Risk & Compliance

Section 1557 Language Access Annual Notice Year 1 Anniversary — July 5, 2026 Compliance Window

HHS Section 1557 Annual Notice of Availability (free language assistance services in English + 15 most common LEP languages in the state) has been in effect since July 5, 2025. Year 1 compliance review window approaching July 5, 2026. CA's 15 LEP languages include Spanish, Chinese, Vietnamese, Tagalog, Korean, Armenian, Russian, Persian, Arabic, Punjabi, Khmer, Hmong, Hindi, Japanese, Mon-Khmer. All FQHCs taking Medicare/Medi-Cal must have posted, distributed, and translated the Notice — pairs with the May 11, 2026 WCAG 2.1AA deadline as a compounding civil rights compliance window for FQHCs. Two HHS OCR rules with overlapping enforcement risk in the same 8-week window.

URGENT: HHS Section 504 WCAG 2.1 AA Digital Accessibility Deadline Hits FQHCs May 11, 2026 — 3 Weeks Away

HHS's first major update to Section 504 regulations in ~50 years imposes two hard deadlines for every FQHC with 15+ employees: (1) All web content and mobile apps must meet WCAG 2.1 Level AA by May 11, 2026 — covering screen reader compatibility, color contrast, keyboard navigation, form labeling. (2) At least one accessible exam table and one accessible weight scale must be in place by July 8, 2026. Non-compliance creates civil rights enforcement exposure and jeopardizes HRSA grant eligibility. Note: state/local governments received a DOJ extension to 2027 — FQHCs did NOT.

MAJOR PIVOT — HHS OCR Extends Section 504 / WCAG 2.1AA Deadline by One Year to May 11, 2027

On May 7, 2026 — four days before the original deadline — HHS Office for Civil Rights issued an Interim Final Rule extending the Section 504 digital accessibility compliance date by one year. FQHCs with 15+ employees now have until May 11, 2027 to make websites, mobile apps, patient portals, online scheduling, telehealth platforms, intake forms, and self-service kiosks WCAG 2.1 Level AA compliant. Recipients with fewer than 15 employees have until May 10, 2028. OCR cited concerns that FQHCs, hospitals, and primary care centers could not meet the original deadline. Comment period runs through July 6, 2026. CRITICAL: this is an extension, not a rescission — Section 504 has been enforceable since July 8, 2024, the private right of action remains active, and ADA-related healthcare litigation grew 11% YoY in 2025. FQHCs should use the 12-month runway to: (1) complete an accessibility audit, (2) publish accessibility statement + complaint intake procedure, (3) train front-desk staff, (4) document good-faith remediation milestones. For FQHCs that were sprinting to remediate, this is genuine relief; for those who deferred, the underlying obligation has not changed.

Salud Para La Gente (Santa Cruz/Monterey FQHC) Pays $750K to Settle False Claims Act Misbranded Contraceptives Case — First CA FQHC FCA Settlement of FY2026

On May 6, 2026, Salud Para La Gente — a Santa Cruz/Monterey County FQHC serving low-income patients across the Central Coast — agreed to pay $750,000 to settle False Claims Act allegations that it billed Medi-Cal and Medicaid for misbranded contraceptives. This is the FIRST California FQHC FCA settlement of FY2026 to surface, and it arrives during peak DOJ enforcement posture (NFED stood up April 7, West Coast Strike Force April 30, FY2025 healthcare = 84% of $6.8B FCA recoveries). Even mission-driven safety-net FQHCs are not exempt from FCA scrutiny — particularly around 340B/family planning drug supply chains, FDA labeling verification, and Medicaid billing alignment. Compliance officers across CA FQHCs should immediately: (1) audit contraceptive and 340B drug procurement chains for FDA-approved labeling, (2) verify Medi-Cal billing reflects the actual product dispensed, (3) document GPO/wholesaler verification procedures, (4) review the DOJ-OIG release language for additional indicators. Pairs with the May 7 Section 504 extension as a one-two signal: OCR pulled back on accessibility enforcement, but DOJ/OIG enforcement on billing integrity is intensifying.

Bay Area Community Health Confirms TriZetto Data Breach — SSN, Medicare Numbers, DOB, Insurance Data Exposed

Bay Area Community Health (BACH, Fremont/San Jose, ~30 sites) confirmed (May 6, 2026 substitute notice + class action investigation update) PHI exposure via TriZetto Provider Solutions (Cognizant subsidiary, OCHIN clearinghouse partner). Exposed: SSN, Medicare beneficiary numbers, DOB, insurance data. Part of the broader 3.4M-patient TriZetto breach. Class-action investigations active in May 2026. Distinct from already-tracked AltaMed and La Clinica breaches — third-party vendor risk pattern across FQHCs using OCHIN/TriZetto stack. Tech-stack relevance: TriZetto is a widely used FQHC RCM clearinghouse. Strategic implication for FQHC CIOs / compliance officers: (1) audit your full Business Associate Agreement (BAA) chain — clearinghouses, RCM vendors, eligibility verifiers, and any subcontractors that touch PHI; (2) TriZetto/Cognizant-related contract review is now a board-level item; (3) confirm your incident-response runbook covers vendor-side breach notification (60-day OCR HIPAA window); (4) document your Security Rule risk analysis updates (the OCR ransomware sweep April 23 and now this BACH item form a one-two compliance pressure pattern).

FQHC Ransomware Surge Q1 2026 — Sandhills (169K), Cherry Health (184K), Central Jersey Hit; Class-Action Lawsuits Now Routine

Comparitech's Q1 2026 healthcare ransomware roundup confirms 201 attacks (120 providers + 81 vendors) — three of which were FQHCs: Sandhills Medical Foundation (SC, 169,017 patients, INC Ransom group), Cherry Health (Michigan's largest FQHC, 184,000 patients), and Central Jersey Medical Center FQHC. Sandhills now faces a class-action investigation announced May 2026, signaling that civil litigation is becoming routine on top of OCR enforcement. Combined with OCR's April 23 four-entity ransomware sweep ($1.165M), the message to FQHC boards is unambiguous: Security Risk Analysis (45 CFR § 164.308(a)(1)(ii)(A)) is now the single most material ePHI compliance gap. CA FQHCs running OCHIN Epic, eClinicalWorks, NextGen, athenahealth — every IT environment with PHI — should refresh risk analysis before the Section 504 May 11 deadline lands and triggers heightened OCR scrutiny.

HHS Section 504 / WCAG 2.1AA Deadline 7 Days Away — DOJ Title II Extension Confirmed Not Mirrored by HHS

Today is May 4, 2026 — exactly 7 days from the May 11 HHS Section 504 enforcement date. Key clarification: legal advisories from Duane Morris (April 26) and Alston & Bird (March) confirm that the DOJ's April 20 Interim Final Rule extending Title II ADA web accessibility deadlines for state/local government agencies does NOT apply to HHS Section 504. Many FQHC executives have wrongly assumed the extension applied to them — it does not. The May 11 deadline holds. OCR enforcement focus: documented good-faith progress (not perfect WCAG 2.1 AA conformance). But Section 504 has been enforceable since July 8, 2024 — May 11 simply makes WCAG 2.1 AA the technical benchmark. Critical: private right of action begins May 12. ADA-related litigation against healthcare providers grew 11% year-over-year in 2025, much of it Section 504-based. Final-week priorities: confirm exam table + scale ≥10% of MDE accessibility (HRSA OSV will check this), publish accessibility statement, document remediation timeline, train front-desk staff on accessibility complaint intake.

HHS Section 504 / WCAG 2.1AA Deadline 9 Days Away — Final Sprint Week for Every CA FQHC With 15+ Employees

Today is May 2, 2026 — exactly 9 days from the May 11 HHS Section 504 enforcement date for digital accessibility (WCAG 2.1 Level AA). All FQHCs with 15+ employees must have remediated patient portals, public websites, mobile apps, online scheduling, telehealth platforms, intake forms, and self-service kiosks. The April 22 AHA News confirmation reiterated: the DOJ Title II web accessibility extension does NOT apply to HHS Section 504 — Section 504 enforcement window stays open. The April 22 Converge Accessibility 'Red Alert' speculated about regulatory contest, but no official rescission has occurred — assume the deadline holds. Final-sprint focus: confirm contrast ratios, alt text, keyboard navigation, ARIA roles, screen-reader compatibility, and accessibility statement publishing. Section 504 also provides a private right of action — even without OCR enforcement, lawsuits can begin May 12. Document remediation work and good-faith compliance posture even if 100% conformance is not yet complete.

DOJ Launches West Coast Health Care Fraud Strike Force — NorCal U.S. Attorney Calls Silicon Valley 'Ground Zero for Tech-Driven Fraud'

On April 30, 2026, the DOJ National Fraud Enforcement Division (NFED — created April 7, 2026) launched the West Coast Health Care Fraud Strike Force, uniting the DOJ Health Care Fraud Section with U.S. Attorney's Offices for Arizona, Nevada, and Northern California, plus DEA and FBI. NorCal U.S. Attorney Craig Missakian called Silicon Valley 'ground zero for technology-driven health care fraud.' The strike force model has prosecuted 6,200+ defendants nationally with $45B+ in alleged fraudulent billing. NorCal FQHCs (Alameda, Contra Costa, San Mateo, Santa Clara, SF, North Bay) face heightened scrutiny on telehealth distant-site billing, incident-to PPS billing, AI-augmented billing schemes, and 340B claim integrity. Pairs with the OCR April 23 four-entity ransomware sweep ($1.165M) — May 2026 is shaping up as the most enforcement-intensive month of the year for FQHC compliance.

Critical FQHC Compliance Fact: Eyeglasses Are NOT In HRSA Scope — Excluded from Sliding-Fee Mandate, NOT PPS-Encounter-Billable

Per HRSA Health Center Program Compliance FAQs and Compliance Manual Chapter 4: 'eyeglasses, hearing aids, and dentures' are explicitly excluded from in-scope services. Critical operational implications for FQHC vision programs: (1) Eyewear sales are NOT encounter-rate billable to PPS — only the OD exam visit is. (2) Eyeglasses are NOT subject to the HRSA sliding-fee discount mandate — FQHCs may set pricing flexibly. (3) HRSA grant funds CANNOT be used for eyewear inventory. (4) Optical dispensary is operationally a patient-experience amenity, not a PPS revenue line. The optometry exam itself is where the FQHC vision program makes its money — that's the PPS encounter for the visit. Many FQHC executives assume the PPS umbrella covers eyewear — it doesn't. This affects budgeting, pricing flexibility, and HRSA compliance reviews. NACHC notes vision is also non-mandatory under HRSA Section 330 — base grants cannot launch new vision lines, must come from expansion grants, 340B savings, or operating capital.

HRSA 340B Rebate Model ICR Burden Comment Window Closes April 27 — Second Window for FQHCs After April 20 Main Deadline

HRSA released a supplemental Information Collection Request (ICR) specifically on the administrative burden of the 340B Rebate Model Pilot Program. Comments on operational impact — pharmacy workflow, staff time costs, IT integration — are due April 27, 2026. This is a distinct window from the April 20 main rebate policy comment deadline. FQHCs that missed the April 20 deadline should use this second window to document pharmacy workflow and staff time cost impact. Burden comments can meaningfully shape the final rule's administrative mechanics.

OCR Settles 4 HIPAA Ransomware Cases — $1.165M Bundled Penalty, 427K Patients Exposed

On April 23, 2026, HHS Office for Civil Rights announced settlements with four healthcare entities (Regional Women's Health Group/Axia Women's Health, Assured Imaging, Consociate Health, and Star Group LP Health Benefits Plan) for HIPAA ransomware breaches affecting 427,000 patients. Total penalty: $1,165,000 + 2-year corrective action plans for each. Common root cause across all four: failure to conduct accurate Security Rule risk analysis. This is OCR's 19th ransomware investigation completed under its dedicated ransomware enforcement initiative, and the first time it bundled multiple settlements in a single press release — signaling a more aggressive, organized ransomware enforcement posture. Strategic implication for CA FQHCs: every FQHC running OCHIN Epic, eClinicalWorks, NextGen, or athenahealth is squarely in scope. Three protective actions are non-negotiable for FY26-27: (1) document a current Security Rule risk analysis (annual minimum), (2) inventory all Business Associate Agreements with PHI vendors, (3) confirm tested backup-restore procedures. Pairs with the May 11 Section 504 deadline as a one-two compliance hit — and arrives during the same week as the AltaMed cybersecurity incident class action investigation extends into May.

Section 504 / WCAG 2.1AA 'Red Alert' — Enforcement Interpretation May Be Contested in Final Weeks Before May 11

A Converge Accessibility 'Red Alert' published April 22 warns that HHS Section 504 Rule enforcement interpretation 'is in danger' of regulatory contest in the final weeks before the May 11, 2026 WCAG 2.1AA deadline. The underlying non-discrimination obligation has been in effect since July 8, 2024 — but the technical benchmark date is what enforcement hangs on. FQHCs with 15+ employees should NOT bet on a delay: remediate website/mobile accessibility now and document good-faith compliance in case enforcement posture shifts unfavorably mid-year.

HRSA 340B Rebate Pilot Comment Window Closes April 20 — AHA + NACHC File Opposition; Novartis Entresto Plan Active April 1

HRSA's 340B Rebate Model Pilot RFI comment period closed April 20, 2026 with thousands of comments filed — AHA and NACHC both filed formal opposition citing FQHC cash-flow risk. Separately, Novartis launched its Entresto rebate plan effective April 1, 2026 — the 10th drug-manufacturer rebate program implemented before the 4th Circuit's WV SB 325 ruling blocked further restrictions. Cash-flow impact: rebate model shifts FQHCs from upfront drug discount to retroactive reimbursement, requiring 30-90 days of working capital reserve to bridge. CA FQHCs heavily dependent on 340B revenue (AltaMed, FHCSD, San Ysidro, Vista, Asian Health Services) face material liquidity risk if rebate model returns post-rulemaking. HRSA must now reconcile comments before re-issuing.

DOJ Extends ADA Title II Web Accessibility 1 Year — But HHS Section 504 May 11 Deadline UNCHANGED

DOJ published an interim final rule April 20 extending ADA Title II web accessibility deadlines for state/local governments — to April 26, 2027 (50K+ population) and April 26, 2028 (under 50K). Critically, HHS did NOT match: the parallel HHS Section 504 rule still becomes enforceable May 11, 2026 (15 days). AHA News (April 22), Jackson Lewis, and Duane Morris all confirm HHS Section 504 deadlines 'remain unchanged.' Confusion risk: many FQHCs may incorrectly assume the DOJ extension applies to them — it does NOT. FQHCs are HHS-funded entities governed by Section 504, not Title II. Converge Accessibility published an April 22 'Red Alert' suggesting the HHS rule itself may be at risk of reconsideration, but legal advisors continue to recommend assuming the deadline holds.

HRSA Migrating Section 330 Grants From EHB to GrantSolutions — Operational Disruption Risk for All FQHCs

HRSA Bureau of Primary Health Care (BPHC) is migrating the core Section 330 grant lifecycle — submission, review, award, management — from the Electronic Handbook (EHB) to GrantSolutions throughout 2026. PAL 2025-05 documents the phased rollout. Affects every Section 330 grantee — SAC submissions, supplements, change-in-scope filings, post-award reporting, and progressive-action correspondence will all transition to new logins, templates, and workflows. Easy to miss until a deadline lapses. Strategic implication for FQHC operations and grants teams: (1) inventory which staff currently hold EHB credentials and assign GrantSolutions onboarding; (2) screenshot existing EHB submission templates before transition; (3) build a GrantSolutions credentialing checklist into the FY26-27 grants calendar; (4) test new system with a low-stakes filing before any high-stakes SAC or change-in-scope submission. CFO pairing point: parallel disruption with the May 14 May Revision means May–June operational bandwidth is at premium — frontload GrantSolutions onboarding now.

CMS V28 Risk Adjustment Model Fully Phased In 2026 — FQHCs in MA/ACO Contracts Face 10-20% Revenue Cliff Without Coding Upgrade

CMS's V28 risk adjustment model is fully phased in for 2026 — removing approximately 2,000 ICD-10 codes from HCC mapping. FQHCs participating in Medicare Advantage, ACO REACH, or APM contracts (including the new CA APM that went live January 2026) face 10-20% revenue decline if clinical documentation hasn't been retrained for V28-compliant coding. Audit risk if V24 codes still in active use. Compounds with the CA APM January 2026 go-live for global payments. Strategic implication: FQHCs running ECM, complex care management, or chronic disease populations need immediate V28 coding readiness assessment. Most FQHCs underperform on HCC capture vs. peer hospitals — the V28 transition widens that gap.

Vance Anti-Fraud Task Force Suspends 470 LA Hospice + Home Health Agencies — $600M Alleged Fraud, FQHC Referral Path Disrupted

Federal anti-fraud task force suspended 447 hospices + 23 home health agencies in LA County April 15, 2026 — alleged $600M in fraudulent billing. 539% increase in suspensions vs. early April. Indirect FQHC impact: end-of-life care referral pathways are disrupted in LA County, especially for Medi-Cal/Medicare patients who rely on FQHCs for primary care + post-discharge coordination. Federal scrutiny is also intensifying around PPS billing, hospice referrals, and incident-to claims — FQHCs running ECM/CCM programs that interface with hospice referrals face heightened audit attention. Combined with DOJ's National Healthcare Fraud Enforcement Division (already tracked) and the $267M CA AG hospice fraud crackdown, signals an expanding federal-state enforcement posture.

NCQA Issues Temporary Scoring Modifications to Health Equity Accreditation — REL/SOGI Data Requirements Paused

NCQA issued temporary scoring modifications in April 2026 (effective through June 30, 2026) to its Health Equity Accreditation program, narrowly focused on requirements organizations may struggle to meet under shifting federal policy on DEI programs and gender identity data. The modifications affect REL/SOGI demographic data collection, language services, and disparity-reduction requirements — all core CLAS-aligned standards. FQHCs pursuing or maintaining NCQA Health Equity Accreditation should review which scoring elements are paused and recalibrate compliance plans through June 30.

4th Circuit Rules for Pharma: Maryland's 340B Contract Pharmacy Access Law Vacated — State-Level Protections Weakened

The U.S. Court of Appeals for the Fourth Circuit vacated the lower court ruling that had upheld Maryland's 340B contract pharmacy access law, siding with AbbVie, Novartis, and AstraZeneca. The ruling weakens the state-law backstop strategy — where states pass their own 340B protections when federal enforcement stalls. A competing 5th Circuit ruling (upholding Mississippi's similar law) creates a circuit split that may push the issue to the Supreme Court. California FQHCs are protected by H.R. 7391 (340B FQHC Protection Act, 35 cosponsors) at the federal level, but this ruling signals pharma is winning in the courts against state-level protections nationally.

AbbVie Files Landmark Lawsuit to Narrow 340B 'Patient' Definition — Directly Targeting FQHC Contract Pharmacy Arrangements

AbbVie sued HRSA to challenge the 30-year-old 340B patient definition, proposing a four-part test requiring direct care connection, clinical encounter, active care management, and 12-month recency. AbbVie flagged Barrio Comprehensive Family Health Care Center (TX FQHC) — 340B purchases of Humira/Skyrizi/Rinvoq up 119% (2021-2022), 71% dispensed through out-of-state pharmacies. If successful, this would dramatically shrink FQHC 340B eligibility for contract pharmacy and telehealth prescribing. Post-Chevron (Loper Bright) makes this challenge viable for the first time.

California's Largest-Ever Medi-Cal Hospice Fraud Takedown — $267M State + $50M Federal Indictments Signal Enforcement Posture Shift

California DHCS and DOJ announced the largest-ever Medi-Cal hospice fraud takedown: 14 fraudulent hospice providers, $267M in improper claims, plus a parallel US Attorney (Central District) federal indictment of 8 defendants for $50M. No FQHCs named, but the signal matters: transnational criminal networks used stolen patient identities to enroll people in Medi-Cal — meaning FQHCs may see duplicate/fraudulent enrollees that trigger downstream eligibility disputes. DHCS is now investigating 300+ hospices. The House Oversight Committee has demanded documents from Gov. Newsom on hospice oversight. FQHCs should expect heightened DHCS audit activity and re-verify Medi-Cal eligibility at the point of service for 2026.

California AG Dismantles $267M LA Hospice Fraud Ring — 21 Charged; DHCS Signals Intensified Audit Activity for All Medi-Cal Providers

California AG and DHCS dismantled a transnational fraud ring operating 14 fraudulent hospice providers in LA that used stolen Medi-Cal identities to bill $267M in false claims, with 21 charged and $70M+ recovered. While unrelated to FQHCs, this action is fueling federal scrutiny of all California Medi-Cal providers and signals DHCS will intensify audit and identity verification requirements — legitimate FQHCs should expect tighter claims review on crossover claims and dual-eligible billing.

AbbVie Sues HRSA in D.C. District Court Over 340B Patient Definition — Post-Chevron Doctrinal Weapon

AbbVie filed a 72-page complaint April 8 in U.S. District Court for the District of Columbia against HRSA, HHS, Secretary Kennedy, and HRSA Administrator Engels — targeting the 1996 'patient definition' guidance that allows 340B drugs to be dispensed to non-FQHC contract patients. Post-Chevron doctrinal weapon: AbbVie argues HRSA's interpretive guidance lacks force of law. If successful, would dramatically narrow which patients qualify for 340B savings and gut FQHC contract pharmacy revenue. Joins the pending Maine District Court case (AHA + 4 safety-net hospitals, already vacated rebate model in Feb 2026). Combined regulatory + litigation pressure on HRSA's 340B authority is the most concentrated industry challenge in program history.

DOJ Stands Up National Fraud Enforcement Division — Healthcare Billing Now Has a Dedicated Litigating Division

Acting U.S. Attorney General Todd Blanche announced (April 7, 2026) the National Fraud Enforcement Division (NFED) — a stand-alone DOJ litigating division consolidating the Tax Section, Health Care Fraud Unit, and Market/Government/Consumer Fraud Unit under one assistant attorney general. Each U.S. Attorney's office must designate a prosecutor to NFED within 21 days. A new National Fraud Detection Center generates investigative leads from federal financial data — meaning billing anomalies can trigger investigation independent of whistleblower complaints. Combined with FY2025 record $6.8B FCA recoveries (84% from healthcare = $5.7B), 2026 enforcement risk is structurally elevated for FQHCs. PPS billing, incident-to claims, telehealth FQHC distant-site billing, 340B claim integrity, and Anti-Kickback/Stark exposure are all in scope. Strategic action items for CFOs and compliance officers in May–June: (1) refresh PPS encounter documentation review, (2) audit incident-to billing for NP/PA visits, (3) reconfirm 340B contract pharmacy patient-definition compliance, (4) tighten BAA inventory and breach-response runbook (pairs with the OCR ransomware sweep enforcement posture).