Top healthcare litigation, compliance, and investigation concerns going into 2027

The enforcement and regulatory landscape facing healthcare and life sciences organizations has never been more volatile, or more consequential. During Health Litigation, Compliance, and Investigation Forum 2026 in October, we cut through the noise to offer practitioners and policymakers space to discuss what’s next. Here are ten takeaways from the event.

1. Enforcement is aggressive but increasingly unpredictable under the current administration.

False Claims Act (FCA) enforcement remains “very hot,” with civil investigative demands and subpoenas arriving swiftly. At the same time, the second Trump administration has also introduced significant enforcement unpredictability. Massive turnover at the US Department of Justice (DOJ) has disrupted the trajectory of investigations. Matters can lie fallow for long stretches without resolution, and personnel shakeups might happen mid-case. This uncertainty can create challenges for organizations trying to make decisions about transactions, board communications, and investor relations.

2. The definition of “fraud” is expanding beyond traditional billing and kickback schemes.

Government enforcers are increasingly including nontraditional issues under the “fraud” umbrella, such as diversity, equity, and inclusion; gender-affirming care; and cybersecurity. To assess new certifications and policy changes that can trigger FCA exposure, healthcare organizations must now track a broader and shifting set of enforcement priorities; follow executive orders closely; and mobilize rapid-response teams that include legal, compliance, government relations, and communications.

3. CMS has emerged as a more active and powerful enforcement player, sharing exclusion authority with the OIG.

The Centers for Medicare & Medicaid Services (CMS) is exercising its suspension and revocation authority earlier, more often, and on less complete information. The agency has openly stated a willingness to “act faster with less” and work through mistakes later. CMS also has been granted shared exclusion authority with the Office of Inspector General (OIG), which held that power exclusively for the last three decades. CMS’s expanded role creates significant new complexity in settling FCA matters. Organizations must now seek comfort regarding CMS exclusion risk even when negotiating with DOJ and OIG, because it remains unclear how CMS and OIG will interact on corporate integrity agreements.

4. Data mining and AI play a central role in the government’s identification of enforcement targets.

CMS and OIG meet weekly to review “heat maps” generated from claims data, using artificial intelligence (AI) to process millions of claims daily and flag outliers (e.g., spikes in specific Current Procedural Terminology code utilization). Organizations should proactively monitor their billing data and analyze anomalies quickly. Elevating physician leadership in revenue integrity is also paramount. When the government comes knocking, the ability to promptly and clearly explain why the organization bills certain codes at certain volumes can steer an investigation onto the right track.

5. Effective investigations require early decisions on scope, ownership, and the in-house/outside counsel divide.

Determining whether an investigation is needed, and who should run it, should happen at the outset. Reputational risk and the sensitivity of internal dynamics (e.g., investigating a peer or C-suite member) drive the decision to engage outside counsel. Outside counsel can bring objectivity, especially in politically charged or multi-stakeholder environments. Meanwhile, in-house counsel provides institutional context: company culture, reporting relationships, the “who’s who,” and key subject matter experts. Setting clear expectations on scope, budget, and communication cadence early prevents surprises for both the legal team and the CFO.

6. Privilege should be built, taught, and actively maintained.

Organizations should conduct formal privilege training for executive teams and business stakeholders, not just ad hoc education in the moment. Upjohn warnings should be delivered clearly and documented in interview memos, and they should name all individual counsel in the room, both inside and outside, rather than simply naming the law firm. Work product doctrine requires a substantial and significant threat of litigation. The general counsel/CCO dual-hat structure can create privilege and personal-liability risks.

7. Compliance programs should be operationalized, not just documented.

A compliance program that lives in a binder on a shelf is a fictitious program. True effectiveness requires understanding the business deeply, integrating compliance into workflows, and following through on corrective action promptly. Audit functions that identify problems but never fix them can be dangerous, because they may demonstrate to the government that an organization knew about a problem and did nothing. Private equity sponsors are increasingly being targeted for exactly this pattern: identifying diligence findings, sitting on boards, and taking no corrective action.

8. Compliance should be a strategic enabler, not a “no” function.

When compliance is perceived as the department that always says no, the business often finds workarounds, and a culture of mistrust can take root. Effective compliance leaders position themselves as business partners who help find the path to “yes” by understanding the business objectives and integrating compliance into decisions early. Compliance can be a tool for creating and protecting enterprise value, including deal multiples, not just a cost center. The most effective compliance professionals combine legal or clinical training with deep business understanding, enabling them to issue-spot and partner strategically.

9. AI is ubiquitous and can create liability the organization ultimately owns.

Use of AI tools, including ambient scribes, claims-processing algorithms, and even workforce members copying and pasting protected information into ChatGPT, is already pervasive in healthcare. From a litigation and enforcement perspective, the organization is responsible for AI output just as it is for a human employee’s work. “We didn’t know how the tool worked” is not a defense. Key risk areas include anything that touches money, hiring and human resources, or patient care. Effective governance requires a multidisciplinary committee, approved-tool inventories, technical blocking of unapproved tools, contract re-review to catch AI add-ins in existing vendor agreements, and stratified risk assessment based on reversibility (e.g., incorrectly scheduling an appointment versus discarding an embryo based on a flawed predictive model).

10. AI risk creates new uncertainty in insurance, vendor liability, and regulatory patchwork challenges.

Cyber insurance is new and not designed to absorb AI-related professional liability risk, yet vendors routinely demand to be added to cyber policies without understanding the mismatch. Organizations should proactively work with brokers on AI-specific coverage questions and be careful about representations made during policy renewals (e.g., attesting that no AI was used when a third party used it on an organization’s behalf). Meanwhile, AI regulation is emerging primarily at the state level, creating a patchwork of varying rules. Multi-state organizations face the difficult task of determining which state laws apply, and definitions are often unclear. Vendor data-use terms have grown more creative, with increasing demands for de-identified, aggregated, or “feedback” data rights that carry significant downstream privacy and intellectual property risk, making data governance a first-order concern in any AI contracting review.