Thematic threads
State AGs rewrite the manufacturer and payer rulebook
Texas extended its state false-claims theory from AstraZeneca to Gilead, extracting $45 million for free nursing and reimbursement-support services treated as kickbacks tainting Medicaid claims, a theory the federal AKS bar has largely tolerated. Missouri opened a parallel front, using the Missouri Merchandising Practices Act to order Eli Lilly to drop 340B claims-data conditions and purge data already collected. Texas also forced structural remedies into provider operations: Texas Children's opened the nation's first Detransition Clinic under settlement terms that permanently stripped physician privileges and amended medical staff bylaws. The common pattern: state statutes being used to drive remedies, data access, and governance changes that federal enforcers either cannot or will not pursue.
The Medicaid work-requirement machine starts turning
January 1 implementation of H.R. 1 community engagement rules is now operational, not theoretical. New Hampshire proposed an 80-hour monthly threshold under He-W 837, Louisiana set self-attestation for medically frail in 2027 and provider verification in 2028, and New Jersey projects loss of coverage for 300,000 of 540,000 expansion enrollees. States are simultaneously suing CMS over the interim final rule while filing technical implementation comments, meaning the operational rules will keep shifting through Q1 even as eligibility redeterminations run.
Behavioral health and residential care remain the audit sweet spot
Arizona suspended payments to more than 100 behavioral health providers in a single coordinated action and moved three provider types to high-risk screening. New Jersey OSC extrapolated $1.5 million from Bonnie Brae on arithmetic-impossibility documentation findings, OIG tagged $416,009 federal share in Kentucky QRTP noncompliance, Indiana capped ABA at 4,000 lifetime hours with phased rate cuts, and Louisiana told SUD residential providers that handing out a provider directory is not step-down planning. The documentation bar for behavioral health and youth residential services is being reset in real time.
Enforcement patterns and posture shifts
OIG is pushing system-edit theories that convert billing errors into oversight failures: the outpatient drug crosswalk audit found 160,918 mismatched Part B lines concentrated in critical access and short-term acute care hospitals, and the incarcerated-enrollee capitation audit hit a 46% error rate. Expect state Medicaid agencies and MACs to tighten edits on both fronts within the quarter. On the AKS side, OIG set the value-based patient engagement cap at $646 for 2027 and issued AO 26-19 favorable to charitable cost-sharing subsidies, maintaining the agency's accommodation posture on structured beneficiary support even as Texas attacks the manufacturer version of the same theory.
Data security is now a joint-AG enforcement product with templated controls. The Boston Children's Health Physicians and XTIUM settlement and the Labcorp/AMCA multistate settlement both impose vendor inventories, segmentation, third-party assessments, and termination rights, with the AGs explicitly framing vendor cybersecurity as a non-delegable duty of the covered entity.
Implications for your program
- Pharmaceutical manufacturers and hub vendors: Reassess nursing support, reimbursement-assistance, and 340B conditions programs against state false-claims and consumer-protection statutes, not just the federal AKS. The Texas and Missouri theories do not require federal buy-in and are producing nine-figure recoveries and injunctive data-destruction orders.
- Medicaid MCOs and expansion-state providers: Stand up a work-requirement implementation command center now. Track state-by-state thresholds (80 vs. 100 hours), medically-frail attestation rules, retroactive coverage changes, and the moving federal IFR.
- Behavioral health, SUD residential, ABA, and youth residential operators: Audit documentation ratios (service hours vs. timesheets), licensure of clinical staff, discharge-planning closed loops, and ABA supervision ratios against the Louisiana, Indiana, New Jersey, and OIG Kentucky findings. Assume extrapolation and payment suspension are the default enforcement tools.
- Hospitals and health systems billing Part B drugs: Run a self-audit against the HCPCS/NDC crosswalk before MACs implement edits. Critical access and short-term acute care facilities are the stated OIG focus and will see targeted MAC activity.
- All HIPAA-covered entities with IT and collection vendors: Update vendor-risk policies to reflect the AG template: contract inventory, data minimization and segmentation across clients, mandatory third-party security assessments, and termination rights for cyber noncompliance. Document board-level review of any security audit findings that remain open past 90 days, the fact pattern that drove the BCHP penalty.
This memo synthesizes the week's most consequential developments across RuleResource Intelligence Report. Article links are free to forward.