization Request (PAR)

• The PAR must be submitted before the services is performed.
• The request includes documentation ASCs already maintain to support medical necessity.
• Requests are submitted to the ASC’s local Medical Administrative Contractor (MAC).

Review Timeframes

• Standard Review: Decision issued within 7 calendar days.
• Expedited Review: Decision issued within 2 business days when delays could jeopardize patient health.

Possible Decisions

• Provisional Affirmation: The claim will likely meet Medicare coverage and payment requirements.
• Non-Affirmation: The documentation does not support coverage as submitted.
• Partial Affirmation: Some services approved, others denied.

What Happens If Prior Authorization Is Skipped?

Prior authorization under the demonstration is technically voluntary. However, bypassing it comes with consequences.

If an ASC submits a claim without a prior authorization decision:

• The claim will be stopped for prepayment medical review.
• The MAC will issue an Additional Documentation Request (ADR).
• Payment will be delayed and may ultimately be denied.

If a service receives a non-affirmation and the ASC proceeds anyway, the resulting claim will be denied. Associated facility services and related claims may also be impacted.

Why This Matters for ASCs and Physicians

From a compliance standpoint, this demonstration significantly changes risk exposure:

• Documentation problems surface before payment, not after.
• Non-affirmed claims offer no payment protection.
• Repeated non-affirmations may increase audit scrutiny.
• Associated services may be denied along with the primary procedure.

At the same time, an affirmed prior authorization decision provides some insultation from future audits and reduces downstream appeals.

Key Takeaways

• The ASC Prior Authorization Demonstration is actively rolling out in early 2026, not a future proposal.
• It applies only in selected states and only to Medicare Fee-for-Service claims.
• The program does not change medical necessity standards but shifts review earlier.
• ASCs should prepare workflows now to avoid payment delays and denials.
• Physicians should understand how these requirements affect scheduling, documentation, and patient counseling.

For ASCs and physicians operating in demonstration states, prior authorization is no longer optional as a practical matter. Understanding the rules now can prevent costly surprises later.

The Centers for Medicare & Medicaid Services (CMS) has finalized a major Medicaid financing rule aimed at closing what the agency has described as a long-standing “healthcare-related tax loophole.” The rule, finalized on January 29, 2026, implements statutory changes enacted last summer and significantly restricts how states may use provider and managed care organizations (MCO) taxes to fund their share of Medicaid expenditures.

According to CMS, the affected financing arrangements have generated roughly $24 billion annually for a small number of states and shifted and increasing share of Medicaid costs onto the federal government. CMS estimates the final rule will save more the $78 billion over the next decade.

Background: How Provider Taxes Are Supposed to Work

Under the Medicaid statute, states are required to finance at least 40 percent of the non-federal share of Medicaid spending. States commonly meet this obligation through provider taxes, including taxes on hospitals, nursing facilities, and Medicaid MCOs, which are then matched with federal funds.

Federal law permits these taxes only if they are:

• Uniform or broad-based, or
• Generally redistributive, meaning they do not disproportionately burden Medicaid providers or plans.

To apply non-uniform taxes, states may seek waivers under a statistical test designed to ensure compliance.

How the Loophole Developed

CMS concluded that some states structured provider and MCO taxes in a way that technically passed the statistical test while undermining its purpose.

In practice, certain states:

• Imposed dramatically higher tax rates on Medicaid business than on comparable non-Medicaid business,
• Used those taxes to draw down enhanced federal matching funds,
• Repaid the taxed entities with federal dollars, and
• Retained surplus funds for state budget purposes, sometimes outside Medicaid.

CMS cited examples where Medicaid MCO taxes vastly exceeded comparable commercial taxes, yet still passed the existing statistical framework.

What the Final Rule Does

The final rule closes these pathways by reinforcing statutory guardrails and prohibiting structures CMS views as exploitative.

Key provisions include:

• Prohibiting higher tax rates on Medicaid business than on non-Medicaid business.
• Blocking vague, opaque, or indirect tax designs intended to disguise disproportionate burdens.
• Strengthening CMS enforcement authority over provider tax waivers.
• Implementing limits enacted by Congress in the Working Families Tax Cuts legislation.

The rule applies prospectively and also prevents new or increased provider taxes beyond authorized limits.

Transition Periods for States

Recognizing the budgetary impact, the final rule allows transition periods based on when a state’s tax waivers were approved:

• MCO taxes with waivers approved within two years of April 3, 2026
  • Transition through December 31, 2026
• MCO taxes with waivers approved earlier
  • Transition through the end of the state’s FY 2027
• Other permissible provider tax classes
  • Transition through the end of the state’s FY 2028

CMS emphasized that these timelines are intended to allow orderly restructuring while preventing continued exploitation.

Why This Matters for Providers and Plans

Although framed as a state financing issue, the rule has downstream implications for:

• Hospitals and health systems that benefited from state-directed payments,
• Medicaid MCOs subject to provider-specific taxes,
• Providers in states with aggressive provider tax structures, and
• Future Medicaid payment arrangements relying on supplemental funding.

States will need to identify alternative financing mechanisms, and providers should expect changes in Medicaid payment methodologies as these tax structures unwind.

Bottom Line

CMS has now finalized and begun enforcing a significant shift in Medicaid financing policy. States may no longer rely on provider tax arrangements that disproportionately burden Medicaid business while shifting costs to the federal government.

For providers and MCOs, the rule signals increased scrutiny of Medicaid financing arrangements and reinforces a broader trend toward tighter federal oversight of state Medicaid funding strategies.

While the increase in the conversion factor marks a positive shift compared to prior years’ reductions, the practical impact on revenue will vary by specialty, service mix, practice setting, and site-of-service adjustments finalized in the rule.

To see the CMS press release, click here, and to see the full 2026 Fee Schedule, click here.