Healthcare Empowered

Cybersecurity, Data Privacy & HIPAA

• Fragmented identity systems across healthcare force patients to maintain separate credentials for patient portals, EHRs, pharmacies, PBM claims platforms, and insurer authorization — multiplying security risks and driving the average cost of a healthcare data breach to $7.42 million in 2025, the highest of any industry for the 12th consecutive year. Most breaches are credential-driven, yet the majority of healthcare organizations still rely on password-based authentication, making credential stuffing attacks — where one breached account enables access to others — a widespread threat. HIPAA, the HITECH Act, NIST, and the Joint Commission for Hospital Accreditation all recommend phishing-resistant MFA methods such as passkeys and magic links, while SMS one-time passwords are considered insufficient for healthcare environments. Fine-grained access control addresses over-permissioning by enabling least-privilege permissions and proxy access — allowing, for example, a caregiver to manage a patient’s appointments without accessing full medical records — without requiring credential sharing, which violates HIPAA. Compliance with interoperability standards such as SMART on FHIR, which uses OpenID Connect and OAuth to connect healthcare apps to EHR systems, is becoming essential as AI agents like ChatGPT Health require secure, standards-based access to health records. Source: MedCity News
• South Texas Oncology and Hematology agreed to pay $1,075,000 to settle a class action lawsuit arising from a February 2024 cyberattack that exposed the personal and health data of 176,303 individuals. An unauthorized actor accessed the San Antonio provider’s network on February 15, 2024, potentially obtaining names, contact information, dates of birth, health information, and Social Security numbers. Multiple lawsuits were consolidated into Flores v. South Texas Oncology and Hematology, PLLC, alleging the provider failed to implement reasonable cybersecurity measures. Under the settlement, which has received court approval pending a final fairness hearing on July 21, 2026, class members may claim up to $5,000 in documented losses or an estimated $100 pro rata cash payment, plus two years of medical data monitoring services. Claims must be submitted by July 6, 2026, and objections or exclusion requests are due by June 22, 2026. Source: HIPAA Journal
• Research institutions deploying AI on biobank and multi-omics datasets face consent gaps that expose them to HIPAA violations, OCR investigations, state attorney general enforcement, and class action lawsuits because historical consent forms did not authorize AI analysis, cross-dataset integration, or commercial applications. Under the Common Rule and HIPAA, informed consent must be both “informed” and “specific,” and broad “future research” language does not cover AI-driven commercial uses; violations can result in millions in fines and suspension of research activities by OHRP. Genomic data compounds the risk because it is immutable, familial, and perpetually re-identifiable — research shows just 15 demographic attributes can uniquely identify 99.98% of Americans, and AI-driven combination of genomic, proteomic, metabolomic, and clinical data creates a profile no traditional de-identification technique can protect. An additional exposure arises when researchers use commercial AI tools such as ChatGPT or Claude to draft grant applications, potentially violating funder confidentiality requirements, institutional IP policies, and collaborator NDAs. To mitigate these risks, institutions must audit existing consent forms for AI authorization gaps, update consent templates to address algorithmic processing and commercial uses, establish AI use policies for grant submissions, strengthen vendor contracts to include data retention and re-identification indemnification clauses, and engage IRBs early to update review criteria for AI-specific risks. Source: Healthcare Law Insights
• HHS is set to finalize the first HIPAA update in more than a decade, eliminating the distinction between “required” and “addressable” security rules and making all cybersecurity and physical security measures mandatory for healthcare providers. Under the updated rule, protocols such as two-factor authentication, data encryption, and network segmentation will be required for all providers, and organizations must demonstrate actual implementation of access control, intrusion detection, and visitor management tools — not merely document policies. Physical security measures will be treated as core requirements, reflecting the reality that unsecured server rooms and uncontrolled facility access can enable cyberattacks that bypass even strong digital defenses. Most providers currently rely on fragmented, siloed security tools and lack the connected infrastructure needed to meet the integrated standards the update demands. Compliance will require unification of security systems and modernization of technology, with cloud migration identified as a path forward for hospitals across budget levels. Source: MedCity News
• The HIPAA Security Rule’s current encryption standards, including RSA-2048, are expected to become vulnerable to quantum computing and may not hold beyond 2030. In January 2025, the U.S. Department of Health and Human Services issued a notice of proposed rulemaking to update the HIPAA Security Rule, the first overhaul of healthcare data security obligations since 2013. NIST has already published post-quantum encryption replacements, but the proposed rule does not yet incorporate them. Healthcare data poses a compounded risk because records such as genomic profiles and clinical datasets do not expire, meaning data encrypted today could be harvested now and decrypted once quantum computing matures. Decisions made during this rulemaking cycle will determine whether electronic protected health information remains secure over the next 10 to 20 years. Source: IAPP

Fraud & Abuse Enforcement

• False Claims Act enforcement hit a record $6.8 billion in FY 2025, more than doubling the prior year’s $2.9 billion, with healthcare and life sciences accounting for $5.7 billion — roughly 83% — of total recoveries. Whistleblower-initiated qui tam filings reached 1,297, nearly double the prior 10-year annual average, and for the first time, relators recovered more in cases the government declined to join ($2.27 billion) than in cases it did ($2.23 billion), signaling that DOJ’s decision not to intervene no longer signals a case will collapse. At the same time, DOJ lost more than 5,000 employees in the first year of the second Trump administration, shut down over 900 federal fraud cases and more than 100 healthcare fraud matters, and proposed a FY 2026 budget cutting the FBI by $545 million — even as senior officials publicly named healthcare fraud a top enforcement priority and relaunched the DOJ-HHS FCA Working Group with six focus areas including Medicare Advantage, kickbacks, and EHR manipulation. A constitutional challenge in United States ex rel. Zafirov v. Florida Medical Associates, LLC is now before the Eleventh Circuit, with a panel that showed skepticism toward the government’s position at oral argument in December 2025, and observers expect an affirmance that could reach the Supreme Court. Healthcare providers should not treat DOJ’s staffing constraints as a reprieve, as the pipeline of pre-existing investigations continues to generate settlements, data analytics increasingly substitute for personnel, and the administration is also deploying the FCA against DEI practices and gender-affirming care billed to federal programs. Source: Arnall Golden Gregory LLP
• The HHS Office of Inspector General issued a favorable advisory opinion declining to impose sanctions on a three-phase ownership transfer plan for a California ambulatory surgical center, even though the arrangement could generate remuneration implicating the Federal Anti-Kickback Statute. The plan, structured around the retirement of a sole physician-owner and estate planning objectives, would transfer ASC ownership interests to his non-physician spouse at no cost, allow his two physician-children to purchase shares at fair market value, and ultimately pass remaining interests to those children through testamentary transfer. Financial distributions to investors qualified under the single-specialty and multi-specialty ASC safe harbors because all transactions were structured at fair market value, returns were proportional to capital investment, no financing assistance was provided to investors, and no investment terms were tied to referral volume. Transfers that fell outside safe harbor protection — including the spousal gift and the children’s share purchases — were nonetheless deemed low-risk because the spouse had no role in health care, the transfers were documented as bona fide succession planning, and the retiring physician committed to cease clinical practice, relinquish all governance roles, and certify no referral influence without directing his patient panel to any specific successor. The OIG’s opinion signals that family-based ownership succession in ASCs can survive Anti-Kickback scrutiny where referrals are functionally decoupled from ownership and transactions reflect legitimate estate planning rather than disguised remuneration. Source: Lamb McErlane PC

Texas Legislation & Compliance

• Under the Texas Covenants Not to Compete Act, courts are required — not permitted — to rewrite overbroad non-compete agreements rather than void them, a rule that carries consequences for both employers and employees. The statute mandates that courts reform unreasonable restrictions on time, geographic area, or scope of activity to the extent necessary to make them enforceable, and then enforce the agreement as rewritten — a process courts apply at every stage of litigation, including temporary injunction proceedings. Courts most frequently reform geographic scope and activity restrictions, tying geography to the territory where the employee actually worked and limiting activity restrictions to roles substantially similar to the employee’s prior position, as seen in Hipps v. CBRE, Inc. (2024) and Galderma Laboratories, L.P. v. Brenner (2026). When a court is forced to reform an overbroad agreement, the employer loses the right to recover attorneys’ fees and cannot pursue financial damages for breaches that occurred before the rewrite, leaving injunctive relief as the only available remedy. Reformation is not available when the underlying agreement is unenforceable, lacks adequate consideration, or when the non-compete has already expired. Source: Hendershot Cowart P.C.
• Texas HB 4224 requires covered healthcare entities to post instructions in two locations — on their website and at each physical facility — telling patients how to request medical records, contact the applicable licensing or disciplinary authority, and file a consumer complaint under Texas Health and Safety Code Section 181.103. The law, which passed the Texas House 149-0 and the Texas Senate 31-0, applies to any person or entity that assembles, collects, stores, transmits, or otherwise handles protected health information, including physicians, hospitals, clinics, mental health providers, and staffing agencies. Entities that exclusively perform claims processing, data processing, utilization review, or billing on behalf of another provider are exempt, but lose that exemption if they also provide direct patient-facing services. The postings must give step-by-step instructions — not merely a statement of rights — and a HIPAA Notice of Privacy Practices alone does not satisfy the requirement. Non-compliance does not create new criminal liability but can trigger investigations by the Texas Attorney General’s office or a provider’s licensing board. Source: Hendershot Cowart P.C.
• Texas Senate Bill 2544 requires out-of-network facility providers — hospitals, ambulatory surgery centers, freestanding emergency rooms, and birthing centers — to request mediation within 180 days of receiving an initial payment for a disputed service or forfeit the right to mediation and any civil action to recover the disputed amount. The law amends Texas Insurance Code Chapter 1467, which already required completion of Texas Department of Insurance mediation before filing suit, but previously set no deadline to initiate that process. The 180-day rule applies to disputes with TDI-regulated commercial health benefit plans and self-insured ERISA plans that have opted into the Chapter 1467 process, but does not cover Medicare, Medicaid, or ERISA plans that have not opted in. The deadline mirrors the existing 90-day arbitration window that already governed out-of-network non-facility providers such as physicians and physician groups under the same framework. The legislature’s stated intent was to create a consistent, time-limited dispute resolution system and eliminate the practice of filing batches of stale claims years after services were rendered. Source: Hendershot Cowart P.C.

Medicare Coverage & Reimbursement

• CMS is moving to eliminate reimbursement advantages for FDA breakthrough-designated devices while simultaneously creating a faster Medicare coverage pathway for the same class of products. The FY 2027 IPPS proposed rule would repeal the alternative New Technology Add-on Payment (NTAP) pathway, requiring all applicants — including FDA-designated breakthrough devices — to meet newness, cost, and substantial clinical improvement criteria beginning October 1, 2026; the same repeal would apply to the Transitional Pass-Through (TPT) program in the outpatient setting. On April 23, 2026, CMS and FDA jointly announced the RAPID (Medicare Regulatory Alignment for Predictable and Immediate Device) coverage pathway, under which eligible breakthrough devices — Class III devices and Class II devices in the FDA Total Product Life Cycle Advisory Program — that are the subject of an investigational device exemption study could receive a proposed national coverage determination the same day FDA grants market authorization, potentially compressing the coverage timeline from nine to twelve months to as little as two months. CMS has paused the Transitional Coverage for Emerging Technologies pathway to focus resources on RAPID implementation. Final IPPS policies are expected on or around August 1, 2026. Source: McDermott+

Practice Transactions & Business Models

• Concierge medicine is a $7.35 billion market projected to nearly double by 2030, as physicians across specialties abandon traditional insurance-based practice for membership models that charge patients a retainer fee in exchange for smaller patient panels, same-day access, and individualized care. Practices operate under two structures: hybrid models, which collect membership fees for enhanced access while continuing to bill insurance and Medicare for clinical services, and direct primary care models, which collect a periodic fee covering a defined scope of services and bill no third-party payers. Hybrid models reduce patient volume but retain CMS compliance obligations, while direct primary care models risk regulatory scrutiny as healthcare service plans if their scope of services is not properly structured. Membership agreements must disclose what fees cover, state that membership is not health insurance, specify termination and refund terms, and outline patient obligations. In California, only licensed physicians may own a medical practice under Business and Professions Code § 2400, and concierge arrangements—often structured as Professional Medical Corporations with a Management Services Organization—require legal counsel to navigate corporate, contractual, and patient-transition requirements. Source: Nossaman
• Home health and hospice M&A deal volume in the second half of 2025 reached its highest level since 2021, but buyers are applying tighter underwriting standards than during the 2019–2022 peak. Rising interest rates and constrained credit markets in 2023 and 2024 reduced leverage and compressed EBITDA add-back tolerance from roughly 20% down to 12–15%, and that discipline has carried into 2026. Hospice platforms with compliance records, diversified payor mix, and consistent growth are trading at 10x–15x EBITDA, while assets with inconsistent documentation or weak infrastructure face pricing reductions and extended diligence. Buyers now prioritize revenue durability, documentation quality, eligibility support, operational scalability, and technology infrastructure over geography or EMR system ownership. For sellers, preparation — not market timing — determines whether a transaction closes at expected value, as compliance gaps and fragmented systems increasingly result in purchase price adjustments, escrows, or deal failure. Source: Arnall Golden Gregory LLP

Employee Benefits & Pharmacy

• Employers can legally reimburse employees for GLP‑1 medications purchased through direct-to-consumer platforms using Health Reimbursement Arrangements (HRAs), despite widespread broker advice to the contrary. Platforms including Hims, Lilly Direct, and NovoCare offer GLP‑1 drugs at $149–$449 per month — versus $1,000-plus through traditional pharmacy channels — and their terms restrict reimbursement from “commercial insurance,” not from employer-funded HRAs, which carry no underwriter and involve no risk transfer. Lilly Direct’s checkout flow (fulfilled through Gifthealth) expressly invites HSA and FSA reimbursement, and a participant-directed HRA mirrors that same transaction structure: the employee pays cash at the point of sale and submits for reimbursement afterward from a separate employer account. Brokers and benefits vendors who advise against these arrangements are often commercially aligned with the carriers and PBMs that lose margin when prescriptions leave the traditional channel. Employers should retain independent benefits counsel to evaluate platform-specific terms and HRA plan design before accepting a blanket “too risky” conclusion. Source: Amundsen Davis

Medical Malpractice

• Strokes are among the most commonly misdiagnosed conditions in the United States, and the errors that give rise to malpractice liability occur before, during, and after the event itself. Grounds for a claim include failure to order diagnostic tests, failure to treat known risk factors such as high blood pressure and diabetes, misdiagnosis as conditions including migraines, seizures, or sepsis, delayed or absent treatment after a correct diagnosis, and medication errors involving blood thinners, anticoagulants, or antiplatelet drugs. Errors by emergency responders and ER staff — including triage failures and surgical mistakes — also support liability, as does failure to monitor a patient after initial treatment. Florida law imposes strict timing requirements on malpractice claims, making prompt action necessary for anyone who believes a stroke was mishandled. Patients or family members with concerns should gather medical records, document the basis for their suspicions, and consult an attorney. Source: Searcy Law

Fraud, Abuse & Government Enforcement

• The HHS Office of Inspector General will not impose sanctions on a Medicare Advantage organization that proposes to share a percentage of its savings with employer groups through its Employer Group Waiver Plans. The arrangement would involve the MA organization making “Gainshare Payments” to groups such as employers, trusts, and unions when a negotiated medical expense ratio falls below an agreed-upon target, with payments typically issued in the third quarter of the following year. OIG concluded that the arrangement would generate prohibited remuneration under the Federal anti-kickback statute if the requisite intent were present, and no safe harbor applies. OIG nonetheless found the fraud and abuse risk sufficiently low because the Gainshare Payment is not guaranteed, does not affect amounts CMS pays to the MA organization, and each group must contractually use any payment to benefit enrollees. The opinion applies only to the requesting entity and could be modified or terminated if CMS rules governing EGWP operation or payment materially change. Source: OIG Advisory Opinion No. 26-07
• IBM agreed to pay more than $17 million to settle allegations it violated the False Claims Act by failing to comply with Title VII anti-discrimination requirements while holding federal contracts. The government alleged IBM tied bonus compensation to diversity targets, used diverse interview slates in hiring decisions, set race and sex demographic goals for business units, and restricted training programs based on race, color, national origin, or sex. IBM denies the allegations but received cooperation credit under DOJ guidelines, though the damages multiplier exceeded 2x. The settlement follows prior legal challenges, including a June 2024 lawsuit by Missouri claiming IBM gave hiring preference to certain races and an August 2024 suit by a white former employee alleging termination based on racial quotas. IBM disbanded its DEI department in April 2025, and Deputy Attorney General Todd Blanche issued a memo in May 2025 instructing DOJ attorneys to use the False Claims Act against recipients of federal funds that promote DEI policies the Administration deems unlawful. Source: ArentFox Schiff
• The Department of Health and Human Services Office of Inspector General issued Advisory Opinion 25-11 establishing guidance for pharmaceutical and medical device manufacturers on discount and rebate arrangements under the Federal Anti-Kickback Statute. The opinion addresses four discount structures: upfront discounts, upfront discounts with purchase requirements, bundled upfront discounts with purchase requirements, and bundled rebates. OIG permits arrangements outside the Discount Safe Harbor when they use objective, transparent metrics and do not emphasize exclusivity, impede competitor sales, or require customers to switch from competing products. Manufacturers must clearly disclose discounts and rebates in invoices and documentation to enable customers to determine and report net prices for payer program purposes. When safe harbor compliance is not feasible, manufacturers must conduct and document risk assessments that evaluate transparency, absence of intent to induce inappropriate utilization, preservation of clinical judgment, commercial reasonableness, and absence of steering federal program business. Source: Gardner Law
• The HHS Office of Inspector General added two FAQs warning that compliance with Stark law exceptions and fair market value alone do not protect healthcare arrangements from Anti-Kickback Statute violations. FAQ #4 clarifies that financial arrangements satisfying Stark exceptions can still violate AKS because Stark is a strict liability statute where intent is irrelevant, while AKS requires knowing and willful intent to induce referrals. OIG provided an example where hospitals or laboratories offer sporting event tickets to referring physicians, which might satisfy the Stark exception for nonmonetary compensation under 42 C.F.R. § 411.357(k) but would be unlikely to receive AKS safe harbor protection. FAQ #17 states that fair market value is only one element of safe harbor compliance and OIG rejects the position that FMV eliminates unlawful remuneration. OIG characterizes this guidance as consistent with statutory text, regulatory safe harbors, and decades of OIG guidance. Source: Health Law Diagnosis
• Texas Attorney General opened investigations into dozens of Medicaid providers using federal claims data released by DOGE earlier this year. The investigations target home health providers, occupational therapy providers, and entities that may have submitted fraudulent claims related to COVID-19 treatments. The AG’s office plans to combine the federal data with internal claims data and civil investigative demands in anticipation of litigation, and has recovered more than $1 billion from Medicaid fraud since 2020. Recent enforcement actions include a February lawsuit over improper Medicaid billing related to care for minors and a $41.5 million settlement involving adulterated drugs provided to children. The state’s use of federal data aligns with a Trump administration executive order establishing a task force to coordinate anti-fraud efforts across federal benefits programs, which may condition federal funding on states adopting enhanced safeguards. Source: Polsinelli
• The DOJ’s Corporate Enforcement and Voluntary Self-Disclosure Policy requires healthcare organizations to navigate four distinct and overlapping disclosure frameworks, each carrying different legal consequences. Under the DOJ policy, companies that voluntarily self-disclose, fully cooperate, and remediate will receive a declination of prosecution absent aggravating circumstances, but disclosure must occur before any imminent government investigation and within 120 days of an internal report to preserve eligibility. Separately, CMS requires Medicare providers to report and return overpayments within 60 days of identification under a six-year lookback period, with retention beyond that deadline creating False Claims Act liability; Stark Law violations are handled through CMS’s Self-Referral Disclosure Protocol; and Anti-Kickback Statute exposure is addressed through the OIG’s Provider Self-Disclosure Protocol, which typically requires settlement at a multiplier of at least 1.5 times damages. These pathways intersect — a billing issue can escalate from an overpayment matter to False Claims Act exposure, and a Stark issue can implicate the Anti-Kickback Statute depending on intent — meaning disclosure to CMS or OIG does not automatically preserve DOJ self-disclosure benefits. Organizations lose leverage not at the moment of disclosure but before it, when delays, miscalculation of exposure type, or failure to recognize escalating risk foreclose the option of a declination or reduced penalty. Source: Clark Hill PLC

Medicare & Reimbursement

• Medicare providers must revalidate their enrollment records every five years, or every three years for durable medical equipment suppliers, under 42 C.F.R. § 424.515.During revalidation, providers confirm or update enrollment information including ownership, practice locations, managing employees, and contact details through the Provider Enrollment, Chain, and Ownership System (PECOS). Providers can submit applications up to three months before their deadline, which they can verify through the Medicare Revalidation List. Failure to revalidate on time results in deactivation of billing privileges, preventing providers from submitting claims for services furnished during the deactivation period and causing potential financial losses because services cannot be billed retroactively. CMS holds providers responsible for tracking their own deadlines despite sending courtesy reminder notices through Medicare Administrative Contractors. Source: Rivkin Rounds
• CMS published a proposed rule that would require Medicare Advantage organizations, Medicaid and CHIP programs, and Qualified Health Plan issuers on Federally-facilitated Exchanges to support electronic prior authorization for all drugs by October 1, 2027. Standard drug prior authorization decisions would be required within 72 hours and expedited decisions within 24 hours, and payers would be required to provide prescribers with a reason for any denial, including what steps are needed to resubmit or appeal. Beginning in 2028, all covered payers must post drug prior authorization metrics publicly on their websites, including approval and denial rates, appeal outcomes, and average decision times based on 2027 data. Payers would also be required to implement FHIR-compliant APIs and report endpoint information to CMS, which would publish a centralized directory for provider and payer access. Public comments on the proposed rule are due by June 15, 2026. Source: Sheppard
• CMS proposed a new rule requiring virtually all acute care hospitals to participate in the Comprehensive Care for Joint Replacement Expanded (CJR-X) Model, a mandatory bundled payment program for lower extremity joint replacement procedures beginning October 1, 2027. Under the model, hospitals bear two-sided financial risk for all Medicare Part A and Part B spending during a 90-day post-discharge episode, with regional risk-adjusted target prices determining whether a hospital receives a reconciliation payment or owes a repayment to CMS, subject to a 20% stop-loss/stop-gain cap (5% for rural and safety-net hospitals). Payment eligibility is tied to a composite quality score based on five measures—complication rates, readmissions, patient experience, and patient-reported outcomes—and hospitals with below-acceptable scores are ineligible for reconciliation payments. CMS projects the model will generate $725 million in net Medicare savings over five performance years, building on the original CJR Model, which achieved $112.7 million in savings while maintaining care quality. Hospitals will need to structure financial arrangements with surgeons, post-acute care providers, and others through value-based enterprise (VBE) frameworks to comply with the Stark Law and Anti-Kickback Statute, as the AKS safe harbor for CMS-sponsored model arrangements alone will be insufficient for many arrangements. Source: Bass, Berry & Sims PLC

Privacy & Data Security

• An unauthorized third party accessed the computer network of North Texas Behavioral Health Authority last October, compromising the protected health information of 285,086 individuals. The mental health and substance use treatment provider detected the intrusion around October 15, 2025, and confirmed on January 7, 2026, that files containing personal information, including Social Security numbers for some individuals, had been accessed. NTBHA began mailing notification letters to affected individuals on March 6, 2026, and offered credit monitoring and identity theft protection services to those whose Social Security numbers were exposed. The organization implemented password resets, expanded multi-factor authentication, and deployed endpoint detection and response tools following the breach. No threat actor has claimed responsibility for the incident, and no evidence of misuse of the information had been found at the time of notification. Source: HIPAA Journal
• Lymphedema Therapy Specialists in Houston, Texas, disclosed a data breach affecting patient and employee information after detecting unauthorized network activity on February 11, 2026. A third-party forensic investigation confirmed unauthorized access to the network, and by February 18, 2026, the clinic determined that names, Social Security numbers, government-issued identification numbers, workers’ compensation information, medical information, and health insurance information had been exposed. The INC Ransom group claimed responsibility for the incident and posted the clinic to its dark web data leak site, asserting that personally identifiable information, protected health information, and organizational data were stolen. The clinic did not offer credit monitoring or identity theft protection services to those affected. The Texas Attorney General was notified that 378 Texas residents were impacted, though the total number of affected individuals remains unknown. Source: HIPAA Journal
• Lawsuits under the California Invasion of Privacy Act and federal wiretapping statutes targeting website tracking pixels have surged to tens of thousands of claims since 2022, with companies facing statutory damages of $5,000 per violation under CIPA and $10,000 under the federal Electronic Communications Privacy Act without proof of harm. CIPA reaches companies outside California when users are in the state, and federal ECPA claims apply nationwide, with Florida now the second-highest state by lawsuit volume and courts in Illinois, New York, Virginia, North Carolina, and Florida issuing ECPA decisions on tracking pixels. Analytics trackers, session replay tools, chatbots, and mobile app SDKs trigger claims when they capture user interactions and transmit data to third parties without consent, and courts have rejected browse-wrap privacy policies and cookie banners with misleading wording as insufficient. Healthcare websites face elevated risk, as demonstrated by FTC actions against GoodRx resulting in a $1.5 million penalty and BetterHelp requiring $7.8 million in consumer refunds for sharing health data through tracking pixels with advertising platforms. Companies must audit tracking technologies, implement cookie management platforms that block trackers when rejected, and align privacy policies with actual data collection practices, with Tennessee, New Hampshire, and Alaska the only states to pass amendments excluding pixels from wiretapping laws. Source: Fox Rothschild
• Healthcare companies face civil penalties, criminal charges, and operational shutdown when cloud hosting providers fail to meet HIPAA standards for protecting electronic health information. HIPAA requires healthcare businesses to protect patient data classified as protected health information and electronic protected health information when processed through computer systems. Non-compliant hosting providers expose organizations to substantial fines that can force cessation of operations, while business leaders can face prison time for malicious breaches or those designed for financial gain. HIPAA-compliant hosting vendors must sign Business Associate Agreements defining permitted uses of ePHI, implement encryption for data in transit and at rest, maintain multi-factor authentication and least-privilege access controls, demonstrate data center security through SSAE 18 or SOC 2 audits, provide 24/7 on-site security, offer automated backups with disaster recovery plans, and maintain segmented environments that isolate ePHI from other cloud tenants. Business owners and top decision-makers must participate in selecting hosting partners rather than delegating the choice to IT departments alone. Source: Healthcare Tech Outlook

Workforce & Non-Competes

• Multiple states enacted laws in Q1 2026 restricting or banning non-compete agreements for health care workers and other employees. Washington passed H.B. 1155 on March 23, 2026, which bans all non-compete agreements with workers and businesses effective June 30, 2027, and requires employers to notify current and former employees that existing non-competes are void by October 1, 2027. Utah prohibited non-compete agreements with health care workers effective May 6, 2026, and Montana expanded its ban to include all physicians effective January 1, 2026. Virginia enacted a law barring enforcement of non-competes against employees terminated without cause unless the employer provides severance, effective July 1, 2026, and passed separate legislation prohibiting non-competes with health care professionals licensed by the Boards of Medicine, Nursing, Counseling, Optometry, Psychology, or Social Work, which awaits the Governor’s proposed amendment when the legislature reconvenes. California banned contractual clauses prohibiting providers from competing with medical or dental practices in contracts involving private equity groups or hedge funds, effective January 1, 2026. Source: Seyfarth Shaw Trading Secrets
• The FTC has committed to prosecuting noncompete agreements it views as anticompetitive, pursuing enforcement on a case-by-case basis rather than through a nationwide ban. Chairman Ferguson stated that many noncompetes likely violate antitrust laws, and that enforceable agreements must advance a procompetitive employer interest and be narrowly tailored to achieve it. Commissioner Meador identified four evaluation factors: the wage and skill level of covered employees, the reasonableness of the agreement’s scope and duration (with durations beyond one to two years viewed as suspect), the employer’s degree of market dominance, and evidence of industrywide economic harm. Employers in health care, veterinary, and beauty industries face heightened scrutiny. Employers should consider alternatives such as nonsolicitation and nondisclosure agreements, document the business interests any noncompete is designed to protect, and limit noncompetes for low-wage or low-skill workers. Source: Troutman Pepper Locke

Corporate Practice & Healthcare Transactions

• Ambulatory surgery centers trade at 7–8x EBITDA, with top-tier centers reaching double-digit multiples, driven by revenue cycle performance, physician alignment, and leadership infrastructure.** Buyers are applying greater diligence to CMS certification status, life-safety systems, and physical plant conditions, with compliance gaps serving as leverage in price negotiations or deal-killers outright. Revenue cycle management is the primary financial variable under scrutiny, as inconsistent collections, denial rates, and accounts receivable backlogs directly reduce EBITDA and can trigger valuation adjustments. Centers with case volume concentrated among a small number of physicians, or those dependent on a single founder for operations, face scalability concerns that reduce buyer confidence. Orthopedics, gastroenterology, and retina remain the most active specialties, while cardiology is drawing attention as procedural volume in ASC settings grows. Source: VMG Health
• Physician organizations face regulatory and transaction risk not from single decisions, but from patterns of undocumented decisions, unmanaged conflicts, and informal governance that cannot withstand scrutiny. Board minutes should capture the business rationale for compensation changes, the alternatives considered, and any conflicts disclosed, while joint venture files should document ownership structure, expected returns, and the basis for satisfying applicable safe harbors. Performance tracking should measure group-level operational metrics and physician productivity tied to personally performed services — not referral patterns or site-of-service data that could imply compensation rewards referrals. Conflicts of interest require disclosure at inception, annually, and before any related decision, with records showing whether the conflicted party recused and how disinterested parties evaluated the arrangement. Organizations that maintain these practices enter due diligence and regulatory investigations with files that respond to document requests without reconstruction, align witness accounts, and allow buyers to price deals on operational performance rather than regulatory risk. Source: Healthcare Law Insights
• Succession agreements in California MSO-PC structures are under direct legal threat after the CA Attorney General filed an amicus brief arguing that any MSO contract granting the right to replace a physician-owner constitutes impermissible corporate practice of medicine (CPOM). The brief arose from Art Center Holdings, Inc. v. WCE CA Art, LLC, in which a 2024 Los Angeles Superior Court ruling found that defendants unlawfully controlled a medical practice through a succession agreement giving them discretion to swap out a physician-owner at will. The AG’s position is categorical: where a contract lets a corporation replace the physician-owner, the corporation “effectively owns and controls all aspects of the practice,” and it is “difficult to imagine any circumstance” in which such a right would not produce undue influence. The California Medical Association filed its own amicus brief pushing back on a categorical rule and urging courts to apply a fact-specific analysis that considers the formation, function, and purpose of each structure, warning that a blanket prohibition could disrupt capital formation and destabilize physician alignment models across the state. California has not banned MSO-PC structures or private equity investment in MSOs, but the AG’s brief signals that succession agreements — including those triggered only by defined events such as loss of licensure — now carry material enforcement risk and require restructuring. Source: Ropes & Gray LLP

FDA & Drug Regulation

• The FDA is narrowing the regulatory pathway for compounding peptides, restricting access to substances that lack FDA approval, USP or NF monographs, or inclusion on bulk substances lists. Peptides fuel a $740B longevity market and are accessed through compounding under Sections 503A and 503B of the Federal Food, Drug, and Cosmetic Act, but compounded drugs do not undergo the same premarket review for safety, effectiveness, or manufacturing quality as approved drugs. The FDA prohibits compounders from replicating commercially available drugs and evaluates intended use based on marketing, distribution, and real-world context rather than labeling alone, making “research use only” disclaimers ineffective where facts point to human use. Enforcement tools include warning letters, import alerts, and seizures, with potential exposure extending beyond manufacturers to clinics, telehealth platforms, and other intermediaries. Many peptides lack clinical data, standardized dosing protocols, and well-characterized safety profiles, limiting companies’ ability to support therapeutic or performance-based claims. Source: Gardner Law
• The DOJ and DEA moved FDA-approved marijuana products and state-licensed medical marijuana products from Schedule I to Schedule III of the Controlled Substances Act, effective immediately. Acting Attorney General issued the order under his authority to reschedule drugs in compliance with U.S. obligations under the Single Convention on Narcotic Drugs, acting pursuant to President Trump’s December 18, 2025, Executive Order on Increasing Medical Marijuana and Cannabidiol Research. The DEA withdrew the prior administration’s August 29, 2024, notice of hearing and terminated those proceedings, replacing them with a new administrative hearing set to begin June 29, 2026, to consider broader rescheduling of marijuana from Schedule I to Schedule III. The new process includes firm deadlines intended to accelerate the rulemaking. Federal controls against illicit drug trafficking remain in place. Source: U.S. Department of Justice

Technology & AI

• States, not Congress, are setting the rules for AI in healthcare— and the resulting patchwork of laws poses a compliance risk for health systems operating across state lines. In 2025, more than 250 AI-related healthcare bills were introduced in state legislatures, covering patient disclosure, bias prevention, clinician accountability, and insurer restrictions on AI use in coverage determinations. The Trump Administration released a National Policy Framework for Artificial Intelligence on March 20, 2026, calling on Congress to establish a single federal regulatory approach with guardrails on child safety, free speech, intellectual property, workforce impacts, and national security, though a December 2025 executive order seeking to preempt state AI laws lacks the legal force to override state statutes. Federal agencies — FDA, CMS, CDC, and NIST — are advancing AI policy through guidance, payment pilots, and voluntary standards rather than new rulemaking, with CMS testing AI-assisted prior authorization under the WISeR model and the FDA moving toward lifecycle oversight requirements for adaptive algorithms. Across HHS, common compliance priorities include auditability of AI outputs, traceability of training data, human oversight in clinical contexts, and ongoing performance monitoring as models evolve. Source: Holland & Knight

Fraud, Abuse & Enforcement

• The Texas Health and Human Services Office of Inspector General recovered more than $95.7 million from home health providers between December 1, 2025, and February 28, 2026, according to its quarterly report. Home health agencies accounted for 21 percent of preliminary investigations and 15 percent of full-scale investigations during this period. The agency identified four primary billing errors: failure to have registered nurses perform in-home assessments before seeking authorization for private duty nursing services, documentation deficiencies in client records, inadequate documentation to verify services were rendered, and billing irregularities such as charging for services when clients were hospitalized or misrepresenting which type of nurse provided care. Settlements with providers ranged from $10,587 to $1,721,586, while one case resulted in a 17-year federal prison sentence and $227,377 in restitution for a Lubbock woman who defrauded Texas Medicaid in February 2026. The agency launched a new OIG Referral System on December 15, 2025, making it easier for the public to report suspected fraud. Source: Holland & Knight
• Federal authorities have launched prosecutions against medical spa providers for distributing unapproved peptides and counterfeit drugs. On April 1, 2026, the Department of Justice indicted Utah osteopathic physician Dr. Watkins for allegedly receiving and selling misbranded peptides to over 200 patients, including substances such as Tirzepatide, Semaglutide, BPC-157, and TB500 that appear on the 503A do not compound list. The same day, the FDA issued its first warning letter to a clinic for sourcing prescription drugs from unauthorized trading partners. Massachusetts medspa owner Rebecca Fadanelli pled guilty on April 7, 2026, to performing thousands of injections using counterfeit Botox and fillers imported from China and Brazil. The enforcement follows a trend that began in 2020 when GLP-1 shortages during COVID-19 led compounding pharmacies to exploit loopholes, with Florida now introducing legislation to mandate licensing and public databases for facilities handling such medications. Source: Stevens & Lee
• Aetna agreed to pay $117.7 million to settle allegations that it violated the False Claims Act by submitting false patient diagnosis data to inflate payments from the Centers for Medicare and Medicaid Services. The Justice Department alleged that the CVS Health unit submitted or failed to withdraw inaccurate diagnosis codes for Medicare Advantage enrollees to receive higher monthly payments, as insurers receive more money for sicker beneficiaries expected to incur higher healthcare costs. The Department of Health and Human Services said the settlement demonstrates that no company is beyond accountability regardless of size. Aetna said it disagrees with the allegations and settled to avoid the uncertainty and expenses of litigation. The company stated the settlement should not be seen as an acknowledgment of liability. Source: MSN
• A Second Circuit ruling in United States ex rel. Camburn v. Novartis Pharmaceuticals Corp. lets qui tam relators plead Anti-Kickback Statute scienter by pointing to a drugmaker’s tracking of prescriber return on investment On March 30, 2026, the Second Circuit formally adopted the “at-least-one-purpose” rule, requiring only that inducing prescriptions be one purpose of remuneration rather than the primary motivation. On remand, the Southern District of New York held that former Novartis sales employee Steven Camburn pleaded scienter under Rule 9(b) by alleging Novartis tracked physician prescription volumes and measured whether speaker payments yielded a return on investment. Camburn also alleged that the speaker program included events with no attendees, payments for canceled events, and speaker selection keyed to prescribing volume. The alert warns that marketing analytics measuring prescription volume and ROI may now be pleaded as evidence of scienter under the False Claims Act. Source: Crowell & Moring
• HHS OIG will not impose sanctions on a physician’s ambulatory surgery center ownership transfer structured as estate and retirement planning even though the arrangement does not fully fit any Anti-Kickback Statute safe harbor. Advisory Opinion 26-04, issued March 9, 2026, involved a physician owner transferring interests through gifts to family members and fair market value sales to other physicians. Succession planning does not have to fit squarely within a safe harbor, and OIG will evaluate the totality of the circumstances. Key safeguards include documenting bona fide estate or retirement purpose, executing all transfers at fair market value, keeping profit distributions strictly proportional to ownership, and ensuring non-physician transferees cannot generate or influence referrals. Retiring physicians must certify that they will not influence referrals after leaving the ASC. Source: Parker Poe

Antitrust & Provider Contracting

• The Department of Justice filed antitrust lawsuits against OhioHealth and NewYork-Presbyterian in 2026, accusing both systems of using market power to negotiate contracts that raise healthcare costs for patients. The DOJ alleges NewYork-Presbyterian prevents payers from offering health plans that exclude its facilities or forbids lower copays at rival facilities, while OhioHealth forces payers to include its facilities in all networks despite lower-priced alternatives. Acting Assistant Attorney General stated the department has adopted a “zero-tolerance policy” against such practices. Market consolidation enables these contracts, with one or two health systems controlling the entire inpatient hospital market in 47% of metropolitan areas in 2024, according to KFF data. Both health systems deny the allegations and maintain their practices comply with the law. Source: Healthcare Brew
• The Department of Justice filed an antitrust lawsuit against New York Presbyterian Hospital on March 26, 2026, challenging contractual restrictions the government alleges prevent insurers from offering lower-cost plans The complaint targets four categories of provisions: all-or-nothing network participation requirements, prohibitions on narrow network plans that exclude NYP, anti-tiering provisions requiring most-favored benefit status, and site-of-service steering restrictions. NYP holds approximately 25 to 30 percent market share in the relevant geographic areas, and the DOJ bases market power on pricing leverage, must-have status with payors, and the ability to impose terms unilaterally. The action follows a February 2026 suit against OhioHealth Corporation and forms part of a coordinated enforcement push against hospital contracting practices. Hospital systems should audit payor contracting terms for antitrust exposure, because the theory does not require dominant market share. Source: Katten

Privacy, Cybersecurity & HIPAA

• Texas has emerged as a major cybersecurity battleground for healthcare organizations, with security leaders now serving as strategists directly tied to patient outcomes and organizational trust. The state’s health systems and research institutions have elevated eight security executives who are shaping cybersecurity practices across the sector. Ron Mehring has led cybersecurity strategy at Texas Health Resources since 2011, while Randy Yates has served as CISO at Memorial Hermann Health System for over two decades. Gordon Groschl spent nearly two decades at Texas Children’s Hospital implementing Zero Trust architecture before moving to City of Hope, and George Finney oversees cybersecurity for millions of patients and students across the University of Texas System. Other leaders include Teresa Tonthat at Cook Children’s Health Care System, Fernando Blanco at CHRISTUS Health with operations spanning Latin America, Ian Schneller formerly of Health Care Service Corporation with background at U.S. Cyber Command and NSA, and Ashish Shah leading cybersecurity at MD Anderson Cancer Center. Source: Security Boulevard
• The Office for Civil Rights of the U.S. Department of Health and Human Services published a proposed rule on January 6, 2025, to update HIPAA Security Rule requirements in response to increased cyberattacks targeting electronic protected health information. The proposed rule eliminates the distinction between “required” and “addressable” specifications, mandates written security documentation, and requires ongoing technology asset inventories and network mapping. Technical safeguards would include multi-factor authentication, encryption of data at rest and in transit, network segmentation, and penetration testing at least annually. The OCR indicated the rule remains on its agenda for finalization in May 2026, with compliance required within 240 days of publication, or early 2027. The proposed framework expands scrutiny to business associates, subcontractors, cloud service providers, and entities on the fringes of the health sector that handle health data. Source: Constangy Cyber Advisor
• The Department of Health and Human Services Office for Civil Rights published a proposed rule on January 6, 2025, that would significantly amend the HIPAA Security Rule, with a final rule expected in May 2026. The proposed rule responds to increases in cyberattacks, expanded use of cloud and mobile technologies, and inconsistent compliance findings. The rule would mandate encryption of ePHI at rest and in transit, require multi-factor authentication, and add requirements for anti-malware, removal of unnecessary software, and disabling unnecessary network ports. Organizations would need to establish written procedures to restore systems and data within 72 hours of service disruption, develop incident response plans with periodic testing, and provide notice within 24 hours when workforce member access to ePHI is changed or terminated. Covered entities and business associates would have 180 days from the effective date to comply. Source: Healthcare IT News
• The DOJ’s Bulk Sensitive Data Transfer Rule establishes compliance requirements for health care and life sciences organizations that provide foreign entities access to sensitive personal data, with thresholds as low as 100 individuals for genomic data. The rule, which originated from Executive Order 14117 and became effective in April 2025, targets data transactions with six countries of concern: China, Russia, Iran, North Korea, Cuba, and Venezuela. The regulation applies to four categories of transactions—data brokerage, vendor agreements, employment agreements, and investment agreements—and is triggered by the ability to access data, not just formal transfers, even when data has been de-identified or anonymized. Enforcement authority rests with DOJ’s National Security Division, with civil penalties up to $368,136 or twice the transaction value and criminal penalties up to $1 million and 20 years imprisonment. Organizations must conduct data mapping exercises to assess compliance, as HIPAA compliance alone does not satisfy the new requirements, though exemptions exist for federally authorized research and FDA-required regulatory activities. Source: Epstein Becker Green

AI & Healthcare Technology

• The White House issued a National Policy Framework for AI on March 20, 2026, that calls on Congress to preempt state laws imposing burdens on AI development. The Framework follows a December 2025 Executive Order and addresses six objectives, with a focus on protecting children and encouraging AI innovation in healthcare. State AI laws in Utah, Colorado, and California remain in effect until Congress acts, and states are expected to challenge federal preemption in courts. The Framework directs existing agencies such as CMS, DOJ, and FDA to continue oversight of healthcare AI rather than creating a new federal body. The Department of Commerce has not released its evaluation of state AI laws that was due March 11, 2026. Source: Sheppard
• Medical technology contracts with evergreen renewal clauses can commit healthcare providers to vendor terms that permit undisclosed AI use of provider data Automatic renewal absent timely notice forecloses renegotiation of data-use, liability, cybersecurity, regulatory, and pricing provisions. Vendors increasingly deploy AI features through software updates characterized as enhancements, using provider data to train models, refine algorithms, or develop new products without affirmative disclosure or consent. Providers should inventory existing agreements, scrutinize permitted data-use scope including model-training rights, confirm HIPAA Business Associate Agreement alignment, and require affirmative consent for AI deployment along with audit and reporting rights. Contract audits before renewal cycles preserve leverage to narrow data rights and reallocate liability for AI-generated errors. Source: Buchalter
• Pharmaceutical buyers and partners must diligence data provenance when acquiring or licensing AI-driven biotech models, because consent gaps and license restrictions in the underlying training data now drive deal risk. Data provenance — the historical record of a dataset’s authenticity, authorship, and modifications — determines whether a model’s outputs can be deployed without running afoul of HIPAA, GDPR Article 9‘s special-category protections, or the EU AI Act. Older patient-consent forms often predate AI applications, forcing acquirers to evaluate whether secondary use is permitted or whether the target must locate patients to re-consent. FTC enforcement against BetterHelp, GoodRx, Flo Health, and Kochava — disgorgement, civil fines, and mandatory deletion of improperly collected data — sets the baseline for what noncompliance costs. The January 2026 FDA/EMA Guiding Principles of Good AI Practice in Drug Development now inform diligence scope, and deals increasingly separate the model from the underlying data or allocate risk through AI-specific representations, indemnities, and escrow. Source: A&O Shearman
• A lawsuit filed in the U.S. District Court for the Northern District of California accuses Sutter Health and Memorial Healthcare Services of violating the Federal Wiretap Act and state consumer privacy laws by using an AI platform that recorded patient-clinician conversations without patient consent. The plaintiffs allege they were unaware that Abridge AI’s platform was recording their conversations and transmitting audio files to external servers for processing into clinical notes. The system captured protected health information including symptoms, diagnoses, prescription information, treatment plans, family medical histories, and mental health information. While the lawsuit does not claim HIPAA violations, it seeks class action certification, damages for each violation, and court orders requiring the defendants to implement consent procedures before intercepting medical information. Sutter Health stated that technology used in clinical settings is evaluated and implemented in accordance with applicable laws and regulations. Source: HIPAA Journal

FDA & Drug Development

• President Trump signed an executive order on April 18, 2026, directing federal agencies to expand access to psychedelic therapies and research. The order allocates $50 million for federal-state collaboration on psychedelic research programs and establishes a Right to Try pathway for eligible patients to access investigational psychedelic drugs that meet safety requirements. It directs the FDA to issue priority review vouchers to qualifying psychedelic drugs that hold Breakthrough Therapy designation. The order references ibogaine twice but does not address protections for religious use of psychedelics. Source: Bill of Health

Rural Health & Funding

• The Centers for Medicare & Medicaid Services is directing $50 billion through the Rural Health Transformation Program to improve healthcare in rural areas from 2026 to 2030. The program funds state-level initiatives for care innovation, workforce development, and technology implementation. States including Alaska, Delaware, Indiana, Iowa, Kentucky, Minnesota, Montana, Nevada, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Texas, Vermont, and West Virginia have released requests for proposals with deadlines ranging from March to June 2026. The funding opportunities support initiatives such as school-based health centers, teledentistry services, workforce recruitment and retention, medical equipment procurement, maternal health services, and behavioral health modernization. Source: VMG Health

Telehealth

• Telehealth providers face medical malpractice exposure when they fail to recognize the clinical limits of a virtual visit and do not escalate to in-person evaluation or additional testing Florida Statute § 456.47 holds telehealth providers to the prevailing professional standard of practice that applies to health care professionals providing the same services in person. Misdiagnosis accounts for 65 to 70 percent of telehealth malpractice claims, compared with 40 to 50 percent in traditional medicine. Virtual visits preclude palpation, assessment of skin color and coordination, olfactory indicators, and in-person communication cues that inform diagnosis. Actionable scenarios include misidentifying cancerous lesions without recommending biopsy, failing to recommend emergency care for heart-attack symptoms, prescribing without reviewing medical history, misdiagnosing acute abdominal pain later found to be appendiceal rupture, and overlooking respiratory distress. Source: Searcy Denney

Employment & Labor

• A Texas appeals court upheld a non-compete injunction against four nurse anesthetists barring them from practicing within a 20-mile radius of their former workplaces for three years. The Court of Appeals for the Ninth District of Texas at Beaumont found that Chad Dubois, Kenneth Simmons III, Monica Bentzen, and Lance Mendoza violated their agreements with Anesthesia Associates when they left on August 1, 2025, to work for EmergencHealth at the same CHRISTUS facilities in Beaumont. Each had signed contracts with a three-year non-compete clause, a 20-mile radius restriction, and a $30,000 liquidated damages provision, which the court ruled existed alongside the right to seek injunctive relief rather than as a buyout. EmergencHealth had promised to pay all legal fees, damages, and expenses, but the court found that a competitor’s promise to absorb consequences does not neutralize a non-compete restriction. Source: Human Resources Director

Fraud, Abuse & Enforcement

• Aetna agreed to pay $115 million to settle allegations that it manipulated diagnosis codes to inflate risk scores for Medicare Advantage enrollees. A former risk-adjustment coding auditor filed the lawsuit on behalf of the federal government, claiming Aetna received inflated payments from the Centers for Medicare & Medicaid Services through a process known as upcoding. The Department of Justice alleged that in 2015, Aetna conducted chart reviews and used the results to seek additional payments while ignoring instances where it was overpaid. From 2018 to 2023, the company allegedly submitted morbid obesity diagnosis codes when BMI values indicated patients were not morbidly obese and directed coders to ignore conflicting information. The settlement resolves allegations only, with no determination of liability. Source: Texas Medical Association
• Government investigations into physician organizations often begin without warning and rely on internal communications as evidence. Investigators from the Office of Inspector General, Department of Justice, or state Medicaid Fraud Control Units target emails, board presentations, investor materials, and strategic planning documents that use phrases like “keeping cases in-house,” “driving volume,” or “referral optimization” to establish violations of the Anti-Kickback Statute or Stark Law. Investigations typically begin through whistleblower complaints, billing data analysis, auditor referrals, related investigations, or transaction disclosures. Organizations should engage experienced healthcare regulatory counsel immediately and avoid responding, producing documents, allowing interviews, altering records, or creating new explanatory materials. Pending investigations affect mergers and acquisitions through expanded diligence, altered deal structures, price adjustments, insurance limitations, and timeline delays. Source: Healthcare Law Insights
• The OIG issued a favorable advisory opinion on April 7, 2026, permitting a State-designated domestic crisis provider to bill Medicare and Medicaid for therapy services while waiving cost sharing for domestic violence survivors. The provider, located in a rural, medically underserved area, has historically offered all services—including crisis lines, legal advocacy, emergency shelter, and therapy—at no cost but faced funding losses that necessitated billing Federal health care programs. Although the arrangement would technically generate prohibited remuneration under the Federal anti-kickback statute and the Beneficiary Inducements CMP, the OIG determined the risk of fraud and abuse was sufficiently low. The OIG cited factors including the provider’s historical mission of free services, the prevalence of financial abuse among domestic violence survivors, the independent determination of medical necessity by mental health professionals, and the provider’s commitment not to advertise free therapy or shift costs to Federal programs. Source: OIG Advisory Opinion No. 26-06
• The Office of Inspector General issued Advisory Opinion 25-11 addressing how biopharmaceutical manufacturers can structure discount arrangements for vaccines in compliance with the Anti-Kickback Statute. The OIG reviewed four types of discount structures proposed by a manufacturer, including upfront discounts, purchase requirement discounts, bundled discounts, and bundled rebates offered to pharmacies, group purchasing organizations, and health care providers. While the OIG determined that upfront discounts and purchase requirement discounts meet the discount safe harbor protections, bundled discounts involving products reimbursed under different Medicare systems do not meet the safe harbor but can present low fraud risk if discounts are attributable to each product and offered equally. The OIG concluded all proposed arrangements presented low risk of fraud and abuse, though it emphasized that discounts requiring purchasers to provide marketing services or switch patients between products fall outside safe harbor protections. The opinion signals that manufacturers have flexibility to structure certain discount arrangements that do not precisely meet safe harbor requirements if they include appropriate safeguards. Source: Foley & Lardner

Regulatory & Competition

• The FTC established a Healthcare Task Force on March 20, 2026, to centralize enforcement across competition and consumer protection matters. Chairman Andrew Ferguson created the cross-bureau unit to address consolidation, exclusionary conduct, and deceptive practices that affect prices, quality, and access to care. The Task Force draws staff from the Bureaus of Competition, Consumer Protection, and Economics, and will coordinate with the Department of Health and Human Services and the Department of Justice. The FTC blocked a $945 million medical device merger in January 2026, challenged an IDD services provider merger, opposed a cataract surgery laser system merger in March 2026, and secured a settlement with a pharmacy benefit manager over insulin pricing practices in February 2026. The agency signals it will scrutinize mergers, contracts, and innovation competition in health care markets. Source: Seyfarth Shaw LLP
• The Trump administration has not yet determined whether to proceed with a proposed overhaul of the HIPAA Security Rule that was published by the previous administration in January 2025. Paula Stannard, director of HHS Office for Civil Rights, told attendees at a HIPAA Summit that regulators are reviewing 4,700 public comments on the 125-page proposal, which would eliminate the distinction between “required” and “addressable” implementation specifications and mandate written documentation for all security policies. Stannard noted that the cost of cyberattacks may exceed compliance burdens, and that many entities, particularly smaller organizations, have treated addressable specifications such as encryption as optional. The proposal would also require greater specificity in security risk analyses, which Stannard identified as the most common compliance failure in security rule investigations. Final action on both the Security Rule update and a separate HIPAA Privacy Rule modification is anticipated for May 2025. Source: GovInfoSecurity
• Texas HB 4224 requires healthcare providers to post instructions on how patients can request medical records, contact licensing boards, and file complaints. The law, which took effect September 1, 2025, applies to covered entities that handle personal health information and mandates postings both on websites and at physical facilities. The bill passed the Texas House 149-0 and the Texas Senate 31-0. Entities that exclusively perform claims processing, data processing, data analysis, utilization review, or billing on behalf of healthcare providers are exempt. The law addresses a gap where patients often cannot find clear information about accessing their records or filing complaints against providers. Source: Hendershot Cowart P.C.

Privacy, Cybersecurity & Data Breaches

• Him & Hers, a telehealth company serving 2.5 million subscribers, suffered a data breach between February 4 and February 7, 2026, when an unauthorized party accessed its customer service platform through a social engineering attack. The company identified the suspicious activity on February 5 and confirmed on March 3 that support tickets containing names and contact information were compromised, though medical records and communications with healthcare providers were not accessed. Him & Hers notified law enforcement and regulators, including the California Attorney General, and is providing affected individuals with 12 months of credit monitoring and identity theft protection. According to Bleeping Computer, the ShinyHunters threat group used a compromised Okta SSO account to access the company’s Zendesk instance and stole millions of support tickets. The company has not disclosed the number of individuals affected by the incident. Source: HIPAA Journal
• Privacy programs face pressure from enforcement bodies that now prioritize operationalized compliance over written policies. The IAPP 2026 Global Summit addressed online tracking and cookies through both EU consent requirements and US wiretapping statutes, with California-based and health-related services identified as enforcement flashpoints. Conference sessions examined health data definitions beyond HIPAA-covered entities, children’s privacy under COPPA and state laws, and dark patterns across product design and consent flows. AI governance was integrated into existing privacy frameworks rather than treated as a separate regulatory category, with speakers emphasizing that laws apply to use cases regardless of technology type. California and other jurisdictions are building audit-style oversight capabilities focused on systemic compliance gaps and data minimization standards. Source: Hinshaw & Culbertson LLP

AI in Healthcare

• Several California patients filed a class-action lawsuit against Sutter Health and MemorialCare in federal court in San Francisco, alleging the healthcare providers used Abridge AI to record their medical visits without consent. The plaintiffs claim the AI system captured and processed confidential physician-patient communications within the past six months, including medical histories, symptoms, diagnoses, medications, and treatment discussions. The complaint states patients did not receive notice that their conversations would be recorded by an AI platform, transmitted outside the clinical setting, or processed through third-party systems. Abridge AI, valued at $5.3 billion as of June 2025, has been deployed across healthcare providers including Kaiser Permanente, Mayo Clinic, and Duke Health to capture, transcribe, and summarize doctor-patient conversations into clinical notes. Sutter Health, which partnered with Abridge two years ago, stated it evaluates technology in accordance with regulations, while MemorialCare declined to comment on the litigation. Source: Ars Technica
• Healthcare providers face compliance requirements under existing HIPAA regulations when deploying AI tools, despite the absence of finalized federal AI standards. Federal civil penalties for HIPAA violations now exceed $2,000,000 annually for repeated violations, while state penalties can exceed $250,000 per violation. Texas enacted SB 1188 and HB 149, requiring healthcare providers to disclose AI use to patients and maintain electronic health records data within the US by January 2026. At least 38 states have enacted AI-related legislation with almost 400 AI bills pending in state legislatures. Sharing protected health information with an AI vendor requires a Business Associate Agreement, and covered entities must conduct risk analyses before adopting AI tools that handle protected health information. Source: Norton Rose Fulbright
• Researchers at the University of Texas at Arlington are deploying AI to predict cancer cure rates, model Alzheimer’s disease progression, and accelerate vaccine development. Associate professor Suvra Pal received a $1.8 million, five-year grant from the National Institutes of Health to develop models that estimate the probability of cure for breast cancer patients based on genetics, lab results, and clinical history, with integration into practice expected within 5 to 10 years. Assistant professor Pedro Maia, working with colleagues at the University of California–San Francisco, built a model showing how tau proteins spread through the brain in Alzheimer’s disease and how genes influence this process. Professor Junzhou Huang secured a $3.1 million R01 grant from NIH to create AI-powered models that design antibodies binding to viruses, potentially shortening the timeline for developing diagnostics, therapies, and vaccines. Source: The University of Texas at Arlington
• One in three adults used AI for health information in the past year, with uninsured individuals (40%) and younger adults ages 18 to 29 (36%) turning to these tools at higher rates than the general population. Adults under 30 were six times more likely than those 50 and older to cite lack of a regular provider or inability to get an appointment as a reason for using AI (38% versus 6%), and more than twice as likely to cite cost (29% versus 12%). Among AI users, 92% reported being at least somewhat satisfied with the responses, and 65% considered AI as reliable as a health care provider. Only 58% of users followed up with a doctor after consulting AI for physical health questions, and 42% did so for mental health. Despite 77% of adults expressing concern about privacy, 41% of AI users uploaded medical information such as test results or doctor’s notes into AI tools. Source: Texas 2036

Healthcare Transactions & Private Equity

• Private equity firms have invested over $1 trillion in debt-financed healthcare transactions over the past decade, with 93% of healthcare companies carrying speculative debt being private equity-sponsored. A JAMA 2023 study showed a 25% increase in complications such as infections and falls following private equity investment in healthcare facilities. Private equity-sponsored healthcare businesses face a 10X increased risk of insolvency and account for two-thirds of healthcare bankruptcies, including seven of the eight largest bankruptcy cases in 2024. Rural and underserved communities experience the most pronounced consequences due to limited access to alternative providers. The NYU Stern report proposes reforms including full public disclosure of finances, prohibitions on sale-leasebacks for dividend payments, state authority to block transactions, and investor liability for healthcare fraud. Source: Rivkin Rounds
• Language used in healthcare transaction materials can create regulatory risk even when the underlying business economics are defensible. Phrases such as “internal pipeline,” “keep more cases,” “move volume,” and “drive cases to the ASC” can be interpreted as plans to steer referrals for financial return, triggering expanded diligence and increased escrows from buyers. Buyers assume deal materials reflect how growth will occur and what drives the financial model, treating any suggestion that growth depends on changing physician referral patterns as a risk allocation issue. Government investigators request internal communications including emails, texts, draft decks, and spreadsheets to prove causation and organizational mindset regarding compensation and referral arrangements. Organizations should describe capacity and access rather than routing, keep messaging grounded in operations, and separate economics from referral patterns. Source: Healthcare Law Insights
• Federal and state legislators introduced numerous bills in Q1 2026 to expand oversight of healthcare consolidation, though most state measures stalled. Of the state bills introduced, only 2 passed while 10 stalled and 10 remain active in battleground states. On the federal level, the U.S. District Court for the Eastern District of Texas vacated the FTC’s 2024 Hart-Scott-Rodino Final Rule on February 12, 2026, returning to pre-February 2025 rules while appeals proceed. Congress reintroduced the Stop Corporate Crimes Against Health Care Act of 2026, which would create federal crimes with up to six years prison time and allow clawback of executive compensation when actions contribute to patient injury or death, and introduced the Take Back Our Hospitals Act of 2026, which would prohibit Medicare payments to hospitals or nursing facilities owned or controlled by private equity funds or REITs. State legislation shifted focus from private equity alone to include real estate investment trusts, management services organizations, and health insurers, while revisiting corporate practice of medicine doctrine and considering private rights of action for violations. Source: Holland & Knight

Fraud & Enforcement

• The Texas Attorney General filed two lawsuits against dental providers and marketing companies over alleged kickback schemes in the Medicaid program. The state alleges that dental practices worked with marketing firms Dental Axis and Dental Market One, paying them per patient, and the marketers then offered Medicaid patients cash, gift cards, or other incentives to influence their choice of provider. Under Texas law, compensation tied to patient referrals or inducements of value can taint any resulting Medicaid claims. The cases focus on marketing violations rather than clinical care, specifically targeting per-patient payments, patient incentives, and volume-based agreements. Dentists now account for 29% of full-scale provider investigations according to the March OIG quarterly report, placing them at the top of the list despite generating only 9% of initial complaints. Source: Texas Dentists for Medicaid Reform
• The Ninth Circuit ruled on March 17, 2026, that False Claims Act claims related to alleged 340B Drug Pricing Program overcharges may proceed. In United States ex rel. Adventist Health System of West v. AbbVie Inc., the court reversed dismissal of a qui tam action where the relator alleged that drug manufacturers charged covered entities above the statutory ceiling price, particularly in scenarios requiring a $0.01 “penny price.” The court held that FCA claims are independent and not automatically barred simply because covered entities lack a private right to sue under the 340B statute. The relator alleged that manufacturers’ pricing practices harmed government programs by increasing Medicaid payments, Medicare cost-based reimbursements, and direct government purchases. The decision recognizes a pathway for alleged 340B issues to be litigated as FCA claims where overcharges tie to government payment, though the case remains at the pleading stage and returns to district court. Source: Husch Blackwell

Privacy & Data Security

• Nacogdoches Memorial Hospital disclosed a data breach that exposed information on more than 257,000 patients. The hospital became aware of the attack on January 31 and notified law enforcement while launching an investigation. Hackers accessed names, addresses, Social Security numbers, dates of birth, medical record numbers, health plan details, and patient photos. The hospital began notifying those affected on March 31 and has reported no instances of identity theft linked to the breach, though it declined to offer credit monitoring services. No hacker group has claimed responsibility, and the method of attack remains undisclosed. Source: HealthExec
• Health data now exists across marketing platforms, analytics tools, and scheduling systems outside the reach of HIPAA regulations. Data from appointment scheduling, symptom checkers, call center recordings, and website browsing can reveal conditions and treatments even when it does not qualify as protected health information. In 2025, California Attorney General Rob Bonta reached a $1.55 million settlement with Healthline under the California Consumer Privacy Act for sharing users’ article views about medical conditions with advertising partners without honoring opt-out rights. State laws including the CCPA and Washington’s My Health My Data Act now regulate health data based on what it reveals rather than where it resides, while the EU GDPR treats health data as a category requiring heightened protection regardless of who collects it. Organizations should evaluate health data based on sensitivity and implement protections for information that reveals health status, even when HIPAA does not formally apply. Source: IAPP
• Small medical practices can implement HIPAA-aligned DevSecOps without enterprise budgets by focusing on basic security controls rather than expensive tools. These organizations handle sensitive patient data through portals, scheduling systems, and cloud applications, yet often struggle with common security gaps including excessive admin permissions, secrets stored in plain text, and untested backup recovery procedures. AWS provides encryption services, CloudTrail, CloudWatch, and Secrets Manager that can support security efforts, but using these tools does not automatically ensure HIPAA compliance without proper architecture and monitoring. DevSecOps integrates security into software development and deployment processes through CI/CD pipelines that scan dependencies, detect exposed secrets, and restrict production deployments. According to Andrii Klepak, DevOps Engineer and founder of CloudCare Pro, small practices need a baseline of limited admin access, MFA, encrypted storage, controlled deployments, and tested recovery rather than enterprise security programs. Source: HIT Consultant

Artificial Intelligence in Healthcare

• Tennessee prohibits AI systems from being marketed as mental health professionals under a law signed April 1, 2026. SB 1580 bars developers or deployers of AI systems from advertising that such systems can act as qualified mental health professionals, effective July 1, 2026. The law defines AI as models and systems capable of performing functions associated with human intelligence, including reasoning and learning. Violations constitute violations of the Tennessee Consumer Protection Act of 1977 and carry civil penalties up to $5,000 per violation, with enforcement available through a private right of action. Tennessee lawmakers are considering companion bills that would make it a felony to train AI to encourage suicide or homicide. Source: Troutman Privacy

Regulatory Compliance

• Recipients of federal financial assistance from the Department of Health and Human Services must ensure their digital content complies with WCAG 2.1 Levels A and AA standards by May 11, 2026, if they have 15 or more employees, or by May 10, 2027, if they have fewer than 15 employees. The rule, issued by HHS on May 9, 2024, represents the first comprehensive update to Section 504 regulations in nearly 50 years and applies to hospitals, physician practices, health centers, long-term care facilities, health plans, research institutions, and medical schools that receive HHS funds. The standards cover websites, mobile apps, social media accounts, patient portals, and telehealth platforms, though five exceptions exist for archived content, preexisting documents, password-protected individualized documents, preexisting social media posts, and content posted by third parties. Medicare Part B reimbursement alone triggers coverage under the rule. Noncompliance can result in investigations, suspension or termination from government programs, loss of federal funding, and private litigation. Source: Alston & Bird
• Clinicians can communicate orders via text message to clinical staff under specific conditions. The Centers for Medicare and Medicaid Services and The Joint Commission allow text message orders when sent through HIPAA-compliant, secure texting platforms consistent with Medicare Conditions of Participation. Clinicians must ensure messages are sent securely, orders are promptly entered and authenticated in the medical record, and EHR documentation remains accurate and accessible. Many communication platforms claim HIPAA compliance, but free versions often lack this protection for texting. Organizations must routinely assess the security and integrity of their texting platforms to prevent risks to patient privacy and safety. Source: American Medical Association
• Certain federal and state agencies can conduct unannounced inspections of companies without warrants or prior notice under “walk-in authority.” Companies in regulated sectors such as healthcare, government contracting, pharmaceuticals, and environmental face inherent risk of surprise compliance inspections. Agencies with walk-in authority include the Food and Drug Administration, the Occupational Safety and Health Administration, the Environmental Protection Agency, and the Centers for Medicare and Medicaid Services, but each agency can only request materials related to its regulatory area. Agencies without walk-in authority, such as the Federal Bureau of Investigation, the Drug Enforcement Administration, and the Internal Revenue Service, must obtain a warrant or subpoena to conduct unannounced inspections. Companies can prepare by designating a communication point person, maintaining organized records, training staff, and establishing relationships with outside counsel. Source: Smith Anderson
• CMS has implemented two regulatory changes that restrict ownership transactions and new enrollments for DMEPOS suppliers. The agency extended the 36-month rule to DMEPOS suppliers through a final rule published December 2, 2025, effective January 1, 2026, which prevents Medicare billing privileges from transferring to new owners when a change in majority ownership occurs within 36 months of initial enrollment or the most recent ownership change. On February 27, 2026, CMS imposed a nationwide six-month moratorium on new Medicare enrollments for certain DMEPOS medical supply companies across all 50 states, U.S. territories, and the District of Columbia. The intersection of these regulations means that suppliers undergoing ownership changes within the 36-month window during the moratorium period cannot reenroll in Medicare, potentially eliminating Medicare revenue from acquired businesses. Florida has followed suit with its own six-month moratorium on new DME provider enrollments in the state Medicaid program effective March 2026. Source: Katten Muchin Rosenman LLP

Insurance & Reimbursement

• A federal court in Connecticut ruled that assignment-of-benefits forms must contain language explicitly conveying “all rights and benefits” for health care providers to pursue reimbursement claims against insurers. The court granted in part and denied in part a motion to dismiss in Abira Medical Laboratories LLC v. Aetna Inc. et al., allowing breach of contract claims to proceed where assignment forms stated patients assigned “all rights and benefits” under their health plans. The court dismissed claims supported only by power-of-attorney language, stating that power of attorney alone does not enable a provider to bring suit in its own name. Abira alleged Aetna and CVS failed to pay $20.6 million for laboratory services, but the court dismissed the ERISA claim because Abira failed to identify specific plan terms that were breached. The court limited state-law claims to health plans not governed by ERISA. Source: ArentFox Schiff

Fraud & False Claims Act Enforcement

• The U.S. Department of Justice recovered more than $6.8 billion in False Claims Act settlements and judgments in fiscal year 2025, marking the largest annual total in the statute’s history. The DOJ reported 1,297 qui tam actions filed by whistleblowers and 401 government investigations during the year. Health care matters accounted for more than $5.7 billion of the total recoveries, with the DOJ focusing on managed care, prescription drugs, and substandard care. The agency recovered more than $52 million in cybersecurity-related settlements and more than $230 million through 200 settlements resolving pandemic-related fraud. The DOJ created a Market, Government, and Consumer Fraud Unit and a Trade Fraud Task Force to address customs and trade fraud, including customs and trade fraud, including country-of-origin errors, tariff misclassification, and forced labor issues. Source: Foley & Lardner
• Robert “Bobby” Leon Smith III received a 150-month prison sentence for orchestrating a $61.5 million health care fraud scheme that targeted Medicare beneficiaries. Smith, 50, of Archer City, Texas, owned and operated seven durable medical equipment supply companies in Florida, Texas, and Maryland that submitted false Medicare claims for orthotic braces, foot baths, and genetic tests that beneficiaries did not need. He ran telemarketing campaigns through a call center in the Philippines and obtained doctors’ orders by paying kickbacks to telemedicine companies, later selling those orders to other medical suppliers. Smith pleaded guilty in March 2025 after four days of trial, then absconded before sentencing and remained at large for over a month until the U.S. Marshals Service apprehended him. The court ordered Smith to pay $30,158,608.25 in restitution, forfeit $9,215,225, and surrender real estate in Texas, in addition to serving two years of supervised release. Source: United States Department of Justice
• AI billing and coding tools pose False Claims Act risks for healthcare providers as the Department of Justice recovered $6.8 billion in settlements during FY 2025, with $5.7 billion from healthcare. Kaiser Permanente paid $556 million in January 2026—the largest Medicare Advantage False Claims Act settlement in history—for chart mining to boost diagnoses and risk scores. The Office of Inspector General identified AI-enabled billing processes as an enforcement priority in February 2026 guidance, specifically naming AI-generated coding prompts as a risk adjustment abuse vector. AI billing tools that scan for undercoding without identifying overcoding create what the DOJ terms “one-way chart reviews,” which can constitute fraud. Other settlements include DaVita at $270 million (2018), Cigna at $172 million (2023), Independent Health/DxID at $100 million (2024), and UCHealth at $23 million (2024). Source: Health Law Attorney Blog

Anti-Kickback Statute & Physician Compliance

• The U.S. Department of Health and Human Services Office of Inspector General issued a favorable advisory opinion on March 9, 2026, regarding a physician’s three-phase retirement plan to transfer ownership interests in a Medicare-certified ambulatory surgical center. The plan involved gifting an ownership interest to the physician’s non-physician wife, allowing two physician children to purchase interests at fair market value, and later offering ownership to outside physician investors at fair market value. Upon the physician and his wife’s deaths, remaining ownership interests would transfer as gifts to their children. The OIG concluded it would not impose administrative sanctions under the federal Anti-Kickback Statute, despite certain transfers not satisfying safe harbor requirements, because the transactions involved fair market value purchases, documented estate planning strategies through trust documents and family business plans, and the non-physician wife held no position to influence referrals to the facility. The physician committed to provide written certification that he would not directly or indirectly influence referrals to the ASC after retirement and would not formally transition his patient panel to his children. Source: Akerman LLP
• Physician compensation plans create compliance risks when they reward referrals or internal facility use rather than clinical work performed. Problems arise when productivity becomes a substitute for business performance, particularly in orthopedic groups seeking more cases in ambulatory surgery centers or predictable hospital joint venture volume. Two questions drive regulatory analysis: what behavior the plan rewards in practice and where exceptions exist in the form of strategic initiative pools, growth bonuses, or year-end adjustments. Buyers examine whether compensation changes based on site of service, how discretionary payments are documented, and whether physician payments tie to facility performance. Organizations that maintain defensible plans keep productivity linked to personally performed services, use defined quality metrics, limit discretionary adjustments, and test models against real physician data before implementation. Source: Healthcare Law Insights
• Texas Attorney General filed suit against Sanofi-Aventis US LLC for violations of the Texas Health Care Program Fraud Prevention Act. The state alleges Sanofi’s “Free Nurse Program” and “Support Services Program” constitute kickbacks to providers by reducing their costs and administrative burdens to induce them to prescribe Sanofi products. Paxton seeks monetary relief exceeding $1,000,000 and an injunction to suspend both programs. Sanofi has rejected the characterization, stating the services comply with federal and state law and support patients rather than influence prescribing. The suit follows a case filed against Eli Lilly in August 2025 over programs with the same names and marks the continuation of Paxton’s enforcement actions against pharmaceutical companies including Johnson & Johnson, Bristol Myers Squibb, and insulin manufacturers. Source: Sheppard

Data Privacy & Cybersecurity

• Threat actors reduced their dwell time in compromised systems to 22 days in 2025, down from 36 days two years prior, according to BakerHostetler’s analysis of over 1,250 data security incidents. Attackers now prioritize data theft over encryption, with healthcare accounting for 27% of incidents, followed by finance and insurance at 18%. Organizations pay ransoms to prevent data publication rather than obtain decryption keys, as backup practices have improved. Hackers exploit weak identity security and use AI to create phishing and social engineering scams, while help desk manipulation remains a threat vector. Ransom negotiations typically last two weeks or longer, resulting in discounts from threat actors. Source: HealthcareInfoSecurity
• Texas plastic surgery practice disclosed data breaches that exposed patient information. Austin Plastic and Reconstructive Surgery in Texas experienced unauthorized network access between June 30 and July 1, 2025, that compromised names, addresses, dates of birth, financial account information, driver’s license numbers, passport numbers, Social Security numbers, medical information, and health insurance information. The practice engaged a cybersecurity firm to investigate the incident and is offering credit monitoring and identity theft protection services to affected individuals. The number of patients affected by the Texas breach remains unknown as the incident has not appeared on federal or state breach portals. Source: HIPAA Journal
• Hospital websites and mobile apps pose privacy risks by collecting health-related data through tracking technologies that operate outside electronic health records. State laws like Washington’s My Health, My Data Act now regulate “consumer health data” that can be inferred from location, browsing, and app use, even when traditional HIPAA rules may not apply. A Health Affairs study found that nearly every US acute care hospital website transmits data to third parties through tracking technologies, while HHS Office for Civil Rights has warned that information collected by pixels and tracking tools can qualify as protected health information. Patient portals, scheduling tools, and mobile apps collect IP addresses, device identifiers, clickstreams, page categories, and location data through third-party cloud services and SDKs. Location tracking raises particular concerns because it runs continuously in the background, connects physical visits to digital advertising systems, and can reveal information about others in a patient’s network. Source: Hinshaw & Culbertson LLP

Healthcare Technology & Artificial Intelligence

• Amazon leverages its ownership of One Medical clinics to differentiate its healthcare AI strategy from competitors like Microsoft and Google. The company purchased the clinic network in 2023 and has since released an agent platform for administrative tasks and a Health AI assistant for consumers, both connected through One Medical’s electronic health record system. Amazon uses an LLM-as-a-judge technique to evaluate chatbot responses and escalate flagged answers to human evaluators. The company focuses on providing underlying infrastructure through AWS rather than workflow-level tools, though this approach faces challenges as healthcare systems increasingly prefer multi-cloud strategies to avoid vendor lock-in. Amazon Connect Health platform features only work for hospitals already using AWS infrastructure. Source: Healthcare Brew
• AI tools are being integrated into medical aesthetics practices for skin diagnostics, facial analysis, treatment planning, and operations. The technology tracks facial features, creates 3D simulations for procedures, personalizes treatment protocols, and automates tasks like scheduling, clinical scribing, and inventory management. Practices face risks including AI accuracy errors, HIPAA compliance requirements for tools handling protected health information, and disclosure obligations to patients. Colorado’s AI Act takes effect February 1, 2026, requiring risk management processes and impact assessments for high-risk AI systems, while 47 states introduced healthcare AI legislation in 2025. Practices must maintain human oversight of all AI outputs and ensure patients can switch from AI to human staff. Source: VMG Health

Pharmacy & Drug Pricing

• Independent pharmacies in Texas are operating cattle businesses and gift shops to offset financial losses caused by pharmacy benefit managers. A pharmacy owners in Wheeler County pharmacies in Wheeler County and uses revenue from her Red Angus cattle operation in Oklahoma to keep her pharmacies open, while another in owner in Spur sells hair products, clothing and gifts alongside prescriptions. Pharmacists blame pharmacy benefit managers, which control 80% of prescription claims in the United States, for setting reimbursement rates that force them to sell medications at a loss. In 2025, more than 4.3 million Texans lived in pharmacy deserts, and 60% of Texas counties had no pharmacy in 2023, according to the Texas Pharmacy Association. Lt. Gov. Dan Patrick charged the Texas Senate with investigating whether pharmacy benefit managers contribute to rising health care costs. Source: The Texas Tribune
• CMS extended the deadline for hospitals to respond to the Outpatient Prospective Payment System Drug Acquisition Cost Survey from March 31, 2026 to April 7, 2026 at 11:59 PM ET. CMS is conducting the survey to meet its statutory obligation before reducing reimbursement to hospitals for separately payable drugs, particularly those under the 340B Drug Pricing Program, but can only proceed if the survey results in a “statistically significant estimate” of drug costs. The extension indicates CMS may not be receiving the response rate it deems necessary to implement lower OPPS reimbursement rates. If hospitals do not respond in sufficient numbers, CMS cannot use the survey results to cut reimbursement to 340B-covered entities, though CMS has suggested without legal authority that it may treat non-responses as indication of low acquisition costs. The US Supreme Court previously denied CMS the reimbursement cuts it seeks to implement through this survey. Source: K&L Gates

Regulatory & Government Oversight

• CMS established standards for electronic transfer of healthcare claims documentation and electronic signatures under a final rule published in the Federal Register on March 24, 2026. The rule takes effect on May 26, 2026, with compliance required by May 26, 2028, for all HIPAA-covered entities including health plans, healthcare providers, and healthcare clearinghouses. The standards enable electronic exchange of medical records, images, clinical notes, telemedicine documentation, and laboratory results, and adopt X12N standards for data exchange and HL7 standards for clinical data sharing. CMS estimates the standards will save the healthcare sector up to $782 million annually. The final rule omitted prior authorization standards due to conflicts with mandated standards. Source: HIPAA Journal
• FTC Chairman Andrew Ferguson announced the formation of a Healthcare Task Force on March 20, 2026, to coordinate antitrust and consumer protection enforcement across the healthcare sector. Ferguson stated that consolidation and anticompetitive conduct have distorted healthcare markets. The Task Force will coordinate efforts across the Bureau of Competition, Bureau of Consumer Protection, Bureau of Economics, Office of Policy Planning, and Office of Technology, and will collaborate with the Department of Health and Human Services and the Department of Justice. The memorandum cited two merger challenges (Alcon/Lensar and Edwards/JenaValve) and a February 2026 consent order with Express Scripts as examples of enforcement under the Trump administration. Healthcare companies should expect increased scrutiny of transactions and commercial arrangements. Source: Goodwin
• States are incorporating health equity impact assessments into Certificate of Need programs to reduce healthcare disparities. New York requires many CON applications to include a health equity impact assessment prepared by an independent entity with community engagement, covering scoping, potential impacts, mitigation, and monitoring. North Carolina implemented a policy in 2025 requiring CON applicants to demonstrate how projects will provide care that reduces health disparities in underserved communities. Connecticut approved an emergency CON application for a hospital acquisition but imposed conditions related to community engagement, service maintenance, and access gaps. These assessments add complexity to healthcare transactions by requiring coordination across compliance, clinical operations, community relations, and finance, which affects deal timelines and economics. Source: Sheppard

Litigation & Expert Witnesses

• Attorneys must evaluate expert witnesses against Daubert admissibility standards before engaging them in health care litigation cases. Expert testimony must be both relevant and reliable under standards established by the U.S. Supreme Court in Daubert v. Merrell Dow Pharmaceuticals Inc., which requires that theories or techniques be tested, subjected to peer review, have known error rates with governing standards, and enjoy general acceptance within the relevant scientific community. Attorneys must verify that expert candidates possess genuine credentials in the specific specialty at issue, as a general surgeon cannot opine on neurosurgical care and a dentist cannot opine on orthodontia. The expert’s publications, speaking engagements, and prior testimony must be reviewed to identify potential contradictions, and any disciplinary record or prior exclusions of testimony can undermine credibility. For jury trials, attorneys must assess whether the expert can articulate complex issues clearly and whether jurors will perceive the expert as credible or potentially biased. Source: Foley & Lardner

Intellectual Property & Medical Devices

• The UPC Munich Local Division dismissed an infringement action involving embolic protection devices, establishing that medical devices can infringe patents through possible use only when that use aligns with professional medical practice. Emboline sued AorticLab over patent EP 2 129 425, which covers an embolic protection device with a graspable structure for hook removal, seeking injunctions in France, Germany, and Italy. The court found that AorticLab’s device was removed using an attached rod rather than a hook, and using a hook would require piercing and damaging the filter mesh material. The court held that while devices normally operated in non-infringing ways can still infringe if patent-infringing use remains possible, such use must comply with recognized rules of medical science for medical devices. AorticLab made its counterclaim for revocation dependent on a finding of infringement and had to pay costs when the court did not decide on the counterclaim after finding no infringement. Source: A&O Shearman

Fraud & Abuse / Anti-Kickback

• The OIG issued a favorable advisory opinion allowing a medical device manufacturer to subsidize Medicare cost-sharing obligations for patients enrolled in a clinical trial testing an implantable device that delivers electrical pulses to baroreceptors in the carotid artery. The study will test the device in heart failure patients with left ventricular ejection fraction between 35 and 50 percent, enrolling up to 2,500 participants at up to 200 sites in the United States and Europe. The company will pay cost-sharing amounts directly to study sites, and participants will learn about the subsidies during informed consent discussions rather than through advertising. While OIG determined the arrangement would generate prohibited remuneration under the Federal anti-kickback statute and Beneficiary Inducements CMP if requisite intent were present, the agency concluded it would not impose sanctions due to low fraud risk, the device being a one-time treatment, and CMS approval of the study under Category B Investigational Device Exemption criteria. Source: OIG Advisory Opinion No. 26-05
• Physician organizations face legal risk when deal structures that appear routine in practice create economic incentives tied to referrals. Buyers, regulators, and lawyers examine who receives economic benefit, what conduct the economics encourage, whether compensation moves with referral activity, and how arrangements function in operations. Three areas create exposure: equity in joint ventures where distributions depend on referral patterns, management agreements where overlapping ownership creates referral incentives, and compensation structures where physicians receive payment based on cases sent to affiliated facilities. When structure and behavior diverge during transactions, buyers increase diligence on referral data, request internal communications about joint ventures, impose tighter indemnities, and adjust pricing with larger escrows. Organizations reduce risk by documenting business purposes for ownership decisions, separating capital decisions from referral expectations, reviewing joint ventures periodically, and ensuring boards understand actual economic flows. Source: Healthcare Law Insights

Healthcare Transactions & Business

• MedTech companies face scrutiny over early partnership agreements when seeking outside capital, as terms negotiated for limited purposes can create obstacles during financing rounds. These collaboration agreements often start small but become central to operations as revenue, product planning, and business assumptions depend on them. Investors focus on how much revenue depends on single agreements, whether expansion requires renegotiation, and whether partners hold rights affecting future decisions. Contract provisions including assignment clauses, fixed pricing terms, exclusivity agreements, and consent rights can affect transaction timing and negotiating leverage during diligence. Companies should review agreements before financing begins to identify terms that limit flexibility, including rigid assignment provisions, pricing protections, consent rights tied to growth decisions, and exclusivity extending beyond the original purpose. Source: Healthcare Law Insights
• Provider mergers with larger healthcare platforms result in higher reimbursement rates from insurers. Studies show hospital mergers produce price increases of 6-18%, while hospital acquisition of physician practices drives approximately 14% price increases, with nearly half attributable to billing changes that add facility fees. Analysis of billions of price transparency records from major insurers covering more than 26,000 providers across the U.S. confirms a statistically significant relationship between practice size and negotiated prices. The Government Accountability Office found hospital-led physician consolidation consistently linked to higher commercial prices with little evidence of quality improvements. These rate increases translate into higher premiums for employers and employees. Source: Ankura

Cybersecurity & Data Breaches

• A cyber incident at Stryker has prompted a proposed class action lawsuit alleging security failures compromised health information. The incident affected enterprise systems but did not compromise medical devices or patient safety systems, though disruptions can affect manufacturing operations, order processing, field service operations, and software updates. Medical technology companies face scrutiny from regulators, investors, and boards under FDA guidance that emphasizes secure design and vulnerability management, while HIPAA-regulated entities must maintain safeguards for electronic protected health information. Companies should review incident response plans, business continuity plans, cybersecurity governance, and security monitoring at least annually to comply with overlapping federal and state requirements. The incident underscores that breach-related risk includes private litigation as well as regulatory scrutiny. Source: Fenwick
• Governor Greg Abbott directed Texas health agencies to address cybersecurity threats from Chinese-manufactured medical equipment. The Texas Health and Human Services Commission, the Department of State Health Services, and public university systems must review cybersecurity and procurement policies and submit findings by April 17. The directive follows January notices from CISA and FDA that identified security vulnerabilities in Chinese-manufactured patient monitors, including the Contec CMS8000 and Epsimed MN-120, which could allow unauthorized remote access and theft of protected health information. State-owned medical facilities must catalog network-connected medical devices and assess cybersecurity protections. Abbott plans to use the findings to inform legislation in the 2027 session. Source: Texas Metro News
• Delve, a Y Combinator-backed compliance startup, faces allegations that it misled hundreds of customers about their data protection and security compliance status. A pseudonymous Substack report claims the company generated pre-filled evidence, routed customers to two audit firms based in India, and published trust pages listing controls that were never implemented. The company raised $32 million Series A at a $300 million valuation and positions itself as an automation platform for SOC 2, ISO 27001, HIPAA, and other frameworks. Delve denies issuing compliance reports and says it provides templates for customers to document processes, with final opinions delivered by independent auditors. A security researcher also claimed access to sensitive internal data including employee background checks and equity records. Source: FindArticles.com
• Organizations must prioritize patch management, documentation and data governance to avoid preventable breaches and compliance risks as they navigate global privacy regulations. Netskope executives Tom Baumgartner and Steve Riley discussed how AI and emerging technologies accelerate change while companies operating across borders contend with differing privacy expectations and regulatory regimes. Riley, field CTO at Netskope, stated that many breaches leading to regulatory scrutiny are preventable with basic security hygiene, noting that organizations should prioritize timely updates and maintain clear documentation of security changes to demonstrate compliance to regulators and auditors. Riley advocated for outsourcing patch management to software vendors. The discussion included how global privacy regulations create compliance challenges for multinational organizations, how AI and evolving technology complicate regulatory frameworks, and best practices for data residency, sovereignty and tracking data lineage across lifecycles. Source: GovInfoSecurity

Privacy & Patient Data Rights

• OCR faces uncertainty over whether its proposed HIPAA Security Rule update will progress to a final rule after receiving more than 4,700 comments, including calls from over 100 hospital systems and provider associations to withdraw the proposal. The Notice of Proposed Rulemaking, issued on December 27, 2024, represents the first update to the HIPAA Security Rule in more than two decades and introduces new security requirements for electronic protected health information. Healthcare providers criticized the proposed rule for placing financial burdens on HIPAA-regulated entities and establishing an unreasonable implementation timeline. OCR Director Paula M. Stannard stated the Trump administration may have a different view on the burdens and benefits of the proposed changes, and if the final rule is released, OCR could extend the compliance deadline beyond the standard 180 days. The proposed update followed OCR’s publication of voluntary Health Care and Public Health Cybersecurity Performance Goals in January 2024, which were intended to advise future rulemaking. Source: HIPAA Journal
• Patient concerns about health data rights drove compliance risks for healthcare providers in 2025, shifting focus from regulatory enforcement to patient-driven issues. Patients increasingly requested electronic health record audit logs showing who accessed their medical information, though current HIPAA and HITECH Act regulations do not require providers to produce these security logs. Amendment requests also rose as patients sought to remove information from medical records, but providers retain discretion to deny such requests and typically add clarifications rather than delete historical documentation. A California health system faced a proposed class action lawsuit over using AI transcription technology in exam rooms without patient consent, highlighting questions about disclosure and consent requirements for AI use. Healthcare organizations should update privacy notices, establish AI governance processes, and train staff to address patient questions about data rights and technology use. Source: Hall Render
• Healthcare organizations face a readiness challenge before they can monetize their clinical records, claims histories, imaging repositories, genomic data, and real-world outcomes. Life sciences companies, technology developers, payers, and analytics firms are driving demand for healthcare data to support real-world evidence, AI initiatives, and product development, but licensees scrutinize governance frameworks, consent documentation, and compliance exposure when determining value. Organizations fall into categories ranging from data-rich but governance-light to those with research collaborations, and value increases as uncertainty decreases around rights of use, patient consent, and operational capacity. Leadership teams must clarify whether they hold defensible rights, what patient consent permits for secondary use, and what operational support partnerships require before discussing licensing fees that depend on income projections, market comparables, or replication costs. Licensing structures including time-limited licenses, subscriptions, research collaborations, or revenue-sharing arrangements shape long-term positioning, with term length, exclusivity, and field-of-use restrictions affecting both value and flexibility. Source: VMG Health
• Companies across industries are facing wiretapping lawsuits from California residents based on website tracking technologies. The lawsuits, filed under the California Information Privacy Act, claim that companies allow third parties to eavesdrop on website visitors through tracking tools like Google Analytics that share data about clicks, searches, and browsing behavior. CIPA permits $5,000 per violation, and plaintiffs argue each tracking technology constitutes a separate violation, meaning one website visit with 8 tracking tools could generate a $40,000 demand. The U.S. Supreme Court has agreed to review a case involving the Video Privacy Protection Act that could affect how older statutes apply to tracking technologies. Companies are advised to implement disclosure pop-ups before tracking begins, audit their tracking technologies, and establish data retention and deletion protocols. Source: Amundsen Davis

AI in Healthcare

• Healthcare organizations face patient confidentiality risks when implementing AI tools that process protected health information. Hospitals, physician groups, and insurers are integrating AI into clinical workflows for applications including medical imaging, predictive analytics, automated coding, transcription, and chatbots, but these systems often require access to large volumes of patient data governed by HIPAA. Confidentiality risks emerge when AI platforms store user inputs outside secure environments, when third-party vendors access PHI without proper Business Associate Agreements, when de-identified data can be re-identified, and when staff use generative AI tools without governance policies. The Department of Health and Human Services has begun examining how HIPAA applies to AI technologies while the Federal Trade Commission signals enforcement actions against companies that misuse health data. Organizations can reduce risks by establishing AI governance policies, conducting vendor due diligence, limiting data exposure, and training employees on privacy obligations. Source: Chartwell Law
• AI enables healthcare providers to tailor treatments to patients’ genetic profiles, predicting disease risk through mutation detection and selecting therapies based on individual responses to maximize treatment effectiveness. In oncology, AI tools guide medical professionals in classifying tumors based on genetic profile, allowing oncologists to customize treatment plans for cancer patients. However, AI models require vast amounts of data for training and function as “black boxes” that fail to explain how they reach conclusions, raising concerns about data privacy and the potential to infer personally identifiable information even from anonymized datasets. The Patent Office released updated guidance on AI patentability in 2024 and 2025, clarifying that AI-assisted inventions remain patent eligible if one or more persons made a contribution to the claimed invention, maintaining the requirement of human conception. Source: Knobbe Martens
• Physicians using AI for clinical documentation must maintain responsibility for the accuracy of patient records despite the technology’s ability to transcribe physician-patient conversations into draft notes. When selecting AI documentation tools, physicians should evaluate cost, integration with electronic medical records systems, device compatibility, and HIPAA compliance. Practices must obtain both written and verbal patient consent for each visit, documenting any declined or revoked consent in the patient’s chart. AI tools may inaccurately capture medical terms and produce errors, and physicians should avoid using AI for medical decision-making such as diagnosing diseases or creating treatment plans. Practices should coordinate with IT vendors, consult legal counsel, verify insurance coverage, train staff, and conduct periodic evaluations of AI tool effectiveness. Source: Kerr Russell

Healthcare Litigation

• A federal court in the Western District of Virginia ordered Cross Country Healthcare, Inc. to produce text message data in a TCPA class action filed by a nurse anesthetist who claims recruiters continued texting him after he requested removal from contact lists. The plaintiff filed suit in August 2025, alleging violations of both the TCPA’s Internal Do Not Call List provisions and National Do Not Call Registry provisions. The defendants argued the discovery was irrelevant because they engaged in recruiting, not telemarketing, and that production would be burdensome because third-party vendors held the data. The court rejected these arguments in its February 23, 2026 decision in Kattato v. Cross Country Healthcare, Inc., finding the defendants failed to provide affidavits or cost estimates supporting their objections. The court ordered production of phone numbers, text message dates, and related records within 30 days. Source: Above the Fold

Patient Safety & Quality

• The Patient Safety and Quality Improvement Act of 2005 provides healthcare providers with protections from legal discovery when they report safety information to authorized Patient Safety Organizations. Congress enacted the law in response to a 1999 Institute of Medicine report that found preventable medical errors caused up to 98,000 deaths annually in the United States. Patient safety work product, which includes data, reports, and analyses assembled for reporting to a PSO, is privileged and confidential and cannot be subject to subpoena, discovery, or admission as evidence in proceedings. The protections do not extend to medical records, billing information, or information required by state law for mandatory reporting. Healthcare facilities must maintain documentation and keep information intended for PSO reporting separate from records maintained for other purposes. Source: Mitchell Williams