The Centers for Medicare & Medicaid Services (CMS) recently posted revised forms for its voluntary self-referral disclosure protocol (SRDP), the process Medicare providers and suppliers use to self-disclose and resolve actual or potential violations of the physician self-referral law (Stark Law). Providers may use the updated forms now, and they must use them for disclosures submitted on or after Nov. 1, 2026. CMS describes the revisions as minor edits to reduce burden, and our comparisons of the four revised forms (available for download below) largely bear that out.
Federal Court Declines to Block DEI Contractor Executive Order: What Higher Education Institutions Need to Know
On Oct. 14, 2026, the U.S. District Court for the District of Maryland denied a request by a coalition of higher education and contractor associations to preliminarily enjoin Executive Order 14398, “Addressing DEI Discrimination by Federal Contractors” (the FAR DEI Order), and to stay the Federal Acquisition Regulatory (FAR) Council’s April 17, 2026, implementing memorandum, “Agency Implementation of Executive Order 14398, Addressing DEI Discrimination by Federal Contractors.”
As a result, the mandatory contract clause at the center of the FAR DEI Order remains in force: All federal contractors and subcontractors, including colleges and universities that hold federal contracts or subcontracts, will be required to accept a clause barring “racially discriminatory DEI activities,” backed by reporting and records-access obligations and termination and debarment remedies, as well as the risk of potential False Claims Act liability. At the same time, the court gave the clause a meaningfully narrow reading that contractors and subcontractors can rely on: The operative phrase, “disparate treatment based on race or ethnicity,” carries its settled legal meaning of intentional discrimination already prohibited by federal law.
Read on to learn more about the decision and what it means for higher education institutions.
DOJ Revises Justice Manual to Streamline False Claims Act Enforcement and Clarify Limits on Use of Agency Guidance
On Sept. 18, 2026, DOJ announced two significant revisions to the Justice Manual that aim to reshape False Claims Act (FCA) enforcement. The first revision reinstates and expands DOJ’s 2017 policy limiting the use of sub-regulatory guidance documents in enforcement actions by restricting the government’s ability to treat agency guidance as binding legal authority. The second revision strengthens DOJ’s approach to dismissing qui tam actions filed by private relators, directing attorneys to assess whether dismissal is warranted in every declined case.
Together, these changes signal a more disciplined enforcement posture, suggesting that DOJ intends to pursue fraud cases grounded in clear legal obligations while more actively culling meritless whistleblower suits.
Read on to learn more about the revisions and what they mean for federal contractors, healthcare entities, and federal funding recipients and defendants in qui tam cases.
DOJ Continues Increased Cybersecurity Enforcement: Honeywell Aerospace Agrees to $2M FCA Settlement for Cybersecurity Noncompliance on DoW Contracts
On September 1, 2026, the U.S. Department of Justice (“DOJ”) announced a $2,042,518 False Claims Act (“FCA”) settlement with Honeywell Aerospace Inc. (“Honeywell Aerospace” or “Honeywell” or “the company”), resolving allegations that the company failed to comply with certain cybersecurity requirements in a contract with the U.S. Department of War (“DoW”). This settlement is the latest in a growing line of enforcement actions under DOJ’s Civil Cyber-Fraud Initiative and underscores the government’s continued willingness to use the FCA to hold defense contractors accountable for apparent failures to comply with cybersecurity-related requirements.
Read on to learn more about the settlement and what government contractors should take away.
Eleventh Circuit Upholds False Claims Act Qui Tam Constitutionality, Vacating Florida District Court Ruling
On September 1, 2026, the Eleventh Circuit issued its highly anticipated decision in United States ex rel. Zafirov v. Fla. Med. Assocs., LLC, holding that the False Claims Act’s qui tam provision does not violate the Appointments Clause of the Constitution and vacating a Florida district court’s dismissal order that had been based on such grounds. This decision, however, is unlikely to be the last to address the constitutionality of the False Claims Act provision permitting whistleblowers to litigate fraud cases on behalf of the United States after the Department of Justice has declined to intervene in those cases.
First Healthcare Company Avoids Criminal Charges Under DOJ’s New Self-Disclosure Policy
On July 29, 2026, the Department of Justice (“DOJ”) announced that it declined to bring criminal charges against Campus Eye Management Holdings LLC and its subsidiary, Campus Eye Management LLC (collectively “Campus Eye”), a New Jersey-based management services organization. Campus Eye is the first healthcare company to avoid criminal prosecution under the DOJ’s new corporate enforcement policy.
The declination was issued by the DOJ’s National Fraud Enforcement Division. It resolved a criminal investigation into Campus Eye’s role providing billing and administrative services to an optometry practice and ambulatory surgery center (“ASC”). The investigation centered on healthcare fraud, illegal kickbacks, and conspiracy.
At the same time, the DOJ unveiled a seven-count indictment against E. Bruce DiDonato, the founder of the optometry practice and ASC. DiDonato is accused of running a years-long scheme to bill Medicare and private insurers for unnecessary diagnostic eye tests and to pay illegal kickbacks to referring surgeons. According to the DOJ, the scheme ran from at least 2015 through March 2023 and generated approximately $3.4 million in allegedly fraudulent Medicare claims, about $1 million of which Medicare actually paid.
CMS Proposes Provider Enrollment Changes to Strengthen Program Integrity
On July 6, 2026, the Centers for Medicare & Medicaid Services (CMS) published its Calendar Year 2027 Home Health Prospective Payment System Proposed Rule (the “Proposed Rule”) in the Federal Register, which includes several provider enrollment changes that would be applicable to all provider and supplier types. In its efforts to strengthen program integrity, CMS has proposed changes to the grounds for, and consequences of, provider enrollment denials and revocations.
Key proposed provider enrollment changes are described below. Comments to the Proposed Rule are due by 5pm ET on August 31, 2026.
DoW Suspends CMMC Phase II Requirements – Launches 60-Day Review
On July 13, 2026, the Department of War (DoW) announced the immediate suspension of all Cybersecurity Maturity Model Certification (CMMC) Phase II requirements, which had originally been scheduled to take effect Nov. 10, 2026, including the transition to mandatory third-party assessments by CMMC Third-Party Assessment Organizations for contractors handling Controlled Unclassified Information. The DoW simultaneously established a CMMC Reform Task Force charged with delivering a comprehensive report within 60 days recommending “realistic, scalable security measures” for the Defense Industrial Base.
The suspension aligns with Secretary of War Pete Hegseth’s Acquisition Transformation System directives and the broader “Arsenal of Freedom” initiative. Critically, the action does not relieve contractors of their underlying obligations to protect federal data, which includes the current DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting) and the NIST SP 800-171 Rev. 2 security controls upon which the CMMC Phase II requirements are based.
Read on to learn more about the announcement and what government contractors need to know to maintain compliance.
OIG Clears Pathway for Free Supplemental Cancer Screening Report
On May 15, 2026, the Office of Inspector General (“OIG”) of the U.S. Department of Health and Human Services issued Advisory Opinion No. 26-11 (the “Opinion”), a favorable opinion for a proposed arrangement that involved providing patients a free supplemental cancer screening report (the “Proposed Arrangement”). The Opinion provides guidance for healthcare companies navigating the intersection of innovative diagnostic offerings and federal fraud and abuse laws.
AI-Assisted Billing Could Create FCA Pitfalls: How Healthcare Companies Can Get Ahead of Risk
Across the healthcare industry, providers are increasingly relying on AI-assisted billing tools to automate medical coding, prior authorization workflows, and the submission of claims to Medicare, Medicaid and other federal payors. The efficiency gains can be substantial, as can the heightened False Claims Act (FCA) exposure these systems can create. As AI continues to develop and becomes more widely integrated into healthcare billing, relators and prosecutors are likely to explore new avenues for evaluating, and litigating, how these tools are deployed, monitored and overseen.
Like every billing system, AI-assisted billing tools can make mistakes. However, AI-assisted systems can scale those mistakes across thousands of claims, and the records those systems generate may make it easier for the government or relators to argue that a provider’s submission of those claims violated the FCA.
Read on to learn what healthcare companies should know when deploying AI-assisted billing, and best practices for getting ahead of FCA risk.