In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walked you through what happens when your employees are contacted by investigators. Part Three will guide you throughout the investigatory process.

In this three-part series, we investigate the duties of SUD providers under Part 2 in the face of subpoenas and investigations. Part One discussed the contours of the duties in the face of a subpoena, while Part Two walks you through what happens when your employees are contacted by investigators.

Part 2 increases protections for SUD patient records because of the stigma and legal consequences associated with substance use treatment. Protecting patient records serves an important public health interest, because weakening confidentiality discourages patient participation in treatment. Federal courts have enforced Part 2 to protect patients. The increased privacy protection for substance use treatment was originally intended to prevent prosecution of patients in active treatment programs, and it still does. While Part 2 is not a new regulation, it did undergo major changes when the 2024 Final Rule was adopted on April 16, 2024 (with a two-year implementation period). Enforcement for the updated Part 2 rules began on February 16, 2026, when the HHS Office for Civil Rights (“OCR”) launched a civil enforcement program and began accepting complaints alleging Part 2 violations and breach notification violations.

With the OIG’s May 30, 2025, announcement that they are seeking $454.4 million in funding to fight healthcare fraud, healthcare providers can expect increased governmental scrutiny despite Trump’s budget cutbacks and staff layoffs.  The OIG justifies its budget request by pointing out that for every $1 invested, there is an expected return of $11 in government recoveries and receivables, which fuels the Trump administration’s fight on fraud, waste, and abuse in health care. What this means for health care providers is intensified scrutiny and likely use of AI as a tool to evaluate big data to identify potential false claims, fraud, outliers, etc. Considering the OIG’s 90-page new General Compliance Guidance, healthcare providers’ self-policing strategies and internal audits are more important than ever as the heat turns up on alleged fraud and false claims.

The landscape of diversity, equity, and inclusion (DEI) in healthcare is undergoing a seismic shift following recent executive orders (EO) issued by President Donald J. Trump. The order, titled "Ending Illegal Discrimination and Restoring Merit-Based Opportunity," aims to eliminate DEI initiatives within federal government agencies and private companies contracting with the government. This policy shift presents significant legal and operational challenges for healthcare providers, particularly those relying on federal funding.

As of January 1, 2025, medical cannabis is legal in Kentucky. Physicians and nurse practitioners who want to create access for their patients to this important treatment must become authorized to certify patients for medical cannabis and should be extremely careful to comply with confusing and complex regulatory requirements.

Traditionally, the Office of the Inspector General for the U.S. Department of Health and Human Services (“OIG”) would take a hard stance on any arrangements that might involve some form of remuneration from a hospital to a referring physician, but the winds of change may be blowing. In Advisory Opinion 22-20, published in December of 2022, the OIG has given a green light, albeit in a limited context, to an arrangement in which a hospital may have its employee nurse practitioners perform some services traditionally performed by the patients’ primary care physicians. This is a small step in the direction of a more flexible OIG stance on the federal Anti-Kickback Statute (“AKS”), but it doesn’t completely sidestep risks.

It may seem like hair-splitting, but including the wrong diagnostic codes for malnutrition on hospital inpatient claims – using codes for severe malnutrition in place of other forms of malnutrition – is a costly mistake. The estimated overpayment as a result of these coding errors is a reported $1 billion. Because the payment error rate was so high at a colossal 31%, Medicare-Severity Diagnosis Related Group ("MS-DRG") applicable entities must take note and prepare for a marked increase in Department of Health and Human Services Office of Inspector General ("OIG") audits for these coding practices. The Centers for Medicare & Medicaid Services ("CMS") also plans to implement review practices for malnutrition coding on a sample of inpatient claims. The increased payer audits will result in severe financial damage for hospitals and other MS-DRG applicable entities if they do not mitigate coding and documentation risks.

Since the implementation of House Bill 1 in 2012, the restrictions on prescribing controlled substances have become more and more stringent, which is a response to the opioid epidemic sweeping Kentucky and the nation. The Cabinet for Health and Family Services, the Kentucky Board of Medical Licensure, the Kentucky Board of Nursing, and the Kentucky Board of Pharmacy are vigilant in policing prescribing practices and have tools through KASPER to closely monitor the prescribing practices of physicians and other practitioners. With the addition of new medications like Gabapentin to the controlled substances hit list, practitioners must be particularly careful to ensure that their prescribing is consistent with regulatory requirements, particularly when patients have been on this medication previously.   Physicians and practitioners must continually monitor compliance as even a minor violation can give rise to investigations, complaints and regulatory penalties.  Assessment of regulatory penalties, even when characterized as “Agreed Orders,” can have devastating consequences for physicians and practitioners’ practices and ability to maintain provider contracts, including Medicare and Medicaid.

Billing for medical services is never easy. Despite attempts by the Centers for Medicare & Medicaid Services (“CMS”) to simplify the rule regarding “incident to” billing for Medicare services, it remains misunderstood by a large swath of providers. This proves problematic, as incorrect billing practices may lead to overpayments and False Claims Act violations. Billing for “incident to” services is an important mechanism to reflect the actual value of mid-level services provided under the specific plan of a physician. When properly followed, the “incident to” rules allow physicians to bill for services provided by non-physician practitioners as if they were performed by the physician at physician reimbursement rates. Additionally, the non-physician provider can be an employee, an independent contractor or even a leased employee, provided that they are supervised by a physician and the requirements are met. Because of the confusing nature of allowing a physician to bill for services he or she did not directly provide to the patient, serious landmines exist that can create problems if the rules are not scrupulously followed and documented.