Key Takeaways
- A hospital that seriously violates Medicare Conditions of Participation can lose its reimbursement contract, and an individual clinician can lose a license or be excluded from federal programs. Both outcomes are functionally terminal. No equivalent enterprise-level fitness determination exists for a company integrated across payer, PBM, pharmacy, provider, and home health.
- Vertical integration does not resolve the conflicts of interest among those roles. It institutionalizes them, resolving each toward the integrated financial incentive rather than the obligation each role carries in isolation.
- Six federal and state enforcement mechanisms each reach a piece of the enterprise. None can make an enterprise-level fitness determination or compel structural disaggregation.
- After 2008, banking regulators paired enforcement with structural constraints, including the Volcker Rule and resolution authority. Healthcare has adopted neither for integrated health enterprises.
- Two near-term levers remain. Coordinated multi-state legislative action in markets outside ERISA preemption, and large-purchaser exit that names structural conflict as the reason.
Every football fan understands the NCAA death penalty. A program cheats badly enough, and the punishment is terminal suspension of the sport itself. The institution absorbs the consequence. Coaches move on. Players transfer or lose eligibility. The community built around the program bears costs it did not create. And crucially, the penalty's existence changes the behavior calculus for every other program watching.
Healthcare has a version of this. A hospital found in serious violation of Medicare Conditions of Participation loses its reimbursement contract. For most hospitals, that outcome is functionally terminal. The penalty is proportionate, structurally decisive, and administered by a single authority with jurisdiction over the whole institution. It works because the threat is credible and the scope is complete.
The penalty is even more pointed for individuals. A state medical board can revoke a clinician's license and end the ability to practice in that state. Federal exclusion goes further. The Office of Inspector General can place a clinician on its List of Excluded Individuals and Entities, and the CMS Preclusion List can bar a prescriber from Medicare Advantage and Part D. An excluded clinician cannot be paid by any federal healthcare program, which is career-ending in most of medicine. For the individual physician and for the single hospital, the death penalty is real, credible, and administered by an authority with jurisdiction over the whole of what it governs. The gap opens only one level up, at the integrated enterprise, where no single authority governs the whole.
The problem is that this accountability mechanism was designed for a healthcare system organized around discrete institutions such as hospitals, clinics, and physician practices. It was not designed for entities that have vertically integrated across payer, pharmacy benefit manager, pharmacy, provider, and home health simultaneously. For those entities, no equivalent mechanism exists. No single regulatory body holds jurisdiction over the whole. No enterprise-level fitness determination aggregates the full compliance record and asks whether the pattern of conduct is compatible with continued participation in publicly funded programs.
That gap is not an oversight. It is a structural consequence of how vertical integration interacts with fragmented regulatory authority. Understanding it requires working through three questions in sequence. What vertical integration actually does to the obligation structure of each role it combines, why the existing enforcement toolkit cannot close the gap, and what levers remain available to the two actors who can.
Integration institutionalizes conflicts of interest
Each role within a vertically integrated healthcare enterprise carries a statutory or fiduciary obligation to a specific principal. A pharmacy benefit manager is obligated to the plan sponsor. A health plan is obligated to the beneficiary. A pharmacy is obligated to the patient. A provider is obligated to the patient. A 340B contract pharmacy is obligated to covered entities serving low-income populations.
When one enterprise holds all of these roles simultaneously, those obligations do not integrate. They compete. And the enterprise resolves the competition in a predictable direction. It moves toward the financial incentive created by the integrated structure, not toward the obligation each role carries in isolation. The matrix below maps this conflict systematically across the roles that vertical integration most commonly combines.
| Role | Statutory obligation | Integrated incentive | Conflict expression |
|---|---|---|---|
| PBM | Optimize formulary for plan sponsor cost and clinical value | Retain manufacturer rebates; favor owned pharmacy network | Formulary placement reflects revenue optimization rather than clinical or economic value to the plan |
| Health Plan | Act in the interest of the enrolled beneficiary; code risk accurately | Maximize risk-adjusted revenue through aggressive diagnosis capture | Risk adjustment coding inflated beyond clinical documentation; RADV audit exposure accumulates |
| Pharmacy | Dispense accurately; counsel patients; act in patient interest | Drive volume through owned channels; meet network fill targets | Steering and dispensing pressure conflicts with independent pharmacist judgment |
| Provider / Primary Care | Clinical decision-making independent of financial relationships | Attribution and MA enrollment targets tied to affiliated plan | Care delivery optimized for plan economics rather than patient-centered clinical outcomes |
| Contract Pharmacy (340B) | Pass 340B savings to covered entities serving vulnerable populations | Retain spread between 340B acquisition cost and standard reimbursement | Savings intended for safety-net institutions diverted to integrated enterprise margin |
| Home Health / Risk Assessment | Conduct accurate, unbiased in-home assessments | HCC capture rates tied to affiliated plan risk-adjustment revenue | Assessment completeness and coding intensity influenced by plan financial interest rather than clinical necessity |
The conduct that generates enforcement action in a vertically integrated enterprise is usually not a deviation from the business model. It is the business model operating as designed under conflicting incentive structures.
This distinction matters for how accountability is framed. The instinct in enforcement and in public commentary is to treat each instance of non-compliant conduct as a discrete failure requiring a discrete remedy. An improper billing pattern gets a settlement. A formulary manipulation allegation gets a consent decree. A risk adjustment coding issue gets a recoupment demand. Each resolution treats the symptom.
The underlying condition is that the same enterprise is simultaneously the plan, the PBM, the pharmacy, the primary care provider, and the risk assessment platform. The conflicts mapped above are not aberrations from that structure. They are outputs of it. Resolving individual enforcement actions without addressing the structure leaves the condition in place and the next set of symptoms predictable.
Too embedded to exclude
The NCAA death penalty works in part because the college football ecosystem has redundancy. When one program is suspended, the conference continues. Other programs absorb the recruits. The sport persists. The penalty is terminal for the institution but not for the infrastructure around it.
Healthcare does not have that redundancy at the level of a sufficiently integrated enterprise. An entity that processes a substantial share of national prescription volume, administers coverage for millions of beneficiaries, operates primary care clinics across multiple markets, and conducts in-home risk assessments for a significant MA population cannot be excluded from federal programs without disrupting patient access at a scale that regulators cannot accept. That is not a legal constraint. It is a political and logistical one. And it is structural. The more roles the enterprise holds, the more embedded it becomes, and the less credible the terminal penalty becomes.
The existing enforcement toolkit reflects this reality. Each mechanism can reach a piece of the enterprise. None can reach the whole.
| Accountability mechanism | Who applies it | What it can do | What it cannot do |
|---|---|---|---|
| CMS Contract Termination | Centers for Medicare & Medicaid Services | Terminate a specific Medicare or Medicaid contract held by a subsidiary | Aggregate conduct across all contracts or make an enterprise-level fitness determination |
| OIG Exclusion | HHS Office of Inspector General | Exclude specific individuals or entities from federal program participation | Practically apply enterprise-level exclusion to infrastructure serving tens of millions without patient harm |
| DOJ Civil / Criminal Action | Department of Justice | Pursue False Claims Act liability, consent decrees, and criminal referrals | Compel structural disaggregation; penalties absorbed as cost of doing business at sufficient scale |
| FTC Antitrust Action | Federal Trade Commission | Challenge mergers and anti-competitive conduct; seek injunctive relief | Unwind completed integrations retrospectively; address conduct-based conflicts in real time |
| State AG / Legislative Action | State attorneys general; state legislatures | Enforce state consumer protection and PBM laws; pursue structural restrictions on common ownership | Apply nationally; preempted by ERISA for self-insured employer plans covering most commercially insured lives |
| Joint Commission / CMS Conditions of Participation | The Joint Commission; CMS | Terminate Medicare participation for a facility found in serious violation | Apply to non-facility entities; no equivalent enterprise-level fitness standard exists for integrated health companies |
The result is that large integrated enterprises face enforcement economics that differ fundamentally from those facing smaller, less embedded entities. Settlements are negotiated at the subsidiary level. Penalties are absorbed as a cost of doing business. Conduct continues or evolves incrementally. The pattern repeats across different segments because the structural incentive generating the conduct has not changed. The detailed record of how those actions land across an integrated enterprise is the subject of a companion piece, the enforcement docket.
This is not a criticism of the regulators administering these tools. CMS, DOJ, HHS OIG, FTC, and state attorneys general are each doing what their authority permits. The problem is that their combined authority does not add up to enterprise-level accountability for an entity that has integrated across every domain each of them regulates.
The Joint Commission analogy is instructive precisely because it breaks down at scale. The Joint Commission can make a unified fitness determination about a hospital because it has jurisdiction over the whole institution. No body can make that determination about a fully integrated payer, PBM, pharmacy, and provider enterprise. That jurisdictional gap is the space that vertical integration occupies and, once occupied, defends.
State legislation as the proxy fight over integration
Several states have moved to restrict common ownership of pharmacy benefit managers and pharmacies, or to impose conduct requirements that effectively limit the margin advantages of integrated structures. These efforts represent something more significant than incremental PBM regulation. They are the first serious legislative attempt to address the structural conflict of interest directly rather than through conduct-specific enforcement after the fact.
The integrated enterprises subject to these restrictions have challenged them in federal court. The legal arguments vary, but the strategic position is consistent. The integrated model is framed as a constitutional and commercial right that states cannot structurally regulate. ERISA preemption arguments are deployed against state PBM laws affecting self-insured employer plans, which cover the majority of commercially insured lives and represent the largest share of PBM revenue.
This is the most important structural contest in healthcare policy right now, more consequential than any individual enforcement action. The enforcement actions are retrospective. They address conduct that has already occurred under an existing structure. The state legislative battles are prospective. They are a direct fight over whether the integrated model continues to exist in its current form. An integrated enterprise litigating to preserve its structure while that same structure is generating multi-front enforcement exposure is not a contradiction. It is a rational strategy. Keep the model intact, absorb the enforcement costs, and prevent the structural remedy.
Settlement math is rational when the structural conditions generating the conduct remain in place. The goal of structural litigation is to keep those conditions in place. Understanding that connection reframes what the enforcement record actually represents.
What banking developed after 2008
The post-2008 financial reform response is the closest structural analogy in American regulatory history. The policy conclusion after the crisis was explicit. Size alone, without structural constraint, does not resolve the incentive problems created by integration. Enforcement after the fact does not adequately deter conduct when the scale of the enterprise makes the terminal penalty functionally unavailable.
The response included both enforcement and structural requirements. Capital buffers and resolution authority addressed the too-big-to-fail problem by making failure more survivable at the system level, which made the terminal penalty more credible at the enterprise level. Activity restrictions addressed the conflict of interest problem by disaggregating roles whose simultaneous combination created irresolvable incentive conflicts. The Volcker Rule is not a conduct standard. It is a structural prohibition on holding certain roles simultaneously.
Healthcare has done neither. Vertical integration across payer, PBM, pharmacy, and provider has been permitted through merger review processes that evaluate market concentration but not the structural conflict matrix above. The enforcement response has been segmented settlement at the subsidiary level, which is precisely the pattern that produces settlement math rather than behavioral change. And no equivalent of resolution authority exists for an integrated health enterprise. There is no mechanism to make the terminal penalty credible by ensuring that its application does not collapse patient access.
The absence of structural reform is a policy choice with a compounding consequence. Each year the integrated structure operates, it becomes more embedded in delivery infrastructure and more difficult to disaggregate without patient harm. The window for structural intervention narrows as the hostage dynamic deepens. This is the trajectory that banking regulators recognized after 2008 and acted on. Healthcare regulators have not yet reached the equivalent recognition, in part because the crisis in healthcare integration is slower-moving and its costs are distributed across millions of patients and purchasers rather than concentrated in a single visible event.
Two levers on different timelines
The enforcement toolkit, as mapped above, cannot close the accountability gap at the enterprise level. Structural regulatory reform can, but it requires jurisdictional consolidation, political will to apply it to entities large enough to cause disruption, and the development of resolution mechanisms that make the terminal penalty credible without collapsing patient access. That is a long-cycle policy project. It is the right answer and it is not the near-term answer.
Two levers operate on a shorter timeline and do not require legislative or regulatory action to be effective.
For policymakers and state legislators, the structural legislative path is available and consequential even within current ERISA constraints. Restrictions on common ownership, mandatory pass-through requirements for 340B savings and PBM rebates, and enterprise-level disclosure requirements that aggregate compliance records across subsidiaries are all achievable at the state level for fully insured markets. The ERISA preemption problem is real but bounded. It applies to self-insured employer plans, not to Medicaid managed care, state employee plans, or individual market coverage. A coordinated multi-state approach targeting those markets creates meaningful structural pressure even without federal action. The enterprise-level fitness determination that CMS and OIG cannot currently make could be approximated through coordinated multi-contract review across state Medicaid programs, which collectively represent a substantial share of integrated enterprise revenue.
For large purchasers and self-insured employers, the market accountability mechanism that regulation cannot replicate is exit, and the signal that makes exit consequential is the stated reason for it. Routine carrier or PBM switching has no lasting effect on the integrated model. A large purchaser publicly attributing a move to the structural conflict of interest rather than to a rate negotiation outcome sends a different signal. It reframes the cost of the integrated model from a legal line item to a commercial liability. Employers who disaggregate the stack, separating plan from PBM from pharmacy benefit and moving toward direct contracting arrangements, reduce the enterprise's ability to extract margin at each integration point. That is market-level structural pressure, and it operates independently of regulatory action.
The college football death penalty does not exist because every program cheats. It exists because the behavior calculus has to include a terminal outcome for the incentive structure to work. Healthcare needs the equivalent, and building it requires both the policy path and the market path moving at the same time.
The NCAA analogy that opened this piece has one more useful dimension. The death penalty is rarely applied, and its deterrent effect operates primarily through its existence rather than its use. The goal in healthcare is not to terminate integrated enterprises. It is to make the terminal outcome credible enough that the integrated enterprise finds compliance more rational than settlement math. That requires both a viable policy path to enterprise-level accountability and a market environment where the cost of non-compliance shows up in revenue, not just in legal reserves.
Neither path alone is sufficient. Regulation without market consequence produces the pattern described above, meaning segmented enforcement, absorbed settlements, and unchanged structure. Market consequence without structural reform produces carrier switching with no lasting effect on the business model. The two working together, with a credible structural remedy behind them, is what the system needs. Building both simultaneously is the work.
All views, analyses, and frameworks presented here reflect independent professional judgment informed by more than two decades of experience across payer strategy, clinical transformation, and health system operations. They do not represent the views or positions of any current or former employer or affiliated organization.