Categories
Health Law Highlights

Wade’s Health Law Highlights for March 17, 2026

Healthcare Fraud and False Claims

Privacy, Data Security, and HIPAA

  • The FTC reached settlements in December 2024 with Mobilewalla, Inc. and Gravy Analytics, Inc. for tracking and selling location data from health centers without user consent. Mobilewalla created audience segments from this data, including pregnant women identified through pregnancy center visits, and sold the information to clients for targeted advertising. Gravy Analytics collected location data without consent, sold data based on health-related characteristics, and geofenced medical events to sell the resulting data. Both companies are now prohibited from selling, disclosing, or using location data from health clinics, religious institutions, labor union offices, and other locations associated with protected status. These settlements occurred under the previous administration, leaving questions about how the new FTC will handle similar cases involving geolocation data that falls outside HIPAA regulations. Source: Healthcare Law Insights
  • California dentists face risks from patients recording office visits without consent, which violates both HIPAA and state privacy laws. The California Invasion of Privacy Act requires all parties to consent to recording conversations, and violations can result in fines up to $2,500 per violation and up to one year in jail. Patients have the right to access their dental records under HIPAA, but they do not have the right to record conversations with their dentist without consent. Dental practices should post signage prohibiting recording and staff should confirm that recording functions on wearable devices like smart glasses are turned off. If staff discover a patient recording without consent, they must instruct the patient to stop and report incidents involving protected health information to the U.S. Department of Health and Human Services Office for Civil Rights. Source: CDA
  • Legacy protected health information in email systems poses risks for HIPAA-covered entities during business email compromise events. A handful of compromised emails can contain PHI for tens or hundreds of thousands of individuals, particularly when organizations lack email archiving systems and retain PHI in emails from years ago. The Department of Health and Human Services Office for Civil Rights requires policies and procedures to guard against unauthorized access to PHI in email systems, yet healthcare organizations continue to underestimate the volume of PHI in their systems. Healthcare entities can implement security measures including archiving emails, using encryption for PHI shared by email, and deploying email filters to detect PHI before transmission. Internal emails, which typically contain the most PHI, often fall outside organizations’ encryption requirements despite presenting the most risk. Source: Data Counsel
  • The HHS Office for Civil Rights is reviewing 4,700 public comments on proposed HIPAA Security Rule updates while the rule’s future remains uncertain under the Trump administration’s deregulatory agenda. OCR Director Paula M. Stannard told attendees at the HIMSS conference that no decisions have been made on which modifications will be finalized, but defended the proposal by arguing that cyberattacks cost more than compliance in terms of reputation damage, ransom payments, system remediation, civil lawsuits, and regulatory penalties. The Biden-era proposal would require more stringent security controls and eliminate the distinction between required and addressable implementation specifications, which Stannard said entities often treat as optional, resulting in lax security. More than 100 hospital systems and industry associations urged HHS in December 2025 to rescind the rule, citing financial burdens and unreasonable implementation timelines. Experts recommend healthcare organizations adopt best practices like the NIST Cybersecurity Framework rather than waiting for a mandate, noting healthcare has been the number one targeted industry for cyberattacks for 13 years. Source: TechTarget

Cybersecurity

HHS Regulatory and Policy Developments

  • The U.S. Department of Health and Human Services announced on March 27, 2025, a reorganization that consolidates 28 divisions into 15 and reduces regional offices from 10 to 5. The restructuring, part of the Department of Government Efficiency Workforce Optimization Initiative, will reduce the workforce from approximately 82,000 to 62,000 employees and generate an estimated $1.8 billion in savings per year. The reorganization creates the Administration for a Healthy America (AHA), which integrates programs from OASH, HRSA, SAMHSA, ATSDR, and NIOSH, with a Fiscal Year 2026 budget request of $20.6 billion for telehealth modernization, behavioral health initiatives, environmental health research, and rural health workforce programs. HHS will establish an Assistant Secretary for Enforcement to oversee the Office for Civil Rights, Departmental Appeals Board, and Office of Medicare Hearings and Appeals. Healthcare organizations may experience delays in response times for inquiries and investigations due to workforce reductions. Source: Healthcare Law Insights
  • HHS withdrew a proposed exception in December 2025 that would have allowed healthcare providers to tailor patients’ electronic access to health information based on patient preferences. The Requestor Preferences Exception, originally proposed in August 2024, was withdrawn as part of the Trump Administration’s deregulatory initiative, creating complications for radiology providers who must navigate both federal information blocking rules and state laws requiring test result embargoes. States including Texas and Kentucky have enacted laws mandating delays before certain sensitive test results can be electronically disclosed to patients—Texas requires a 72-hour delay for pathology or radiology reports showing potential malignancy or genetic markers—while federal rules under 45 CFR Part 171 generally require timely release of finalized test results through electronic health record systems and patient portals. The American College of Radiology urged HHS in February 2026 to codify rather than withdraw the exception, arguing it would enable providers to share test results according to patient timeframes without triggering information blocking liability. Healthcare providers operating in states with mandatory embargo laws must assess whether their practices fall within the “required by law” exclusion and ensure compliance with federal rules after statutory delay periods expire. Source: ReedSmith

Artificial Intelligence in Healthcare

Industry Transactions and Business Disputes

  • DSO affiliation among U.S. dentists grew from 7.2% in 2015 to 16.1% in 2024, representing 124% growth over the decade. The trend is more pronounced among dentists with fewer than 10 years of experience, with 27% affiliated with a DSO in 2024. The platforms that outperform execute on operational integration and design liquidity from the outset, as these decisions shape margin performance, dentist retention, and exit outcomes. Without pre-close mapping of information systems, workflows, and governance structures, the first several months after closing are consumed by reconciling data instead of improving performance. Investors now focus on margin durability, reporting consistency, dentist retention, and governance clarity rather than acquisition volume alone. Source: VMG Health
  • A Business Court ruled that Apex Health cannot pursue claims against Atrium Health over a failed Medicare Advantage plan partnership because Apex failed to include the co-branding and partnership commitments from their Letter of Intent in the final agreement. In Apex Health, Inc. v. Atrium Health, Inc., 2026 NCBC 10, the parties’ LOI referenced a “co-branded” Medicare Advantage plan where Atrium would provide support as a “true partner,” but the final agreement only required Atrium to use “commercially reasonable efforts” to support marketing efforts with no co-branding commitment or marketing specifics. Apex alleged it suffered $62 million in losses when the plan attracted fewer than 50 enrollees in 2021 and 150 in 2022. The Court denied Apex’s motion to amend its complaint to add a Chapter 75 claim, finding the allegations of deception did not meet the “egregious and aggravating circumstances” standard and noting Apex waited months after discovery revealed the relevant documents to seek the amendment. The Court observed that given Apex’s sophistication and experience in the industry, it could have done more to set out its expectations regarding co-branding and partnership in the agreement itself. Source: It’s Just Business
  • Function Health filed a lawsuit against Superpower Health on January 26, 2026, in California federal court alleging false advertising and unfair competition under the Lanham Act and California state law. The complaint centers on Superpower’s marketing claims that it offers “100+ biomarkers” when Function alleges the platform actually provides approximately 55 direct laboratory measurements, with the remainder consisting of calculated metrics derived from existing lab values. Function also challenges Superpower’s representations about 24/7 clinical team availability and access to 3,000+ laboratory locations, claiming the clinical support consists of dieticians and health coaches responding within 24 hours on weekdays and that Quest Diagnostics operates approximately 2,250 patient service centers. Function, which was founded in 2021 and raised $298 million in Series B financing in November 2025, seeks an injunction, corrective advertising, monetary damages, disgorgement of profits, and attorneys’ fees. Superpower, founded in 2023, has not yet filed its answer to the complaint. Source: ArentFox Schiff

Provider Compliance and Payor Contracts

  • Healthcare providers frequently overlook binding obligations in third-party payor agreements that can result in contract breaches. Some provider agreements mandate notification to payors within 24 hours of a HIPAA breach, though the requirement often lacks clarity on whether unsuccessful security penetration attempts must be reported. Contracts may require providers to notify or obtain approval from payors before ownership or leadership changes, with thresholds varying by agreement. Most agreements also require providers to report settlements, overpayments, and adverse actions taken by regulating bodies such as licensing boards or certification entities. Payor contracts typically mandate an “effective” compliance program and may include cultural competence standards, though payors provide minimal guidance on what meets these requirements. Source: Shumaker, Loop & Kendrick, LLP
  • The FTC is reshaping the pharmacy benefit manager industry through settlements rather than litigation. On March 3, 2026, the FTC extended the stay in its administrative proceeding against OptumRx and Caremark Rx to allow time for settlement negotiations, following its Feb. 4, 2026 settlement with Express Scripts that imposes 10-year operational commitments on formulary, pricing, transparency and compensation structures. The FTC’s enforcement focuses on PBM rebate-driven incentives and formulary design affecting insulin access and patient out-of-pocket costs. Express Scripts agreed to incorporate the TrumpRx platform into its standard offering to plan sponsors and shift member out-of-pocket costs from list prices to net pricing. If all three PBMs reach similar settlements, the result could be an industry-wide regulatory baseline for PBM operations. Source: Polsinelli

State-Level Healthcare Regulation

FDA Enforcement

  • The FDA issued 30 warning letters to telehealth companies for marketing compounded GLP-1 medications in ways that violate federal law. The enforcement action, announced in March 2026 under Commissioner Makary, targets three violations: claims that compounded versions contain the “same active ingredient” as innovator drugs, marketing compounded drugs as “generic” equivalents, and use of “research use only” labeling for peptides intended for human consumption. This follows September 2025 enforcement actions that marked a shift from limited oversight to enforcement activity in the compounding and telehealth industry. Commissioner Makary stated in CNBC comments that he expects to see the end of unlawful mass compounding in 2026. The agency may pursue investigations or litigation beyond warning letters to address what it views as consumer deception and circumvention of the FDA approval process. Source: Sheppard