Regulations in healthcare are the federal and state rules that govern how medical care is delivered, how patient information is protected, how providers and facilities get paid, and how the whole system is held accountable when something goes wrong. They set the floor for what a hospital, doctor, insurer, drug maker, or pharmacy is allowed to do, and they carry real teeth: fines, loss of license, exclusion from Medicare and Medicaid, and in the most serious cases, prison. The rules exist because the stakes are unusually high. A billing error can defraud a public program of millions. A careless disclosure can expose the most private details of a person’s life. A bad drug can kill.
Who Writes and Enforces the Rules
Most healthcare regulation starts at the federal level, under the Department of Health and Human Services.1Department of Health & Human Services. HHS.gov HHS is an umbrella, and the sub-agencies inside it do the day-to-day work.
The Centers for Medicare & Medicaid Services (CMS) runs Medicare and Medicaid and sets the billing rules, payment rates, and quality standards that shape almost every hospital and provider in the country, because nearly all of them participate in at least one of those programs.2CMS.gov. Medicare Fee-for-Service Payment Regulations The Food and Drug Administration (FDA) is responsible for the safety and effectiveness of drugs, biological products, and medical devices.3U.S. Food and Drug Administration. What We Do The HHS Office of Inspector General (OIG) polices fraud, waste, and abuse in federal healthcare programs.4U.S. Department of Health and Human Services Office of Inspector General. Compliance
States add their own layer. Each state runs a health department and licensing boards for physicians, nurses, pharmacists, and other practitioners. Those boards set education requirements, investigate complaints, and can revoke the right to practice. A working provider answers to federal regulators and state regulators at the same time.
The Laws That Protect Patient Privacy
The Health Insurance Portability and Accountability Act, better known as HIPAA, created the first national standards for protecting individually identifiable health information. Its Privacy Rule governs how hospitals, clinics, insurers, and their business associates use and share “protected health information,” or PHI, whether that information is electronic, paper, or spoken aloud. Covered entities have to keep reasonable safeguards in place, from shredding paper records to restricting electronic access.5HHS.gov. Summary of the HIPAA Privacy Rule
A companion Security Rule adds specific protections for electronic PHI, requiring measures that keep digital records confidential, intact, and available when needed.6CMS. HIPAA Basics for Providers: Privacy, Security, and Breach Notification Rules When a breach happens, federal rules require notice to affected individuals no later than 60 calendar days after discovery, and breaches affecting 500 or more people must be reported to the HHS Secretary in the same window.7eCFR. Subpart D – Notification in the Case of Breach of Unsecured Protected Health Information
Violations are organized into four penalty tiers based on how much the violator knew. As adjusted in January 2026, they range from $145 per violation at the low end to a minimum of $73,011 per violation for willful neglect that isn’t corrected, with an annual cap around $2.19 million per tier.8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment Because each patient record can count as a separate violation, a single data breach involving thousands of files can produce penalties in the millions.
The Right to Emergency Care
The Emergency Medical Treatment and Labor Act (EMTALA) requires any hospital with an emergency department that participates in Medicare to screen and stabilize anyone who shows up seeking emergency care, no matter their ability to pay, insurance status, or citizenship.9Centers for Medicare & Medicaid Services. You Have Rights in an Emergency Room Under EMTALA Since most U.S. hospitals participate in Medicare, the law functions in practice as a near-universal guarantee of emergency access.
The obligation has two parts. The hospital has to provide a medical screening examination to determine whether an emergency medical condition exists, and if one is found, it has to stabilize the patient or arrange an appropriate transfer.10Centers for Medicare & Medicaid Services. Emergency Medical Treatment and Labor Act (EMTALA) A hospital can ask about insurance, but it cannot delay screening or treatment to do it.
Protection From Surprise Bills
The No Surprises Act took effect January 1, 2022, and it targets one of the most common complaints about the healthcare system: unexpected bills from out-of-network providers. If you have group or individual coverage and get emergency care at an out-of-network hospital or freestanding emergency department, the provider cannot bill you more than your normal in-network cost-sharing amount. The same protection applies to non-emergency care from an out-of-network provider at an in-network hospital, outpatient department, critical access hospital, or ambulatory surgical center. Out-of-network air ambulance services are also covered.11Centers for Medicare & Medicaid Services (CMS). The No Surprises Act at a Glance
Two gaps to know about. Ground ambulance rides are not covered by the law. And the balance-billing protection for non-emergency care only applies when the facility is in-network, so an out-of-network clinic visit sits outside the rule.
Uninsured or self-pay patients get a separate protection. When you schedule a service at least three days out or ask for a price, the provider has to give you a good faith estimate of expected charges. If the final bill exceeds the estimate by $400 or more, you can dispute the charge through a patient-provider dispute resolution process.12Centers for Medicare & Medicaid Services (CMS). Decision Tree: Requirements for Good Faith Estimates
The Fraud and Abuse Laws
A separate cluster of laws exists to keep federal healthcare dollars from being paid out on illegitimate claims. The OIG identifies five key federal fraud and abuse laws, and three of them do most of the enforcement work.13U.S. Department of Health and Human Services Office of Inspector General. Fraud and Abuse Laws
The Anti-Kickback Statute
The Anti-Kickback Statute makes it a felony to knowingly pay or receive anything of value in exchange for patient referrals that will be billed to a federal healthcare program. “Anything of value” is read broadly, covering cash, free rent, expensive meals, and inflated consulting fees. Both sides of the transaction face criminal liability, with penalties up to 10 years in prison and fines up to $100,000.14Office of the Law Revision Counsel. 42 U.S. Code 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs
The Stark Law
The Stark Law, formally the Physician Self-Referral Law, prohibits physicians from referring Medicare or Medicaid patients to an entity for certain “designated health services” when the physician or an immediate family member has a financial relationship with that entity, unless a specific exception applies. Designated health services include clinical lab work, radiology, physical therapy, durable medical equipment, home health, and outpatient prescription drugs.15Centers for Medicare & Medicaid Services. Physician Self-Referral Exceptions exist, but the burden of fitting into one falls on the physician and the entity.
The False Claims Act
The False Claims Act is the government’s main tool for clawing back money lost to billing fraud. Anyone who knowingly submits a false claim for payment to a federal healthcare program faces a civil penalty for each false claim, plus damages equal to three times the government’s loss.16Office of the Law Revision Counsel. 31 USC 3729 – False Claims Because each fraudulent claim triggers its own penalty, and because damages are trebled, even a modest scheme can produce a judgment in the tens of millions. The Act also lets private citizens sue on the government’s behalf and share in the recovery.
Drug and Device Safety
The FDA regulates drugs, biological products, and medical devices across their entire lifecycle. Before a new drug reaches pharmacies, the manufacturer has to demonstrate safety and effectiveness through clinical trials and submit the data for FDA review. Devices follow a similar path, sometimes streamlined depending on risk level. Once products are on the market, the FDA inspects manufacturing facilities, reviews imports, and investigates illegal activity involving regulated products.17U.S. Food and Drug Administration. Inspections, Compliance, Enforcement, and Criminal Investigations
When something goes wrong, the agency can order recalls, issue warning letters, seize adulterated or misbranded products, and refer criminal cases to the Department of Justice.
Facility Standards
Every hospital, nursing home, and ambulatory surgical center has to meet both state licensing requirements and federal conditions of participation to receive Medicare or Medicaid payments. State licensing typically covers building safety, staffing, and operational standards, with fees that vary by state.
At the federal level, CMS conditions of participation reach into governing body structure, patient rights, infection control, and emergency preparedness. Hospitals must comply with all applicable federal health and safety laws, hold state licensure, and ensure their personnel have appropriate credentials. Failure to meet the conditions bars the facility from Medicare and Medicaid, which for most hospitals would be financially fatal.18eCFR. 42 CFR Part 482 – Conditions of Participation for Hospitals
Telehealth Rules
Telehealth regulation is still shifting after the pandemic. Through December 31, 2027, Medicare beneficiaries can receive telehealth services from anywhere in the United States, and practitioners can provide those services from their homes. Starting January 1, 2028, geographic and facility restrictions are scheduled to return for most services, meaning beneficiaries would generally need to be in a medical facility in a rural area.19CMS. Telehealth FAQ
Behavioral health is an exception. Congress permanently removed geographic and facility restrictions for behavioral health telehealth, so those services can continue from home in any location indefinitely. State licensing rules add another wrinkle, since many states require the practitioner to be licensed in the state where the patient is physically located during a visit.
What Happens When the Rules Are Broken
Enforcement scales with the severity of the conduct, and the financial penalty is often the smallest part of the damage.
Civil monetary penalties are adjusted for inflation each year. The January 2026 adjustment brought some per-day penalties related to biological product recalls up to $286,184.8Federal Register. Annual Civil Monetary Penalties Inflation Adjustment HIPAA penalties can reach $73,011 per violation at the highest tier. False Claims Act penalties, combined with treble damages, regularly generate eight-figure judgments.
Exclusion from federal healthcare programs is often worse than any fine. When the OIG excludes a person or entity, no federal healthcare program will pay for any item or service that person furnishes, orders, or prescribes.20U.S. Department of Health and Human Services Office of Inspector General. The Effect of Exclusion From Participation in Federal Health Care Programs For a physician with a Medicare-heavy patient base, that effectively ends the practice. Organizations that employ an excluded person and bill federal programs for their work face their own penalties.
Criminal prosecution reaches the most serious cases. Anti-Kickback Statute violations are felonies punishable by up to 10 years in prison and fines up to $100,000, and submitting false statements to obtain federal healthcare payments carries the same possible sentence.21Office of the Law Revision Counsel. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs Criminal convictions also typically trigger mandatory exclusion from federal healthcare programs, compounding the loss.