Post-Pandemic Regulatory Enforcement: State-Level Vigilance vs. Federal Aggression in Healthcare and Government Contracts

The post-pandemic regulatory landscape in the U.S. has been defined by a stark divergence between state-level enforcement rigor and federal-level assertiveness, particularly in healthcare and government contracts. While federal agencies have doubled down on aggressive strategies-such as expanding the False Claims Act (FCA) and modernizing procurement rules-state governments have adopted a more fragmented but equally impactful approach, often leveraging technology and localized priorities to address fraud and compliance gaps. For investors, understanding this duality is critical to navigating risk and opportunity in sectors where regulatory scrutiny directly shapes profitability and operational resilience.

Healthcare: Federal Overreach and State-Level Innovation

Federal enforcement in healthcare has reached unprecedented levels under the Trump administration. The Department of Justice (DOJ) secured nearly $3 billion in settlements in fiscal year 2024, with a sharp focus on Medicare Advantage fraud and AI-driven documentation practices. The launch of the DOJ-HHS FCA Working Group in July 2025 underscores a strategic shift toward inter-agency coordination, targeting high-cost treatments and risk adjustment data. This federal push is amplified by the expansion of the Corporate Whistleblower Awards Pilot Program, which now includes federal healthcare programs, incentivizing internal reporting of misconduct.

Meanwhile, states are carving their own paths. California, for instance, has mandated human oversight in AI applications for therapy services and insurance denials, reflecting a broader trend of state-level innovation in regulating emerging technologies. The disbanding of the Healthcare Infection Control Practices Advisory Committee (HICPAC) in late 2025 has further decentralized guidance, leaving states to interpret infection control standards independently. This patchwork approach creates compliance challenges for multi-state healthcare providers, particularly as UPIC audits intensify, leveraging data analytics to flag billing irregularities.

The federal-state contrast is also evident in Medicaid reforms. While the federal government has introduced cost-containment models like the Global Benchmark for Efficient Drug Pricing (GLOBE) and the Guarding U.S. Medicare Against Rising Drug Costs (GUARD) Model under the federal health policy update, states are experimenting with localized solutions. For example, California's recent procurement fraud cases highlight the risks of decentralized oversight, with improper hiring practices and mismanagement of public funds exposing systemic vulnerabilities.

Government Contracts: Federal Procurement Overhaul and State-Level Scrutiny

Federal procurement rules have undergone a seismic shift since 2020. The 2025 overhaul of the FAR, which retired over 500 provisions, has created ambiguity for contractors accustomed to rigid compliance frameworks. Simultaneously, the Department of Defense's CMMC 2.0 mandate has raised cybersecurity standards, requiring contractors to maintain real-time compliance certifications and address gaps within 180 days. These changes, coupled with the FAR Council's extension of CUI safeguarding obligations to all federal contractors, have heightened FCA risks for firms failing to adapt.

At the state level, enforcement has taken a more forensic turn. The Treasury's audit of the SBA 8(a) Business Development Program, launched in late 2025, is a case in point. This initiative targets pass-through contracts where large firms dominate work execution while small businesses receive minimal compensation, a practice that has cost taxpayers over $9 billion. Similarly, California's State Auditor identified $875,000 in unprocessed payments and fraudulent hiring schemes within state agencies, illustrating the scale of mismanagement even in non-federal procurement.

The federal-state dynamic is further complicated by divergent priorities. While the Office of Federal Contract Compliance Programs (OFCCP) has rolled back affirmative action mandates, under Executive Order 11246, states like Florida have maintained stringent DEI requirements, creating compliance conflicts for multi-jurisdictional contractors. This regulatory dissonance is particularly acute in cybersecurity, where federal CMMC 2.0 standards coexist with state-specific data protection laws, increasing operational complexity.

Investment Implications: Compliance as a Competitive Advantage

For investors, the post-pandemic regulatory environment demands a nuanced approach. In healthcare, companies with robust compliance programs-particularly those integrating AI oversight and proactive self-disclosure mechanisms-are better positioned to withstand federal and state audits. Conversely, firms reliant on legacy billing practices face elevated FCA exposure, as evidenced by the DOJ's $54.4 million settlement with Ceratizit USA for customs duty evasion.

In government contracts, the shift toward commercial-style procurement and cybersecurity accountability favors firms with agile compliance frameworks. However, the ambiguity surrounding revised FAR provisions and CMMC 2.0 creates short-term risks, particularly for small-to-midsize contractors lacking resources for continuous compliance updates. States' audits of preference-based programs also signal a long-term trend: investors should prioritize firms with transparent supply chains and diversified contract portfolios to mitigate regional enforcement shocks as highlighted in emerging minefields in federal procurement.

Conclusion: Navigating a Fragmented Regulatory Future

The post-pandemic era has cemented regulatory enforcement as a defining factor in healthcare and government contracts. While federal agencies have embraced a top-down, technology-driven approach, states have adopted a more experimental and localized strategy. For investors, the key lies in identifying companies that treat compliance not as a cost center but as a strategic asset. As both federal and state regulators continue to refine their tools-whether through AI-driven audits or cybersecurity mandates-the ability to adapt to this dual-layered enforcement regime will separate resilient businesses from vulnerable ones.