IHIPAA
Privacy, Security and Breach Notification Rules, 45 C.F.R. Parts 160 and 164. The first cut is whether the company is a covered entity, a business associate, or both. HHS published a proposed Security Rule update on 6 January 2025.
IIStark and the Anti-Kickback Statute
Physician Self-Referral Law, 42 U.S.C. § 1395nn, is strict liability unless an exception fits. The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), is a criminal prohibition on remuneration for federal-program referrals. The civil path for both is usually the False Claims Act.
IIIPayer contracts
The agreement that pays the hospital, the group or the plan. In 2026, 35.2 million people, 55 percent of 64.2 million eligible Medicare beneficiaries, were in Medicare Advantage. MedPAC reported Medicare paid Advantage plans 14 percent more per person in 2026, about $76 billion.
IVM&A and affiliation
Kaufman Hall counted 46 announced hospital and health-system transactions in 2025, $18.5 billion of transacted revenue, and a record 43.5 percent involving a financially distressed party. The GC owns the affiliation, the medical staff and the change-of-control in the payer contracts.
HIPAA is the file that separates a health-system GC from a commercial GC who has "done privacy" as a policy. A hospital or health plan is ordinarily a covered entity. A revenue-cycle company, a telehealth platform that does not bill as a provider, or a software vendor sitting on electronic protected health information is often a business associate, sometimes both. The officer has to know which hat the company is wearing before the breach clock starts. The Privacy, Security and Breach Notification Rules live in 45 C.F.R. Parts 160 and 164. On 6 January 2025, HHS published a proposed rule to strengthen the HIPAA Security Rule (Federal Register, document 2024-30983). A 2026 brief asks whether the candidate has run the Security Rule now in force and has read that proposal. The 6 January 2025 notice is not itself a final rule.
The second file is physician money. The Physician Self-Referral Law, 42 U.S.C. § 1395nn, restricts a physician from referring Medicare patients for designated health services to an entity with which the physician, or an immediate family member, has a financial relationship, unless an exception applies. It is strict liability. Employment, leases, call coverage, medical directorships and value-based arrangements are legal only when an exception actually fits the paper. The Anti-Kickback Statute, 42 U.S.C. § 1320a-7b(b), is the criminal statute: knowingly and willfully offering, paying, soliciting or receiving remuneration to induce referrals of business payable by a federal health care program. Intent is the difference. A counsel who treats the two statutes as one policy memo will sign arrangements that one of them prohibits.
Those statutes reach the board through the False Claims Act. The Department of Justice announced on 16 January 2026 that settlements and judgments under the Act exceeded $6.8 billion in the fiscal year ending 30 September 2025, the highest annual total in the history of the Act, and that over $5.7 billion related to the health care industry. Whistleblowers filed 1,297 qui tam suits in that year, a single-year record. The Department named three areas in which it had continued and expanded its work: managed care, prescription drugs, and medically unnecessary care. The $5.7 billion is federal loss only. State Medicaid recoveries sit on top of it. A hospital GC and a payer GC both live inside that number. They do not live in it the same way. The hospital file is physician arrangements, medical necessity and cost reporting. The payer file is risk adjustment, the bid and the provider contract.
Payer contracts are the third file, and in 2026 they are a Medicare Advantage file for a large share of the market. KFF's analysis of CMS enrollment files, published 5 June 2026 and updated 1 July 2026, found 35.2 million people enrolled in Medicare Advantage, 55 percent of 64.2 million Medicare beneficiaries with both Part A and Part B. Enrollment grew by about 1.1 million people, 3 percent, from 2025. UnitedHealth Group and Humana together accounted for 46 percent of Medicare Advantage enrollment (UnitedHealth 9.3 million, 26 percent; Humana 7 million, 20 percent). The same KFF brief, citing the Medicare Payment Advisory Commission's March 2026 Report to Congress, reported that Medicare payments to Advantage plans in 2026 were 14 percent higher per person than spending for similar beneficiaries in traditional Medicare, about $76 billion in additional federal spending. A GC who has only negotiated a commercial PPO contract has not owned that book.
The paper itself is a participation agreement, a risk deal, a delegation schedule, or a health-system contract with a plan. It allocates prior authorization, medical necessity, prompt pay, the No Surprises Act dispute path, data rights, and what happens to the contract if either party is sold. On the plan side it also includes the bid, the state insurance filing and the risk-adjustment audit. On 30 September 2026 the Department of Justice announced that Independence Blue Cross had agreed to pay $22.5 million to resolve allegations that it retained Medicare Advantage overpayments by failing to withdraw inaccurate diagnosis codes. The same announcement said the government pays private insurers over $530 billion a year for Medicare Advantage, and it stated that the claims resolved were allegations only. One resolution is not a market total. It is the exposure a payer general counsel is hired to own. A provider GC who cannot read the plan's contract will concede economics the CFO thinks legal has already approved.
M&A is the fourth file, and in hospitals it is often an affiliation of a distressed seller rather than a cash auction between two healthy systems. Kaufman Hall's year-end review, published 15 January 2026, counted 46 announced hospital and health-system transactions in 2025. Total transacted revenue was $18.5 billion, of which $9.8 billion came in the fourth quarter. The share of transactions involving a financially distressed party reached 43.5 percent, a record in that series. For-profit organizations were the seller in 11 of the 46 and the acquirer in one. The fourth quarter had 17 announced transactions, including four in which the smaller party's annual revenue exceeded $1 billion. The officer on that deal owns antitrust and state review, bond covenants, medical-staff bylaws, pension and benefit liabilities, the religious or governmental character of the seller where that exists, and every payer contract with a change-of-control clause. A capital-markets GC who has closed a software acquisition has not done this work.
Week 1 names which of the four files the officer owns and which stay with a deputy, a compliance officer or outside counsel. The search that stalls asks for one person who has been the HIPAA security officer, the Stark specialist, the Medicare Advantage lead and the deal lead. That person is a department. Revenue under $50 million usually means one lawyer. Revenue of $50 million to $250 million usually means two to four. A system at $1 billion to $5 billion is briefed at 12 to 18 lawyers, and a system above $5 billion at 25 to 60. Those are the bands we use for any company at that revenue. They are not a hospital census.
