Q1 2026 Healthcare Policy Update: What Private Practices, Health Tech & Digital Health Need to Know Right Now
The first quarter of 2026 delivered more consequential healthcare policy shifts than most full calendar years. Medicare telehealth waivers were extended (again). CMS unveiled a historic GLP-1 coverage program. The FDA launched its most aggressive enforcement campaign against compounded weight-loss drugs in a decade. A new pharmaceutical tariff regime was signed. The White House released an AI legislative framework. And a lawsuit over patient data access through TEFCA raised existential questions about the future of health data interoperability.
Whether you run a private practice, build health tech products, lead a physician group, or operate in digital health, these changes will affect your workflows, revenue, compliance posture, and strategic planning. Here's what happened, what it means, and what to do about it.
1. Medicare Telehealth Flexibilities: Extended Through December 2027
After a rocky ride that included the longest government shutdown in U.S. history (October 1–November 12, 2025), Congress passed the Consolidated Appropriations Act, 2026 on February 3, 2026. The legislation retroactively extended most Medicare telehealth waivers through December 31, 2027.
The practical impact: patients can continue receiving telehealth from home with no geographic restrictions. Audio-only visits remain reimbursable. Expanded provider types — including occupational therapists, physical therapists, speech-language pathologists, and audiologists — can keep furnishing telehealth services. FQHCs and RHCs remain eligible as distant-site providers.
What's permanent vs. what's temporary: Behavioral and mental health telehealth from home, audio-only behavioral health visits, and FQHC/RHC distant-site eligibility for behavioral health are now permanent policy. Non-behavioral telehealth flexibilities remain temporary through December 31, 2027. If Congress doesn't act again, tighter location and practitioner limits return in 2028.
New Telehealth-Eligible Services
CMS also added new services to the permanent telehealth list under the CY2026 Physician Fee Schedule final rule. Multi-family psychotherapy (CPT 90849) and group obesity counseling (HCPCS G0473) are now telehealth-covered — permanent additions with no sunset date. An infectious disease consultation add-on (G0545) and auditory processor codes were also added.
What to do now
Confirm scheduling and billing teams understand that home remains an eligible originating site through 2027 with no rural requirement.
Begin offering group visits (multi-family therapy, obesity counseling) via telehealth using the correct codes (90849, G0473).
Map which patients rely on audio-only telehealth — these services may face scrutiny in 2028 without further legislation.
Start advocacy planning now. The 2027 expiration will arrive fast.
2. GLP-1 Coverage Expansion: The Medicare Bridge & BALANCE Model
On December 23, 2025, CMS announced a two-step plan to expand GLP-1 coverage for weight loss — the most significant Medicare drug coverage expansion in years.
The Medicare GLP-1 Bridge (July–December 2026)
Beginning July 1, 2026, eligible Medicare Part D beneficiaries will gain access to Wegovy or Zepbound for obesity at a $50/month copay. The program operates outside the normal Part D benefit — plans don't opt in, and a centralized CMS processor handles prior authorizations and claims. Eligibility requires BMI thresholds combined with qualifying conditions (heart failure, hypertension, CKD, pre-diabetes, or cardiovascular history).
Two critical details practices need to understand: the $50 copay does not count toward Part D deductible or out-of-pocket maximum, and low-income subsidy (LIS) cost-sharing reductions don't apply. For some patients, this may actually be more expensive than their existing Part D coverage for GLP-1s prescribed for diabetes.
The BALANCE Model (2027+)
Starting January 2027, the CMMI BALANCE Model will offer GLP-1 coverage through participating Part D plans (Medicaid access begins May 2026 in opt-in states). But CMS has set an 80% Part D plan participation threshold — if it isn't met, the Medicare component won't launch in 2027. Patients on the Bridge will need to be enrolled in a participating plan to maintain coverage, potentially requiring a plan switch.
Coverage continuity risk: There is a realistic scenario where patients gain GLP-1 access under the Bridge in mid-2026 but lose it in January 2027 if the BALANCE model doesn't launch or their plan doesn't participate. Counsel patients about this during enrollment.
What to do now
Review the GLP-1 Bridge PA criteria and establish workflows for the centralized CMS processor (not the usual Part D channel).
Differentiate care pathways: patients on GLP-1s for diabetes stay on existing Part D coverage; only obesity-specific use goes through the Bridge.
Monitor the 80% threshold — CMS expects to notify plans by April 30, 2026.
3. The GLP-1 Enforcement Crackdown: FDA, FTC, DOJ & Novo Nordisk
This is arguably the most consequential development of Q1 2026 for anyone in telehealth or weight management. The federal government has coordinated enforcement against compounded GLP-1 products at unprecedented scale.
FDA: 30 Warning Letters and Counting
On March 3, 2026, the FDA issued 30 warning letters to telehealth companies for misleading marketing of compounded GLP-1 products. This was the second major wave — the agency has now sent thousands of letters in six months, more than in the entire preceding decade. Commissioner Marty Makary stated the agency is taking action against companies that imply compounded products are equivalent to FDA-approved drugs or obscure the identity of the actual compounder.
The Hims & Hers Saga
The highest-profile enforcement story unfolded in rapid sequence:
February 5: Hims launches a $49/month compounded oral semaglutide pill
February 6: HHS refers Hims to the DOJ for potential criminal violations of the Federal Food, Drug, and Cosmetic Act
February 6: FDA announces it will take "decisive steps" to restrict GLP-1 APIs used in compounded products
February 9: Novo Nordisk sues Hims for patent infringement, seeking a permanent ban on compounded product sales
February 8–9: Hims pulls its compounded pill from the market
March 9: Novo drops the lawsuit after Hims agrees to sell branded Wegovy and Ozempic and stop advertising compounded GLP-1s
The SEC also disclosed an investigation into Hims's public disclosures about its compounded semaglutide business. The company faces simultaneous DOJ, FDA, and SEC scrutiny.
FTC: The NextMed Precedent
In December 2025, the FTC finalized its order against NextMed for deceptive GLP-1 advertising — including hidden costs, fake testimonials, fabricated before-and-after photos, and suppression of negative reviews. The $150,000 penalty was modest, but the case established that the FTC will use its full consumer-protection toolkit against telehealth companies marketing weight-loss drugs.
If your practice prescribes, markets, or is affiliated with any compounded GLP-1 products, you are operating in a high-enforcement environment. Audit your marketing immediately. Verify compounding pharmacy relationships. Ensure prescribing decisions are clinician-driven — not marketing-driven.
4. Pharmaceutical Tariffs and What They Mean for Compounding
On April 2, 2026, President Trump signed a Section 232 proclamation imposing up to 100% tariffs on imported patented pharmaceutical products and active pharmaceutical ingredients (APIs). This is the most significant trade action targeting pharmaceuticals in modern history.
The structure
According to the White House fact sheet, the tariff framework is tiered:
100% baseline tariff on patented pharmaceutical imports and APIs (for companies without trade deals)
15% tariff for products from EU, Japan, South Korea, and Switzerland (trade deal countries)
0% tariff for companies that sign both MFN pricing agreements with HHS and onshoring commitments with Commerce
20% tariff for companies with onshoring agreements only
Generic drugs, biosimilars, and their ingredients are currently exempt — but subject to reassessment within one year
The effective dates are staggered: July 31, 2026 for large companies listed in the proclamation's Annex III, and September 29, 2026 for all others.
What this means for compounding pharmacies and practices
Here's where it gets complicated for anyone in the compounding space. The tariffs apply to patented APIs — and the proclamation specifically covers associated pharmaceutical ingredients. That means:
API cost increases are coming. Approximately 85% of patented APIs by volume are produced abroad. Compounding pharmacies sourcing patented APIs from India, China, or non-trade-deal countries could face dramatically higher input costs. A Johns Hopkins study estimated a 100% worldwide API tariff would raise prices approximately 30% on average.
Compounders using semaglutide or tirzepatide APIs already face massive regulatory risk from the FDA crackdown. Now add potential tariff exposure on the raw ingredient itself. The economics of compounded GLP-1s are getting squeezed from both sides.
The generic exemption may not last. The proclamation directs a reassessment of generic drug tariffs within one year. Compounding pharmacies that source unpatented ingredients may be safe for now, but this is a moving target.
Supply chain disruptions are already being flagged across the industry. Practices that depend on imported specialty compounds should start identifying alternative domestic sources and assessing inventory resilience.
Bottom line for practices and health tech companies: If you're involved in compounding, prescribing compounded drugs, or building platforms that facilitate compounded medication access, the combined impact of FDA enforcement + pharmaceutical tariffs + patent litigation is creating an environment where the risk/reward calculus is shifting rapidly. Talk to your supply chain partners and healthcare counsel now — not after the tariffs take effect.
5. The TEFCA Data Fight: Epic vs. Health Gorilla and What It Means for Interoperability
If you work in health tech or digital health, this is the story that should be keeping you up at night — not because of the lawsuit itself, but because of what it reveals about the structural vulnerabilities in our national health data infrastructure.
What happened
On January 13, 2026, Epic, OCHIN, Reid Health, Trinity Health, and UMass Memorial Health filed a federal lawsuit against Health Gorilla — a designated Qualified Health Information Network (QHIN) under TEFCA — and several affiliated entities including RavillaMed, LlamaLab, Mammoth, Unit 387, SelfRx, and GuardDog Telehealth.
The core allegation: Health Gorilla's clients posed as healthcare providers to access approximately 300,000 patient records through the Carequality and TEFCA interoperability frameworks — then used that data not for treatment, but to market records to personal injury law firms for mass tort recruitment. The complaint alleges the entities used fake provider IDs, shell websites, and clinically useless documentation to maintain the illusion of legitimate patient care.
The GuardDog admission
On March 18, 2026, defendant GuardDog Telehealth admitted to improper access and agreed to be permanently barred from TEFCA and Carequality participation, and to delete all patient data obtained from the frameworks.
Health Gorilla denies the allegations and characterizes the lawsuit as a competitive tactic by Epic to maintain monopolistic control over health data exchange. The company retained Quinn Emanuel — the same firm representing Particle Health in its ongoing antitrust case against Epic.
The Particle Health antitrust case
This isn't the only lawsuit on Epic's docket. In September 2024, Particle Health filed an antitrust lawsuit alleging Epic uses its EHR monopoly power to block competition in the payer platform market. In September 2025, a federal judge denied Epic's motion to dismiss the core monopolization claims — the first time an antitrust case against Epic has survived this stage. The case is now in discovery. Texas AG Ken Paxton also sued Epic in December 2025 for monopolistic control over the medical records market.
Why this matters beyond the courtroom
The deeper issue is structural. Both TEFCA and Carequality operate on a distributed trust model: once a participant is listed in the directory, other participants must release records for treatment queries. QHINs like Health Gorilla are responsible for vetting their connections, but the frameworks themselves don't independently verify every participant or every query.
As one industry analyst put it: the parties best positioned to prevent fraud have minimal incentive to do so, while the parties harmed by fraud lack real-time detection capability. This is a textbook governance gap — and it exists at the foundation of the national interoperability infrastructure that TEFCA was supposed to secure.
Some Epic customers have already said they may limit or withdraw from TEFCA and Carequality participation because of these concerns. If that happens at scale, the promise of seamless, universal health data exchange takes a serious hit.
What to do now
Digital health companies connecting through TEFCA or Carequality: review your vetting processes for downstream participants. Document your compliance controls. The bar for what constitutes adequate participant verification is about to rise significantly.
Practices and health systems: audit your data exchange logs. Understand which QHINs and implementers are accessing your patient data and for what stated purpose.
Health tech builders: if you're building on interoperability infrastructure, factor in the possibility of stricter governance requirements and potential framework disruption. The trust model that enables frictionless data exchange is under real stress.
6. AI Federal Policy: The White House Framework and What's Coming
On March 20, 2026, the White House released a National AI Legislative Framework with recommendations across six areas: child safety, community protection, free speech, intellectual property, innovation, and workforce development.
For healthcare, the most consequential element is the push for federal preemption of state AI laws. States like Colorado, California, and New York already have AI-specific statutes in effect or pending. The framework calls for Congress to establish a unified national standard — but it's a nonbinding recommendation, not enforceable law. Concurrently, the TRUMP AMERICA AI Act (a 291-page discussion draft from Sen. Blackburn) would codify many framework goals, including bias audits for high-risk clinical AI and new liability standards.
Existing FDA and HIPAA oversight is preserved under all current proposals. But the signal is clear: if you deploy AI tools in clinical workflows — diagnostics, triage, imaging analysis, decision support — documentation, validation, and bias auditing requirements are coming.
AI billing codes are live now
The AMA has added Category III CPT codes for AI-augmented services, including 0902T for AI-assisted EKG analysis and codes for AI echocardiogram interpretation. Use these when billing for physician-supervised AI-assisted diagnostics.
What to do now
Inventory all AI/algorithmic tools in use across your organization. Document validation and FDA clearances.
Review patient consent forms to ensure they cover AI-assisted processes.
Adopt the new AMA CPT codes to capture reimbursement for AI-augmented diagnostics.
Monitor the federal framework's legislative progress — early action is expected in 2026.
7. Behavioral Health: 988 Funding, Tele-BH Rules & Addiction Treatment
On January 13, 2026, SAMHSA announced a $231 million funding opportunity to administer the 988 Suicide & Crisis Lifeline, which handled over 8 million contacts in 2025. The network includes more than 200 local crisis contact centers.
Long-term funding stability is less certain. Only 11 states have implemented telecommunications fees to support 988, and states are scrambling to identify sustainable funding sources amid questions about continued federal support.
On the clinical side, Medicare has permanently made tele-behavioral health visits available from home with no geographic restrictions. Marriage and family therapists and mental health counselors gained Medicare billing eligibility in January 2024 and can provide telehealth services under these expanded rules. CMS also now allows OTPs to provide methadone and counseling via telehealth, and patients can initiate buprenorphine treatment via audio-video (G2076).
8. Remote Patient Monitoring: New Codes and Billing Flexibility
The 2026 Medicare PFS introduced shorter-duration RPM codes (CPT 99445, 99454 for 2–16 device readings) and clarified that monitoring time and device readings can be billed separately. Practices can bill RPM time codes (99457/99458) and device transmission codes together when criteria are met.
Audit your RPM/CCM billing workflows. Deploy the new shorter monitoring codes. Reconsent patients (99453) when restarting a monitoring program.
Key Dates to Watch
DateEventApr 30, 2026CMS notifies plans on 80% BALANCE participation thresholdJul 1, 2026Medicare GLP-1 Bridge demonstration launchesJul 31, 2026Pharma tariffs take effect for large companies (Annex III)Sep 29, 2026Pharma tariffs take effect for all other companiesJan 1, 2027CMMI BALANCE Model begins in Medicare Part D (if threshold met)May 2027Medicaid BALANCE Model begins (participating states)Dec 31, 2027Extended Medicare telehealth flexibilities expire
Sources & References
All claims in this post were verified against primary sources. Key references include:
FDA — 30 Warning Letters to Telehealth Companies (March 2026)
White House — Section 232 Pharmaceutical Tariff Proclamation (April 2, 2026)
Disclaimer: This post is for informational purposes only and does not constitute legal, regulatory, or financial advice. Consult qualified counsel for guidance specific to your organization. Policies and timelines described are subject to change as legislation, rulemaking, and litigation evolve.
Questions about how these changes affect your practice, platform, or organization? Contact Camino Strategy.
