February 2026 in review: Extenders pass, margins settle, UMMC goes offline

A spending law secured key hospital programs, Kaufman Hall described a flat but fragile 2025, and a ransomware attack shut an academic system's clinics.

February delivered welcome policy relief, a sober read on 2025 finances and a reminder that cyber risk remains an operational risk, not only an IT one.

Spending law extends telehealth, hospital at home and DSH relief

On Feb. 3, the president signed the Consolidated Appropriations Act, 2026, a roughly $1.2 trillion package that cleared the House by 217-214. For hospitals, the health extenders mattered most:

• Acute hospital care at home: waivers extended through September 2030.
• Medicare telehealth flexibilities: extended through 2027.
• Medicaid DSH: scheduled cuts held off until 2028.
• Medicare-Dependent Hospital and low-volume adjustment: extended through 2026.

The longer hospital-at-home runway changes the investment math. Programs that were hard to justify on year-to-year extensions now have a multi-year window to scale. Note, too, that MDH and low-volume support run only through 2026, so rural finance teams face another cliff within a year. The law also reauthorized the Dr. Lorna Breen Health Care Provider Protection Program, which funds clinician well-being efforts, and streamlined enrollment for out-of-state providers treating Medicaid and CHIP patients, which eases care for patients who cross state lines for treatment.

Kaufman Hall: 2025 margins held, but the mix worsened

Kaufman Hall’s year-end National Hospital Flash Report, drawn from more than 1,300 hospitals, found operating margins stable through December. Underneath, expenses rose across categories, while bad debt, uninsured volumes and charity care all increased. Revenue tilted further toward government payers and away from commercial plans, and the gap between gross and net revenue persisted. The firm’s advice was blunt: hospitals without an outpatient footprint will struggle as demand migrates to ambulatory settings.

Ransomware closes all UMMC clinics

In late February, a ransomware attack forced the University of Mississippi Medical Center to take its systems offline, including its Epic record, and close all 35 of its clinics statewide. Hospitals and emergency departments stayed open on paper, but chemotherapy and elective procedures were canceled, and the FBI joined the response. Mississippi’s only academic medical center illustrates how quickly an attack becomes an access-to-care crisis for an entire state. Early coverage could not say how much patient data was exposed or how long recovery would take, the two questions every board should be able to answer about its own organization.

Deal notes

Consolidation continued. Prime Healthcare Foundation took on Central Maine Healthcare and its 250-bed Lewiston hospital, bringing its nonprofit portfolio to 21 hospitals in eight states.

Sources

• Congressional Bill H.R. 7148 Signed into Law (White House)
• Congress Extends Key Hospital Priorities in Latest Spending Bill (HAP)
• Hospital finances' 'new normal' (Becker's)
• Mississippi health system shuts down clinics statewide after ransomware attack (NPR via HPPR)
• Signed and scrubbed: February 2026 hospital M&A (Healthcare Brew)