Medicine and the Law

The Regulatory Outlook

Fraud Risks, Legislative Wins and a Path Forward

BY David Holt, JD

Attorneys and compliance officers often find themselves in a precarious position during this festive season. They are tasked with reminding clients of the risks of fraud, waste, and abuse (FWA), audit trails and regulatory pitfalls just when organizations want to focus on growth, bonuses and patient care. It is a necessary friction.

Looking toward 2026, however, the regulatory landscape is not merely a list of new threats. While the environment remains perilous for the unprepared, there are genuine legislative developments that Minnesota practitioners should view as victories. The legislature has responded to the collective concerns of the provider community regarding administrative burden and professional well-being.

The following analysis breaks down the current landscape into three distinct categories: the current enforcement trends practitioners must watch, the new Minnesota laws that offer relief and the proactive compliance steps necessary to navigate the coming year.

The Enforcement Landscape: FWA Trends

Federal and state regulators do not take holiday breaks. The Department of Justice (DOJ) and the Office of Inspector General (OIG) have signaled aggressive enforcement priorities for 2025 and 2026.

For Minnesota practitioners, the risks are local, specific and higher than ever. The era of “pay and chase” is evolving into “predict and prevent,” utilizing data analytics that rival those of major tech firms. Several key trends are currently driving enforcement activity.

A practice cannot outsource its compliance risk.

Third-Party Risk and Oversight While the “Feeding Our Future” scandal primarily involved child nutrition funds, its shockwaves are felt across all government-funded sectors in Minnesota, including health care. This case serves as a massive red flag regarding the systemic failure of oversight.

The crux of this fraud was a failure to validate whether services were actually provided. Money flowed to entities that claimed to be serving thousands of units with little to no physical verification. For health care providers, this translates to renewed, aggressive scrutiny on third-party billing and partnerships.

Regulators are operating under the assumption that if oversight failed in one state sector, it is likely failing elsewhere. The Minnesota Department of Human Services (DHS) and other state agencies are under immense pressure to prove they are monitoring the flow of funds.

If a practice works with Management Services Organizations (MSOs), external billing companies or aggressive marketing firms, it is effectively “sponsoring” their conduct. The legal doctrine of vicarious liability means a practice cannot outsource its compliance risk.

Regulators in Minnesota are hypersensitive to entities that bill for high volumes of services with little direct oversight. If a physician serves as the medical director of a clinic where they rarely see patients, or signs off on charts prepared by a third-party vendor without reviewing them, they are in the danger zone. If a provider’s name is on the claim, the provider owns the risk, even if a vendor prepared it. The defense of “the biller did it” is treated with decreasing leniency in the current climate.

Medical Directors and Facility Oversight A specific and growing area of risk involves physicians who serve as medical directors or consulting providers for facilities such as nursing homes, hospices or inpatient treatment centers.

There is a tendency for physicians in these roles to be “painted with a broad brush” by regulators. Even well-intentioned doctors who have little to do with the day-to-day operations of an assisted living or hospice facility can suffer significant legal and reputational damage if illegal activities occur under their watch.

A common scenario involves the “rubber stamping” of orders or reviews. For example, psychiatrists visiting inpatient treatment facilities for medication management reviews often face enormous pressure to sign off on dozens of client charts in a single afternoon. If a physician signs off on these reviews without genuinely assessing the patients, perhaps assuming the facility’s staff has managed the details correctly, they risk allegations of billing for services not rendered or services that lack medical necessity.

This aligns with the government’s aggressive use of the “Worthless Services” theory of liability. Under this theory, the government argues that if the care provided, or the oversight exercised, was so substandard or deficient that it effectively amounted to no care at all, billing Medicare or Medicaid for it constitutes fraud.

This is being applied aggressively in hospice care, for example, if providers are admitting patients who are not terminally ill, or failing to provide the palliative care required by the hospice benefit. Another area of potential concern involves inpatient treatment where physicians may be billing for medication management or supervision when they were not physically present or did not perform a substantive review.

If a provider operates in these spaces, clinical documentation must prove not only that the service happened, but that the quality and necessity of that service were verified by the billing physician.

Telehealth and High-Cost Anomalies Nationally, the “honeymoon phase” of telehealth enforcement is over. During the public health emergency, regulators offered flexibility to ensure access to care. That grace period has expired.

The OIG’s 2025/2026 Work Plan explicitly targets telehealth schemes, using sophisticated data mining to find statistical anomalies. Regulators are looking for the “impossible day,” where providers bill for more than 24 hours of time-based services in a single day.

However, they are also looking for subtler patterns, particularly regarding Evaluation and Management (E/M) upcoding.

The Minnesota Department of Human Services has admitted to flagging unusually high billing trends. In response to broader oversight concerns, the state has implemented a new third-party audit system. This system is designed to catch outliers faster than ever before. If a provider is billing high-complexity codes, like 99215s, at a rate significantly higher than their peers, or billing for prolonged services without metadata to support the duration of the call, an audit is inevitable.

Additionally, kickbacks remain a priority. There is a crackdown on arrangements where telemedicine companies pay providers specifically to order durable medical equipment (DME) or genetic testing, such as high-cost PCR panels, without a valid patient relationship. Receiving a per-chart fee to review records and order equipment for patients never examined is a priority enforcement area.

Legislative Relief: Wins for Minnesota Providers

Despite the heightened scrutiny, the 2024 Minnesota legislative session produced some of the most provider-friendly changes seen in years. These structural changes are designed to reduce administrative burden and improve the quality of professional life.

Practices must know who is touching their money and their data.

Prior Authorization Reform After years of advocacy, Minnesota passed a sweeping Prior Authorization (PA) reform law. Although the full weight of the law takes effect in 2026, the transition begins now, and the changes are significant.

Among them, health plans will be prohibited from requiring PA for sensitive areas of care, including outpatient mental health services, substance use disorder treatment and cancer treatments consistent with national guidelines. This removes the barrier between a patient in crisis and the help needed.

The law also mandates tighter timelines for PA decisions. The timeline for urgent medication requests drops to 48 hours. Furthermore, once a PA is approved for a chronic condition, it generally cannot be revoked or require frequent re-approval. This aims to spare patients and staff from the “monthly approval dance” that wastes thousands of administrative hours.

This law directly attacks a major source of administrative burnout and signals a legislative shift in power back to the provider’s clinical judgment.

Physician Well-Being and Credentialing Another significant victory is the new law regarding credentialing and mental health. For decades, physicians and other providers have avoided seeking mental health treatment due to the fear that answering “yes” to intrusive credentialing questions would trigger investigations and jeopardize their licenses or hospital privileges. These questions are often asked broadly if a provider had ever been treated for a mental health condition.

The new Minnesota law prohibits health systems and licensing boards from asking about past or current health conditions unless they currently impair the provider’s ability to practice.

This distinction shifts the focus from “illness” to “impairment.” A provider can have a diagnosis and be in treatment, and as long as they can perform their job safely, it is not a matter for the credentialing committee. This step reduces stigma and encourages a healthier workforce, which ultimately protects patients better than the punitive systems of the past.

Reimbursement Adjustments The legislature also authorized reimbursement increases for specific sectors under Medical Assistance (MA), including mental health and dental services. While higher rates across the board are always desired to match inflation, these targeted increases acknowledge the critical shortage of access in these areas. By boosting these rates, the legislature is attempting to shore up the safety net for the state’s most vulnerable populations.

Moving Forward: Proactive Compliance as a Strategy

The bridge between the risks of enforcement and the rewards of legislative reform is compliance.

While often viewed as a burden, or the “vegetables” of the health care dinner table, compliance is no longer just a shield. It is a strategic advantage. In light of the “Feeding Our Future” scrutiny and the new PA laws, proactive compliance is the only safe bet in a volatile environment.

Building a robust compliance program does not just avoid fines. It builds the infrastructure necessary to utilize the new laws. For example, providers cannot benefit from faster PA turnaround times or PA bans if internal documentation is so poor that the insurer denies the claim for “lack of medical necessity” instead of “lack of PA.”

Furthermore, with the governor’s new third-party audit system coming online, the ability to self-audit and correct errors before the state finds them is the difference between a simple refund and a fraud investigation.

Actionable Steps for 2026

To make this practical, Minnesota health care practices should consider taking four specific steps before the first quarter of 2026.

The “Vendor Scrub” Practices must know who is touching their money and their data. It is important to review contracts. Pull every contract with a third party that touches billing, coding or the revenue cycle. Check to ensure a valid, up-to-date Business Associate Agreement (BAA) is in place.

It can be very helpful to conduct your own audit action. Select 10 random claims processed by an external biller and trace them back to the medical record. Did the service happen? Is the documentation there? Is the code correct? If a discrepancy is found in a sample of 10, statistically, a systemic problem likely exists. Documenting this audit serves as a “Good Faith” defense if regulators ever investigate.

Update Credentialing Forms Peer review committees, practice owners and HR managers must revise questionnaires immediately.

It is vital to review initial application and renewal forms. Look for questions asking about “any past mental health treatment” or broad questions about “conditions.” If you find these terms, remove them. Replace them with legally compliant language that focuses strictly on current impairment and the ability to perform the essential functions of the job. Failure to do this could expose the organization to discrimination claims under the new state law.

Prepare for PA Data Collection The new PA reform law includes reporting requirements for payers, but providers should not rely on payers to police themselves. It is advisable to start tracking PA denial rates and turnaround times now. Create a simple dashboard: date requested, date responded, outcome and reason. When the law fully kicks in, these longitudinal data will be necessary to prove if a payer is noncompliant with the new 48-hour mandates.

Risk Assessment Conducting a formal risk assessment is a requirement for HIPAA and a best practice for general compliance, yet it is frequently overlooked in private practice. To do this, gather practice leaders, such as the administrator, medical director and IT Lead, for a brief strategy session. Identify what keeps the leadership up at night. Common answers include employee theft, data breaches, audit risk or unhappy staff. Document these risks, rank them by likelihood and impact and create a plan to address the top three. Documenting this meeting counts as a “compliance activity” and demonstrates a culture of compliance.

Conclusion

As the industry heads into 2026, the message for Minnesota health care practitioners is one of cautious optimism.

The government is watching where the money goes more closely than ever, fueled by the fallout of past scandals. The risks of audits and allegations of “worthless services” are real, particularly for physicians supervising facilities.

Yet, the regulatory environment is also shifting. The new prior authorization reforms and well-being laws are victories for the sanctity of the doctor-patient relationship and the mental health of the workforce. They are recognition that the system requires repair.

The smartest move this season is to tighten internal controls immediately. Auditing partners, cleaning up documentation and refreshing compliance plans may not be festive activities. Ensuring a practice is audit-proof, however, provides the peace of mind necessary to truly enjoy the holidays.

David Holt, JD, is the CEO of Holt Law, a firm focusing on health care law with offices in California and Minnesota.