Wade’s Health Law Highlights for February 4, 2025

Data Privacy

• Data breach incidents in 2024 affected 1.7 billion individuals, marking a 312% increase from 2023 despite a 1% decrease in total breaches. Six major breaches accounted for 85% of all notices, including Change Healthcare with 190 million records. Cyberattacks caused 80% of all data compromises, with four of the largest breaches resulting from lack of multifactor authentication. While 40% of states now have comprehensive data privacy laws, with eight more taking effect in 2025, the U.S. still lacks federal data privacy legislation.
• The FDA and CISA have identified security vulnerabilities in patient monitors that could allow unauthorized access and manipulation of the devices. Certain monitors, which display patient vital signs in healthcare and home settings, contain a hidden backdoor in their software that enables cybersecurity controls to be bypassed and patient data to be accessed. The FDA has not identified any incidents related to these vulnerabilities but advises disconnecting affected devices from the internet and using local monitoring features only. Healthcare facilities must unplug and stop using devices that rely on remote monitoring, as no software patch exists to address these risks. The warning comes as healthcare data breaches have increased by 100% from 2018 to 2023, with the number of affected individuals rising by 1000%.

Dental

• Dental plans distinguish between non-covered services and disallowed services in their payment policies. Non-covered services are those not included in a patient’s dental plan due to limitations or exclusions, while disallowed services are covered procedures that the plan refuses to pay for due to deficiencies or improper execution. Participating dentists must follow fee schedule limits even for non-covered services and file claims unless patients pay out-of-pocket and request no filing under HIPAA rules. When services are disallowed, dentists cannot bill patients or retain payments, though they may contest these determinations through their participation agreements. HIPAA allows patients to prevent claim filing by paying in full and making a written request.

Fraud & Abuse

• The U.S. Department of Justice recovered $1.67 billion in healthcare fraud settlements in 2024, with major developments including a new whistleblower program targeting private insurer fraud. The DOJ launched increased scrutiny of private equity and venture capital firms in healthcare, examining their influence on portfolio companies and patient care. The Civil Cyber Fraud Initiative secured $14 million in settlements related to cybersecurity violations, while the FDA strengthened its focus on medical device cybersecurity through new guidance documents and enforcement actions. The government expanded whistleblower incentives with rewards up to 30% of recovered funds for the first $100 million, signaling continued emphasis on fraud detection and prevention.

Healthcare Delivery

• The United States faces a physician shortage of 50,000 doctors, with projections indicating this number could reach 80,000 by 2035. The shortage affects multiple specialties, with cardiology expected to experience a 17% deficit by 2035, while thoracic surgery and ophthalmology face potential deficits of 31% and 30% respectively. The situation in cardiology appears particularly concerning as 54% of general cardiologists are 55 or older, compared to 38-40% of primary care providers in the same age range. Training new physicians requires 12 or more years of education, making immediate solutions difficult. AMN Healthcare’s report suggests focusing on workforce management and improving working conditions to retain existing physicians.
• Amazon has partnered with Teladoc Health to expand its healthcare offerings, including virtual care and chronic condition management through its Health Benefits Connector. Walmart has launched same-day pharmacy delivery across 49 states, integrating pharmacy, merchandise, and grocery into a single online order with 15,000 pharmacists nationwide. AWS has partnered with General Catalyst to develop AI-driven healthcare solutions, while also expanding its collaboration with Booz Allen Hamilton for government technology solutions. Walmart plans to launch a drone delivery system at its Kaufman, Texas location through a $750,000 project with Alphabet’s Wing. The companies continue to compete through technological innovation, with Amazon projecting double-digit revenue growth over the next five years.
• Dr. Margaret Daley Carpenter, a New York doctor and co-founder of the Abortion Coalition for Telemedicine, was indicted by a Louisiana grand jury for prescribing abortion medication via telehealth to a woman in Louisiana. The case marks the first criminal charges against a physician for prescribing abortion medication to a patient in a state where they don’t practice and will test New York’s shield law, which protects providers from out-of-state prosecutions. Louisiana, which bans abortion except in cases of rape and incest, classified abortion medications as Schedule IV controlled substances last year. New York Governor Kathy Hochul has stated she will not comply with any extradition requests from Louisiana, while Attorney General Letitia James condemned the charges.

HIPAA

• The U.S. Department of Health and Human Services has proposed new HIPAA Security Rule updates through a Notice of Proposed Rulemaking that will affect group health plans and their sponsors. The updates require plan documents to explicitly connect safeguards to provisions applying to covered entities and business associates, while mandating sponsors report security incidents within 24 hours of contingency plan activation. Plan sponsors must amend existing documents to reflect these changes, though many may already have compliant procedures in place. HHS is seeking input on implementation deadlines and potential transition periods for document amendments, with future updates expected to address encryption, multi-factor authentication, and administrative controls.

Hospice

• The U.S. hospice care industry faces significant transformation as private equity firms acquire providers, with nearly three-quarters now under for-profit ownership. The number of Americans aged 65 and older will increase 47% to 82 million by 2050, intensifying demand for hospice services. For-profit ownership has led to challenges including staff burnout, reduced care quality, and increased billing issues, while workforce shortages limit access to services. Non-profit organizations are positioned to address these challenges through integration with broader healthcare systems, increased collaboration between providers, and adoption of new technologies like AI and telehealth. The industry must focus on improving quality standards and accessibility while maintaining the core mission of providing comprehensive end-of-life care.

Innovative Technology

• The FDA issued draft guidance on January 7, 2025, establishing a framework to assess AI model credibility in drug and biological product development. The guidance outlines a 7-step process for evaluating AI models throughout the drug product lifecycle, including defining questions of interest, determining context of use, assessing risks, developing credibility plans, executing plans, documenting results, and determining model adequacy. The framework requires sponsors to provide detailed documentation about model development, training data, and evaluation processes while emphasizing ongoing performance monitoring. The FDA is accepting public comments until April 7, 2025, and encourages early engagement with organizations on AI credibility assessment.
• German researchers have developed a method to repair heart damage using stem cells, with trials showing results in both primates and humans. The heart contains specialized muscle cells called cardiomyocytes which stop dividing after maturity, meaning damage from injury or infection becomes permanent. Blocked blood vessels can kill these cells, leading to reduced heart function and death. Scientists attempted to address this by converting induced pluripotent stem cells into cardiomyocytes and injecting them into damaged hearts, though initial animal experiments showed mixed results.
• Proposed House Bill 2298, relating to a health care facility grant program supporting the use of artificial intelligence technology in scanning medical images, would establish a grant program in Texas to support health care facilities in utilizing artificial intelligence (AI) technology for cancer detection through medical imaging. Eligible applicants include hospitals and federally qualified health centers within the state. The program, administered by a commission, requires applicants to provide matching funds and submit a detailed plan for AI technology use, including physician oversight and scanning capacity. Grants, limited to $250,000, are awarded annually to no more than five recipients. Recipients must report on the effectiveness of AI in cancer detection within a year.

Insurance & Reimbursement

• California enacted the Physicians Make Decisions Act in September 2024, prohibiting health insurers from using AI alone to deny medical claims based on medical necessity. The law, which took effect January 1, requires physician oversight for medical necessity decisions while still allowing insurers to use AI tools under specific guidelines and state inspection requirements. The legislation comes amid class action lawsuits against Cigna and United Healthcare for allegedly using AI to deny physician-approved claims. While the Act makes violations a crime, providers cannot enforce it directly but may pursue remedies through other state laws, and other states are expected to follow with similar legislation.

Medicaid

• In Texas, where postpartum Medicaid coverage was extended from 2 months to 12 months in 2023, implementation has faced significant challenges. The program now covers more than 265,000 pregnant and postpartum Texans, but many patients remain unaware of their extended benefits and struggle to access care. Texas healthcare providers report confusion about the new coverage rules, with many doctors learning about the changes through billing departments rather than official communications. The state’s recent removal of people from Medicaid rolls has complicated matters further, with many postpartum women having to fight to reinstate their coverage. Structural issues like provider shortages and limited mental health screening coverage continue to hinder access to care under the expanded program.

Private Equity

• Private equity firms have invested hundreds of billions of dollars in healthcare over the past 15 years, leading to increased scrutiny from the Department of Justice under the False Claims Act. PE firms typically use leveraged buyouts to purchase companies, leaving portfolio companies with substantial debt burdens that can complicate FCA enforcement and recoveries. The DOJ has two main options for addressing fraud in PE-owned healthcare companies: pursuing fraudulent transfer claims under the Federal Debt Collection Procedures Act and targeting individual liability, particularly former owners who received cash payouts during buyouts.