Florida Healthcare Regulatory Compliance in 2026: A Guide for Physicians, Clinics and Hospitals

A medical director agreement looks routine. So does a lease with a referring physician, a marketing deal with a management company, or a percentage-based billing arrangement. Any one of them can create federal or state exposure if it is structured the wrong way.

That is the core challenge of healthcare regulatory compliance in Florida. Almost everything a healthcare business does is regulated, and enforcement comes from several directions at once: the HHS Office of Inspector General (OIG), the Department of Justice, CMS, the Florida Agency for Health Care Administration (AHCA), and state licensing boards.

This guide explains the major compliance areas for physicians, clinics, hospitals, surgery centers, labs and other healthcare businesses, and when it makes sense to bring in a healthcare regulatory attorney.

Federal and Florida Law: Why You Have to Check Both

Many providers assume that if an arrangement satisfies the federal rules, it is safe. That assumption causes problems in Florida for two reasons.

1. State laws can be broader. Florida's Patient Brokering Act applies regardless of who pays, including commercial insurance and self-pay. The federal Anti-Kickback Statute applies only to federal healthcare programs.
2. The rules use different tests. An arrangement can fit a federal safe harbor and still raise a state-law question, or the reverse.

A proper compliance review checks each arrangement against both sets of laws.

At a Glance: The Major Compliance Risk Areas

Law or issue	Who it affects most	Common trigger points
Anti-Kickback Statute and Florida Patient Brokering Act	Physicians, clinics, labs, DME suppliers, marketers	Referral payments, marketing arrangements, free or discounted items
Stark Law and Florida Self-Referral Act	Physicians who refer designated health services	Compensation, leases, ownership interests, medical directorships
Fraud and abuse (False Claims Act and related laws)	All Medicare and Medicaid providers	Billing errors, overpayments, improper financial relationships
Fee splitting	Professionals paying percentage-based fees	Billing, management and marketing agreements
EMTALA	Hospitals and on-call physicians	Screening, stabilization, transfers
HIPAA and Florida Information Protection Act	Covered entities and business associates	Breaches, vendor contracts, missing policies

Anti-Kickback and Patient Brokering Laws

The federal Anti-Kickback Statute makes it a crime to knowingly and willfully offer, pay, solicit or receive anything of value to induce or reward referrals for services paid by federal healthcare programs. It is a criminal law, and violations can lead to fines, imprisonment, exclusion from federal programs and civil penalties.

Florida's Patient Brokering Act goes further. It prohibits paying or receiving a commission, bonus, rebate or other payment for referring patients, regardless of payer.

Arrangements that most often draw scrutiny include:

• Marketing and referral arrangements
• Medical directorships
• Leases between providers
• Corporate structure and ownership
• Purchase and sale transactions
• Compensation arrangements of any kind

Federal safe harbors protect certain arrangements, but only if every element is met. Close is not enough. A documented fair-market-value analysis, a written signed agreement and a legitimate business purpose are your best defense.

A common scenario: A clinic hires a marketing company and pays it a percentage of the revenue from every new patient it generates. If the marketer is actually steering patients to the clinic, the arrangement may look like paying for referrals. A flat-fee structure, clear scope of services and proper documentation can change the analysis. This is exactly the sort of question to ask counsel before you sign.

Stark Law and Self-Referral Rules

The Stark Law restricts a physician from referring Medicare patients for certain designated health services to an entity with which the physician or an immediate family member has a financial relationship, unless an exception applies. Florida's Patient Self-Referral Act of 1992 adds state-level restrictions.

The key difference from the Anti-Kickback Statute: Stark is a strict liability law. Intent does not matter. If the arrangement does not meet an exception, the claim is non-payable, even if everyone acted in good faith. Consequences can include refunds, civil monetary penalties and False Claims Act exposure.

Stark issues often arise in:

• Employment and compensation arrangements
• Space and equipment leases
• Medical directorships and professional services agreements
• Practice acquisitions, joint ventures and ownership interests
• Imaging, laboratory, physical therapy and surgery center relationships

The details matter. Whether a lease is compliant can depend on a signature date, a missing renewal or a rent amount that drifted from fair market value. Periodic review of existing agreements catches these problems early.

Fraud and Abuse: When Something Goes Wrong

Fraud and abuse enforcement covers false claims, improper financial relationships and billing practices. Whistleblower complaints from employees, competitors and former business partners are a common way these cases begin.

Counsel regularly helps with:

• Structuring complex business arrangements
• Unwinding a transaction or venture that raises compliance concerns
• Due diligence reviews before buying, selling or investing
• Group purchasing safe harbors
• Financial relationships with physicians
• Internal investigations and self-disclosures

If you identify a possible overpayment, there are generally deadlines for reporting and returning it, and federal self-disclosure programs may be an option in some situations. How you handle the first few weeks can shape the outcome. Bring in counsel early so the review is protected by privilege and the response is handled correctly.

Fee Splitting

Fee splitting is a frequent trap in Florida, particularly in percentage-based arrangements between professionals and billing companies, management companies or marketers. If you pay a percentage of collections or revenue to someone other than a partner or employee, have the agreement reviewed. Violations can expose the licensed professional to board discipline and can make the contract itself unenforceable.

EMTALA

EMTALA, the federal anti-dumping law, requires hospitals with emergency departments to provide a medical screening examination and stabilizing treatment regardless of ability to pay. Investigations can involve OIG and AHCA, and both hospitals and on-call physicians can be affected.

Legal support is most often needed for:

• Developing or updating EMTALA policies for hospitals and medical staffs
• Investigating possible compliance errors
• Responding when a provider receives a subpoena or notice of an EMTALA investigation
• OIG and AHCA investigations and enforcement actions

HIPAA and Florida Privacy Compliance

HIPAA requires covered entities and business associates to protect patient information. Florida's Information Protection Act (FIPA) adds state breach-notification duties and applies in addition to HIPAA.

A defensible compliance program includes:

• HIPAA privacy and security policies and procedures
• A current security risk assessment
• Business associate agreements with every vendor that touches patient data
• Documented workforce training
• A breach response plan with clear reporting steps
• Review of any OIG Corporate Integrity Agreement obligations

Regulators ask whether policies are actually followed, not only whether they exist. Keep training records and update your risk assessment on a regular schedule.

Emerging Industries: Peptides, Stem Cells and Medical Marijuana

New service lines often move faster than the regulations governing them. Regulators are paying close attention to several of them.

Peptide businesses. Oversight is increasing. Whether you are launching a peptide company, running a wellness clinic, manufacturing products or expanding a telehealth platform, compliance planning should cover FDA considerations, advertising and marketing claims, business structure, contracts, licensing and risk management.

Stem cell practices. There are no off-the-shelf solutions. Between regulation, training and marketing, there is a lot to address in a short time. Even highly trained clinicians benefit from counsel at the start, because it saves time and money later.

Medical marijuana and CBD. Florida's medical marijuana law, and the Department of Health rules under it, change over time. Physicians who recommend or prescribe need to keep up with current requirements to run a compliant practice.

If you are launching one of these lines, our guidance for wellness businesses and telemedicine and telehealth providers may also apply.

A Practical Compliance Checklist for Your Practice

1. List every referral source and financial relationship with physicians, vendors, marketers and other providers.
2. Confirm each arrangement is in writing, signed before services begin, and supported by a fair-market-value analysis.
3. Review percentage-based compensation for fee-splitting and patient brokering risk.
4. Calendar renewals, expirations and rent or compensation changes in every lease and services agreement.
5. Update your HIPAA security risk assessment and refresh staff training at least annually.
6. Run due diligence before every acquisition, joint venture or new service line.
7. Create a written procedure for responding to subpoenas, audits and employee complaints.
8. Have counsel review changes before they take effect, not after.

Many practices also keep outside general counsel on call so these questions get answered quickly as the business changes.

When to Call a Healthcare Regulatory Attorney

Contact counsel if you:

• Received a subpoena, audit letter, CID or notice of investigation
• Are drafting or renewing a medical directorship, lease or compensation arrangement
• Are buying, selling or merging a practice (see healthcare business transactions and mergers and acquisitions)
• Suspect a billing error, overpayment or privacy breach
• Are launching a new service line
• Run a lab, pharmacy or DME business with referral relationships (see laboratory compliance, pharmacy law and durable medical equipment)

Talk to a Florida healthcare regulatory attorney

Schedule a free, no-obligation consultation. Call (561) 455-7700 or toll-free (888) 455-7702, or contact our team online.

Our attorneys represent physicians, clinics, hospitals, treatment centers, physician groups, surgery centers, imaging centers and healthcare business owners. Meet our team.

Frequently Asked Questions

What is the difference between the Anti-Kickback Statute and the Stark Law? The Anti-Kickback Statute is a criminal law that requires intent to induce or reward referrals. The Stark Law is a civil strict liability law that applies to physician referrals for designated health services. An arrangement must satisfy both, if both apply.

Does Florida have its own anti-kickback law? Yes. Florida's Patient Brokering Act and related statutes prohibit referral payments and, unlike the federal statute, are not limited to federal healthcare programs.

Can a clinic pay a marketing company a percentage of revenue? It depends on what the marketer does and how the payment is structured. Percentage-based compensation raises both patient brokering and fee-splitting concerns, so it should be reviewed by counsel before signing.

What should I do if I receive a subpoena or audit letter? Do not respond or discard documents. Preserve all records and contact a healthcare attorney right away.

What should I do if I discover a possible overpayment? There are generally deadlines to report and return overpayments once identified. Speak with counsel promptly about your options, including whether a self-disclosure is appropriate.

Do HIPAA and Florida law both apply to a data breach? Often yes. HIPAA sets federal breach notification duties, and Florida's Information Protection Act adds state requirements. Both should be evaluated.