Health care organizations in the United States come in several types — non-profit and for-profit hospitals, ambulatory clinics, long-term care facilities, and integrated networks that tie them together — and all of them operate under an overlapping set of federal laws governing Medicare participation, emergency treatment, patient privacy, fraud, self-referral, and billing transparency. Understanding how those categories work, and which rules attach to which activities, is the starting point for anyone evaluating how a provider organization is structured or how it stays out of trouble with regulators.
Non-Profit and For-Profit Structures
The first fork in the road is tax status. Non-profit health care organizations qualify for federal income tax exemption under Internal Revenue Code Section 501(c)(3) when they are organized and operated exclusively for charitable, educational, scientific, or similar purposes.1Office of the Law Revision Counsel. 26 U.S. Code 501 – Exemption From Tax on Corporations, Certain Trusts, Etc. The IRS reads “charitable” broadly, covering relief of the poor, advancement of education or science, and lessening the burdens of government.2Internal Revenue Service. Exempt Purposes – Internal Revenue Code Section 501(c)(3)
The trade for that exemption is strict: no part of a non-profit’s net earnings can benefit any private shareholder or individual.3Internal Revenue Service. Charitable Hospitals – General Requirements for Tax-Exemption Under Section 501(c)(3) Surplus revenue goes back into the mission. Non-profit hospitals also have to satisfy Section 501(r), added by the Affordable Care Act: they must conduct a community health needs assessment, maintain a written financial assistance policy, limit charges for patients who qualify for that assistance, and follow specific billing and collection restrictions.4Internal Revenue Service. Requirements for 501(c)(3) Hospitals Under the Affordable Care Act – Section 501(r) Falling short of those requirements can cost the hospital its exemption.
For-profit organizations are fully taxable and distribute net earnings to owners or shareholders. Patient care standards are the same, but the financial incentives differ. Duties to investors can influence which services get offered, which markets get entered, and how tightly costs get managed.
Types of Facilities
Inpatient Care
Acute care hospitals provide round-the-clock medical and nursing care for short-term illness, injury, or surgery. Specialty hospitals narrow their scope — cardiac care, orthopedics, rehabilitation — and psychiatric hospitals serve patients with severe mental health conditions needing continuous supervision. What ties inpatient facilities together is the expectation of an overnight stay and 24-hour staffing.
Ambulatory Care
Ambulatory care is any service that does not require an overnight stay: physician offices, community health centers, urgent care clinics, and ambulatory surgical centers where patients have procedures and go home the same day. This category has expanded steadily as procedures that once required a hospital admission can now be done on an outpatient basis, often at lower cost.
Long-Term and Post-Acute Care
Skilled nursing facilities provide 24-hour nursing and rehabilitative services for patients who need more than home-based care. Home health agencies deliver skilled nursing, physical therapy, and other clinical services in the patient’s residence. Federal staffing rules for nursing facilities have moved in recent years; CMS adopted minimum staffing requirements in 2024 and then repealed them in December 2025, so as of 2026 there is no active federal hours-per-resident-day standard, though individual states may impose their own.
Integrated Systems, ACOs, and HMOs
Standalone facilities increasingly sit inside larger structures designed to coordinate care and manage cost. An integrated delivery system owns or manages a network of providers — hospitals, physician groups, sometimes insurance plans — under one organizational umbrella, with the aim of standardizing care and reducing duplication as patients move between settings.
Accountable Care Organizations take a different approach. They are voluntary groups of doctors, hospitals, and other professionals who coordinate care for a defined patient population, typically Medicare beneficiaries.5Centers for Medicare & Medicaid Services. Accountable Care and Accountable Care Organizations Payment ties to quality and cost outcomes: when an ACO improves quality while reducing Medicare spending, participating providers share in a portion of the savings. Patients assigned to an ACO keep their normal Medicare rights, including the freedom to see any provider that accepts Medicare.6Medicare. Coordinating Your Care
Health Maintenance Organizations collect a fixed prepaid fee per member per month in exchange for covering a defined set of services. That capitated model puts financial risk on providers in the HMO’s network, which creates an incentive to manage utilization and keep members healthy rather than treat them once they are sick. HMOs typically require members to pick a primary care physician and get referrals before seeing specialists.
The Corporate Practice of Medicine Doctrine
One structural constraint on how these systems get built is the corporate practice of medicine doctrine. Several states — including California, Texas, New York, Illinois, Ohio, Colorado, Iowa, and New Jersey — prohibit non-physician-owned corporations from directly employing physicians to provide outpatient medical services. The rationale is that clinical judgment should not be controlled by an unlicensed business entity. Organizations in those states work within the rule by having physicians hold ownership interests, or by using management services organizations that handle the administrative side while a physician-owned entity controls clinical decisions.
Federal Participation Standards and Accreditation
Any health care organization that wants to bill Medicare or Medicaid has to meet federal Conditions of Participation. CMS writes these standards, which cover governing body structure, patient rights, infection control, pharmaceutical services, discharge planning, and more.7Centers for Medicare & Medicaid Services. Conditions for Coverage and Conditions of Participation Hospitals in particular must comply with dozens of individual conditions in 42 CFR Part 482 spanning medical staff qualifications, nursing services, emergency preparedness, and quality improvement.8eCFR. 42 CFR Part 482 – Conditions of Participation for Hospitals
CMS does not survey every facility directly. The system leans on accreditation. Organizations like The Joint Commission run their own surveys against standards CMS has recognized as equivalent to federal requirements. A hospital accredited by an approved organization gets “deemed status,” meaning it does not need a separate CMS survey to participate in Medicare and Medicaid.9National Center for Biotechnology Information. Medicare and Medicaid Accreditation and Deemed Status Losing accreditation can mean losing access to Medicare reimbursement, which for most hospitals would be financially devastating.
EMTALA and Emergency Treatment
Any hospital that participates in Medicare and has an emergency department has to comply with the Emergency Medical Treatment and Labor Act. EMTALA requires the hospital to provide an appropriate medical screening examination to anyone who comes to the emergency department and requests treatment, whether or not that person has insurance or the ability to pay.10Centers for Medicare & Medicaid Services. Emergency Medical Treatment and Labor Act (EMTALA) If the screening finds an emergency medical condition, the hospital must either stabilize the patient with the staff and resources it has, or arrange an appropriate transfer to a facility that can.11Office of the Law Revision Counsel. 42 U.S. Code 1395dd – Examination and Treatment for Emergency Medical Conditions and Women in Labor
Violations carry civil penalties of up to $50,000 per violation, or up to $25,000 per violation for hospitals with fewer than 100 beds. Individual physicians responsible for a violation face the same $50,000 cap, and in cases of gross, flagrant, or repeated violations, they can be excluded from Medicare and state health care programs entirely.11Office of the Law Revision Counsel. 42 U.S. Code 1395dd – Examination and Treatment for Emergency Medical Conditions and Women in Labor
HIPAA: Privacy, Breaches, and Penalties
The Health Insurance Portability and Accountability Act is the federal framework for protecting patient health information. HIPAA’s Privacy and Security Rules apply to covered entities — health plans, health care clearinghouses, and health care providers who transmit information electronically — and to their business associates, all of whom must implement safeguards for protected health information.12U.S. Department of Health and Human Services. Covered Entities and Business Associates A covered entity that hires a business associate to perform health care functions has to have a written contract requiring the associate to comply with HIPAA.13Centers for Medicare & Medicaid Services. Are You a Covered Entity
When unsecured health information is breached, notification deadlines depend on scale. Breaches affecting 500 or more individuals require the covered entity to notify the affected individuals and HHS’s Office for Civil Rights within 60 days of discovery, and to alert prominent media outlets in the affected area. Breaches affecting fewer than 500 individuals still require individual notice within 60 days of discovery, but HHS reporting can wait until within 60 days after the end of the calendar year in which the breach was discovered.14eCFR. 45 CFR 164.408 – Notification to the Secretary
Penalties follow a four-tier structure based on culpability. For 2026, the minimum penalty per violation ranges from $145, where the entity did not know and could not reasonably have known about the problem, up to $73,011 for willful neglect that the entity failed to correct within 30 days. The maximum annual penalty for all violations of a single HIPAA provision is $2,190,294. HHS adjusts these figures annually for inflation.
Healthcare Fraud and Abuse Laws
Three federal statutes do most of the work in health care fraud enforcement, and organizations billing Medicare or Medicaid have to keep track of all of them. They operate differently, and the differences matter.
The False Claims Act
The False Claims Act reaches anyone who knowingly submits, or causes the submission of, false claims for payment to a federal program. “Knowingly” is not limited to intentional fraud; it also covers deliberate ignorance and reckless disregard of whether a claim is accurate.15Office of Inspector General. Fraud and Abuse Laws Liability also extends to using a false record material to a fraudulent claim, or improperly avoiding an obligation to pay the government.16U.S. Department of Justice. Civil Division – The False Claims Act
Recoveries include three times the government’s actual damages plus a per-claim civil penalty adjusted annually for inflation. As of 2025, that per-claim penalty runs from $14,308 to $28,619. Because each individual service billed can count as its own claim, penalties compound quickly in systematic overbilling cases.
The Act also has a strong whistleblower provision. A private individual with knowledge of fraud against a federal program can file suit on the government’s behalf — a qui tam action. If the government takes over the case, the whistleblower gets between 15% and 25% of the recovery. If the government declines and the whistleblower proceeds alone, the share rises to between 25% and 30%.17Office of the Law Revision Counsel. 31 U.S. Code 3730 – Civil Actions for False Claims Those incentives have made qui tam cases one of the most productive tools in health care fraud enforcement.
The Anti-Kickback Statute
The Anti-Kickback Statute is criminal. It makes it a felony to knowingly and willfully offer, pay, solicit, or receive anything of value in exchange for patient referrals, or to generate business payable by a federal health care program.18Congress.gov. Health Care Fraud and Abuse Laws Affecting Medicare and Medicaid: An Overview “Remuneration” is intentionally broad: cash, gifts, free services, below-market leases, and anything else that could function as an incentive to steer patients.
Unlike the False Claims Act, the AKS requires proof that the person acted knowingly and willfully. Penalties include criminal fines, imprisonment, and exclusion from all federal health care programs.15Office of Inspector General. Fraud and Abuse Laws The statute has safe harbors — specific arrangement types exempt from prosecution — but fitting neatly inside one requires careful structuring, and a good-faith belief that a payment “wasn’t really a kickback” is not a defense.
The Stark Law
The Stark Law, codified at 42 U.S.C. § 1395nn, prohibits a physician with a financial relationship with an entity from referring Medicare patients to that entity for designated health services, unless the arrangement fits within a specific statutory exception.19Office of the Law Revision Counsel. 42 U.S. Code 1395nn – Limitation on Certain Physician Referrals Designated health services is a long list: clinical laboratory services, physical and occupational therapy, radiology and imaging, radiation therapy, durable medical equipment, home health services, outpatient prescription drugs, and inpatient and outpatient hospital services, among others.20Centers for Medicare & Medicaid Services. Physician Self-Referral
Stark is strict liability. Intent is irrelevant. If a physician has a financial relationship with an entity, refers a Medicare patient for a designated health service, and the arrangement does not fit squarely within an exception, the law has been violated even if the arrangement was entirely accidental. The entity cannot bill Medicare for the service, has to refund any amounts already collected, and faces civil penalties of up to $15,000 per service. Schemes designed to circumvent the law carry penalties up to $100,000.19Office of the Law Revision Counsel. 42 U.S. Code 1395nn – Limitation on Certain Physician Referrals For 2026, the limited remuneration exception permits compensation arrangements of up to $6,237 per year without triggering the full exception requirements, though the compensation still has to reflect fair market value.
Price Transparency and the No Surprises Act
Hospital Price Disclosure
Federal rules require hospitals to publicly disclose their standard charges for all items and services. As of January 1, 2026, hospitals must publish pricing data using CMS’s v3.0 data schema, with enforcement of the new format starting April 1, 2026. Required files must include payer-specific negotiated rates, use CMS-approved code and rate-type values, and appear on the hospital’s website in a machine-readable format with no login barriers or data collection. A senior official at each hospital attests to the data’s accuracy and completeness.
Surprise Billing Protections
The No Surprises Act, which took effect in 2022, protects patients with job-based or individual health insurance in three situations: emergency care at any facility, non-emergency care from out-of-network providers at in-network facilities, and air ambulance services from out-of-network providers.21Office of the Law Revision Counsel. 42 U.S. Code 300gg-111 – Preventing Surprise Medical Bills In those situations, patient cost-sharing is calculated as if the provider were in-network, and the payments count toward in-network deductibles and out-of-pocket maximums.
When the provider and the insurer disagree on payment, the two sides first enter a 30-business-day open negotiation period. If they cannot settle, either party can initiate the federal Independent Dispute Resolution process within four business days after negotiations end.22Centers for Medicare & Medicaid Services. About Independent Dispute Resolution A certified IDR entity reviews the offers and supporting information from each side and picks one. The losing side pays within 30 calendar days. For uninsured or self-pay patients, the law separately requires providers to give good-faith estimates of expected charges before scheduled services.23Centers for Medicare & Medicaid Services. Overview of Rules and Fact Sheets
How the Rules Stack in Practice
A single patient encounter can trigger EMTALA screening duties, HIPAA privacy protections, CMS billing rules, Stark referral restrictions, and Anti-Kickback safe harbor analysis all at once. That is why compliance infrastructure is a real operational investment, not a paperwork exercise. Organizations that treat it as the latter tend to learn about their gaps only after a whistleblower files a qui tam suit or an audit flags a billing pattern, and by that point the treble damages, per-claim penalties, and program exclusion risks can dwarf whatever short-term gain the underlying conduct produced.