This monthly update highlights key regulatory developments, enforcement trends, and
compliance issues affecting health care providers across the continuum – from solo practices to hospitals and large physician groups. Each section includes practical action items to help you assess risk and prepare for upcoming obligations.

Regulatory Developments

Iowa Medicaid Provider Revalidation Is Underway

Iowa Medicaid has launched a statewide provider revalidation initiative that will continue through June 30, 2028. All enrolled provider types are subject to revalidation, although providers will be contacted in phases based on factors including federal risk category, enrollment age, and data completeness.

Once notified, providers will have 30 business days from the date of the notice to complete and submit required revalidation materials. Failure to timely complete revalidation may result in deactivation of the provider’s Medicaid enrollment, causing claims to be denied until the provider completes revalidation.

Providers should ensure that enrollment and contact information is current and that responsibility for monitoring and responding to Medicaid enrollment communications is clearly assigned.

Action Items

  • Confirm Iowa Medicaid enrollment and contact information is current.
  • Identify who within the organization is responsible for receiving and responding to revalidation notices.
  • Begin gathering current licensure, ownership, and other enrollment information that may be needed for revalidation.
  • Calendar the 30-business-day response deadline immediately upon receipt of a notice.
  • Promptly address enrollment discrepancies or requested updates to avoid potential deactivation.

Contracting Focus

Iowa’s New UIHC Noncompete Law: What It Does—and Does Not—Change

Recent changes involving noncompete provisions at University of Iowa Hospitals & Clinics (UIHC) have generated some confusion. Importantly, the change was not simply a business or institutional decision by UIHC. The Iowa Legislature enacted House File 2254, which was signed by the Governor and became effective June 2, 2026.

HF 2254 amended Iowa Code section 262.9 to require the Iowa Board of Regents to develop a policy prohibiting UIHC from including noncompete clauses in employment contracts with advanced registered nurse practitioners, licensed practical nurses, pharmacists, physicians, physician assistants, and registered nurses. The prohibition applies to covered employment contracts entered into, extended, or renewed on or after June 2, 2026.

Importantly, HF 2254 does not establish a statewide prohibition on healthcare noncompetes. The legislation specifically addresses employment contracts with UIHC. Healthcare organizations outside UIHC should continue to evaluate restrictive covenants under applicable Iowa law and the terms and circumstances of the particular employment relationship.

Action Items

  • Do not assume Iowa has enacted a statewide ban on healthcare noncompetes.
  • Review restrictive covenants when recruiting covered healthcare professionals currently employed by UIHC.
  • Consider whether a UIHC employment agreement was entered into, extended, or renewed on or after June 2, 2026.
  • Continue evaluating restrictive covenants in private healthcare employment agreements under applicable Iowa law.
  • Continue to monitor whether the Iowa legislature broadens this prohibition on healthcare non-competes to other healthcare employers.

Compliance Focus

HIPAA Right of Access Enforcement Continues

On August 27, 2026, the U.S. Department of Health and Human Services Office for Civil Rights (OCR) announced its 55th enforcement action under the HIPAA Right of Access Initiative.

The settlement involved a healthcare provider’s alleged failure to provide an individual timely access to protected health information within the 30-day period required by the HIPAA Privacy Rule. The individual did not receive the requested records until nearly two years after the initial request and after OCR initiated its investigation. The provider agreed to pay $50,000 and implement a corrective action plan that includes policy review, workforce training, and ongoing monitoring.

The enforcement action is a timely reminder that patient record requests should not be treated as purely administrative matters. Organizations should have processes for identifying requests, tracking applicable deadlines, documenting responses, and escalating delays.

Action Items

  • Review policies and procedures governing patient access to medical records.
  • Confirm staff understand applicable response deadlines.
  • Track requests from receipt through completion.
  • Review workforce training regarding HIPAA access requirements.
  • Establish an escalation process for requests that may not be completed timely.

Payer Audits, Claim Denials, and Recoupment Demands Require a Coordinated Response

Healthcare providers continue to face audits, medical record requests, claim denials, and recoupment demands from both government programs and commercial health plans. Although some requests are routine, others can develop into significant reimbursement disputes involving medical necessity, coding, documentation, provider enrollment, contractual interpretation, or audit methodology.

Providers should avoid treating every significant payer request as simply a billing department issue. Before responding to an audit or recoupment demand, organizations should identify the payer’s legal or contractual authority for the review, applicable deadlines, the scope of records requested, and available appeal rights.

Commercial payer procedures vary by payer and contract. Provider agreements and incorporated payer manuals may contain important provisions governing audit rights, repayment, offsets, extrapolation, and appeals. A coordinated response involving revenue cycle, clinical personnel, compliance, and legal counsel when appropriate can help preserve appeal rights and reduce the risk that an initial response creates problems later in the process.

Action Items

  • Establish an internal process for escalating significant payer audits, recoupment demands, and patterns of claim denials.
  • Calendar all response and appeal deadlines immediately.
  • Review applicable payer contracts and provider manuals before responding to significant audit requests.
  • Review responsive records for completeness before production.
  • Preserve relevant correspondence, records, and supporting documentation throughout the audit and appeal process.

FAQ of the Month

Our Claims Are Being Denied. When Does This Become a Legal Issue?

An isolated claim denial can often be addressed through the organization’s ordinary billing and appeal processes. A pattern of denials, however, may warrant broader review.

Providers experiencing repeated denials should consider whether the problem involves individual claims or reflects a broader contractual, reimbursement, enrollment, or regulatory issue. Identifying that distinction early can help determine the most effective response.

Upcoming Deadlines & Reminders

  • Iowa Medicaid Provider Revalidation: The statewide initiative is underway and continues through June 30, 2028. Providers have 30 business days from the date of their individual notice to complete and submit required revalidation materials.
  • Section 504 Accessibility Compliance Deadlines: Recipients of HHS funding with 15 or more employees must comply with applicable web and mobile accessibility requirements by May 11, 2027. Recipients with fewer than 15 employees have until May 10, 2028.
  • HIPAA Claims Attachment Standards – Compliance Deadline: May 26, 2028.
  • Monthly OIG Exclusion Screening: Continue monthly screening against the OIG List of Excluded Individuals and Entities (LEIE).
  • Medicare Revalidation: Continue monitoring CMS notices and applicable enrollment revalidation deadlines.

Disclaimer

The information provided here is for general informational purposes only and does not constitute legal advice. No attorney-client relationship is created by this communication. Parties should consult legal counsel regarding specific questions or implementation decisions.

For questions or assistance, contact Paul A. Drey or Emily E. Reiners of the Brick Gentry P.C. Healthcare & Regulatory Team.