The Regulator

8 provisions: that is how many pieces of a major Affordable Care Act marketplace rule a federal judge paused last week, days before they were set to reshape how millions of Americans buy 2027 health coverage. The U.S. District Court for the District of Maryland ruled July 16, 2026 to stay eight provisions of the Centers for Medicare and Medicaid Services’ 2027 Notice of Benefit and Payment Parameters final rule, in a case brought by the City of Columbus and a coalition of other municipalities, local governments and advocacy organizations against Department of Health and Human Services (HHS) Secretary Robert F. Kennedy Jr. The paused provisions, which had been scheduled to take effect July 20, include an expansion of annual out-of-pocket maximums for bronze and catastrophic marketplace plans, broadened eligibility for catastrophic plans, a relaxation of federal network adequacy requirements, and a new pathway letting non-network plans qualify as Health Insurance Marketplace coverage. The court found the challengers were likely to succeed on their claim that the changes violated the Administrative Procedure Act, and that insurers and enrollees would suffer irreparable harm if the provisions took effect while the underlying case proceeds. Confidence: Medium. Trade-press and law-firm reporting on the order is consistent across multiple independent outlets, but this run could not independently retrieve the court’s written opinion, so the docket specifics are not confirmed firsthand. Sources: District court pauses 8 provisions from 2027 notice of benefit and payment parameters final rule, American Hospital Association, Federal court stays key 2027 ACA marketplace rule changes, Norton Rose Fulbright.

290 million dollars: that is the combined sum three of the country’s largest Medicare Advantage insurers say CMS owes them over a star-ratings formula a federal court already found partly illegal, and CMS just appealed rather than pay any of it. The Centers for Medicare and Medicaid Services filed a notice of appeal around July 21, 2026 asking the U.S. Court of Appeals for the Eleventh Circuit to overturn a Georgia federal court’s May 29, 2026 judgment in Clover Insurance Company v. HHS, which found CMS unlawfully used 20 measures to calculate Clover’s 2026 Medicare Advantage star rating, 10 built on data sources the statute does not authorize and 10 adopted without the notice-and-comment rulemaking the law requires. When CMS partially recalculated industry-wide ratings in June using only some of the disqualified measures, it triggered a wave of copycat suits: Elevance Health sued July 1 saying the mismatch will cost it 115 million dollars in 2027 quality bonus payments, SCAN Health Plan sued July 7 calling the ratings system “undeniably broken” and citing 125 million dollars at stake, and Alignment Healthcare followed July 10 seeking 50 million dollars. Confidence: Medium on the ruling’s substance and the dollar figures, since multiple independent trade-press outlets and a law firm client alert corroborate them consistently, but this run’s attempts to pull the underlying court filings directly from CourtListener and Justia were blocked; High on the fact of the appeal and the three copycat suits. Sources: CMS appeals Clover MA stars lawsuit, Healthcare Dive, Elevance sues CMS over $115M Medicare Advantage star ratings dispute, Healthcare Finance News, ‘The system is undeniably broken’: More insurers sue CMS over Medicare Advantage stars, Healthcare Dive.

227 days: that is how long the Eleventh Circuit has sat on a case that could strip whistleblowers of their power to sue over Medicare and Medicaid fraud on the government’s behalf. The U.S. Court of Appeals for the Eleventh Circuit heard oral argument December 12, 2025 in U.S. ex rel. Zafirov v. Florida Medical Associates, LLC, an appeal of a September 30, 2024 ruling by a U.S. District Court for the Middle District of Florida judge that the False Claims Act’s qui tam provisions are unconstitutional under Article II’s Vesting, Appointments and Take Care clauses, the first federal court ever to so hold. As of this issue, more than seven months after argument, no panel opinion has issued. Qui tam suits, brought by private whistleblowers rather than the government, are the mechanism behind the large majority of the federal government’s Medicare and Medicaid fraud recoveries each year, and a ruling either way would bind every False Claims Act case in the circuit and likely head to the Supreme Court. Confidence: High on the procedural history and the underlying constitutional question, since multiple law-firm case trackers and the original district court ruling are independently confirmed; the timing of any decision remains unknown. Sources: Eleventh Circuit Oral Argument Recap: Constitutionality of FCA Qui Tam Provisions, Reed Smith, Zafirov v. Florida Medical Associates LLC, U.S. Chamber of Commerce Institute for Legal Reform.

71 percent: that is the share of Georgia’s pediatric Medicaid therapy network an analysis found could have been squeezed by a rate cut one of the state’s Medicaid managed-care insurers is now only partially reversing. CareSource, one of three companies managing Georgia’s Medicaid program, notified some providers this week that it is formally rescinding a 20 percent reimbursement cut for special-needs therapy services that had been set to take effect May 11, 2026, a reduction that would have taken a clinic billing 65,000 dollars a year down to 52,000 dollars. The reversal is not universal: CareSource is restoring full rates for some providers while leaving others out, and excluded clinics say the uneven rollback still threatens their ability to keep serving children who depend on the therapy. Confidence: High on the rate figures and the partial reversal, since Atlanta News First’s direct reporting on CareSource’s rescission notices is independently corroborated by a Gray Television sister station; Low on how many providers remain excluded or whether CareSource extends the reversal further. Sources: Georgia Medicaid insurer reverses 20% therapy rate cut, but not all providers, Atlanta News First, Ga. Medicaid insurer reverses 20% therapy rate cut, but not for all providers, WRDW.

One sector named by name: that is how directly a joint federal cybersecurity advisory called out healthcare when it warned that Russian state-sponsored hackers are actively targeting the industry’s networking equipment. The Cybersecurity and Infrastructure Security Agency, the National Security Agency, the Federal Bureau of Investigation (FBI) and the Defense Cyber Crime Center, along with international partners, published advisory AA26-194A on Russian Federal Security Service-linked actors exploiting poorly configured or unpatched routers and other networking devices across critical infrastructure sectors, explicitly listing healthcare and public health alongside communications, energy and government facilities. The advisory says stolen router configuration files can hand attackers network topology, VPN settings and credentials well beyond a single device, letting them map hospital networks and maintain long-term access for future espionage or disruption; the agencies recommend restricting management-interface access, rotating credentials on any exposed equipment and segmenting networks to limit how far a breach can spread. Confidence: High on the advisory’s existence, agencies and recommendations, since CISA’s own advisory and multiple corroborating security-press reports confirm them directly; Low on whether any specific U.S. hospital network has already been compromised, since the advisory describes a threat pattern rather than a confirmed breach. Source: Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting, AA26-194A, Cybersecurity and Infrastructure Security Agency.