|
Food Benefit Disruptions and Food Insecurity
The recent disruptions to federal food assistance programs, including the Supplemental Nutrition Assistance Program (SNAP) and related benefit programs, highlighted a planning gap for many licensed home care services agencies. Patients who rely on these benefits for food access were left vulnerable, and agencies without formal protocols in place could face regulatory and liability exposure going forward.
Two compliance and risk issues stand out. First, your Emergency Preparedness Plan should be reviewed and updated to address food access emergencies. Second, your agency should have a formal Food Insecurity Policy covering identification, intervention, and follow-up.
Licensed Home Care Services Agencies (LHCSAs) are required under 10 NYCRR § 766.9 to maintain a written emergency plan, and Medicare-certified home health agencies are subject to the additional CMS Emergency Preparedness requirements at 42 C.F.R. § 484.102. The late-2025 SNAP funding disruption made clear that those plans must account for the sudden loss of a patient's ability to purchase or obtain food. Separately, food insecurity is a recognized social determinant of health that directly affects patient outcomes, hospitalization rates, and care plan adherence. A dedicated policy gives staff a clear framework for identifying patients at risk and taking timely action.
We are available to assist in reviewing or amending your Emergency Preparedness Plan and in developing a Food Insecurity Policy tailored to your patient population.
Wage Parity Compliance Forms and Certification Submission Dates
On April 20, 2026, the Department of Health (DOH) released an update to the March 9, 2026, guidance regarding Wage Parity Compliance Forms and Certification Submission Dates. The most recent update extended the compliance submission dates for calendar year 2025. No other changes were made to the March 9th guidance.
The updated 2025 deadlines are as follows:
Licensed Home Care Services Agencies (LHCSAs), Former Fiscal Intermediaries, and the Statewide Fiscal Intermediary (FI) must submit:
- The New York State Department of Labor (DOL) Annual Compliance Statement of Wage Parity, Hours and Expenses Form (Form LS300) to all contracted Certified Home Health Agencies (CHHAs) and Medicaid Managed Care Organizations (MMCOs) by June 15, 2026; and
- The Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by June 15, 2026.
CHHAs must submit:
- Form LS300 to all contracted MMCOs by June 15, 2026; and
- The Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by June 15, 2026.
MMCOs must submit the Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by June 30, 2026.
The April 20th update did not provide guidance for DOL Employer’s Statement Verifying Wage Parity Hours and Expenses Form (Form LS301) for the 2025 calendar year.
As a reminder, the compliance submission dates for calendar year 2026 and subsequent years will be as follows:
LHCSAs and FI must submit:
-
Form LS300 to all contracted MMCOs and CHHAs by June 1 of each year for the previous calendar year;
- Form LS301 and audited financial statements or Agreed Upon Procedures (AUPs) to all contracted CHHAs and MMCOs by October 1 of each year for the previous calendar year; and
-
The Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by December 1 of each year for the previous calendar year.
CHHAs must submit:
-
Form LS300 to all contracted MMCOs by June 1 of each year for the previous calendar year;
- Form LS301 and audited financial statements or AUPs to all contracted MMCOs by October 1 of each year for the previous calendar year; and
-
The Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by December 1 of each year for the previous calendar year.
MMCOs must submit the Annual Certification of Compliance with Home Care Worker Wage Parity to the DOH by December 1 of each year for the previous calendar year.
If you have questions about your agency’s compliance obligations or submission deadlines, please contact us.
OCR Releases Webinar on Risk Management Under the HIPAA Security Rule
On April 8, 2026, the Department of Health and Human Services’ Office for Civil Rights (OCR) released a webinar discussing risk management under the HIPAA Security Rule. The webinar covers how to have an effective cybersecurity plan in compliance with HIPAA Security Rule 45 C.F.R. §164.308 which requires a HIPAA Covered Entity to:
- Implement policies and procedures to prevent, detect, contain, and correct security violations;
- Conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the Covered Entity or business associate; and
- Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with HIPAA Security Standards.
OCR repeatedly emphasized that security measures must actually reduce risk to a reasonable and appropriate level. Measures that only marginally reduce risk are not compliant.
The security rule does not require Covered Entities to use any particular framework or methodology for risk management. However, OCR recommends that Covered Entities, at a minimum:
- Identify and assess potential risks and vulnerabilities to the confidentiality, integrity, and availability of Electronic Protected Health Information (ePHI);
- Consider potential risks and vulnerabilities to all ePHI it creates, receives, maintains, or transmits;
- Use the results of its risk analysis as a direct input to the risk management process; and
- Use risk analysis to inform risk management decisions.
OCR investigations have repeatedly found that breaches of ePHI are caused by Covered Entities leaving known risks unmitigated. OCR recommends that Covered Entities proactively identify gaps in their current security measures and to mitigate known risks before a breach occurs. Recommended security measures include, but are not limited to:
- Multifactor authentication;
- Network segmentation;
- Enhanced anti-malware software;
- Limiting the number of accounts with administrative privileges;
- Enhanced audit and event logging; and
- Active monitoring of event logs.
OCR noted that Covered Entities that are unable to implement safeguards against all known risks are expected to prioritize which mitigation strategies to use based on the following factors:
- The size, complexity, and capabilities of the Covered Entity;
- The Covered Entity's technical infrastructure, hardware, and software security capabilities;
- The costs of security measures; and
- The probability and criticality of potential risks to ePHI.
OCR also explained what to expect during an investigation of a Covered Entity's compliance with the risk management requirement. OCR will request the entity's risk management policies and procedures, along with evidence that those policies are actually being followed. Acceptable evidence may include:
- Risk management plans;
- Meeting notes;
- Emails between staff and management showing implementation progress;
- Management approvals; and
- Screenshots and logs showing security measure implementation details.
OCR cautioned that conscious and intentional failures to comply, or demonstrations of reckless indifference to the obligation to comply with the implementation requirements, can rise to the level of willful neglect. If the noncompliance is not corrected within 30 days, the Covered Entity will receive civil money penalties of up to $73,011 per day per violation, with an annual cap of $2,190,294 per violation. Each day of noncompliance can be treated as a separate violation.
The webinar is available on the HHS OCR website and linked here. Webinar
CMS Announces National Provider Revalidation Initiative
On April 23, 2026, Centers for Medicare & Medicaid Services (CMS) sent letters to the governors and the state Medicaid Directors (Directors) of all fifty states requesting revalidation of Medicaid providers.
The letter to the Directors requests that each Director submit a comprehensive two-year Provider Revalidation (PR) strategy which includes a description of how the state ensures the accuracy of its provider enrollment data through revalidation and other approaches such as provider directory validation. CMS is recommending that Directors increase oversight measures of providers that are considered to be at high-risk of fraud and abuse (High-Risk Providers) by adopting off-cycle or more frequent revalidation intervals than the minimum five-year requirement and by prioritizing High-Risk Providers who have not been screened within the past 12 months for near-term revalidation. Directors are expected to submit:
A plan to undertake a swift revalidation of High-Risk Providers by May 7, 2026.
A comprehensive two-year PR strategy, by May 23, 2026, that includes:
- The state’s specific scope and the priorities of the PR strategy;
- The proposed methodology and timeline for conducting off-cycle PR, with a focus on High-Risk Providers, including providers without a National Provider Identifier (NPI);
- The metrics used to measure effectiveness and progress of the PR strategy, including links to any public-facing data or reporting;
- The state’s approach for keeping provider information accurate and up-to-date on an ongoing basis;
- How the state ensures consistency and accuracy of provider data across fee-for-service and managed care delivery systems, including oversight of managed care plan provider directories;
- How the state Medicaid agency does or will coordinate with other relevant law enforcement partners.
The results of the PR strategy upon completion.
The letter to the governors asks that each state’s Medicaid program undertake a swift revalidation of High-Risk Providers as part of each state's program integrity obligations under federal law. CMS emphasizes that immediate action must be taken to address the rapid increase in fraud, waste, abuse, and corruption in Medicaid and to prevent further abuse. CMS predicts that the increased scrutiny of High-Risk Providers will immediately deter criminal actors from continuing their fraud schemes. The governors are expected to:
- Confirm by May 7, 2026, whether they intend to carry out the swift revalidation along with a proposed timetable; and
- Include any provider without an NPI in the state’s definition of High-Risk Provider.
| 
