Enforcement at the seams of healthcare vertical integration: what the 2026 docket is actually testing.

Vertical integration in healthcare creates value at the seams, meaning the handoffs where a patient, a claim, a diagnosis, or a dollar moves from one owned entity to another. In 2026 regulators, courts, plan sponsors, and state attorneys general arrived at nearly every one of those seams at the same time. The reason is not coordinated intent. Three separate legal frameworks with different jurisdictional reach have converged on the same conduct, and between them they now cover books of business that were previously beyond any single enforcement authority.

The inventory is the setup, not the story

CVS Health currently faces active or recently resolved proceedings touching insurance, pharmacy benefit management, retail pharmacy, long-term care pharmacy, specialty pharmacy, primary care, and in-home assessment. Trade coverage has treated these as a run of bad quarters. Read together, they describe something more specific.

The table below reflects public sources as of late July 2026. Matters marked active involve allegations that have not been adjudicated, and no inference of liability should be drawn from their inclusion.

Ten matters, seven business lines, one enterprise. What makes this worth an analytical read rather than a news summary is that each proceeding lands on a different structural connection point, and integrated enterprises are built out of those connection points.

Where integration actually pays

Integration promises coordination. Buy the plan, the benefit manager, the pharmacy, the clinic, and the in-home assessment capability, and you can theoretically move a patient through a coherent experience while capturing margin that would otherwise leak to intermediaries.

That promise is real and worth stating plainly before examining where it strains. Combining capabilities under one corporate roof can shorten deployment cycles, close handoff gaps between care settings, and remove friction that independent parties spend years negotiating around. Those gains are observable across multiple integrated models and should not be waved away in order to make a point about enforcement.

The economics of that value, though, concentrate in specific places. Five seams recur across every integrated healthcare model.

Diagnosis capture sits between care delivery and risk-adjusted payment. Accurate documentation of clinical complexity is genuinely valuable, and the entity generating that documentation is also the entity paid on it.

Formulary and rebate economics operate between manufacturer negotiation and plan sponsor benefit. Aggregated purchasing leverage lowers net cost, though the size and disposition of manufacturer payments remain visible to the negotiator and largely invisible to the payer of record.

The dispensing channel connects benefit design to the owned pharmacy filling the prescription. Operational integration produces real efficiency, while reimbursement rates and network design are set by a party with an interest in where the script lands.

340B allocation runs between a covered entity's discount entitlement and the contract pharmacy administering it. Contract pharmacy arrangements extend program reach to entities without dispensing capability, and the administrator holds the reconciliation data.

Patient cost share involves the interaction of manufacturer assistance with accumulator or maximizer design. These programs reduce plan spend on specialty drugs, and the assistance being redirected was funded with a patient beneficiary in mind.

Every seam shares one property. The party capturing the value also controls the record that would demonstrate whether the capture was appropriate. That is not evidence of wrongdoing. It is a description of why these arrangements attract scrutiny, and why substantiation infrastructure is now the operative asset.

Three frameworks, and what each one reaches

The common assumption that intra-corporate arrangements sit outside fraud and abuse exposure has never been accurate, and understanding why explains the timing of everything else.

The Anti-Kickback Statute reaches further than commonly assumed

Payments moving within a single legal entity fall outside the Anti-Kickback Statute. Payments moving between two separate legal entities do not, and OIG has held that position consistently since 1991, stating that the statute is implicated when payments pass from one entity to another even where those entities share common ownership. In 1999 OIG declined to create safe harbor protection for integrated delivery systems and wholly-owned subsidiaries, citing concern that such arrangements may present opportunities for improper financial incentives resulting in overutilization.

The analysis therefore turns on legal separateness rather than economic unity. A subsidiary is a separate legal entity, and remuneration flowing to it from an affiliate is remuneration between two parties regardless of who owns both.

What protects a given arrangement is qualifying under a specific safe harbor, and that is where integrated pharmacy structures encounter difficulty. The investment interest safe harbor requires, among eight standards, that no more than forty percent of investment interests be held by those in a position to make referrals and that no more than forty percent of revenue derive from investor referrals. Those thresholds are structurally hard for a vertically integrated enterprise to satisfy, since the integration itself concentrates both ownership and referral flow.

The practical limit on this framework is jurisdictional rather than doctrinal. The Anti-Kickback Statute requires a federal healthcare program nexus. The exposure was always closer than the common ownership assumption suggested, but it applies to the wrong book of business to reach the bulk of commercial PBM arrangements.

Section 5 of the FTC Act requires neither two parties nor an inducement

The FTC's insulin action, brought administratively in September 2024 against Caremark, Express Scripts, and Optum Rx together with their affiliated group purchasing organizations Zinc Health Services, Ascent Health Services, and Emisar Pharma Services, charged unfair methods of competition and unfair acts or practices under Section 5. The respondents collectively administer roughly eighty percent of United States prescriptions.

Section 5 requires no remuneration passing between two parties and no inducement to a referral. It requires only that the conduct be unfair or constitute an unfair method of competition on its own terms. That framework reaches the identical fact pattern without any of the structural predicates the Anti-Kickback Statute demands, and it applies without regard to which book of business the conduct touches.

The remedies are correspondingly different. The Caremark consent order entered July 14, 2026 requires delinking manufacturer compensation from drug list prices and prohibits compensation structures tied directly or indirectly to WAC-based benchmarks. It sets copay caps by days' supply and requires patient cost sharing to reflect the contracted amount between Caremark and the plan sponsor net of applicable rebates. It limits Caremark's ability to restrict relationships between hub pharmacies and service providers. It establishes reimbursement for independent and community pharmacies tied to acquisition cost plus dispensing fees. Express Scripts settled earlier on comparable though not identical terms, using a general out-of-pocket cap tied to net unit cost.

Those are structural remedies rather than a clawback of past remuneration. A consent order that reprices the rebate mechanism and the community pharmacy reimbursement methodology changes how the seam works going forward.

ERISA Section 406 reaches the commercial book

The framework with the widest potential reach applies to employer-sponsored coverage, which the Anti-Kickback Statute cannot touch at all.

ERISA Section 406, codified at 29 U.S.C. § 1106, prohibits specified transactions between a plan and a party in interest, including self-dealing where a fiduciary causes the plan to enter a transaction benefiting an affiliate. The theory requires no federal program nexus and no showing of inducement to refer. It requires a prohibited transaction and a party in interest.

The Supreme Court's 2025 decision in Cunningham v. Cornell materially lowered the barrier to pleading these claims, holding that a complaint tracking the statutory elements of Section 406(a) is sufficient and that the Section 408 exemptions operate as affirmative defenses to be raised by the defendant. Claims that previously failed at the motion to dismiss stage now generally survive it.

Diagnosis capture is the load-bearing seam

Of the five seams, diagnosis capture carries the most weight. It holds the largest dollars, enforcement capacity there has expanded most dramatically, and artificial intelligence is being deployed into it fastest with the least attention to what the deployment creates.

The mechanism described in the Aetna settlement

The March 2026 settlement resolved allegations covering payment year 2015 and payment years 2018 through 2023. Aetna did not admit liability, and the resolved claims remain allegations. The described mechanisms are worth reading closely regardless of how the matter resolved.

The government alleged that a 2015 chart review program paid coders to review medical records for diagnoses, and that findings which increased risk-adjusted payment were submitted while findings indicating overpayment were not acted upon. It separately alleged that morbid obesity codes were submitted between 2018 and 2023 for members whose recorded body mass index contradicted the diagnosis.

What these allegations describe is a review pipeline running in one direction rather than any act of fabrication. That distinction matters enormously for anyone designing such a pipeline today, because a one-directional design can emerge from ordinary incentives without anyone deciding to build something improper. A vendor paid per code identified will optimize for codes identified. A program whose success metric is aggregate risk score accuracy will not naturally surface the deletions.

The same seam, three positions

The enterprise pattern is instructive. Oak Street Health resolved allegations concerning how members arrive, involving payments to insurance agents for Medicare beneficiary referrals. Aetna resolved allegations concerning what is submitted. In-home assessment capability sits between those points, generating clinical documentation in the member's residence.

To be precise, there is no public enforcement action concerning Signify Health, and none should be implied. Its relevance is categorical. In-home health risk assessments are a named area of regulatory attention, and any organization operating one is operating on a seam that regulators have explicitly identified.

The deeper shift in that market is evidentiary. A diagnosis captured in the home no longer survives on its own. Under RADV, the burden of proof runs to the corresponding record of monitoring, evaluation, assessment, and a treatment plan for the condition documented, the MEAT criteria that risk-adjustment auditors apply. An in-home visit that generates a code without that longitudinal care record produces a diagnosis that cannot be substantiated on audit. That is the same asymmetry the Aetna allegations describe, carried into the member's residence, where the incentive to capture a code is strongest and the infrastructure to support it with real monitoring, evaluation, and treatment is weakest.

What OIG said in February 2026

In February 2026 the HHS Office of Inspector General issued industry compliance program guidance for Medicare Advantage, its first substantial update to that guidance since 1999. The document addresses six risk areas, and the risk adjustment section names three practices as warranting scrutiny. Chart reviews. In-home health risk assessments. Prompts to physicians within the electronic medical record that increase risk scores.

The third item is the one the market has not absorbed.

Every ambient documentation product, every clinical documentation integrity engine, and every HCC suggestion surfaced at the point of care is, functionally, a prompt inside the electronic medical record that raises risk scores. OIG drew no carve-out for clinical decision support, machine learning, or tooling marketed as accuracy improvement. The asymmetry logic from the Aetna allegations transfers directly. A tool that surfaces conditions to add, without equal facility to surface conditions the record does not support, is a one-directional review pipeline implemented in software rather than in a coding department.

This is a design problem before it is a legal one. An organization that can demonstrate its documentation tooling surfaces both directions, and that maintains a record of what the model suggested, what the clinician accepted, and what the clinician declined and why, is in a fundamentally different evidentiary position than one that cannot. Most current deployments log the acceptances. Far fewer log the declines with reasoning attached.

The guidance also carries a vendor oversight requirement that deserves separate attention. OIG places ultimate responsibility for delegated functions on the Medicare Advantage organization and recommends triaging delegations by risk. A health plan cannot contract away exposure for diagnoses generated by a third-party assessment vendor or suggested by a licensed software product. The plan owns the submission.

Detection stopped being improbable

Design assumptions built when audit was a sampling exercise no longer hold.

CMS moved from auditing roughly 60 Medicare Advantage contracts annually to auditing all eligible contracts for each payment year, a shift to roughly 550 contracts. Record pulls expanded from 35 per plan to between 35 and 200 depending on plan size. The agency stated it would deploy automated systems to flag unsupported diagnoses and expand its medical coding workforce from roughly 40 to roughly 2,000. Federal estimates cited in support of the change place annual Medicare Advantage overpayment in the range of $17 billion, with MedPAC estimates considerably higher.

An organization whose risk adjustment program was designed on the working assumption that any given contract year would probably not be examined has an operating model that no longer matches its environment. That belongs on the enterprise risk register rather than solely in the compliance function.

Two routes to structural change

Nine of the ten matters in the opening table allege conduct occurring inside the integrated model. Tennessee asks a different question, which is whether the model itself may operate in that state.

Governor Bill Lee signed the FAIR Rx Act in May 2026, making Tennessee the second state after Arkansas to restrict common ownership across the pharmacy value chain. The statute prohibits an entity holding more than a five percent interest from simultaneously owning or controlling a pharmacy, a health insurance issuer, and a PBM. It carves out hospital and health system pharmacies, employer-owned pharmacies serving their own populations, and certain independently owned mail order and specialty operations. Civil penalties reach $10,000 per violation per day. The prohibition takes effect July 1, 2028, with a transition window through December 31, 2028 for entities demonstrating a bona fide sale process to an unaffiliated owner.

CVS filed in May, followed by Express Scripts and PCMA in June, with consolidation expected. The challenges rest on the dormant Commerce Clause and on ERISA preemption. CVS states publicly that compliance would require closing 136 retail and specialty locations and 25 retail medical clinics in Tennessee, ending mail order service in the state, displacing roughly 1.5 million patients, eliminating approximately 2,000 jobs, and raising Tennessee employer drug costs by more than $180 million annually. CVS characterizes the statute as protectionism for in-state independent pharmacies. A federal court enjoined a comparable Arkansas law on Commerce Clause grounds, and that litigation continues.

Both outcomes are consequential, and neither is predictable from here. If the statutes survive, structural separation becomes a state-level compliance variable, and national integrated operating models would need to run different structures in different states. If the statutes fall, the underlying reform pressure relocates toward transparency mandates, fiduciary obligations, and reimbursement methodology, which regulate conduct rather than corporate form. The question of whether an enterprise should be held accountable at the structural level rather than the transaction level is the subject of a companion analysis on structural accountability, which takes up the case for reaching corporate form directly.

A more durable structural path in pharmacy may run through professional-practice doctrine rather than ownership caps. Corporate Practice of Medicine prohibitions, long established in many states, bar a corporation from employing physicians or controlling their clinical judgment, and they survive legal challenge because they regulate professional accountability rather than corporate form. A parallel prohibition on the corporate practice of pharmacy would separate the professional roles and accountabilities inside the integrated stack. It would require the pharmacy to operate through a management services organization and professional corporation structure, an MSO-PC, that keeps clinical and dispensing judgment answerable to a licensed professional rather than to the enterprise capturing the margin. That approach targets the conflict at the point where professional obligation and enterprise incentive collide, and it is harder to dislodge on Commerce Clause grounds than an ownership ban. The operating mechanics of the MSO-PC model are developed in a related analysis on provider-status infrastructure.

The relevant observation is that the second route is already operating. While the constitutionality of ownership restrictions is litigated, the FTC consent orders have already reset rebate mechanics, hub pharmacy access, and community pharmacy reimbursement methodology by agreement, without any court reaching the question of whether integration is permissible. Structural change through consent order does not require winning a constitutional argument.

One factual thread runs underneath the Tennessee litigation and is not resolved by it. The legislature acted following a state audit reporting that PBMs reimbursed affiliated pharmacies at materially higher rates than unaffiliated ones. Whether the statute is a permissible response is a question of constitutional law. Whether differential affiliated reimbursement occurred is a question of fact.

What the plan sponsor cases actually hold

The employer-side litigation is frequently summarized as employers now facing liability for PBM arrangements. The record is more specific than that, and the specifics are what plan sponsors should be acting on.

Two prominent cases have been dismissed at the pleading stage for lack of Article III standing. Lewandowski v. Johnson & Johnson was dismissed a second time in February 2026, and Navarro reached the same outcome. In both, courts found that injury premised on higher premium contributions was too speculative, because plan language gave the employer discretion over contribution amounts. Appeals in both are briefed for decision in 2027.

Stern v. JPMorgan Chase produced a more instructive split. Claims for breach of fiduciary duty were dismissed. Two things survived. Standing survived where plaintiffs alleged specific out-of-pocket overpayments, on specific dates, at specific markups, rather than a generalized premium theory. And prohibited transaction claims under ERISA Section 406 survived, consistent with Cunningham v. Cornell, though the court required additional briefing on the Section 408 exemptions.

Two doctrinal points from Stern deserve attention from anyone advising plan sponsors. Decisions about benefit plan design are settlor functions falling outside ERISA fiduciary standards, which insulates a meaningful category of employer decision-making. And fiduciary claims that do proceed require a meaningful benchmark, meaning an apples-to-apples comparison of what similarly situated participants paid rather than a comparison to pharmacy acquisition cost.

The practical read is narrower and more useful than the headline version. Fiduciary breach claims premised on drug pricing are struggling. Prohibited transaction claims are the theory with momentum, and they reach the commercial book precisely where the Anti-Kickback Statute cannot. Standing turns on participant-level overpayment evidence rather than plan-level cost theories.

That shapes what a plan sponsor should hold in its file. Many hold contractual assurances about rebate pass-through. Considerably fewer hold a reconciliation matching manufacturer payments received against amounts credited to the plan, including payments routed through affiliated group purchasing organizations under labels other than rebate. Given that the FTC has now required delinking of manufacturer compensation from list price at the largest PBM, a plan sponsor asking for that reconciliation is asking for something the market is already being restructured to produce.

The questions worth answering inside your own organization

The useful output of this docket is diagnostic rather than predictive. Each role below faces a version of the same substantiation problem.

The read

None of these matters, taken individually, indicts vertical integration. Integration produced real coordination value, and dismantling it would not by itself improve how care is delivered or financed.

That is the gray space. The Anti-Kickback Statute reaches intra-family remuneration that many assumed it did not, Section 5 reaches the same conduct without needing two parties or an inducement, and Section 406 reaches the employer-sponsored book that neither of the others could.

The white space is that very few organizations have built the substantiation infrastructure this environment requires. Bidirectional review with retained evidence. Vendor attribution that survives an audit. Rebate reconciliation rather than rebate assurance. Documentation logs that record what was declined. A clear-eyed inventory of which intra-family flows depend on a safe harbor they cannot actually satisfy.

Frequently asked questions

What does vertical integration mean in healthcare?

It describes a single corporate parent owning entities across multiple stages of the healthcare value chain, such as a health insurer, a pharmacy benefit manager, retail and specialty pharmacies, primary care clinics, and home-based assessment services. CVS Health, UnitedHealth Group, and Cigna each operate integrated models of this type.

Does the Anti-Kickback Statute apply between commonly-owned companies?

Yes. Payments within a single legal entity fall outside the statute, but OIG has stated since 1991 that the statute is implicated when payments pass between separate legal entities even where those entities share common ownership. OIG declined in 1999 to create a safe harbor for integrated delivery systems and wholly-owned subsidiaries. Protection depends on qualifying under a specific safe harbor, and the investment interest safe harbor's forty percent ownership and forty percent revenue thresholds are structurally difficult for integrated enterprises to satisfy. The statute's reach is limited to federal healthcare program business.

Why is Medicare Advantage risk adjustment under increased enforcement in 2026?

CMS expanded Risk Adjustment Data Validation audits from roughly 60 contracts annually to all eligible contracts for each payment year, expanded record sampling, deployed automated flagging, and substantially increased its coding workforce. Federal estimates place annual Medicare Advantage overpayment in the range of $17 billion, with MedPAC estimates higher.

What did the OIG 2026 Medicare Advantage compliance guidance change?

It was the first substantial update to Medicare Advantage industry compliance guidance since 1999. It identifies six risk areas and specifically names chart reviews, in-home health risk assessments, and electronic medical record prompts that increase risk scores as practices warranting scrutiny. It also places responsibility for delegated functions on the Medicare Advantage organization rather than the vendor.

Does AI-assisted clinical documentation create False Claims Act exposure?

The tooling itself is not prohibited, and no enforcement action to date has turned on the use of artificial intelligence in documentation. Exposure arises from design. A system that surfaces only diagnoses that raise risk scores, without equivalent capability to surface unsupported ones, replicates the asymmetric review pattern described in recent risk adjustment settlements. Logging suggestions, acceptances, and clinician-declined recommendations is the practical mitigation.

What did the FTC's insulin settlements require?

The FTC brought an administrative action in September 2024 under Section 5 of the FTC Act against Caremark, Express Scripts, and Optum Rx together with their affiliated group purchasing organizations, charging unfair methods of competition and unfair acts or practices. The Caremark consent order entered July 14, 2026 requires delinking manufacturer compensation from list price and WAC-based benchmarks, sets copay caps by days' supply, ties patient cost sharing to the client contracted amount net of rebates, limits restrictions on hub pharmacy relationships, and ties independent and community pharmacy reimbursement to acquisition cost plus dispensing fees. Express Scripts and Optum Rx settled earlier on comparable terms.

What is the Tennessee FAIR Rx Act?

Signed in May 2026, it prohibits an entity holding more than a five percent interest from simultaneously owning or controlling a pharmacy, a health insurance issuer, and a pharmacy benefit manager in Tennessee. It takes effect July 1, 2028, with a transition period through the end of that year, and carries civil penalties up to $10,000 per violation per day. CVS, Express Scripts, and PCMA have filed constitutional challenges resting on the dormant Commerce Clause and ERISA preemption.

Do employers have fiduciary liability for their PBM arrangements?

The picture is more specific than the headlines suggest. Fiduciary breach claims premised on drug pricing have been dismissed in Lewandowski v. Johnson & Johnson, Navarro, and Stern v. JPMorgan Chase, with the first two failing on Article III standing. Prohibited transaction claims under ERISA Section 406 survived in Stern, aided by the Supreme Court's 2025 decision in Cunningham v. Cornell holding that Section 408 exemptions are affirmative defenses rather than pleading requirements. Standing has turned on participant-level out-of-pocket overpayment evidence rather than premium-based theories. Plan design decisions are settlor functions outside fiduciary standards.

What is 340B contract pharmacy and why is it being litigated?

The 340B program requires manufacturers to offer discounted drug pricing to safety net providers. Covered entities without their own dispensing capability contract with retail pharmacies to fill prescriptions, with a third-party administrator reconciling which fills qualify. Litigation filed in 2026 by hospital systems alleges that CVS subsidiaries retained roughly $250 million in savings that should have flowed to covered entities. Those allegations are unproven. A 2022 New York Attorney General action separately challenged a requirement that covered entities use a CVS-owned administrator, which CVS disputed.

Method and sources

Every figure and procedural position in this piece was verified against public sources during the week of July 27, 2026. Litigation positions change, and readers evaluating these matters for their own organizations should confirm current status before relying on any specific detail.

Matters described as active involve allegations that have not been adjudicated. Where a settlement was reached without an admission of liability, that is noted. Statements of position attributed to CVS Health reflect the company's public filings and public statements.

Primary sources include the Department of Justice press releases for the Aetna and Oak Street Health settlements, the HHS Office of Inspector General Medicare Advantage compliance program guidance issued February 2026 and OIG's published positions on common ownership under the Anti-Kickback Statute, the CMS press release announcing expanded Risk Adjustment Data Validation audits, the Federal Trade Commission administrative complaint and consent orders in the insulin matter, filings and coverage of the Tennessee FAIR Rx Act challenges, reported decisions in Lewandowski v. Johnson & Johnson, Navarro, and Stern v. JPMorgan Chase, and the Supreme Court's decision in Cunningham v. Cornell.

This piece is analysis and commentary based on public sources, public filings, and public statements as of the dates noted, and nothing in it constitutes legal advice. Descriptions of active or pending matters are characterizations of allegations that have not been adjudicated, and their inclusion implies no finding, admission, or inference of wrongdoing or liability by any named party. Where a matter resolved without an admission of liability, none is implied. Statements attributed to any company reflect that company's own public filings and public statements. Interpretive conclusions and forward-looking judgments are the author's opinion, offered for analytical discussion rather than as assertions of fact about any party's conduct beyond what the cited public record establishes. All views reflect independent professional judgment informed by more than two decades of experience across payer strategy, clinical transformation, and health system operations, and do not represent the views or positions of any current or former employer or affiliated organization.