The Regulatory Landscape Is Changing Faster Than Most Health Systems Can Track: Here Is What Executives Need to Prioritize

Healthcare regulatory complexity is not new. Health system executives have always operated within one of the most heavily regulated industries in the American economy, navigating CMS conditions of participation, payer contract compliance, state licensing requirements, HIPAA privacy and security obligations, and the overlapping enforcement jurisdiction of DOJ, OIG, OCR, and state attorneys general.

What is new is the velocity of regulatory change. In a compressed period spanning the past several years, the regulatory landscape has shifted in ways that are individually significant and collectively transformative. Price transparency requirements have created new public accountability obligations. The No Surprises Act has introduced a dispute resolution infrastructure that is still evolving. Interoperability and information blocking rules have fundamentally changed how health systems must manage and share data. Value-based care regulatory frameworks are shifting financial risk in ways that compound existing compliance obligations.

For the executive leaders responsible for compliance, legal, quality, and revenue cycle management, the challenge is not just keeping up with individual regulatory changes. It is maintaining a coherent strategic posture across a regulatory environment that is moving faster than most governance models were designed to handle.

This blog addresses four of the most consequential regulatory developments currently shaping health system compliance strategies and what executive leaders need to be doing about each of them.

One development that warrants immediate attention beyond those four areas: in April 2026, CMS Administrator Mehmet Oz announced that CMS will require all states to submit, within 30 days, a plan outlining how they will verify that Medicaid providers are real, licensed, and actually delivering care, with particular focus on areas flagged as high-risk for fraud. This directive represents a significant escalation of Medicaid program integrity enforcement and will affect every health system with meaningful Medicaid participation. Organizations with complex provider enrollment structures, multi-site billing arrangements, or Medicaid revenue streams that have not been recently audited should treat this development as a near-term compliance action item, not a background regulatory development to monitor.

1. Information Blocking and Interoperability: Enforcement Is Here, and the Stakes Are Higher Than Most Organizations Have Modeled

The 21st Century Cures Act information blocking provisions became enforceable in 2021. For the first three years, enforcement was handled by the Office of the National Coordinator for Health Information Technology with a referral mechanism to HHS’s Office of Inspector General for cases involving health IT developers, health information networks, and health information exchanges. Health systems, categorized as “healthcare providers” under the rule, faced a different enforcement structure with initially lower financial exposure.

That structure has changed. The Cures Act Update of 2022 authorized expanded penalties for healthcare provider information blocking, and HHS has continued to strengthen its enforcement posture. The combination of expanded financial penalties, growing patient rights consciousness, and the increasing sophistication of ONC complaint investigation means that information blocking is now a material compliance risk for health systems, not a theoretical one.

What information blocking compliance requires

Information blocking, defined under the Cures Act as any practice that is likely to interfere with the access, exchange, or use of electronic health information, is broader in scope than most health system compliance programs have fully internalized. The eight regulatory exceptions, which define the conditions under which practices that might otherwise constitute information blocking are permissible, are complex, technically specific, and require active management.

For the Chief Compliance Officer and Chief Legal Officer, the immediate priorities are:

• Audit current patient request fulfillment processes against the Patient Access exception requirements, including response timeframes, fee limitations, and format requirements, to identify practices that may not meet the regulatory standard
• Assess EHR configuration and API accessibility against the interoperability exception requirements, in coordination with the CIO and Chief Data Officer. Information blocking risk frequently originates in technical configuration decisions made without compliance review
• Establish a complaint intake and response process specifically for information blocking allegations, separate from standard patient grievance processes. ONC investigates based on complaints, and documented response processes are material to enforcement outcomes
• Review business associate and vendor contracts for provisions that may restrict data sharing in ways that are inconsistent with information blocking exceptions. Vendor-imposed restrictions can create health system liability under circumstances that are frequently misunderstood
  

The information blocking rule does not just apply to requests that the organization chooses to deny. It applies to practices, including technical configurations, contract terms, and workflow designs, that have the effect of interfering with information access, regardless of intent.

2. Price Transparency: From Compliance Checkbox to Strategic Liability

CMS’s hospital price transparency rule has been in effect since January 2021. For much of its initial enforcement period, civil monetary penalties were limited, and the compliance response from many health systems was correspondingly minimal: a machine-readable file was posted, the technical requirement was nominally met, and the operational implications were treated as a low priority.

That posture is no longer adequate. CMS has substantially increased its enforcement posture, raising the maximum annual penalty for non-compliance to over $2 million for large hospitals. More significantly, the compliance standard has evolved. CMS is now actively auditing the accuracy and usability of posted price information, not just its existence, and issuing corrective action plans to hospitals whose files do not meet the technical and substantive requirements of the rule.

For the Chief Financial Officer, Controller, and VP of Revenue Cycle, price transparency compliance has moved from a regulatory check-the-box to an operational requirement that demands ongoing attention.

The accuracy obligation that most compliance programs are underweighting

The most significant and least appreciated price transparency compliance obligation is the accuracy requirement. Posted prices must reflect the actual amounts the hospital will accept for each item and service agreement, including payer-specific negotiated rates for each of the hospital’s established payer arrangements. In a health system with dozens of payer contracts, hundreds of contract amendments, and complex fee schedule structures that are updated on irregular cycles, maintaining accurate posted prices is an ongoing data management challenge.

When posted prices are inaccurate, whether because contract updates were not reflected, because fee schedule changes were not propagated, or because the machine-readable file was generated from a source that does not reflect current negotiated rates, the organization is out of compliance regardless of whether the file was technically present. CMS’s audit methodology is increasingly focused on this accuracy gap.

For the Controller and VP of Revenue Cycle, this requires establishing a documented process for updating posted price information whenever payer contract changes occur, with clear ownership, defined timelines, and an audit trail that demonstrates compliance management.

The No Surprises Act intersection

Price transparency and No Surprises Act compliance are operationally connected in ways that health system compliance programs do not always manage coherently. The good faith cost estimate requirement under the No Surprises Act, which applies to uninsured and self-pay patients and, in certain circumstances, to insured patients who request estimates, depends on the same underlying price data that price transparency requires the organization to maintain accurately.

When price data is unreliable, both obligations are compromised simultaneously. The health system faces price transparency enforcement exposure and No Surprises Act dispute resolution exposure from the same underlying data quality failure.

An emerging information blocking risk that health systems should be tracking now: AI-generated clinical content. As health systems deploy clinical AI tools that generate diagnostic summaries, care plan recommendations, and AI-assisted clinical documentation, a regulatory question is forming around whether patients and authorized providers have the right to access that AI-generated content under the Cures Act information blocking framework. The ONC’s position, not yet finalized through rulemaking as of mid-2026 but directionally clear from agency guidance, is that AI-generated content incorporated into a patient’s designated record set is subject to the same access rights as any other electronic health information. Health systems deploying clinical AI tools should work with CLO review to assess whether AI-generated content in the EHR is accessible to patients through existing portal infrastructure, and whether any current technical restriction on that access would constitute information blocking under the Patient Access or Interoperability exceptions. This is the information blocking risk vector that most compliance programs have not yet mapped, and the 34% annual increase in ONC complaint volume suggests the plaintiff and patient advocacy bar is ahead of most compliance programs on this question.

3. Value-Based Care Regulatory Compliance: The Obligations Inside the Incentives

The transition from fee-for-service to value-based payment has been a strategic priority for health systems for over a decade. What has received less systematic attention is the regulatory compliance infrastructure that value-based care arrangements require, and the specific obligations that create compliance exposure when they are not met.

Value-based care contracts, whether through Medicare Advantage, Medicaid managed care, commercial risk arrangements, or CMS alternative payment models, embed compliance requirements that are distinct from and in addition to standard billing compliance. For the Chief Medical Officer, Chief Quality Officer, and VP of Revenue Cycle, understanding this compliance layer is not optional. It is a condition of sustainable participation in risk-based contracting.

Quality measure data integrity as a compliance obligation

In a value-based care environment, quality measure performance is not just a clinical achievement metric: it is a billing determinant. Bonus payments under shared savings arrangements, quality withhold releases under managed care contracts, and risk adjustment payments under Medicare Advantage all depend on quality and clinical data that the health system submits to payers and regulators.

When that data is inaccurate, in either direction, the organization has a compliance problem. Submitting inflated quality data to obtain quality bonus payments is False Claims Act exposure. Failing to submit complete risk adjustment data under Medicare Advantage is revenue leakage and potentially a compliance obligation failure under the contract terms. Both risks are managed through the same underlying capability: accurate, complete, and well-governed clinical and quality data.

Patient attribution and care management obligations

Many value-based care arrangements, particularly Medicare Shared Savings Program ACOs and total cost of care models, carry explicit care management obligations for attributed patient populations. When the organization cannot accurately identify its attributed patients, cannot track care plan compliance, or cannot demonstrate the care coordination activities required under the contract, it is not just leaving value-based revenue on the table. It may be in breach of its contractual compliance obligations.

For the Chief Compliance Officer, value-based care contracts deserve the same compliance monitoring infrastructure as billing compliance, including periodic audits of attribution accuracy, care management documentation, and quality measure data integrity.

The most active VBC enforcement area currently is Medicare Advantage Risk Adjustment Data Validation (RADV). CMS conducts RADV audits to verify that diagnosis codes submitted for risk adjustment payments are supported by medical record documentation. The extrapolation methodology CMS uses, which projects findings from an audit sample to the entire contract-year population, means a relatively small number of unsupported codes can generate repayment demands in the tens of millions for large MA plans and the health system providers that submit encounter data to them. For health systems with significant Medicare Advantage volume, RADV readiness is not a payer relations issue: it is a compliance program priority. Organizations should conduct internal RADV-style audits annually, validate that submitted HCC codes are supported by current-year medical record documentation, and address documentation gaps proactively before CMS selects them for audit.

4. Cybersecurity and HIPAA: The Regulatory Convergence That Is Reshaping Compliance Programs

HIPAA’s Security Rule has required health systems to maintain administrative, physical, and technical safeguards for electronic protected health information since 2005. For most of that period, HIPAA security compliance was managed as an IT governance function: risk assessments, access controls, encryption standards, and workforce training.

Two developments have fundamentally changed this framing.

The first is the dramatic increase in healthcare cybersecurity incidents. Healthcare remains the most targeted industry for ransomware and data breach activity, and the operational and financial consequences of major incidents, including the 2024 Change Healthcare attack, which disrupted revenue cycle operations across thousands of health systems for weeks, have elevated cybersecurity from an IT risk to a board-level strategic risk.

The second is the evolution of HHS enforcement posture. OCR’s HIPAA security enforcement actions have consistently identified the same underlying failures: inadequate risk analysis, failure to implement identified controls, insufficient workforce training, and inadequate business associate management. These are not technical failures: they are governance failures. And OCR is holding executive leadership accountable for them.

What the new HHS cybersecurity strategy means for compliance programs

HHS released an updated healthcare cybersecurity strategy in 2024 that signals a significant shift in the regulatory approach to health system cybersecurity. The strategy contemplates updating HIPAA Security Rule requirements to be more specific and prescriptive, and it proposes incentive structures for health systems that adopt recognized cybersecurity frameworks, along with enforcement consequences for those that do not.

For the Chief Compliance Officer and Chief Legal Officer, the implication is clear: HIPAA security compliance is moving from a principles-based framework that health systems could interpret flexibly to a more prescriptive standard with defined technical and administrative requirements. Organizations that have maintained a minimal compliance posture, meeting the letter of the current rule without investing in robust security capabilities, will face increasing exposure as the regulatory standard evolves.

Business Associate Risk as a Compliance Obligation, Not Just a Contract Matter

The Change Healthcare incident demonstrated, at scale, that health system operational and compliance exposure from business associate relationships is not adequately managed through contract terms alone. When a critical vendor’s systems are compromised, the health system faces regulatory exposure under HIPAA’s breach notification requirements and potentially under state data breach laws, regardless of what the business associate agreement says.

For the Chief Compliance Officer and Chief Data Officer, this requires a more sophisticated approach to business associate risk management than most health systems currently have in place. Vendor cybersecurity assessments, contractual incident response requirements, and operational continuity planning for critical vendor disruptions are not just prudent risk management: they are increasingly components of an adequate HIPAA compliance program.

The risk profile extends beyond traditional cybersecurity vendors to the rapidly expanding category of clinical AI tools. In April 2026, a class-action lawsuit was filed against Sutter Health and Memorial Health, alleging that their use of Abridge AI’s ambient documentation platform resulted in the unauthorized recording and transmission of sensitive patient conversations without prior consent. The plaintiffs allege violations of California consumer privacy law and the federal Wiretap Act, not HIPAA, despite the existence of a business associate agreement between the AI vendor and its health system clients. This distinction is critical: executing a BAA does not resolve exposure under state wiretapping statutes or consumer privacy laws, which impose independent consent obligations. For health systems currently deploying or evaluating ambient AI scribes, clinical documentation AI, or any tool that captures audio or clinical data from patient encounters, the immediate compliance priority is verifying that patient consent processes are explicit, documented, and operationally enforced, not merely addressed in vendor agreements.

Building a Regulatory Intelligence Function That Can Keep Pace

The four regulatory areas addressed in this blog share a common characteristic: they are all evolving faster than a static compliance program can track. Price transparency enforcement standards are changing. Information blocking penalty structures are expanding. Value-based care compliance obligations are proliferating as contract models become more complex. HIPAA security requirements are moving toward greater specificity.

Health systems that are managing this environment most effectively have invested in a regulatory intelligence capability, a structured function within the compliance organization that monitors regulatory developments, translates them into operational implications, and ensures that compliance program updates are driven by regulatory trajectory rather than enforcement actions.

This is not a large investment. It is a disciplined one. It requires designated responsibility for regulatory monitoring across the key domains: CMS billing and payment, OIG enforcement priorities, OCR privacy and security, ONC interoperability, and state regulatory developments. It requires a governance process for translating regulatory developments into compliance program updates. And it requires an executive-level forum, at a minimum, the Chief Compliance Officer, Chief Legal Officer, and Chief Data Officer, where regulatory intelligence is reviewed, and compliance strategy is adjusted.

The alternative, responding to regulatory changes after they become enforcement actions, is a posture that no health system can afford to maintain.