Category: Health Law Highlights

AI Governance

• Joint Commission and the Coalition for Health AI released the first national guidance for responsible AI implementation in U.S. healthcare systems. The guidance establishes policies for local validation, monitoring, and use that healthcare organizations can integrate into existing or new processes. The organizations plan to release governance playbooks later this year and in 2026, followed by a voluntary AI certification program for Joint Commission’s more than 22,000 accredited healthcare organizations. The partnership, launched in June 2025, combines Joint Commission’s standards and reach with CHAI’s technical expertise to help health systems utilize AI while improving patient outcomes. CHAI membership includes nearly 3,000 organizations across healthcare and technology sectors. Source: Joint Commission
• Healthcare providers are generating return on investment from AI in tech support and patient experience applications, according to a Google survey of more than 600 senior leaders in healthcare and life sciences. The survey found 80% reported better patient engagement metrics and 70% saw higher patient satisfaction scores, with both tech support and patient experience showing ROI for 34% of respondents. Meanwhile, 44% of organizations now use agentic AI agents, though data privacy and security remains the top concern for healthcare executives evaluating AI suppliers. A separate NYU study of 55,000 portal messages revealed clinicians use AI for patient communication 20% of the time, reducing composition time by 7% but requiring additional time for reviewing and editing AI-generated drafts. Source: AI in Healthcare

Biotech

• The biotech industry confronts a convergence of financial and regulatory pressures while showing signs of recovery in select funding areas. A patent cliff threatens $300 billion in biologics revenue from 2023 through 2028, while the Inflation Reduction Act and potential tariff policies create pricing uncertainties for pharmaceutical companies. Venture capital funding rebounded in 2024 to $23.1 billion total, exceeding pre-pandemic levels, though fewer companies received funding with larger average round sizes. The IPO market remains weak with only 30 companies raising $4 billion in 2024, and 39% of smaller biotech firms hold less than one year of operating cash. Alliance deals reached $144 billion in potential value during 2024, representing the highest level in a decade as companies pursue partnerships over traditional mergers and acquisitions. Source: DCAT Value Chain Insights

Cybersecurity

• Healthcare organizations face escalating cyber threats that directly compromise patient safety and care delivery. A Ponemon Institute survey of 677 healthcare IT professionals found that 93% of organizations experienced cyberattacks in the past year, with 72% reporting disruptions to patient care including delayed procedures, extended hospital stays, and complications that led to increased mortality rates in 29% of cases. Organizations experienced an average of 43 attacks each, up from 40 the previous year, while supply chain attacks proved most damaging with 87% of victims reporting negative patient care impacts. The average cost of the most expensive cyberattack reached $3.9 million, though this represents a decrease from 2024’s $4.7 million average, with operational disruption accounting for the largest expense at $1.2 million per incident. Human error contributed to 35% of data breaches, with employees failing to follow security policies, while 75% of organizations plan to migrate clinical applications to cloud platforms and 30% have adopted AI security tools. Source: HIPAA Journal
• The EU Data Act establishes a framework requiring companies to provide users access to data from connected products and related services, with obligations that became applicable September 12, 2025. The regulation applies to manufacturers of connected products placed on the EU market and service providers, regardless of their location, covering Internet of Things devices that collect data about their use or environment. Users gain rights to access personal and non-personal data their devices generate, and companies must make this data available on fair, non-discriminatory terms while allowing transfer to third parties upon request. Medical and health devices fall within scope, including wearables and digital health platforms, requiring manufacturers to build mechanisms for patients to retrieve operational data in portable formats. Non-compliance can result in fines, regulatory investigations, and civil liability, with the regulation working alongside the European Health Data Space Regulation that entered force in 2025. Source: White & Case LLP

Federal Drug Administration

• The FDA plans to use artificial intelligence to automate drug advertising compliance enforcement within five years as the agency faces reduced manpower while pharmaceutical advertising budgets have increased 800% since 1997. AI-driven technologies will enable the agency to issue warning letters without human inspectors reviewing complete files. The FDA currently conducts single-digit enforcement actions per year for direct-to-consumer advertisements despite the expansion of advertising vehicles. Pharmaceutical companies should work with regulatory counsel to comply with the 2023 final rule on direct-to-consumer advertising and develop corrective action plans within 15 days if they receive warning letters. Asebey predicts this automation will compel companies to tighten regulatory practices and improve consumer protection. Source: Pharmacy Times
• FDA has begun publishing complete response letters that were historically kept confidential, marking a shift toward transparency in drug approval processes. The agency frames this initiative as helping drug developers learn from prior deficiencies and strengthening public trust in FDA decision-making. Federal law requires FDA to redact personal privacy information, trade secrets, and confidential commercial information before disclosure, though the agency has not explained how this practice aligns with existing regulations that prohibit disclosing unapproved applications. Companies must now re-evaluate their disclosure practices and develop response plans for potential CRL publication. The shift creates a more transparent environment where FDA pre-approval feedback is no longer confined to confidential correspondence. Source: Morgan Lewis

Fraud & Abuse

• The Trump Administration continued False Claims Act enforcement in healthcare during fiscal year 2025. Healthcare enforcement continued with settlements exceeding $1 billion, including a $350 million settlement with Walgreens for filling invalid opioid prescriptions and a $98 million Medicare Advantage settlement for inflated risk scores. The DOJ also maintained focus on cybersecurity compliance violations among government contractors, securing multiple settlements totaling over $20 million. Paycheck Protection Program fraud cases continue due to Congress extending the statute of limitations to 10 years in 2022. Source: Mayer Brown
• ASCs operate under federal anti-kickback law enforcement risk despite exemption from Stark law restrictions. The federal Anti-Kickback Statute prohibits offering or receiving remuneration in exchange for patient referrals reimbursed by Medicare or Medicaid, requiring physicians who invest in ASCs to disclose their ownership interests and ensure investment opportunities are not based on referral volume. Safe harbor protections shield ASCs from prosecution when physician-owners personally perform procedures at the center and meet specific thresholds, including requirements that at least one-third of a physician-investor’s income comes from ASC-eligible procedures and physicians perform at least one-third of their procedures at the ASC. ASC ownership transactions must occur at fair market value to avoid referral-based inducements, with independent third-party valuations recommended to validate pricing and mitigate risk. Operating an ASC requires Medicare certification, state registration, and facility inspections, with restrictions that prevent space-sharing with hospitals or Medicare diagnostic facilities and prohibit passive ownership. Source: Becker’s ASC

GLP-1

• The Fifth Circuit Court of Appeals ruled that companies can now sue competitors under state laws that mirror federal FDA regulations, breaking from the tradition that only the federal government can enforce violations of the Federal Food, Drug, and Cosmetic Act. In Zyla Life Sciences, LLC v. Wells Pharma of Houston, LLC, the court reversed a district court dismissal and held that state laws mirroring the FDCA are not preempted by federal law. Zyla Life Sciences had sued Wells Pharma under unfair competition laws in six states, claiming Wells’ sales of compounded indomethacin suppositories violated state laws that mirror FDA premarket approval requirements. The decision relied on California v. Zook (1949) and could impact the ongoing legal battles between traditional drug manufacturers and compounding pharmacies, particularly involving GLP-1 weight loss drugs. Companies operating in FDA-regulated industries now face increased risk of civil lawsuits from competitors under state law, marking a shift in regulatory enforcement beyond federal oversight. Source: Foley & Lardner LLP

Intellectual Property

• Healthcare startups utilize software and intellectual property licensing to overcome development costs and regulatory barriers while accelerating time-to-market. Three primary licensing models exist: proprietary licensing with strict usage conditions, open source licensing that permits modification and distribution, and custom agreements tailored to specific needs. Healthcare companies must ensure licensing agreements address regulatory compliance with laws like HIPAA and GDPR, define scope of rights and ownership of improvements, and specify exclusivity terms and liability protections. Beyond licensing, startups need comprehensive IP strategies that include filing patents, trademarking assets, and protecting trade secrets to attract investors and increase company valuation. These licensing arrangements enable partnerships with universities, pharmaceutical companies, and technology vendors for research collaboration and market expansion. Source: Healthcare Law Insights
• Life sciences and medtech companies risk compromising patent rights during conferences through premature disclosure of technical details. Companies should file provisional patent applications before public disclosures and focus patent protection resources on inventions tied to core business objectives rather than pursuing patents for every idea. Teams should prepare two pitch decks—a non-confidential version and a confidential deck for NDA settings—since global patent rights depend on what companies disclose publicly. While the U.S. provides a one-year grace period after public disclosure to file for patent protection, many other jurisdictions do not offer this protection. Investors expect companies to maintain clean IP documentation, conduct freedom-to-operate scans, and protect trade secrets, particularly for software-enabled devices and AI systems. Source: Healthcare Law Insights

Private Equity & Startups

• Physician-founded healthcare companies require structured equity plans, regulatory compliance, and disciplined funding approaches to succeed. Founders should implement standard four-year vesting schedules with one-year cliffs, while advisors need written agreements with defined scope, deliverables, and milestone-based equity that reflects fair market value rather than referral-based compensation. Early-stage funding typically uses SAFE agreements with valuation caps and discounts, progressing to clean preferred stock with 1x non-participating liquidation preferences for priced rounds. Due diligence examines corporate structure integrity, deal economics clarity, and regulatory compliance, particularly for companies delivering direct care through physician-owned professional corporation and management services organization models. Companies should form immediately when intellectual property, data, personnel, or pilot programs are involved, as delays complicate ownership and rights assignments. Source: Healthcare Law Insights
• The California Governor signed SB 351, restricting private equity and hedge fund control over medical and dental practices. The law, which takes effect January 1, 2026, mandates that only physicians and dentists can own medical records, make employment decisions, negotiate payor agreements, make billing decisions, and approve medical equipment and supplies. SB 351 prohibits practice management contracts from including non-compete clauses that would bar providers from competing after termination or from commenting on quality of care issues and revenue strategies. The legislation grants the California Attorney General authority to seek injunctive relief and attorney’s fees from investors who violate corporate practice of medicine laws. The law applies exclusively to physician and dental practices backed by private equity or hedge funds and excludes government-owned healthcare entities from its restrictions. Source: The National Law Review

Medicaid Reimbursement

• Medicaid home care eligibility requirements became more restrictive on September 1, 2025, requiring applicants to demonstrate need for assistance with three activities of daily living instead of the previous two. Individuals with dementia or Alzheimer’s must now show need for “supervisory assistance or cueing” with two activities of daily living, compared to the previous requirement of just one activity. The housekeeping program, which provided up to eight hours per week of personal care assistance for tasks like meal preparation and laundry, will no longer accept new applicants. People with “legacy status” who were already enrolled in managed long-term care organizations or authorized for home care services before the September 1 cutoff remain exempt from these new requirements. The previously announced 30-month look-back period for community-based Medicaid coverage has not been implemented and has no scheduled date. Source: Falcon Rappaport & Berkman LLP

Telehealth

• Key telehealth flexibilities from the COVID-19 public health emergency expired on October 1, 2025, after Congress failed to extend them beyond the September 30 deadline. The expired provisions include allowing telehealth services from patients’ homes, expanding practitioner definitions to include occupational therapists and physical therapists, permitting audio-only telehealth sessions, and waiving in-person visit requirements for mental health services. The Centers for Medicare & Medicaid Services published then removed guidance instructing Medicare contractors to implement temporary claims holds for affected services. Medicare will now revert to pre-pandemic restrictions that limit telehealth services to designated rural areas and require in-person hospice recertifications. While bipartisan support exists for extending these flexibilities, the timing of any future extension and whether it might apply retroactively remains uncertain. Source: Healthcare Law Blog

Texas Medical Board

• The Texas Medical Board reprimanded Houston doctor for prescribing ivermectin to a COVID-19 patient at a Fort Worth hospital where she lacked treatment privileges. Administrative law judges determined Bowden engaged in unprofessional conduct when she prescribed the medication to a Tarrant County Sheriff’s Deputy in October 2021 without completing the required privilege application. The incident escalated when the physician sent a nurse to administer the medication, creating what the hospital called a “disruptive scene” that required police intervention. The doctor, an ear, nose and throat specialist, stated she does not regret her actions and plans to appeal the reprimand while filing a lawsuit against the medical board. The reprimand carries no fines or suspension. She has gained national attention for her opposition to COVID-19 vaccine mandates and support for ivermectin treatment. Source: Houston Chronicle

AI Governance

• Health systems possess the expertise to monitor AI tools but lack the infrastructure to implement comprehensive governance at scale. The Joint Commission and Coalition for Health AI released guidance covering AI policies, data security, quality monitoring, and safety event reporting, while the National Association of Insurance Commissioners established a model bulletin on AI use adopted by multiple states. Hospitals currently focus on low-risk AI applications such as chart review, ambient scribes, and radiology triage that maintain human oversight, according to Troy Bannister, CEO of Onboard AI. Mark Sendak of Vega Health argued that standards exist but healthcare organizations need scalable infrastructure and data systems to monitor AI tools across their systems. Industry executives expressed skepticism about Sen. Ted Cruz’s SANDBOX Act, which would create regulatory waivers for AI companies, preferring instead a distributed governance model similar to Clinical Laboratory Improvement Amendments. Source: Healthcare Innovation
• AI in healthcare has come a long way since the FDA approved the first autonomous diagnostic system for diabetic retinopathy in 2018. The technology now detects patterns in medical scans, predicts patient deterioration, and automates administrative tasks while enabling personalized medicine through analysis of genetic and clinical data. However, algorithms can amplify healthcare inequities when training data underrepresents certain populations, and a 2023 study highlighted how racial and ethnic bias affects resource allocation and diagnostic accuracy. Current privacy frameworks like HIPAA and GDPR fail to address AI complexity, prompting new regulations including the EU AI Act that classifies medical AI as “high risk” and the US NIST AI Risk Management Framework. The American Medical Association has established principles requiring healthcare AI to be transparent and accountable while augmenting rather than replacing clinical judgment. Source: IAPP

Antitrust

• U.S. antitrust officials signal a shift toward case-by-case enforcement over broad rulemaking as they target AI and healthcare markets for competition protection. DOJ Assistant Attorney General Gail Slater, DOJ Deputy AAG Dina Kallay, and FTC Director Daniel Guarnera outlined their enforcement priorities at the Fordham Competition Law Institute conference, backing away from the Biden Administration’s rulemaking approach in favor of targeted legal action. Slater framed the Google Search remedies decision as a foundation for AI market competition, while warning that monopolists may use privacy concerns to gatekeep data and block interoperability. The FTC plans to grant early termination of merger reviews more frequently, having already approved nearly 250 cases, and will continue enforcing against unlawful non-compete agreements despite abandoning the defunct broad rule. Officials emphasized scrutiny of incumbents in AI and healthcare sectors to prevent suppression of startups and ensure American competitiveness in deploying transformative technologies. Source: Wilson Sonsini

Cybersecurity

• The U.S. Department of Labor expanded its cybersecurity guidance to cover all employee benefit plans, including health plans, requiring sponsors to implement 12 key security practices. Previously, DOL guidance focused only on ERISA retirement plans, leaving health plans outside the scope of federal cybersecurity requirements. Health plan sponsors must now align their cybersecurity practices with DOL standards while maintaining compliance with existing HIPAA and HITECH regulations. The 12 required practices include establishing formal cybersecurity programs, conducting annual risk assessments, implementing penetration testing, performing third-party security audits, and maintaining data encryption protocols. Unlike HIPAA and HITECH regulations that focus primarily on health data confidentiality, the DOL guidance takes a broader approach emphasizing ongoing monitoring, annual assessments, and continuous risk management across all health plan operations. Source: Security Magazine
• Quantum computers will render current healthcare encryption methods obsolete, forcing organizations to prepare now for future security threats. Cyberthreat actors are already collecting encrypted healthcare data to store until quantum computers become available to break current RSA and ECC algorithms, according to Kurt Rohloff, chief technology officer at Duality Technologies. The National Institute of Standards and Technology released three post-quantum cryptography algorithms in 2024 after eight years of development, recommending organizations adopt these standards immediately. Healthcare data faces particular risk because health records retain sensitivity indefinitely, unlike credit card information that can be replaced when compromised. Rohloff recommends healthcare organizations conduct cryptographic inventories, discuss post-quantum plans with vendors, and consider fully homomorphic encryption that allows computations on encrypted data without decryption. Source: TechTarget

Data Breach

• Harris Health notified over 5,000 patients that a former employee accessed their electronic health records without authorization for a decade. The Houston-area healthcare system discovered the breach on February 10, 2021, but the unauthorized access occurred from January 4, 2011, to March 8, 2021. The employee was terminated after an investigation confirmed that patient records were accessed without legitimate work purpose and some information was disclosed to unauthorized individuals, prompting Harris Health to notify the FBI. The compromised data included names, dates of birth, addresses, medical histories, medications, health insurance information, and Social Security numbers for some patients. Patient notifications were delayed four years at the request of law enforcement to avoid interfering with their investigation. Source: HIPAA Journal

Data Privacy

• The Texas App Store Accountability Act will expose mobile app developers to private lawsuits starting January 1, 2026. The law requires app developers serving Texas users to assign age ratings for apps and in-app purchases, implement age verification systems, obtain parental consent for minors, and notify app stores of changes to terms of service or privacy policies. Unlike other Texas privacy laws, TASAA allows private litigants to sue for economic damages, injunctive relief, and attorney’s fees under the Texas Deceptive Trade Practices Act, while the Texas Attorney General can recover up to $10,000 per violation. The law prohibits developers from enforcing contracts against minors without parental consent, misrepresenting age ratings, and sharing personal data collected for age verification purposes. Utah and Louisiana will implement laws later in 2026. Source: Womble Bond Dickinson
• States are stepping in to regulate reproductive health data privacy after a federal court struck down enhanced HIPAA protections in 2025. A Texas federal judge vacated the Reproductive Health Care Privacy rule in Purl v. U.S. Department of Health and Human Services on June 18, 2025, after a physician challenged it for conflicting with state child abuse reporting requirements. The Department of Health and Human Services did not appeal the decision by the August 18, 2025 deadline, leaving covered entities to rely on existing HIPAA protections. California, Virginia, and Washington have enacted comprehensive laws that extend beyond traditional healthcare entities to cover fitness trackers, retailers, and tech companies that process reproductive health data, with penalties ranging from $2,500 to $250,000 per violation. These state laws require explicit consent for data collection and sharing, with New York preparing similar legislation through the pending New York Health Information Privacy Act. Source: Troutman Pepper Locke

Devices

• Ingestible sensors are transforming healthcare by providing real-time health monitoring from inside the human body. These capsule-shaped devices pass through the digestive tract and track temperature, medication adherence, pH levels, gastrointestinal motility, and biomarkers before transmitting data wirelessly to smartphones or tablets. The technology enables healthcare providers to monitor chronic diseases, ensure medication compliance, and conduct post-surgical monitoring without invasive procedures. The ingestible sensors market is projected to grow from $986.2 million in 2025 to over $1.7 billion by 2032 at an 8.1% compound annual growth rate. However, the technology faces challenges including high costs, data privacy concerns, and regulatory barriers, with the FDA approving only a few ingestible sensor products under strict guidelines. Source: Technowize

Enforcement

• The Department of Justice established the Enforcement & Affirmative Litigation Branch within its Civil Division to consolidate enforcement efforts targeting public health and safety violations. The new branch contains two sections: an Enforcement Section that will pursue cases under the Controlled Substances Act, Food Drug and Cosmetic Act, and Federal Trade Commission Act, and an Affirmative Litigation Section that will sue states, municipalities, and private entities that obstruct federal policies. DOJ identified two priorities for the branch: targeting pharmaceutical companies, health care providers, and medical associations regarding gender transition claims, and ending sanctuary jurisdiction laws that impede federal immigration enforcement. The reorganization coincides with the FDA’s September 9, 2025 announcement of a crackdown on deceptive drug advertising and the winding down of the Consumer Protection Branch. The restructuring does not expand DOJ’s statutory powers but centralizes certain consumer protection matters and enforcement priorities. Source: Epstein Becker Green

Fraud & Abuse

• The Trump Administration expanded False Claims Act enforcement beyond traditional healthcare and defense contracting into new areas including trade fraud, civil rights violations, and gender-related medical treatments during fiscal year 2025. The Department of Justice secured settlements exceeding $500 million in healthcare cases, including $98 million from a Medicare Advantage provider for inflated risk scores, $60 million from a pharmaceutical company for kickbacks, and $350 million from Walgreens for filling invalid opioid prescriptions. The DOJ launched the Civil Rights Fraud Initiative targeting universities and organizations that allegedly violate civil rights laws while receiving federal funding, and created a Trade Fraud Task Force with Homeland Security to pursue customs duty evasion cases. Government contractors faced over $20 million in cybersecurity-related settlements for failing to meet federal security requirements. The administration continues pursuing Paycheck Protection Program fraud cases under the extended 10-year statute of limitations, with settlements including $21.6 million from three foreign-owned companies. Source: Mayer Brown
• Accountable care organizations report detecting fraud in Medicare skin substitute treatments that cost individual patients over $600,000 in 2025. Six doctor groups are seeing higher rates of spending on skin substitutes this year compared to 2024, with one case exceeding $2 million per patient. The Centers for Medicare and Medicaid Services estimates Medicare spent $10 billion on these treatments last year and has proposed reducing reimbursement from $2,000 per square centimeter to around $125, with a final decision expected in November. The accountable care organizations first alerted CMS to the possible fraud two years ago but say the agency is not moving fast enough to address the problem. The wound care industry is fighting the proposed payment reductions through the MASS Coalition, arguing the changes will not help crack down on fraud. Source: POLITICO
• A federal court ordered Humana to pay $90 million to the government following the first whistleblower settlement involving Medicare prescription drug contracting fraud. Former Humana actuary Steven Scott alleged the company submitted fraudulent bids to the Centers for Medicare & Medicaid Services for Part D contracts from 2011 to 2017, maintaining two sets of books while providing coverage below required levels. The court also ordered Humana to pay $32 million in attorney fees to Scott’s legal team, while Scott received $26.1 million as his whistleblower share, equivalent to 29% of the government settlement. Humana did not admit liability in the agreement and said it settled to avoid litigation costs. The Department of Justice declined to intervene in the case, which centered on allegations that Humana’s “basic Walmart Plan” was not actuarially equivalent to required standards despite the company’s certifications to CMS. Source: Healthcare Innovation

HIPAA

• The Office for Civil Rights reached a $182,000 settlement with Cadia Healthcare Facilities for posting patient success stories online without proper HIPAA authorization. On September 30, 2025, OCR announced the settlement with five Delaware rehabilitation and nursing facilities for violating HIPAA Privacy and Breach Notification Rules. Cadia compromised the protected health information of 150 patients by posting their names, photographs, and treatment details on the company’s public website through a success story program. The settlement requires Cadia to implement a two-year Corrective Action Plan, review compliance policies, train staff, and ensure no PHI appears on websites or marketing materials. This enforcement action follows similar cases, including a 2016 settlement with Complete P.T. for $25,000 over patient testimonials posted without authorization. Source: Mintz
• Reid Health agreed to settle a class action lawsuit over allegations it used Meta Pixel tracking tools that disclosed patients’ protected health information without consent. The lawsuit, Jane Doe v. Reid Health, claimed the Richmond-based healthcare provider impermissibly shared patient data with third-party technologies through website tracking tools that collect information about user interactions, web pages visited, and searches performed. Reid Health denied any wrongdoing but chose to settle rather than face the costs and risks of continued litigation. Under the settlement terms, class members can claim a $25 cash payment and receive automatic enrollment in a medical shield product that protects against personal information misuse. Class members have until October 25, 2025, to object to the settlement, with claims due by December 24, 2025, and a final fairness hearing scheduled for December 9, 2025. Source: HIPAA Journal

Joint Ventures

• Joint ventures have emerged as a standard mechanism for healthcare growth across multiple sectors as health systems face mounting pressure from shifting care sites, tightening margins, and labor shortages. The momentum spans sectors including ambulatory surgery centers, where Tenet Healthcare’s USPI operates 520 ASCs and 25 surgical hospitals as of April 2025, and the overall ASC market is projected to grow from $40 billion in 2024 to $57.4 billion by 2034. RadNet reports 153 joint ventures within health system partnerships representing 38.4% of its 398 locations, while Encompass Health structures 67 of its 168 inpatient rehabilitation facilities as joint ventures with acute-care hospitals. Other sectors show similar patterns, with Acadia Healthcare maintaining 21 joint venture partnerships across 22 hospitals and Civica Rx including over 50 health systems to supply around 80 medications. Execution requires coordination across strategy assessment, financial valuation, legal compliance, governance alignment, and operational management. Source: VMG Health

Medicare Reimbursement

• The Centers for Medicare & Medicaid Services issued final guidance for the 2028 implementation of the Inflation Reduction Act’s Drug Price Negotiation Program, marking the last year the agency must implement the program through guidance rather than rulemaking. The guidance establishes policies for Part B drugs to be selected for price negotiation for the first time, alongside Part D drugs, with CMS planning to select 15 drugs from the 50 highest-spending drugs in each category. CMS finalized most proposals but reversed course on treating certain fixed combination drugs as distinct qualifying single source drugs and will now include Medicare Advantage expenditure data in selection calculations. The agency shortened the negotiation timeline for 2028, giving manufacturers only six weeks for meetings instead of the previous two months. CMS concurrently issued revised Information Collection Request forms for small biotech exceptions and biosimilar delay requests, with public comments due by October 30, 2025. Source: Hogan Lovells

Mergers & Acquisitions

• Healthcare transaction activity showed mixed results in early 2025 as political uncertainty and federal policy changes disrupted deal momentum. Deal values declined in the second quarter despite volume increases, with tariff threats and federal changes creating market uncertainty that caused investors to pull back. Dental practices dominated physician group transactions, accounting for over half of all deals in the first six months, while e-health transactions jumped from 124 deals in 2024 to 160 deals in the same 2025 period. Behavioral health deals increased from 34 to 54 transactions during the same timeframe, and hospital transactions cooled after elevated activity in 2024. Non-private equity investment reached 200 deals in the second quarter of 2025, marking the first time this threshold was crossed in 18 months. Source: CLA

Regenerative Medicine

• The FDA issued draft guidance on September 20, 2025, establishing expedited review pathways for regenerative medicine therapies targeting serious conditions. The guidance will replace earlier FDA guidance from February 2019 and outlines how sponsors can utilize streamlined review processes for cell and gene therapies and other regenerative medicine products. The FDA has received almost 370 Regenerative Medicine Advanced Therapy (RMAT) designation requests as of September 2025 and approved 184, with 13 RMAT-designated products receiving marketing approval as of June 2025. The guidance emphasizes long-term safety monitoring for regenerative therapies and encourages sponsors to use digital health technologies for safety data collection and real-world evidence to support accelerated approval applications. The FDA is accepting public comments on the draft guidance through November 24, 2025. Source: Holland & Knight

Reproductive Rights

• Texas Attorney announced the arrest and indictment of eight people connected to a Houston-area midwife for practicing medicine without a license. At least one of the eight individuals is also accused of performing an abortion, while the midwife Maria Margarita Rojas, 49, was previously charged in March with 15 felony counts including performance of an abortion and 12 counts of practicing medicine without a license. Rojas was the first person charged under the Texas Human Life Protection Act, and Paxton emphasized that some of the defendants include foreign nationals. Rojas’ attorney and the Center for Reproductive Rights are defending her, calling the case a sham and noting that her clinics served low-income, uninsured immigrants before being shut down. Texas law permits abortions only when a pregnant person faces risk of death or serious physical impairment, with providers facing penalties of at least $100,000, loss of medical licenses, and prison time for violations. Source: CNN
• The US Court of Appeals for the Fifth Circuit dismissed an appeal that effectively ends HIPAA privacy protections for reproductive healthcare records. The court dismissed the appeal on September 10, 2025, following a June 2025 ruling in Purl v. Department of Health & Human Services that vacated provisions of the 2024 HIPAA Privacy Rule to Support Reproductive Health Care Privacy. The rule provided protection to protected health information related to reproductive healthcare services. The Biden Administration implemented the rule to protect reproductive healthcare records from disclosure following the 2022 Supreme Court ruling in Dobbs v. Jackson Women’s Health Organization. The dismissal signals the conclusion of the Purl case and the end of these privacy protections. Source: American Bar Association
• States are enacting reproductive health data privacy laws after a federal court struck down HIPAA protections. A Texas federal judge overturned the Reproductive Health Care Privacy rule in June 2025, which had amended HIPAA to impose restrictions on the use and disclosure of reproductive health information for criminal or administrative investigations. California, Washington, Virginia, and New York have implemented or are implementing their own laws that extend beyond traditional healthcare entities to cover fitness trackers, retailers, and tech companies that process health-related data. These state laws require explicit consent before collecting or sharing reproductive health information and impose penalties ranging from $2,500 per violation in Virginia to $250,000 per willful violation in California. The laws apply to organizations that may not consider themselves healthcare-oriented, including digital health companies, data brokers, and companies using geolocation data. Source: Troutman Pepper Locke

Tariffs & Taxation

• U.S. tariffs implemented since spring 2025 are driving healthcare construction and equipment costs up by approximately 6%, forcing hospitals to extend asset lifecycles and increase reliance on refurbished equipment. The tariffs include reciprocal duties, expanded steel and aluminum measures, and ongoing Section 301 tariffs on Chinese goods, with JE Dunn’s calculator showing a $10 million healthcare project now costs $573,761 more due to these trade policies. Healthcare facilities are responding by delaying capital expenditures, extending the useful life of imaging systems and diagnostic equipment, and turning to refurbished equipment that costs 30-70% less than new systems. VMG Health observed a $1.4 million tariff escalation line item in one facility construction budget, representing 4% of hard costs on top of typical construction contingencies. The Supreme Court will hear oral arguments in November 2025 regarding the legality of certain tariffs, while healthcare providers navigate increased costs for everything from MRI scanners to ambulances. Source: VMG Health

Alternative Medicine

• Texas Medical Board now requires physicians to obtain structured consent before providing complementary and alternative medicine therapies. Effective January 2025, the rules apply to any non-conventional treatment including peptides, stem cells, and exosomes, regardless of FDA approval status. Physicians must use an unmodified TMB consent form that covers assessment requirements such as medical history, physical exams, and discussion of conventional treatment options. The disclosure process requires documentation of treatment objectives, risks and benefits, regulatory status of substances used, and plans for periodic review of patient progress. The executed form must become part of the patient’s medical record and cannot be customized beyond translation or supplemental pages. Source: Healthcare Empowered

Devices & Wearables

• Patients are managing their own healthcare through direct-to-consumer tests, wearable devices, and AI chatbots due to doctor shortages and long appointment wait times. Companies like Quest Diagnostics now offer more than 150 direct-to-consumer lab tests ranging from $29 complete blood counts to $385 comprehensive health profiles analyzing over 75 markers. Two-thirds of adults use smartphone apps to track health information, while new devices can monitor heart rhythm for $79-$129, screen for sleep apnea, and measure blood pressure without cuffs. Patients and caregivers are turning to ChatGPT and other AI chatbots to diagnose symptoms, manage chronic diseases, and research treatments for serious conditions. Harvard Medical School professor Dr. Tom Delbanco notes that evidence shows patient involvement in their own care leads to better outcomes, though the trend carries risks including reliance on information not reviewed by clinicians and data privacy concerns. Source: WSJ

Emerging Tech

• AI models demonstrate high accuracy in diagnosing skin conditions in low- and middle-income countries but face equity challenges, according to a systematic review of 19 studies. The review found that AI systems achieved accuracy rates up to 99% in detecting skin cancer and infectious diseases like monkeypox, with 63% of studies showing AI outperformed dermatologists in diagnostic accuracy. However, significant disparities emerged when AI systems trained primarily on Caucasian datasets were tested on darker skin tones, with one study finding accuracy dropped from 69.9% for Caucasian patients to just 17% for Black patients in Uganda. The research covered conditions including skin cancer, monkeypox, facial aging analysis, acne, and burn depth estimation across Africa, Asia, and global datasets. Most studies exhibited moderate to high risk of bias due to small sample sizes and limited real-world validation, highlighting the need for diverse datasets and lightweight mobile-compatible models for equitable implementation. Source: International Journal of Emergency Medicine

Fraud & Abuse

• The OIG identified billing practices that warrant scrutiny in Medicare’s remote patient monitoring program after payments reached $536 million in 2024. The August 25, 2025 report found Medicare payments for RPM services increased 31% from 2023, with nearly one million Medicare enrollees receiving services from approximately 4,600 medical practices. The OIG flagged concerning billing patterns including 45 practices billing for patients with no prior medical relationship, 52 practices billing for patients who never received treatment management, and instances of multiple practices billing the same enrollees or providers billing for multiple devices per patient monthly. The findings follow previous fraud alerts and precede an upcoming 2026 audit of Medicare Part B RPM services announced in December 2024. Healthcare providers face increased scrutiny and audit risk as the OIG calls for CMS to implement safeguards to monitor these billing patterns. Source: The FCA Insider

HIPAA

• Texas enacted SB 1188 to regulate electronic health records and artificial intelligence use in healthcare. The law, which took effect September 1, 2025, requires all EHRs containing Texas patient data to be physically stored in the United States beginning January 1, 2026. SB 1188 applies to healthcare entities, third-party vendors, cloud service providers, and subcontractors that manage or store EHRs. The legislation mandates disclosure when AI is used for diagnostic purposes, requires EHR systems to include dedicated fields for biological sex at birth, and prohibits collection of patient credit scores or voter registration data. The law authorizes civil penalties against entities that violate its requirements. Source: Buchalter
• Cadia Healthcare Facilities paid $182,000 to settle HIPAA violations after posting patient success stories without proper authorization on their websites and social media. The Department of Health and Human Services Office for Civil Rights investigated the five Delaware nursing homes following a complaint that the chain disclosed patient names, photographs, and health information without valid written HIPAA authorization. The investigation revealed that Cadia disclosed protected health information for 150 patients across its websites, despite having policies requiring written consent forms. Under the settlement agreement, Cadia must implement a two-year corrective action plan monitored by OCR, provide workforce training on HIPAA policies, and notify all affected individuals of the potential breach. The company apologized and stated it had enhanced its privacy policies and increased employee training. Source: McKnight’s Senior Living

Marketing

• Texas defends its text marketing law by arguing it targets spam messages rather than consent-based business communications. Texas Senate Bill 140, signed by Governor Greg Abbott on June 20, 2025, and effective September 1, 2025, requires businesses using text message telemarketing to register with the secretary of state, pay a $200 fee, post a $10,000 security bond, and submit quarterly reports. The state filed a brief opposing a preliminary injunction request from plaintiffs including an industry association and two e-commerce companies who challenged the law in federal court. Texas argued the law excludes transmissions that mobile customers have agreed to receive and focuses on stopping deceptive solicitations without permission. The law includes a “customer” exemption for businesses that have operated under the same name for at least two years when soliciting current or former customers. Source: The National Law Review

Medicare Advantage

• A federal judge in Texas vacated a Medicare Advantage audit rule that would have allowed the government to recover billions from insurance companies. Judge Reed O’Connor ruled that the Centers for Medicare & Medicaid Services failed to provide notice and comment when it eliminated the Fee-for-Service Adjuster method that had been used since 2012 to calculate audit overpayments. The 2023 rule would have allowed CMS to apply a new methodology retroactively to 2018 and could have recovered up to $4.7 billion from Medicare Advantage organizations between 2023 and 2032. Humana challenged the rule, arguing it was arbitrary, unlawfully retroactive, and improperly promulgated. CMS must now continue using its previous methodology until any new proposal goes through proper rulemaking channels. Source: Humana v. Xavier Becerra – Order

Mergers & Acquisitions

• The FTC moved to block private equity firm GTCR’s $627 million acquisition of medical device company Surmodics in the Trump administration’s first merger challenge. The FTC alleges the merger would combine the two largest providers of hydrophilic coatings used in medical devices, resulting in a market share exceeding 50% and concentration levels that surpass antitrust guidelines. The Commission voted unanimously in March 2025 to file suit, arguing the transaction would eliminate competition between direct competitors in a market with high entry barriers. The case signals a shift from the Biden administration’s focus on private equity transactions to more traditional antitrust theories centered on market concentration and competitive harm. Healthcare transactions remain a priority for antitrust enforcers regardless of political administration, reflecting the industry’s impact on patients and the economy. Source: Jones Day
• Healthcare transaction due diligence requires a fundamentally different approach than other industries due to regulatory complexity and constant change. Healthcare deals face challenges including regulatory exposure, reimbursement risk, compliance pitfalls, and cybersecurity threats, with oversight from CMS, DOH, OIG, HIPAA and commercial payer policies making compliance more difficult than most industries. Coding and billing errors can trigger claim denials, payment delays, reduced payments, and legal exposure, while annual updates to CPT and ICD codes mean rules change constantly. Historical performance fails to predict future results because reimbursement models, regulatory frameworks, and care delivery models remain in flux, forcing investors to develop forward-looking approaches that assess how policy changes will reshape revenue models. Technology tools like analytics platforms now enhance due diligence by providing targeted sampling and audit insights, while collaboration between finance and coding teams delivers a complete view of risks and opportunities rather than isolated findings. Source: VMG Health

Patient Safety

• Florida will require Level 2 background screenings for nearly all healthcare practitioners starting July 1, 2025, under House Bill 975. The law expands fingerprint-based criminal history checks from a select group of healthcare professions to include dentists, pharmacists, therapists, social workers, and dozens of other licensed practitioners. New applicants must complete the screening before licensure, while current practitioners must undergo screening at their first renewal on or after the effective date. The law also expands the list of criminal offenses that can disqualify someone from holding a healthcare license, including abuse, fraud, and certain felonies. Practitioners who fail to complete the screening cannot have their licenses renewed, which immediately revokes their authority to practice in Florida. Source: Health Care Law Matters

Pharmaceuticals

• The Trump Administration plans to impose tariffs on pharmaceutical imports, ending decades of duty-free trade for the industry. The administration is conducting a Section 232 investigation into pharmaceutical imports’ impact on national security, with President Trump and key officials expressing intent to introduce tariffs in the near future. Companies must review supply agreements to identify which entity serves as importer of record, as this entity bears legal responsibility for paying tariffs on U.S. imports. Pharmaceutical companies can potentially reduce tariff exposure through the “first sale” rule, which allows dutiable value to be based on the price between manufacturer and intermediary rather than the subsequent sale to the U.S. importer. Companies should also evaluate tariff-free exemptions for products used in research and development activities and consider modifications to supply chains involving chemical compounds and bulk drug substances. Source: Jones Day

Telehealth

• Medicare telehealth flexibilities expired for the first time since the COVID-19 pandemic, ending nearly five years of extensions and forcing coverage to revert to pre-pandemic rules. Under the restored regulations, most Medicare beneficiaries can no longer receive telehealth services from home and must instead visit specific sites such as provider offices, hospitals, or skilled nursing facilities located in rural professional shortage areas outside metropolitan statistical areas. The changes also reinstate restrictions on which practitioners can provide telehealth services and limit audio-only telehealth to certain circumstances. The Centers for Medicare and Medicaid Services advised providers through an October 1 newsletter to consider sending Advance Beneficiary Notices of Noncoverage to Medicare patients continuing telehealth care and directed Medicare Administrative Contractors to hold claims for 10 days. Healthcare providers must now reassess their telehealth operations to comply with the pre-pandemic requirements while the industry awaits potential Congressional action. Source: BakerHostetler

Artificial Intelligence

• Shadow AI tools used without IT oversight create security risks that cost healthcare organizations $200,000 more per data breach than sanctioned AI incidents. IBM’s 2025 Cost of a Data Breach report found that 20% of organizations across all sectors suffered breaches due to shadow AI incidents, compared to 13% for sanctioned AI tools. A 2025 survey revealed that 86% of healthcare IT executives reported shadow IT instances in their health systems, up from 81% in 2024. Shadow AI displaced security skills shortage as one of the top three factors contributing to breach costs, with personally identifiable information being the most compromised data type and intellectual property compromised in 40% of shadow AI incidents. More than 60% of organizations lack governance policies to manage AI or detect unauthorized AI use, according to IBM research. Source: TechTarget

Fraud & Abuse

• Federal appellate courts remain divided on whether plaintiffs must prove “but-for causation” when bringing False Claims Act cases based on Anti-Kickback Statute violations. The dispute centers on a 2010 amendment to the Anti-Kickback Statute that declares claims “resulting from” kickback violations constitute false claims under the False Claims Act. The First, Sixth, and Eighth circuits have ruled that the “resulting from” language requires but-for causation, meaning plaintiffs must prove the kickback caused the false claim submission. Some courts have suggested alternative pathways exist that bypass the but-for causation requirement, but legal experts argue this interpretation contradicts statutory language and creates illogical outcomes. The Department of Justice opposes the but-for causation requirement, stating it would complicate litigation by forcing extensive analysis of physician motivations for thousands of treatment decisions. Source: Akin Gump Strauss Hauer & Feld LLP
• A federal district court in Tennessee has limited False Claims Act liability for Anti-Kickback Statute violations in a September 22 ruling that could restrict healthcare fraud prosecutions. In United States v. HCA Healthcare, Inc., the court ruled that hospitals did not receive “remuneration” when a laboratory agreed not to seek reimbursement for technical components of pathology services for non-Medicare patients, since hospitals had no legal obligation to pay those costs. The court also established a “but for” causation standard, requiring whistleblowers to prove that providers would not have sought government reimbursement without the alleged kickback violation. The decision rejected claims that were merely “tainted by” kickbacks, calling such allegations too “attenuated” to establish False Claims Act liability. The court characterized the disputed arrangement as normal marketplace competition rather than illegal kickback activity. Source: Warner Norcross + Judd LLP

Hospice

• Hospice providers are expanding their service offerings through diversification into palliative care, home-based primary care, and community aging programs. Hospices are broadening their horizons when it comes to service diversification. Some providers are exploring innovative care models, while others are moving upstream into palliative care and branching out their community-based services. Cost, referral streams and staffing considerations are significant pieces of developing and growing a palliative care program. The federally approved CAPABLE program has been under consideration for Medicare reimbursement since 2019. Currently, services provided under the program are reimbursed through partnerships with Accountable Care Organizations (ACOs) and private insurers. Source: Hospice News

HIPAA

• A federal court vacated reproductive health care provisions of the 2024 HIPAA Privacy Rule while preserving substance use disorder protections. On June 18, 2025, in Purl v. HHS, a federal district court eliminated requirements for group health plans to update policies and Privacy Notices for reproductive health care information protections. The court preserved regulations at 42 CFR part 2 that require group health plans to implement protections for substance use disorder (SUD) records by February 16, 2026. SUD records include patient identity, diagnosis, prognosis, or treatment information maintained in connection with substance use disorder programs conducted or assisted by any U.S. government department. Group health plans cannot disclose SUD records in legal proceedings without written consent or court order, and must update Privacy Notices and distribute them to all participants by the February deadline. Source: Spencer Fane

Marketing

• Texas Senate Bill 140 requires companies sending text messages to or from Texas to comply with telemarketing regulations starting September 1, 2025. The law redefines “telephone solicitation” to include text and multimedia messages, requiring companies to register with the Secretary of State and post a $10,000 bond. Text messages can only be sent between 9 am and 9 pm Monday through Saturday and between noon and 9 pm on Sundays in Central time, with fines reaching thousands of dollars per message for violations. The legislation strengthens consumer enforcement rights under the Texas Deceptive Trade Practices Act and allows consumers to bring multiple lawsuits for continuing violations. The changes come as the US Supreme Court’s June 2025 McLaughlin decision created uncertainty about federal Telephone Consumer Protection Act rules, making state laws more important in regulating text marketing campaigns. Source: Foster Garvey PC

Medicare

• CMS plans to phase out its inpatient-only procedure list over three years starting in 2026, prompting healthcare providers to call for elimination of Medicare’s three-day hospital stay requirement for skilled nursing facility coverage. The proposed removal of 285 procedures, mostly musculoskeletal, threatens access to post-acute care since traditional Medicare beneficiaries must have a three-day inpatient hospital stay within 30 days before qualifying for skilled nursing facility coverage. LeadingAge, representing over 5,400 nonprofit providers, submitted comments to CMS recommending elimination of the rule, which affects 20% to 50% of current skilled nursing facility admissions and only applies to roughly 20% of Medicare beneficiaries on traditional Medicare plans. The organization proposes reimagining skilled nursing facilities as settings for chronic care management and direct physician admissions, allowing patients to avoid hospitals for stabilizing treatments. Industry leaders argue the three-day stay rule forces patients into cycles of hospital visits and compromises quality of life while driving up costs. Source: Skilled Nursing News

Medicaid

• Texas overpaid $10.5 million to hospices due to lack of oversight policies during fiscal years 2020 through 2022. The Office of Inspector General found that 174 hospices, representing 36 percent of hospices that received payments, were overpaid because Texas had no policies and procedures for calculating and collecting hospice cap overpayments. Of the total overpayments, $6.9 million represents the Federal share that should have been returned to the Federal Government. The OIG recommends that Texas collect the $10.5 million in overpayments and refund the Federal share, and also develop policies and procedures for future cap overpayment calculations. Texas agreed with the second recommendation but did not indicate concurrence or nonconcurrence with the first recommendation. Source: Office of Inspector General

Mergers & Acquisitions

• The FTC and DOJ reported 32 merger enforcement actions in fiscal year 2024 while processing 1,973 transactions under the Hart-Scott-Rodino Act. The agencies issued 59 second requests for additional information, representing approximately 3% of all reported transactions. Healthcare transactions accounted for 3% of reported deals, with the FTC issuing second requests for two hospital acquisitions and two ambulatory healthcare service acquisitions. Healthcare sector enforcement will remain a top priority going forward. Source: Stevens & Lee

Non-Competes

• The Federal Trade Commission issued warning letters to healthcare employers and staffing firms, urging them to review their noncompete agreements for legal compliance. The letters, signed by Chairman Andrew Ferguson, advised recipients to immediately discontinue any agreements that do not comply with law and notify employees accordingly. The action follows the FTC’s withdrawal of its defense of a nationwide noncompete ban that federal courts had enjoined. The FTC also issued a request for information from the public about noncompete agreements in healthcare, seeking examples that have affected wages, hiring difficulties, or competition within specific geographic areas. The Commission stated these restrictions can limit healthcare professionals’ employment options and patient choices, particularly in rural areas where medical services face constraints. Source: Stevens & Lee

Pharmacies

• Four Texas pharmacy professionals received prison sentences for operating a pill mill that distributed over half a million opioid pills. Arthur Billings, 61, the owner of Health Fit Pharmacy in Houston, was sentenced to 12 years in prison and ordered to forfeit $2.6 million for his role in the conspiracy. Three pharmacists who worked at the facility received sentences ranging from 20 months to six years in prison, with forfeiture orders between $5,000 and $68,931. The cash-only pharmacy dispensed hydrocodone and oxycodone to individuals posing as patients for drug traffickers, using fraudulent prescriptions issued under stolen physician identities. The operation continued despite repeated warnings from the Texas State Board of Pharmacy, the Texas Department of Public Safety, and the Drug Enforcement Administration. Source: U.S. Department of Justice

Private Equity

• Private equity firms are investing in hormone replacement therapy businesses as the treatment gains mainstream acceptance following the debunking of a 2002 study that set back menopause care for two decades. HRT has expanded from endocrinology and gynecology practices into primary care, dermatology, and aesthetic medicine. Investors view HRT as a source of recurring revenue and higher customer lifetime value, as patients commit to long-term treatment plans and the service provides stability during economic downturns. However, challenges include regulatory compliance, recruiting medical staff, patient education requirements, and tensions over insurance coverage versus cash-pay models. Several PE firms exemplify this trend through partnerships to integrate HRT services across various platforms and expand into new markets. Source: VMG Health

Website Tracking

• Four federal courts delivered mixed rulings in August on Electronic Communications Privacy Act claims against healthcare companies using website tracking technologies like Meta Pixel and Google Analytics. The decisions reveal a split among courts on invoking ECPA’s “crime-tort exception,” with Illinois courts producing contradictory outcomes—some allowing claims to proceed where plaintiffs alleged transmission of protected health information to third parties, while others dismissed cases for lack of specificity about what information was disclosed. A Washington court permitted an addiction treatment case to advance, finding that results from an online addiction survey coupled with appointment requests constituted protected health information. Courts emphasized that successful ECPA claims require plaintiffs to provide details about what health information was disclosed and how it relates to individual health status, rather than general assertions about website usage. The rulings demonstrate that the outcome of these cases depends on the specifics of alleged HIPAA violations and whether tracking data can identify individuals and relate to their health conditions. Source: Byte Back

Advertising

• The FDA announced a crackdown on direct-to-consumer pharmaceutical advertising on September 9, following a presidential memorandum directing action against misleading advertising practices. The agency issued thousands of template letters to pharmaceutical companies warning them to remove misleading advertising and sent hundreds of cease-and-desist letters to companies violating advertising rules. FDA plans to increase enforcement actions from the current 10-20 untitled letters annually to hundreds per year, with focus on social media and digital advertising content. The agency targets violations of “fair balance” requirements between drug risks and benefits, with attention to how seniors access risk information and influencer posts that fail to follow regulations. FDA also intends to eliminate the “adequate provision” rule that currently allows drug manufacturers to avoid listing all safety risks in broadcast advertisements if they direct consumers to additional information sources. Source: Loeb & Loeb LLP

Cybersecurity

• Healthcare organizations must understand cloud lifecycle management beyond initial migration to achieve cost optimization and security compliance. Healthcare systems have increased cloud adoption over the past five to seven years, with providers like Amazon Web Services offering compliance and security features that reduce concerns about hosting protected health information in the cloud. Organizations face challenges including stakeholder buy-in, security concerns around PHI, selecting appropriate cloud architecture, and maintaining HIPAA compliance throughout the cloud lifecycle. Cloud lifecycle management begins with planning and determining what to host in the cloud, followed by migration, operationalizing with a FinOps approach for financial responsibility, continuous workload optimization, and eventual decommissioning or modernization. Technology partners such as Mission Cloud Services can guide healthcare organizations through each stage of cloud lifecycle management, with cloud infrastructure serving as a foundation for accessing AI and machine learning tools. Source: HealthTech Magazine

Data Privacy

• Texas mandates electronic health records must be stored within the United States starting January 1, 2026. Senate Bill 1188 requires all electronic health records under the control of covered entities to be physically maintained in the United States or U.S. territories, regardless of whether the records are stored by the covered entity or a third party. The law defines “covered entity” more broadly than HIPAA, encompassing nearly any entity that assembles, collects, analyzes, uses, evaluates, stores, or transmits protected health information, including healthcare providers, payors, schools, researchers, and business associates. Violations can result in civil penalties between $5,000 and $250,000, and regulatory agencies may revoke or suspend licenses, registrations, or certifications. The Texas Health and Human Services Commission and the Texas Attorney General are authorized to investigate and penalize non-compliance with the storage requirements. Source: Katten Muchin Rosenman LLP

Economics

• Hospitals in economically disadvantaged areas adopt health information technologies at lower rates than those in affluent regions, according to a study of 16,646 hospital observations from 2018-2023. Hospitals in the most deprived areas were less likely to implement treatment-stage telehealth, postdischarge telehealth, electronic data query systems, and data availability functions compared to hospitals in the least deprived areas. The research found that hospital participation in accountable care organizations was associated with higher adoption rates across all technology types, with ACO-participating hospitals showing adoption probabilities 2-7 percentage points higher than non-participating facilities. Despite persistent gaps, health information technology adoption increased over time across all hospitals regardless of area deprivation level, with adoption rates rising from 2018 to 2023. Hospital characteristics including bed size, urban versus rural location, and ACO participation explained 60-104% of the observed disparities in technology adoption between advantaged and disadvantaged areas. Source: JAMA Health Forum

Fraud & Abuse

• Healthcare whistleblowers now use AI algorithms to analyze public datasets and flag statistical anomalies that signal potential fraud. The Department of Justice recorded 979 qui tam actions in 2024, marking the second-highest number of False Claims Act cases in program history, with many initiated through mathematical outliers rather than insider tips. The Centers for Medicare & Medicaid Services pioneered this approach in 2011 with their Fraud Prevention System, which prevented or caught $820 million in inappropriate payments within three years by running predictive analytics on 100% of Medicare fee-for-service claims. Analysis of nearly 3,500 analytics-driven audits reveals an 18% error rate, roughly double what traditional probe audits detect, while traditional audits examine only 10 encounters per provider and miss over 90% of potential issues. Healthcare organizations can now use tools like VMG Health’s Compliance Risk Analyzer to identify the same billing patterns and anomalies before external investigators spot them. Source: VMG Health
• The federal government made $162 billion in improper payments during fiscal year 2024, representing a $74 billion decrease from the $236 billion recorded in 2023. The decline occurred primarily due to the termination of pandemic-related programs, with the Department of Labor’s Pandemic Unemployment Assistance program alone accounting for a $44 billion reduction. Of the total improper payments, $135 billion (84%) were overpayments to recipients, while the remainder included underpayments, unknown payment errors, and procedural violations. Five programs concentrated 75% of all improper payments: Medicare, Medicaid, the Earned Income Tax Credit, SNAP, and the Restaurant Revitalization Fund. Since 2003, the federal government has made an estimated $2.8 trillion in improper payments across various programs and agencies. Source: U.S. GAO

IV Hydration

• Texas enacted House Bill 3749, known as “Jenifer’s Law,” to regulate IV therapy services outside traditional medical facilities following a death at a Texas spa in 2023. The law, effective September 1, 2025, requires physicians to prescribe or order all elective IV therapy in non-facility locations such as spas, mobile units, and homes. Only physician assistants, advanced practice registered nurses, and registered nurses may administer IVs under physician supervision, ending the practice of unlicensed staff providing these services. The law mandates written prescriptive authority agreements between physicians and delegated clinicians, with registration required through the Texas Medical Board. Source: Healthcare Empowered

Litigation

• Healthcare tech companies face mounting class action lawsuits that threaten investor confidence and stock stability. The sector has become a target for litigation due to digitization, data privacy concerns, and regulatory scrutiny, with UnitedHealth Group settling for $69 million in 2024 after accusations of prioritizing business relationships over 401(k) fund performance. Data breach lawsuits surged in 2024, with plaintiffs filing more cases than in any prior year, despite amendments to privacy laws that reduced per-scan damages. Companies that demonstrate transparency and strategic pivots during legal disputes recover faster than those with poor leadership, while servant and transformational leadership styles help mitigate risks through proactive compliance. Investors should monitor leadership actions such as cybersecurity spending increases as indicators of a company’s ability to manage legal challenges and maintain long-term stability. Source: AInvest

Medical Devices

• The FDA has escalated enforcement against AI health apps by issuing warning letters to SeniorLife Technologies and Whoop for marketing diagnostic features without proper authorization. SeniorLife received an August 21, 2025 warning letter for its AI app that assesses mobility and cognitive health, predicts fall risk, and detects Alzheimer’s signs without premarket clearance, while also lacking basic quality system controls like complaint handling and employee training procedures. Whoop received a July 14, 2025 warning letter for its Blood Pressure Insights feature that estimates systolic and diastolic blood pressure, which FDA determined to be inherently diagnostic and tied to hypertension conditions. Both companies violated regulations by falsely claiming FDA approval in their marketing materials and failing to submit required 510(k) applications for their diagnostic software functions. The enforcement actions signal FDA’s position that AI-enabled health software performing diagnostic functions must undergo premarket review regardless of how companies frame the features as “wellness” tools. Source: Hogan Lovells
• The Office of Inspector General approved physician ownership in a medical device company through Advisory Opinion 25-09 while maintaining scrutiny of such arrangements. The opinion involved an emergency stroke treatment device company where physician investors owned 35 percent of the company and could order or recommend the device to hospitals. OIG found no Federal Anti-Kickback Statute violation because the arrangement met all requirements of the small entity investment safe harbor, including keeping physician ownership under 40 percent and providing equal investment terms to all investors. Despite the approval, OIG reaffirmed that physician-owned medical device companies remain “inherently suspect” and warned that such arrangements can create incentives to overutilize services and distort clinical judgment. The opinion confirms that compliance pathways exist for physician investment in medical device companies when structures align with safe harbor requirements. Source: Orrick

Non-Competes

• FTC Chairman Ferguson sent letters to healthcare employers and staffing companies warning them to review and eliminate anticompetitive noncompete agreements. The letters emphasize that enforcement against unreasonable noncompetes remains a top FTC priority, with the agency targeting provisions that limit clinician job opportunities and reduce patient choice, particularly in rural areas. The FTC focused on large healthcare employers and staffing firms, noting that enforcement will target roles including nurses, physicians, and other medical professionals. This outreach follows the FTC’s withdrawal from defending its nationwide noncompete ban and the creation of a Joint Labor Task Force in February 2025 to prosecute anticompetitive labor practices. While the FTC cannot seek damages for overbroad noncompetes, it can issue cease-and-desist orders and seek civil remedies in federal court. Source: McDermott Will & Emery
• Texas Senate Bill 1318 imposed strict new limits on healthcare non-compete agreements that took effect September 1, 2025, requiring immediate compliance from employers whose contracts renew automatically. The law applies to physicians, dentists, nurses, and physician assistants and restricts geographic limitations to a maximum five-mile radius from the practitioner’s primary practice location, while capping duration at one year from termination. Buyout provisions must now be limited to the practitioner’s total annual salary and wages at termination, and contract terms must be written in plain language. Non-compete agreements become void if physicians are discharged without good cause, defined as conduct, job performance, or employment record issues. Healthcare employers face potential liability for attorney fees if they attempt to enforce non-compliant agreements that were renewed or entered into after the September 1 effective date. Source: Hendershot Cowart P.C.

Qui Tam Actions

• A federal judge rejected TriHealth’s constitutional challenge to the False Claims Act but certified the case for appeal to the Sixth Circuit Court. On July 28, 2025, U.S. District Judge Douglas Russell Cole stayed the False Claims Act lawsuit in United States of America et al. v. TriHealth Inc. et al. while the constitutional challenge proceeds. TriHealth argued that the FCA’s qui tam provisions violate the Constitution’s Article II Appointments and Take Care Clauses and that whistleblowers Thomas Murphy and Dr. Set Shahbabian lack standing under Article III. The court ruled that relators are not officers under the Appointments Clause and that the Executive Branch retains control over relator conduct, rejecting TriHealth’s constitutional arguments. This case represents the third federal court of appeals to examine the constitutionality of qui tam provisions, with legal experts predicting the issue will eventually reach the Supreme Court. Source: Whistleblowers Blog

Reimbursement

• CMS is conducting more frequent and targeted RADV audits to increase oversight of risk adjustment programs. These audits pressure healthcare organizations and payers to ensure precise Hierarchical Condition Category (HCC) coding and documentation, as coding errors can trigger repayment demands and penalties. For payers, RADV audits validate risk-adjusted payments and can uncover financial discrepancies leading to recoupment of overpayments, while providers face repayment demands and penalties for documentation or coding errors. Organizations must implement internal controls, conduct regular coding validations, and invest in provider education to reduce audit exposure. Clinical documentation serves as evidence that validates diagnoses, requiring specificity, clarity, and completeness to avoid claims being flagged during audits. Source: VMG Health

Telehealth

• Telehealth delivers financial benefits to healthcare organizations through increased revenue, reduced losses, and decreased operational costs. The technology helps prevent patient attrition by offering virtual visits and self-scheduling capabilities that meet consumer expectations for convenience and access. Healthcare organizations can avoid government penalties through remote physiological monitoring programs, with 2,499 hospitals facing Medicare readmission penalties averaging $208,000 per hospital in 2022. Telehealth reduces recruitment costs by improving clinician satisfaction and combating burnout, which decreases staff turnover rates. Organizations can also lower facility costs since telehealth work can be performed from clinicians’ homes, allowing multiple providers to share exam rooms and expanding geographic reach without additional physical space. Source: Telehealth.org
• The telehealth obesity market has experienced explosive growth, reaching $57.75 billion in 2024 and projected to hit $392.89 billion by 2033 with a 24% compound annual growth rate. The U.S. telehealth weight-loss market saw a 300% year-over-year increase in patient consultations for GLP-1 prescriptions in 2025, with platforms like Noom and LifeMD bundling these medications with AI-driven coaching services. The FDA has issued over 100 warning letters to telehealth providers for promoting compounded GLP-1 drugs as equivalents to FDA-approved medications, creating opportunities for compliant companies like Weight Watchers (WW), which has attracted 87,000+ subscribers with its hybrid model combining FDA-approved medications and behavioral support. An estimated 40 million people will use GLP-1 medications by 2029, generating $126 billion in sales. Source: Ainvest

OIG Advisory Opinion No. 25-10

• The OIG issued a favorable advisory opinion for a grant-funded family-powered therapy arrangement. The Company’s mission is to provide care for individuals with a certain disorder, particularly for those individuals who lack adequate access to care. The therapy for the disorder is generally covered by insurance, including Medicare. The Company created a tax-exempt Foundation that awards monthly grants directly to families of children receiving this therapy from any provider, based on verified treatment hours, adherence, and financial need. The Foundation’s grant decisions are made under policies approved by an independent board and outside counsel, do not vary by provider choice, and require that a child already have a treatment plan in place; families may change providers and remain eligible. The OIG found low risk of overutilization or inappropriate steering because the Company’s donations are unrestricted, the Foundation operates autonomously, funds go to families (not providers), and eligibility is provider‑neutral and needs‑based. Source: OIG Advisory Opinion No. 25-10 (Sept. 8, 2025)

Antitrust

• States are expanding antitrust oversight of healthcare transactions to target private equity and other for-profit entities in healthcare mergers and acquisitions. Washington and Colorado implemented premerger notification laws that went into effect on July 27 and August 6, 2025, while Indiana modified its transaction notice law and New Mexico enacted a permanent version of its notification law. Pennsylvania proposed H.B. 1460 to authorize the Attorney General to block healthcare transactions involving private equity companies that are “against the public interest,” while California’s A.B. 1415 would expand OHCA review requirements to include private equity companies, hedge funds, and management services organizations. Illinois introduced S.B. 1998 to require private equity and hedge funds to obtain Attorney General consent for financing healthcare transactions, and Massachusetts is considering multiple bills to strengthen its transaction review process, including requiring bonds from private equity groups and authorizing post-transaction reviews. Source: Healthcare Law Blog

Cybersecurity

• The Department of Justice is using the False Claims Act to pursue cybersecurity violations by government contractors and healthcare companies. Two settlements demonstrate this expansion: a defense contractor and private equity firm paid $1.75 million for failing to implement NIST cybersecurity controls and control access to Controlled Unclassified Information between 2018-2020, while a biotechnology company paid $9.8 million for selling genomic sequencing systems with cybersecurity vulnerabilities to the federal government from 2016-2023. These cases mark the first FCA cybersecurity settlement involving healthcare Quality System Regulations and the first to include a private equity firm alongside a defense contractor. The DOJ launched its Civil Cyber-Fraud Initiative in 2021 and recently reformed the DOJ-HHS False Claims Act Working Group to focus on medical device investigations. FCA settlements exceeded $2.9 billion in fiscal year 2024, with per-claim penalties now exceeding $28,000. Source: Healthcare Law Blog

Data Blocking

• The U.S. Department of Health and Human Services escalated enforcement of information blocking regulations, directing additional resources toward identifying violations under the 21st Century Cures Act. Secretary Robert F. Kennedy Jr. instructed the Office of Inspector General and the Office of the National Coordinator for Health Information Technology to pursue enforcement actions against healthcare providers, health IT developers, and health information networks that block patient access to electronic health information. Civil monetary penalties can reach $1 million per violation for certified health IT developers and health information exchanges, while Medicare-participating providers face penalties under three Medicare payment programs. The agencies have received approximately 1,300 information blocking claims since April 2021, with most submitted by patients against healthcare providers. HHS will prioritize enforcement in cases involving longstanding practices, patient harm, care delivery impacts, or financial losses to federal programs or private entities. Source: Health Industry Washington Watch

Durable Medical Equipment

• CMS has launched initiatives using artificial intelligence to combat fraud in the durable medical equipment industry. The agency created a competition to leverage AI and machine learning for detecting anomalies in Medicare claims data, targeting fee-for-service hospice, Part B and DME claims through a two-phase process. AI results from private payers have been mixed due to the nuances in DME claims. CMS is also implementing the Wasteful and Inappropriate Service Reduction (WISeR) model and promoting competitive bidding as fraud-reduction measures. Industry experts anticipate increased audits this year from Unified Program Integrity Contractors (UPIC), particularly targeting catheters, surgical dressings, supplies and respiratory claims. Source: HME News

Equity and Access

• Researchers have developed an interpretable deep learning model that predicts healthcare access in underserved communities while addressing fairness concerns. The study by Saxena, Sharma, Kumar Johari, and collaborators tackles the “black box” problem in AI by creating a model that stakeholders can understand and trust. The researchers used multi-source data from health and demographic datasets to provide insights into factors affecting healthcare access, from socioeconomic status to geographic location. The model emphasizes fairness by ensuring predictions do not systematically disadvantage any particular group. This approach enables more efficient resource allocation and can inform policies aimed at reducing healthcare disparities. Source: BioEngineer

Food and Drug Administration

• The FDA will now publish Complete Response Letters in real time through a centralized database, marking a shift in transparency for drug and biologic applications. The agency will post CRLs for pending New Drug Applications and Biologics License Applications shortly after transmission to sponsors, while also releasing historical letters from 2024 forward. The FDA has already published 89 archived CRLs and will continue releasing letters tied to withdrawn or abandoned applications. While confidential commercial information and trade secrets will be redacted, sponsor identities and high-level scientific and regulatory deficiencies will remain visible. The letters are searchable by product, sponsor, or therapeutic area through the openFDA database, creating new competitive intelligence opportunities and compliance challenges for pharmaceutical companies. Source: Orrick

Fraud & Abuse

• A former laboratory CEO and nine healthcare professionals agreed to pay over $6 million to settle federal allegations of kickback schemes involving laboratory testing referrals. Christopher Grottenthaler, former CEO of True Health Diagnostics in Frisco, Texas, will pay $4.25 million to resolve claims he orchestrated kickbacks disguised as managed service organization distributions to induce doctors’ laboratory referrals to Medicare, Medicaid, and TRICARE from January 2015 to May 2018. Two physicians, Dr. Hong Davis and Dr. Elizabeth Seymour, along with seven marketers, agreed to pay an additional $1,818,462 for their participation in the scheme. The settlements are part of a broader Department of Justice effort that has recovered over $59 million in civil False Claims Act settlements for healthcare kickbacks disguised as MSO investment distributions, involving 50 physicians. The Anti-Kickback Statute prohibits offering or receiving remuneration to induce referrals of services covered by federal healthcare programs to ensure medical decisions are based on patient interests rather than financial incentives. Source: U.S. Department of Justice

Friendly PC Model

• Private equity firms using “Friendly PC” structures must implement three specific agreements to comply with Corporate Practice of Medicine regulations. The structure allows physician-owned Professional Corporations to sell non-clinical assets to PE buyers while a designated “Friendly Provider” maintains ownership of clinical operations. The Administrative/Management Services Agreement handles non-clinical services but must avoid creating a partnership between the management entity and practice. Employment Agreements must guarantee clinical professionals retain autonomy in patient care decisions without employer interference. The Clinical Liaison Agreement enables the Friendly Provider to oversee clinical staff supervision and policy development as the only legally authorized party for such services. Source: Dickinson Wright

Medical Marijuana

• Texas implemented an expanded medical marijuana program that adds chronic pain as a qualifying condition. The law signed by Gov. Greg Abbott also adds traumatic brain injury, Crohn’s disease, and other inflammatory bowel diseases to the list of qualifying conditions. A recent poll of 391 cannabis consumers found 91% believe cannabis treats chronic pain, with 65% calling it “very effective” and 26% “mildly effective.” The Department of Public Safety will issue 12 new dispensary licenses across Texas, expanding from the current three facilities, with the first nine licenses awarded December 1 from 139 applicants who applied in 2023. Federal data shows at least two million Texans use cannabis regularly. Source: Marijuana Moment

Management Services Organizations

• Physicians entering Management Services Organization arrangements face risks that require documentation and negotiation to protect their interests. MSOs handle administrative functions like billing and compliance while allowing physicians to focus on clinical work, but disputes can emerge when these arrangements involve private equity or joint ventures. Physicians must document all compensation terms including salary, bonuses, equity rights, and expense reimbursements across multiple agreements, as verbal agreements prove difficult to enforce. Termination provisions require attention to prevent physicians from being removed without recourse, including restrictions on no-cause termination and clear definitions of termination “for cause” with cure periods. All agreements must preserve physician autonomy over medical decisions and comply with healthcare fraud and abuse laws. Source: Stevens & Lee

Medicaid

• CMS has issued new federal payment limits for State Directed Payments in Medicaid managed care to combat fraud and preserve program integrity. The guidance implements requirements from the One Big Beautiful Bill Act, limiting SDPs for hospital and nursing facility services to 100% of Medicare rates in Medicaid expansion states and 110% in non-expansion states, effective July 4, 2025. States can qualify for a grandfathering period until January 1, 2028, for certain SDPs submitted before the deadline, followed by a phased reduction to meet the new limits. The restrictions come as SDP usage has exploded from just 2 states in 2016 to 39 states today, with CMS projecting annual spending of $124.3 billion for FY 2025 and $144.6 billion for FY 2026. States must now revise pending SDP submissions to comply with Section 71116 requirements before CMS will continue review. Source: CMS Guidance

Non-Competes

• Healthcare employers must carefully review non-compete provisions in employment contracts as state laws vary and have recently changed. Ericka Adler, shareholder at Roetzel & Andress, advises that enforceable non-competes require three factors to be reasonable: geography should match patient location (such as 3 miles if patients come from within 3 miles), scope should limit restrictions to the employee’s role or practice functions, and duration should typically range from one to two years. Some states require notice language allowing employees to consult counsel before signing, while many states mandate consideration for non-compete agreements. Employees commonly request carve-outs that void non-competes if terminated without cause or if the employer breaches the contract. When violations occur, employers can send cease and desist letters to the employee and their new employer, along with pursuing other legal remedies to protect their practice. Source: Roetzel & Andress

Pharmaceuticals

• The FTC and DOJ concluded three listening sessions on pharmaceutical competition as part of an effort to lower drug prices. The sessions featured panels of legal experts, patient advocates, academics, Congressional staffers, and industry representatives who discussed generic and biosimilar competition, patent issues, regulatory barriers, and pharmacy benefit managers. Panelists debated whether pharmaceutical companies misuse patents to prevent generic competition through practices like pay-for-delay agreements, patent thickets, and product-hopping, with some arguing the patent system drives innovation while others claimed it creates barriers. Key recommendations included implementing generics-first policies across federal programs, increasing transparency in pharmaceutical supply chains, and eliminating separate interchangeability designations for biosimilars. FTC Chair Andrew Ferguson stated the information will feed into a final report with recommendations to guide legislation and regulatory reform for prescription drug access. Source: Hogan Lovells

Physician Compensation

• Hospitals face mounting financial pressures as Medicare cuts physician reimbursement while provider costs rise and workforce shortages intensify. The Centers for Medicare & Medicaid Services cut the Medicare conversion factor by 2.8% in 2025 to $32.35, marking the fifth consecutive year of reductions and bringing total cuts to over 10% since 2020. Meanwhile, 20% of practicing physicians are age 65 or older and another 22% are between 55-64, creating a projected shortage of up to 86,000 physicians by 2036. Hospital salary costs have risen 5% annually from 2018 through 2022, while 63% of medical groups planned to add advanced practice provider roles in 2024 to maintain coverage. Health systems are responding with recruitment incentives including relocation allowances (55% of positions), signing bonuses (51%), and loan forgiveness (17%), while anesthesia and radiology groups are seeking subsidies that sometimes double current agreements. Source: VMG Health

Remote Monitoring

• The Department of Health and Human Services Office of Inspector General issued a report calling for increased oversight of remote patient monitoring Medicare billing due to concerns about fraud and abuse. Medicare payments for RPM services reached $536 million in 2024, representing a 31% increase from 2023, with nearly one million Medicare beneficiaries receiving these services. The OIG identified concerning billing patterns, including 45 medical practices that billed RPM services for patients with whom they had no prior medical relationship for over 80% of cases, and some practices billing for over 100 new enrollees monthly compared to an average of five. The report recommended that the Centers for Medicare and Medicaid Services and Medicare Advantage Organizations monitor practices that bill without established patient relationships, track treatment management billing rates, and watch for duplicate services across multiple providers. The OIG also flagged practices billing for multiple monitoring devices per patient per month when Medicare generally covers only one device monthly. Source: Health Law Diagnosis

Synthetic Data

• Synthetic data represents algorithm-generated information that mimics real-world data while preserving privacy, and government adoption is expected to accelerate despite current resistance. This artificial data retains the statistical properties of original datasets and has been used since the early 1990s in applications ranging from census research to traffic management, with companies like Replica raising $52 million to develop these technologies. While 32 percent of government decision-makers worldwide refuse to consider synthetic data compared to 23 percent in other industries, Utah has emerged as a leader by incorporating synthetic data definitions into its Consumer Privacy Act and having officials advocate for its adoption. The U.S. Census Bureau controversially used synthetic data in the 2020 census to protect individual privacy while analyzing income and poverty trends, though critics worried about errors and manipulation. A noted research firm predicts that 75 percent of businesses will use generative AI to create synthetic data by 2026, with potential government applications including school performance analysis, agricultural research, and smart city management. Source: Government Technology

Wound Care

• Home health agencies are transforming wound care practices as payment models shift from volume-based to outcomes-based reimbursement under value-based purchasing programs. The transition requires providers to move from frequent dressing changes to longer wear-time products that optimize healing while reducing care burden on clinicians and caregivers. Accountable care organizations now demand streamlined, evidence-based product formularies that homecare agencies must adopt to remain partners in coordinated care networks. Under CMS’s Patient Driven Groupings Model, wound care represents one of the highest-paying clinical categories, but only when documentation supports medical necessity and skilled intervention. The model places homecare agencies under pressure to demonstrate outcomes through data reporting while managing a 7.4% annual growth rate and widespread caregiver shortages affecting 59% of agencies. Source: Homecare Magazine

Antitrust

• Hospital associations challenge new merger notification rules as burdensome and unnecessary. The Federal Trade Commission under Lina Khan adopted changes to Hart-Scott-Rodino premerger notification requirements that took effect February 10, 2025, increasing information volume and preparation time by four times. On August 8, 2025, the American Hospital Association and Federation of American Hospitals filed an amicus brief supporting business groups’ lawsuit seeking injunctive relief against the changes. The hospital associations argued the FTC failed to identify any anticompetitive hospital merger that went undetected under prior reporting requirements. They contended the rule changes function as a tax on hospitals and aim to discourage mergers in an industry facing economic pressures. Source: Epstein Becker Green
• The Trump administration’s antitrust regulators maintain focus on healthcare competition but reject the Biden era’s emphasis on private equity and corporate greed in favor of targeting regulatory barriers to market entry. The Federal Trade Commission and Department of Justice demonstrate willingness to approve mergers through consent decrees involving divestitures, as seen in the UnitedHealth Group-Amedisys deal that required selling 164 home health and hospice locations. The FTC issued a Second Request to examine Aya Healthcare’s $615 million acquisition of Cross Country Healthcare over concerns about self-preferencing in travel nurse staffing services. The DOJ launched an investigation into NewYork-Presbyterian’s contracting practices following union complaints about anti-steering provisions that prevent insurers from excluding the health system from their networks. The FTC released findings showing that 38% of physicians belonged to practices affected by mergers between 2015 and 2020, representing consolidation across approximately 2,000 transactions. Source: Goodwin

Data Privacy & Cybersecurity

• The Office for Civil Rights published two new HIPAA Privacy Rule FAQs on August 11, 2025, clarifying PHI disclosure rules and patient access rights. The first FAQ permits healthcare providers to disclose protected health information to value-based care arrangements for treatment purposes without individual authorization, supporting payment models that tie compensation to patient outcomes. The second FAQ confirms that treatment consent forms fall within designated record sets that patients can access, removing ambiguity about these documents. The guidance aligns with the Centers for Medicare & Medicaid Services’ July 30, 2025, announcement of its Health Tech Ecosystem initiative, which over 60 organizations including Epic, Oracle Health, CVS Health, and major tech companies have pledged to adopt. OCR has announced 53 enforcement actions since launching its Right of Access Initiative in 2019, including a $200,000 penalty imposed in March 2025 against a provider that failed to provide timely patient record access. Source: Data Privacy + Cybersecurity Insider
• Ransomware attacks on hospitals create cascading effects that overwhelm neighboring healthcare facilities and endanger patients throughout entire communities. When a hospital’s systems go offline, surrounding facilities must absorb diverted ambulances and walk-in patients, creating overcapacity situations that can lead to worse patient outcomes and potential deaths. Health-ISAC tracked 446 ransomware events in healthcare during 2024, with 281 incidents occurring in just the first half of 2025, indicating the threat continues to escalate. Rural communities face greater risks than urban areas because longer ambulance travel times to alternate facilities can delay treatment and worsen medical conditions. Both the Ascension and Change Healthcare attacks stemmed from lack of multifactor authentication for remote access, highlighting how basic security gaps enable attackers to target patient care systems for maximum leverage. Source: Dark Reading

Emerging Tech

• Hospital executives believe in AI’s potential but lack readiness for implementation. A recent survey of 101 executives across integrated delivery networks, academic medical centers and independent hospitals, found that 83% believe AI can improve clinical decision-making and 75% think it could reduce operational costs. While 67% report current investments in AI for patient care and 66% pursue solutions for administrative operations, only 13% have a strategy for integrating AI into clinical workflows. Just 12% trust today’s AI algorithms as reliable enough for use, and only 10% report their organizations aggressively pursue AI implementation. Nearly half of respondents (49%) cite appropriate use of AI as one of their top three challenges. Source: Becker’s Hospital Review

False Claims Act

• Paul Njoku received a 75-month federal prison sentence for orchestrating a Medicare fraud scheme through his home health care agency. The 64-year-old owner and CEO of Opnet Health Care Services Inc. forged signatures of doctors and nurses by cutting out old signatures and taping them onto new medical documents required for Medicare payments. Njoku continued using a registered nurse’s signature on nursing notes and assessments in 2018 and 2019 without her knowledge after she left the company in 2017, and he bribed a doctor to approve home health services. From 2015 to 2019, Opnet billed Medicare over $400,000 in claims and received over $360,000, with many claims lacking required documentation or based on falsified records. A jury found Njoku guilty on all counts after deliberating for less than two hours following a three-day trial. Source: U.S. Attorney’s Office, Southern District of Texas
• The Sixth Circuit affirmed a district court’s dismissal of a False Claims Act case against three Kentucky cancer centers, ruling that Medicare does not require radiation services be performed by board-certified radiologists or radiation oncologists. In United States ex rel. Robert C. O’Laughlin, M.D. v. Radiation Therapy Services, P.S.C. et al., the court rejected Dr. O’Laughlin’s allegations of Medicare fraud after nearly a decade of litigation. The court found that CMS manuals permit any physician to perform radiation services regardless of specialty, making billing by non-specialist physicians proper. The relator failed to provide evidence linking specific Medicare claims to instances where qualified providers were absent during radiation or chemotherapy treatments. The court established that whistleblowers must present concrete, claim-specific proof rather than relying on scheduling documents or statistical inferences to survive summary judgment under the False Claims Act. Source: CaseMine

Marketing

• Texas Senate Bill 140 takes effect September 1, 2025, expanding the state’s telemarketing regulations to cover text messages and SMS marketing. The law allows consumers to file private lawsuits against businesses for violations and removes caps on cumulative damage recoveries. Companies that send marketing texts to Texas phone numbers must register each business location with the Texas Secretary of State, pay a $200 filing fee, and post a $10,000 security bond. The Texas Attorney General can impose penalties of up to $5,000 per violation, while consumers can seek actual damages or treble damages for knowing violations. Exemptions include banks, insurance companies, nonprofits, and communications with current or former customers, though the law does not define what constitutes a “customer.” Source: Thompson Hine LLP

Medical Devices

• Illumina agreed to pay $9.8 million to settle False Claims Act allegations with the Department of Justice for selling genomic sequencing systems with cybersecurity vulnerabilities to federal agencies. The biotechnology company allegedly falsely represented that its LRM and UCS software adhered to cybersecurity standards including ISO and NIST from February 2016 through September 2023. The settlement represents the first cybersecurity-focused False Claims Act enforcement action in the healthcare industry and arose from a whistleblower complaint filed by Illumina’s former Director for Platform Management. The former employee will receive $1.9 million from the settlement, and the case is notable because it focused on failures to implement cybersecurity programs regardless of whether actual breaches occurred. The resolution signals that cybersecurity representations and certifications will become a focus area for future False Claims Act enforcement actions against medical device companies. Source: Orrick

Management Services Organizations

• The California legislature is advancing two bills that target private equity groups, hedge funds, and management services organizations operating in the state’s healthcare industry. AB 1415 would require management services organizations to notify the Office of Health Care Affordability of asset sales and changes of control, expanding reporting obligations that currently apply only to payors, providers, and delivery systems. SB 351 would clarify where private equity groups and hedge funds may provide advisory support while ensuring physicians and dentists retain ultimate authority over clinical decisions. AB 1415 has passed the Senate Appropriations Committee and is set for a third reading by the Senate, while SB 351 has cleared the Assembly Committee on Appropriations and awaits an Assembly vote. The bills would increase compliance burdens for management services organizations and reinforce restrictions on private equity participation in healthcare. Source: Polsinelli

Patient Care

• Medicare enrollees left acute-care hospitals against medical advice at rising rates since 2006, spiking during the COVID-19 public health emergency and remaining slightly elevated in 2023. From 2006 to 2019, AMA discharge rates grew from about 0.68% to 0.99%, peaked near 1.17% during the PHE, and ended at 1.00% in 2023, with those leaving AMA showing higher 30-day readmission (34.6% vs. 16.2%) and mortality (4.23% vs. 2.09%) than those discharged home. AMA rates were inversely correlated with CMS Overall Hospital Quality Star Ratings, with lowest-rated hospitals nearly three times more likely to have AMA discharges than highest-rated hospitals (1.95% vs. 0.66%). Dual Medicare-Medicaid enrollees and patients with a mental health diagnosis were more likely to leave AMA than Medicare-only enrollees and those without such diagnoses, including within each Star Rating tier. The brief notes CMS lacks specific guidance on designating and managing AMA discharges, and indicates findings may inform future guidance to improve outcomes and reduce costs. Source: HHS OIG Data Brief A-04-24-03003

Pharmacies

• New Medicare regulations that took effect January 1, 2025 have increased criminal prosecution risks for pharmacies facing claim reversals. The Centers for Medicare and Medicaid Services overhauled regulations under the federal Overpayment Statute, redefining when pharmacies “identify” overpayments and limiting internal investigation periods to 180 days maximum. Pharmacies can face criminal charges for violations including failure to submit “clean claims,” noncompliance with prescription rules, and billing errors involving prescription drugs. Criminal penalties include fines up to $250,000 for individuals and $500,000 for businesses, plus potential federal imprisonment up to five years under the False Claims Act. Investigations by the FBI and Department of Health and Human Services Office of Inspector General can result from claim rejections by Part D sponsors and other Medicare billing compliance failures. Source: Oberheiden P.C.

Accountable Care Organizations (ACOs)

• Hospital participation in Medicare accountable care organizations failed to reduce emergency department admission rates, length of stay, or costs for unplanned admissions, according to a new study that challenges the effectiveness of hospital-led ACO cost-saving strategies. Researchers analyzed 995 hospitals that joined Medicare ACOs between 2012 and 2017, tracking their performance for up to five years using Medicare claims data from 2008 to 2019. The findings remained consistent across different ACO programs, contract risk levels, and performance benchmarks, suggesting that hospitals did not alter their care delivery practices for unplanned hospitalizations after joining an ACO. The study indicates that physician-led ACOs outperform hospital-led models in generating cost savings, raising questions about the value of hospital participation in these programs. Researchers recommend that policymakers consider stronger financial incentives, such as global budgeting and multipayer alignment, to enhance hospital engagement in value-based care. Source: The American Journal of Managed Care

Data Breach and Ransonware

• The U.S. Department of Health and Human Services settled a HIPAA Security Rule investigation with BST & Co. CPAs, LLP for $175,000 following a ransomware attack that compromised protected health information. The New York accounting firm discovered ransomware had infected part of its network on December 7, 2019, impacting client health information. OCR’s investigation determined that BST failed to conduct a risk analysis to assess vulnerabilities to electronic protected health information. Under the settlement agreement, BST must implement a two-year corrective action plan that includes conducting risk analysis, developing risk management procedures, updating HIPAA policies, and providing workforce training. This enforcement action represents OCR’s 15th ransomware case and 10th action in its Risk Analysis Initiative. Source: HHS.gov

Data Privacy

• Researchers have developed a new blockchain framework that significantly enhances security and efficiency for electronic health records while reducing storage costs. The PDA-HIHM system combines traditional blockchain technology with a hybrid hashing approach that integrates SHA-256 with entropy-based dynamic hashing and data compression techniques. Testing showed the system achieved 27% reduced storage usage and 35% faster data retrieval compared to conventional blockchain-based health record systems. The framework demonstrated a 99.8% access control success rate with zero hash collisions during security testing, while also showing improvements in patient trust metrics of 97.62% and system efficiency of 97.43%. The system employs smart contracts for role-based access control and creates immutable audit trails for all data transactions. Source: Scientific Reports
• A study reveals that 98% of small healthcare organizations incorrectly believe they are HIPAA compliant despite using inadequate email encryption systems. The survey of 214 healthcare IT leaders at organizations with fewer than 250 employees found that most rely on Microsoft 365 or Google Workspace tools that fail to provide consistent encryption, with nearly half of healthcare email breaches stemming from Microsoft 365 alone. Common misconceptions include 83% believing patient consent eliminates encryption requirements and 20% lacking email archiving systems needed for compliance audits. Phishing attacks now account for over 70% of healthcare data breaches, with 43% of small practices experiencing such incidents in the past year while 99% have not implemented secure email transfer protocols. Recent breach penalties range from $25,000 to $9.76 million, with healthcare incidents taking an average of 308 days to detect and contain. Source: Business Wire

Emerging Tech

• The White House and Centers for Medicare and Medicaid Services launched the HealthTech Initiative, a digital health technology ecosystem that aims to create standardized health data exchange between patients and providers. The initiative enables patients who voluntarily enroll to share their medical history with third-party apps like sleep trackers and weight loss applications through the CMS Interoperability Framework. Patients will access diabetes and obesity management tools plus conversational AI assistants through an app library on Medicare.gov that draws from CMS-Aligned Networks. The program emerged from a May 2025 request for information that received approximately 1,400 stakeholder comments and supports HHS Secretary Robert F. Kennedy Jr.’s technology-centered healthcare agenda. The initiative currently lacks formal enforcement mechanisms, making privacy and security dependent on participating entities’ commitment to maintain standards rather than regulatory mandates. Source: Orrick
• Healthcare stakeholders must comply with existing privacy laws when implementing AI systems, despite legislation not keeping pace with technology advances. GlobalData forecasts AI in healthcare will reach a $19 billion valuation by 2027, with applications ranging from transcribing patient communications to evaluating radiologic images. Legal expert Shannon Hartsfield from Holland & Knight states that AI tools are subject to HIPAA and state privacy laws, requiring patient consent for recording in states like Florida and prohibiting vendors from using protected health information for their own purposes. HIPAA mandates covered entities conduct risk analyses to identify security threats to patient data when using AI tools. Hartsfield notes ongoing tension exists between advancing AI capabilities and regulating potential negative effects. Source: Medical Device Network

Fraud & Abuse

• The Department of HHS/OIG approved a physician-owned medical device company investment structure that complies with federal Anti-Kickback Statute requirements. On August 7, the OIG issued Advisory Opinion No. 25-09 regarding a company that develops emergency stroke treatment devices, where physicians hold approximately 35% of equity interests. The arrangement met all eight conditions of the “small entity investment safe harbor” under federal regulations, including ownership thresholds below 40%, uniform investment terms for all investors, and prohibitions on referral requirements or preferential treatment. The company implemented safeguards such as proportional profit distributions based on capital invested and written policies preventing special arrangements for physician investors. The advisory opinion provides a compliance framework for structuring physician investment arrangements in medical device companies, though it applies only to the specific facts presented and has no precedential effect. Source: ArentFox Schiff
• The Ninth Circuit Court of Appeals issued the first appellate decision interpreting the Eliminating Kickbacks in Recovery Act (EKRA) in United States v. Schena, ruling that the statute applies to payments made to marketers and not just physicians. Mark Schena, who owned Arrayit laboratory, was convicted of healthcare fraud and EKRA violations after paying marketers on a percentage-of-revenue basis to promote unnecessary allergy testing alongside COVID tests. The court rejected Schena’s argument that EKRA only prohibited payments to those who directly refer patients, finding that the statute covers situations where marketers cause individuals to obtain referrals from physicians. The court determined that percentage-based compensation structures do not violate EKRA alone, but become unlawful when marketers exert “undue influence” by misleading referral sources about the nature and need for services. The decision establishes that EKRA compliance will depend on the specific facts and circumstances of each arrangement. Source: Dykema

Medical Privacy

• Texas Senate Bill No. 1188 establishes requirements for electronic health record storage, artificial intelligence disclosure, and parental access to minor medical records starting September 1, 2025. The law mandates that healthcare practitioners and covered entities maintain electronic health records within the United States or its territories, with the geographic restriction taking effect January 1, 2026. Healthcare practitioners must inform patients when artificial intelligence tools are used in diagnosis or treatment, and they must review all AI-generated records according to Texas Medical Board standards. The legislation requires covered entities to provide parents and guardians complete and unrestricted access to their minor children’s electronic health records immediately, unless restricted by state or federal law or court order. Violations carry civil penalties ranging from $5,000 to $250,000 per violation, with the Texas Attorney General authorized to seek injunctive relief and the Texas Health and Human Services Commission empowered to investigate alleged violations. Source: Hall Render
• HIPAA compliance requirements for GPT-5 depend on who uses the AI platform and in what context. OpenAI announced GPT-5’s release last week, stating the platform should be used for healthcare navigation. HIPAA does not apply when individuals share their own health information with GPT-5, but regulations do apply when doctors use the platform to process patient data or direct patients to use it with provided access. In January, industry leaders announced Project Stargate, a $500 billion investment to build AI infrastructure focused on healthcare. While AI offers benefits like faster problem-solving and drug discovery, healthcare systems require cybersecurity built into AI platforms from the start to protect against data poisoning and other threats. Source: Mobi Health News
• Texas enacts a law delaying electronic release of cancer test results to patients by three days to allow physicians to communicate findings first. Senate Bill 922, effective September 1, pauses the immediate release of pathology and radiology reports that may show malignancy or genetic markers, giving doctors time to review and contact patients before results appear in electronic health records. The 2025 Texas Legislature passed the law in response to federal requirements under the 21st Century Cures Act that mandated immediate release of all health information to patient portals since spring 2021. Prior to this law, patients received test results electronically before physicians could review them, causing confusion when patients could not understand the medical terminology. The law allows physicians to call patients with results at any time during the three-day period. Source: Texas Medical Association
• The U.S. Department of Health and Human Services Office for Civil Rights issued new guidance clarifying that health care providers can share patient information with value-based care organizations for treatment purposes without obtaining patient authorization. The new FAQ specifically addresses protected health information disclosure to accountable care organizations and other value-based care arrangements under HIPAA Privacy Rule provisions. An updated FAQ also reinforces patients’ rights to access all information in their designated record sets, including clinical, billing, and other records used for decision-making about the individual. These changes align with the Centers for Medicare & Medicaid Services’ initiative to create a patient-centric, digital health care ecosystem announced on July 30, 2025. Health care providers must review their HIPAA policies, conduct internal audits, and ensure their systems can support complete responses to patient record requests within required timelines. Source: Baker Donelson

Licensure

• Texas enacted legislation creating an alternative licensure pathway for foreign-trained physicians to address doctor shortages. The new law requires qualifying physicians to have work authorization in the United States and demonstrate English proficiency. The legislation targets experienced foreign-trained doctors who can help fill gaps in the state’s medical workforce. The measure was passed by the Texas Legislature as part of healthcare reform efforts. Source: Dallas Morning News

Litigation

• HCA Healthcare agreed to pay $3.5 million to settle allegations from California, Colorado, and Nevada attorneys general that the hospital operator misled nurses about training repayment agreements. The states alleged that HCA failed to disclose that nurses would need to repay training costs of $4,000 in California and $10,000 in Colorado if they left their jobs within two years, affecting approximately 34,500 nurses in California alone since 2018. Under the settlement terms, California will receive $1,162,900 plus restitution for affected nurses, Nevada will get $862,276 in reimbursements and penalties, and Colorado will receive $1,393,008 for consumer redress and enforcement. The consent judgments permanently prohibit HCA from engaging in training repayment agreement practices and void all existing debts, requiring the company to request credit reporting agencies delete related information. HCA denied wrongdoing but agreed to the settlement in what it called the best interests of its nurses and hospitals. Source: Regulatory Oversight
• The Fifth Circuit Court of Appeals established that class action plaintiffs need only prove individual standing at the certification stage, not class-wide standing. The July 17, 2025 ruling in Wilson v. Centene Management Co. resolved an open question in the circuit and aligned the Fifth Circuit with the First, Third, Sixth, and Ninth Circuits in adopting the “class certification approach” over the “standing approach.” The court held that merits-based evaluation of expert testimony is inappropriate when determining standing at the class certification stage. The decision separates the threshold standing inquiry from class certification requirements under Rule 23. This ruling may make it easier for class action plaintiffs in the Fifth Circuit to satisfy standing requirements and obtain class certification. Source: Inside Class Actions

Mergers & Acquisitions

• The Federal Trade Commission sued to block Edwards Lifesciences Corp.’s $945 million acquisition of JenaValve Technology, Inc. on August 6. The deal would combine the two companies competing to develop transcatheter aortic valve replacement devices to treat aortic regurgitation, a heart condition with no currently approved treatments. Edwards previously acquired JC Medical in August 2024, whose J-Valve device is undergoing clinical trials, while JenaValve’s Trilogy TAVR device awaits FDA approval. The FTC built its case on evidence of head-to-head competition rather than traditional market share analysis, arguing the merger would eliminate competition between the only two firms with active US clinical trials. The all-Republican Commission voted 3-0 to challenge the acquisition, demonstrating the Trump administration’s focus on pipeline competition and healthcare market enforcement. Source: Katten Muchin Rosenman LLP

340B

• HRSA launched a pilot program on August 1, 2025 that will change how drug manufacturers provide 340B discounts to safety net healthcare providers. Under the new rebate model, covered entities will pay full price for drugs upfront and receive rebates later, rather than receiving discounts at the time of purchase as traditionally done. The pilot program applies only to manufacturers with products on the Medicare Drug Price Negotiation Selected Drug List, which includes 23 drugs subject to pricing negotiations under the Inflation Reduction Act. Manufacturer applications are due September 15, 2025, with the program beginning January 1, 2026, and HRSA is accepting public comments through August 30, 2025. The initiative follows disputes between HRSA and manufacturers over rebate models, which resulted in multiple lawsuits after HRSA blocked manufacturer attempts to implement such systems without approval. Source: Healthcare Law Blog

Cybersecurity

• The Department of Justice secured a $9.8 million settlement from biotechnology company Illumina Inc. on July 30, 2025, marking the first False Claims Act case focused on cybersecurity compliance failures for medical devices. The settlement resolves allegations that Illumina misrepresented compliance with federal cybersecurity requirements for medical device software from January 2016 to April 2023, despite failing to incorporate adequate cybersecurity into product design and development. A former Illumina employee brought the whistleblower lawsuit under the False Claims Act, with the government later intervening in the case. The company allegedly certified compliance to the FDA while maintaining inadequate security programs and failing to correct known vulnerabilities. Illumina denied the allegations but agreed to settle to avoid litigation costs, paying $4.3 million in restitution and $1.9 million to the whistleblower, while stating it remediated the software issues between 2022 and 2024. Source: White & Case LLP

Data Privacy & Breach

• West Texas Oral Facial Surgery notified 11,151 patients of a data breach following a network disruption on May 29, 2025. Third-party cybersecurity experts confirmed unauthorized network access had occurred, though the breach notice did not specify when. A file review completed on July 18, 2025, revealed exposed data included patient names, imaging files, birth dates in some cases, and treatment reasons. Electronic medical records, Social Security numbers, and financial information were not accessed. The Inc Ransom ransomware group claimed responsibility for the attack on June 18, 2025. Source: HIPAA Journal
• Researchers have developed a server-rotating federated machine learning system that enables medical imaging AI models to be trained across different device manufacturers while preserving patient privacy. The system incorporates differential privacy techniques and cryptographic safeguards to prevent patient data from being reverse-engineered from model parameters. Testing on multi-center datasets containing MRI, CT, and digital X-ray images from multiple device manufacturers showed the approach matched or exceeded performance of traditional centralized and conventional federated methods. The framework includes adaptive normalization layers to handle vendor-specific imaging artifacts and scanner discrepancies without requiring data harmonization. Source: BioEngineer

Emerging Tech

• The Texas Responsible Artificial Intelligence Governance Act will require businesses operating in Texas or serving Texas residents to implement comprehensive AI governance policies when it takes effect January 1, 2026. The law applies to both developers and deployers of AI systems, defined as machine-based systems that generate outputs such as content, decisions, predictions, or recommendations. Companies must establish policies covering AI system purpose, data usage, performance evaluation, post-deployment monitoring, user safeguards, anti-discrimination provisions, and user disclosure requirements. Businesses that receive violation notices from the Attorney General have 60 days to cure violations or stop using the non-compliant AI system portion. Texas also created an AI regulatory sandbox program that allows companies to test AI systems for up to 36 months with legal protections while meeting specific safeguard requirements. Source: IAPP

Employee Benefits

• Healthcare employers face mounting regulatory compliance challenges following the 2025 Comprehensive Reform Act, which was signed into law on July 4, 2025. The Act adds complexity to existing requirements including Affordable Care Act compliance for variable-schedule employees, fiduciary oversight of retirement and health plans, and nondiscrimination testing under Code Sections 105(h) and 125. Healthcare organizations increasingly form health and welfare plan committees to manage fiduciary responsibilities and protect boards from litigation related to pharmacy benefit management agreements and excessive fees. Hospital mergers and acquisitions create additional risks when benefits integration is not properly reviewed, potentially resulting in unexpected liabilities from retiree medical plans, multiemployer pension withdrawal liability, or undocumented 403(b) plans. Employers using self-insured plans, flexible spending accounts, or health savings accounts must conduct annual nondiscrimination testing to avoid negative tax consequences for higher-earning participants. Source: Saul Ewing LLP

Fraud & Abuse

• Texas Attorney General sued Eli Lilly, accusing the drugmaker of bribing medical providers to prescribe its medications. The lawsuit alleges the company engaged in kickback schemes to induce providers to prescribe its profitable drugs, including GLP-1 medications Mounjaro and Zepbound used for weight loss and diabetes treatment. The action follows a previous lawsuit against insulin manufacturers, including Lilly, over pricing practices with pharmacy benefit managers. Lilly denied the allegations, stating the claims stem from a corporate relator whose accusations have been dismissed by multiple courts and the federal government. Source: Reuters
• Dr. Ajay Aggarwal agreed to pay $2,053,515 to settle allegations that he defrauded federal healthcare programs by billing for procedures he did not perform. The 63-year-old Houston anesthesiologist and pain medicine doctor allegedly billed Medicare and Workers’ Compensation programs for the surgical implantation of neurostimulator electrodes from November 2021 to March 2023. Instead of performing these invasive procedures that typically require operating rooms and pay thousands of dollars, Aggarwal allegedly provided patients with electro-acupuncture treatments that involved inserting monofilament wire a few millimeters into patients’ ears and taping neurostimulators behind the ear in his clinic. The investigation involved multiple agencies including the U.S. Postal Service Office of Inspector General, Department of Labor Office of Inspector General, and Department of Health and Human Services Office of Inspector General. The settlement resolves allegations only, with no determination of liability. Source: U.S. Attorney’s Office, Southern District of Texas

HIPAA Privacy Rule

• The HHS Office for Civil Rights published updated HIPAA Privacy Rule guidance that expands permitted disclosures of protected health information for value-based care arrangements and broadens patient access rights. The guidance includes a FAQ stating that healthcare providers can disclose PHI to participants in accountable care organizations and other value-based care arrangements without patient authorization when the disclosure supports treatment activities. The update follows a July 30, 2025 White House event where the Trump Administration announced commitments from tech firms to improve healthcare interoperability through data exchange platforms. OCR also updated guidance to specify that individuals can now access consent forms for treatment as part of their health information rights under HIPAA. The changes support CMS efforts to create a digital healthcare ecosystem that reduces provider burden while improving patient outcomes. Source: HIPAA Journal
• The HHS Office for Civil Rights updated its HIPAA Privacy Rule FAQs to provide guidance on protected health information disclosures to value-based care arrangements and patient access rights. The updates support CMS’ July 2025 health tech ecosystem initiative, which aims to create a patient-centric healthcare system through interoperability frameworks and commitments from tech companies, app developers, and payers. OCR clarified that covered entities can disclose PHI to participants in value-based care arrangements for treatment purposes without patient authorization, reasoning that the Privacy Rule’s definition of “treatment” incorporates interaction between multiple entities. The guidance also expanded the types of information patients can request to include consent forms for treatment, adding to the existing list of medical records, billing records, lab reports, and other health data. The FAQs provide clarity to help covered entities navigate HIPAA compliance as federal initiatives work to make the health tech ecosystem more interconnected. Source: TechTarget

Mergers & Acquisitions

• F-reorganizations under federal tax law provide healthcare companies a method to preserve Employer Identification Numbers during mergers and acquisitions, avoiding disruptions to Medicare enrollment and regulatory approvals. Healthcare entities rely on EINs for Medicare enrollment, state licensing, DEA registration, and commercial payer contracts, making EIN changes during transactions costly due to re-enrollment requirements with CMS, credentialing delays, and potential business interruptions. Under IRC § 368(a)(1)(F), F-reorganizations allow businesses to undergo structural changes while the IRS treats pre- and post-reorganization entities as the same taxpayer, preserving the EIN and associated contracts and tax attributes. Private equity firms, health systems, and MSO platforms increasingly use this structure to avoid Medicare enrollment hurdles that can take months and maintain continuity of state licenses tied to EINs. Texas law provides mechanisms including statutory conversions, reverse triangular mergers, and cross-jurisdictional reincorporations to implement F-reorganizations while preserving entity continuity. Source: Clark Hill PLC

OIG Advisory Opinion

• The Office of Inspector General approved a physician ownership arrangement in a medical device company that develops emergency stroke treatment products. The OIG concluded that the arrangement met the conditions of the small entity investment safe harbor. Physician owners comprise 35 percent of the company’s ownership, below the 40 percent threshold that triggers heightened scrutiny under federal regulations. The company certified that investment terms remain consistent across all investors and that profit distributions will be proportional to capital investments. OIG will not impose administrative sanctions on the company under sections 1128A(a)(7) or 1128(b)(7) of the Social Security Act. Source: OIG Advisory Opinion No. 25-09

Patient Harm

• Hospitals failed to capture half of patient harm events that occurred among hospitalized Medicare patients, according to an Office of Inspector General review. The OIG traced harm events from a 2022 report and found that hospitals often applied narrow definitions of harm, with staff not considering many events to be harm or stating it was not standard practice to capture them. Of the harm events hospitals did capture, few were investigated and even fewer resulted in improvements for patient safety. The OIG recommends that the Agency for Healthcare Research and Quality (AHRQ) and CMS work with partners to align harm event definitions and create a patient harm taxonomy, that CMS ensure surveyors prioritize Medicare Quality Assurance and Performance Improvement requirements, and that CMS instruct Quality Improvement Organizations to help hospitals identify weaknesses in their incident reporting systems. Increased federal leadership is needed to drive progress in patient safety after nearly 20 years of high patient harm rates nationwide. Source: OIG Report

Physician Compensation

• Physicians and hospitals are generating higher revenues by increasing workload rather than receiving better reimbursement rates. From the second quarter of 2023 to 2025, median net gain per employed physician rose 8% while median revenue per provider unit of work increased 12% for physicians, but median net patient revenue per provider work unit declined 7%. Support staffing levels dropped 13% over two years, creating potential obstacles for future growth. Hospital operating margins improved to 3% when including shared service costs and 6.6% without those allocations, driven primarily by outpatient revenue increases. The trends reflect ongoing Medicare reimbursement declines that force providers to complete more work to maintain income levels. Source: Fierce Healthcare

Telehealth

• States are implementing permanent telehealth regulations to replace pandemic-era emergency rules as federal waivers approach expiration. The DEA and HHS extended telemedicine prescribing waivers through December 31, 2025, allowing providers to prescribe controlled substances via telehealth without prior in-person examinations. New York finalized rules in May 2025 requiring in-person medical evaluations before prescribing controlled substances through telemedicine, with exceptions for recent evaluations, temporary coverage, and emergency situations. States including California, Delaware, Florida, New Hampshire, and Texas have enacted or proposed legislation with varying approaches to telehealth prescribing requirements. The DEA proposed a special registration system in March 2023 that would establish three types of registrations for remote prescribing of controlled substances with enhanced verification and monitoring requirements. Source: Healthcare Law Blog
• Telemedicine has become a cornerstone of mental health services, with telehealth services for mental health issues increasing 16 to 20 times during the first year of the COVID-19 pandemic according to RAND Corporation data. A nationwide poll by the American Psychiatric Association found that over half of Americans would choose telehealth for mental health needs, with more than one-third preferring it outright. AI-powered platforms from companies like Teladoc Health and IBM Corporation now enable predictive analytics for early intervention in conditions like anxiety and depression, while digital mental health counseling apps like Calm and SilverCloud Health provide 24/7 support through chatbots and virtual therapists. Pittsburgh-area clinics have reduced wait times for psychiatric evaluations by up to 40% through telemedicine implementation, though experts warn against over-reliance on virtual care for cases like schizophrenia. Federal legislation has bolstered telehealth reimbursement and cross-state licensing, but challenges remain around data privacy and equitable access for low-income populations. Source: WebProNews

Value-Based Arrangements

• The American Medical Association has released guidance to help private practices navigate partnerships with “aggregator entities” that manage value-based care arrangements. These aggregators are specialized private companies that help physicians handle the complexities of value-based care without requiring practices to fully invest in the technical infrastructure themselves. The AMA resource addresses three core areas: evaluating aggregator business models, understanding physician considerations when working with aggregators, and planning for potential termination of these relationships. According to Dr. Alexander Sun from the AMA’s Professional Satisfaction and Practice Sustainability unit, the guidance helps practices determine whether aggregator partnerships align with their value-based care goals. The resource is part of the AMA’s broader Business of Medicine education program, which includes materials on revenue-cycle management and accountable care organizations. Source: American Medical Association

Breach Notifications

• Two Texas healthcare facilities disclosed data breaches affecting nearly 10,000 patients combined. Nova Recovery Center in Wimberley detected unauthorized network access on May 25, 2025, which compromised personal information of 7,713 individuals including names, addresses, Social Security numbers, and financial data. The facility confirmed the breach on June 17, 2025, and provided credit monitoring services to affected patients. OB/GYN Medical Center Associates in Houston reported a separate incident involving ConnectOnCall, a voicemail service provider that experienced unauthorized access between February 16, 2024, and May 12, 2024, affecting 2,132 patients. The compromised data included names, medical conditions, medications, procedures, and other personal health information disclosed in voicemail messages. Source: HIPAA Journal
• Oklahoma has enacted Senate Bill 626 that expands data breach notification requirements and will take effect on January 1, 2026. The state Attorney General must be notified about breaches affecting 500 or more residents, or 1,000 or more residents for credit bureau systems, within 60 days of individual notifications being mailed. The law broadens the definition of personal information to include unique electronic identifiers with security codes and biometric data such as fingerprints and retina images. Entities that employ reasonable safeguards and issue breach notifications will be shielded from civil penalties of up to $150,000 per breach. Organizations compliant with HIPAA, the Oklahoma Hospital Cybersecurity Protection Act, or the Gramm-Leach-Bliley Act are deemed compliant with the requirements if they notify the Attorney General within 60 days. Source: HIPAA Journal

Cybersecurity

• Texas has enacted Senate Bill 2610, becoming the fifth state to implement cybersecurity safe harbor protections that shield businesses from punitive damages in data breach cases. Governor Greg Abbott signed the law, which formally recognizes the Center for Internet Security Critical Security Controls as a standard for demonstrating reasonable cybersecurity practices. The legislation establishes a tiered system where businesses with fewer than 20 employees face simplified requirements, those with 20-99 employees must implement CIS Controls Implementation Group 1, and companies with 100-249 employees must comply with frameworks such as NIST CSF or ISO/IEC 27000-series standards. Texas joins Ohio, Utah, Connecticut, and Iowa in offering safe harbor protections, and follows Nevada in recognizing CIS Controls as a benchmark for reasonable cybersecurity practices. The law incentivizes businesses to adopt cybersecurity programs by providing legal protection when they meet specific cybersecurity criteria. Source: KGET
• Proposed amendments to the HIPAA Security Rule mandate comprehensive cybersecurity requirements for healthcare organizations handling electronic protected health information (ePHI). The modifications require mandatory encryption of ePHI at rest and in transit, multi-factor authentication, annual compliance audits, vulnerability scanning every six months, and penetration testing annually. Organizations must maintain written documentation for all Security Rule policies and procedures, develop technology asset inventories and network maps annually, and conduct risk assessments that include AI systems accessing ePHI. The rules specifically address AI governance by requiring documentation of AI system training, prediction models, and algorithm data, while mandating organizations monitor AI tools for vulnerabilities and potential impacts on ePHI confidentiality, integrity, and availability. While initially scheduled to take effect January 6, 2025, with a compliance deadline of January 6, 2026, the new administration has paused all HHS regulation updates. Source: Ankura

Data Privacy

• Differential privacy protects personal data by adding mathematical noise to datasets, allowing organizations to analyze and share information without revealing individual identities. The technique uses two parameters, epsilon and delta, to control the amount of randomness added to data, ensuring algorithms cannot determine whether specific individuals’ information is included in a database. Companies including Apple, Google, and Microsoft have implemented differential privacy in their products, while the U.S. government uses it for census data collection to protect survey participants’ identities. The method has applications across healthcare research, mobile user behavior analysis, and advertising campaign assessment, though it faces limitations with small datasets where accuracy becomes compromised. Despite these constraints, differential privacy enables broader data sharing while maintaining mathematical guarantees that individual privacy remains protected. Source: Built In
• Healthcare facilities face mounting cybersecurity risks as IoT device adoption grows and patient data moves to cloud storage systems. Personal health information trades for 10-20 times more than stolen credit card data on the dark web, making healthcare networks prime targets for cybercriminals. Major vulnerabilities include devices with default passwords, unencrypted data transmission, cloud misconfigurations, and unpatched firmware in medical equipment. The 2017 WannaCry ransomware attack demonstrated these risks when it compromised over 300,000 systems across 150 countries, severely impacting UK’s NHS hospitals running outdated Windows software. Healthcare organizations must implement end-to-end encryption, zero trust architecture, device hardening, network segmentation, and real-time monitoring systems to protect patient data and maintain compliance with HIPAA and GDPR regulations. Source: Programming Insider

Dental Service Organizations (DSOs)

• DSO transactions face complex regulatory challenges that require careful structuring to comply with state laws prohibiting corporate practice of dentistry. Most states prevent non-dentists from directly owning dental practices, forcing DSOs to operate through management agreements with dentist-owned entities rather than direct ownership structures. Buyers must address practitioner retention through production-based compensation and non-compete agreements, though enforceability varies by state and must comply with healthcare fraud and abuse laws. Physical clinic locations present risks when lease agreements contain change-of-control provisions that require landlord consent for transactions. Additional transaction complexities include managing deferred revenue obligations from prepaid services, conducting billing compliance audits to identify potential upcoding issues, and navigating state healthcare transaction review laws that may require pre-closing notice or approval. Source: Bass, Berry & Sims PLC

Emerging Tech

• Mount Sinai researchers found that six large language models demonstrated hallucination rates between 50% and 83% when exposed to fabricated medical information. The study, published in Nature, tested 300 clinical cases containing false medical details and measured how frequently each model elaborated on the incorrect information. GPT4o performed best with hallucination rates of 50.0% for short cases and 53.3% for long cases, while DeepSeek performed worst with rates of 82.7% and 80.0% respectively. The other models tested—Llama 3.3, Phi-4, Gemma-2-27b-it, and Qwen-2.25-72b—showed hallucination rates ranging from 58.7% to 82.0%. Prompt mitigation techniques reduced hallucination rates from an average of 65.9% to 44.2% but failed to eliminate the errors completely. Source: Healthcare IT News
• AI systems in healthcare face two distinct types of errors that pose risks to patient safety. Hallucinations occur when AI generates completely fabricated information that does not exist in training data or reality, such as inventing medical conditions or citing nonexistent studies. Confabulations happen when AI misrepresents or distorts real information, such as citing legitimate sources but misinterpreting their findings or applying them incorrectly. Both types of errors can lead to misdiagnoses, inappropriate treatments, and loss of trust in digital tools. Healthcare organizations can prevent these errors through five methods: using peer-reviewed training data, implementing validation testing, incorporating human oversight, using confidence scoring systems, and restricting AI outputs to verified knowledge sources. Source: Wolters Kluwer
• AI-ready data serves as the foundation for next-generation radiology tools as healthcare systems face mounting imaging volumes and increasing complexity. AI-ready data refers to patient studies that are curated, standardized, and integrated for artificial intelligence systems, including high-quality images, comprehensive annotations by radiologists, standardized formats like DICOM, rich metadata with clinical context, and de-identified secure data. Machine learning algorithms require vast amounts of well-annotated, diverse data to recognize patterns and detect abnormalities with precision, while curated datasets help minimize biases and ensure AI tools perform reliably across different patient populations and imaging modalities. The process involves data collection from diverse sources, expert annotation by radiologists, quality assurance verification, standardization and structuring of metadata, and continuous monitoring with real-world data to refine systems over time. Challenges remain in data variability, privacy protection, bias mitigation, clinical validation, and maintaining human oversight where radiologists retain decision-making authority supported by AI. Source: Healthcare Dive

Fraud & Abuse

• The HHS Office of Inspector General issued an unfavorable advisory opinion finding that a medical device company’s payment of vendor fees to access an electronic billing portal violates the Anti-Kickback Statute. In Advisory Opinion 25-08 published July 7, 2025, the OIG determined that a medical device company’s proposal to pay $395 per year for each representative to access a third-party billing portal used by hospital customers presents anti-competitive risks and constitutes prohibited remuneration. The company supplies “bill-only” medical devices to hospitals and could face up to $1.2 million in annual fees for 3,000 representatives if hospitals require use of the portal as a condition of doing business. The OIG found the arrangement violates the Anti-Kickback Statute because the vendor would arrange for hospital purchases of the company’s products, and the payments could inappropriately steer customers away from competitors unwilling to pay the fees. The company told the OIG the portal was redundant with its own billing processes and provided no additional benefits, making the fees commercially unreasonable. Source: The National Law Review

HIPAA

• HIPAA applies to far fewer organizations than commonly believed, contrary to the widespread assumption that all health and medical data falls under federal regulation. The law only covers three categories of “covered entities”: health plans, health care clearinghouses, and health care providers that electronically transmit health information in connection with transactions like insurance claims, payments, or eligibility verification. Healthcare providers that operate on a cash-only basis and do not accept insurance—such as specialty practices, small medical offices, or certain pharmacies—typically fall outside HIPAA’s scope. Companies that incorrectly assume they are subject to HIPAA may face penalties for non-compliance, while those that wrongly believe they are covered could miss obligations under state privacy laws that apply when HIPAA does not. The distinction has become more critical as data breaches targeting healthcare providers have increased, particularly among smaller providers with vulnerable security systems. Source: BCLP – Bryan Cave Leighton Paisner

Medicare Reimbursement

• MIPS has streamlined its Improvement Activities requirements for 2025 by eliminating the weighting system and reducing the number of measures healthcare practices must select. Small practices with 15 or fewer NPIs now need to choose only one of 104 available IA measures, while larger practices must select just two measures. The changes come as healthcare faces a projected shortage of 17,800–48,000 primary care physicians and 21,000–77,100 non-primary care physicians by 2034, with ophthalmologists reaching crisis levels by 2035. Key IA measures include promoting clinician wellbeing through surveys and implementation plans, participating in private payer clinical practice improvement activities, and developing written policies to ensure equal treatment of Medicaid patients. These measures focus on care delivery, patient engagement, and operational efficiency rather than just compliance scoring. Source: VMG Health
• CMS established a mandatory payment model targeting specialists who treat heart failure and low back pain patients. The Ambulatory Specialty Model, announced July 10, 2025, will run from 2027 through 2031 and represents CMS’s first mandatory alternative payment model for specialists treating chronic conditions in outpatient settings. Participation becomes mandatory for clinicians who treat at least 20 episodes annually of heart failure or low back pain, with targeted specialties including anesthesiology, pain management, neurosurgery, orthopedic surgery, interventional pain management, and physical medicine and rehabilitation. The model evaluates participants using MIPS framework across quality, clinical practice improvement, cost, and interoperability domains, with payment adjustments of up to 9 percent positive or negative based on performance. CMS selected these conditions because they represent 6 percent of total annual spending for traditional Medicare, and the agency is accepting public comments through September 12, 2025. Source: The National Law Review
• CMS will deploy AI technology to screen prior authorization requests for Medicare services starting January 2026 through its Wasteful and Inappropriate Services Reduction program. The program, introduced July 1, 2025, requires prior authorization for select fee-for-service Medicare treatments in Arizona, New Jersey, Ohio, Oklahoma, Texas, and Washington, targeting procedures such as nerve stimulators, cervical fusions, and incontinence treatments. CMS will partner with Medicare Advantage plans and other payors as “model participants” who will use AI tools to review and approve or reject treatment requests, including determinations of medical necessity. Model participants will receive compensation based on a share of expenditures they prevent, creating financial incentives that may increase denials for covered services. The program may conflict with state laws limiting AI use in utilization management, and providers should prepare for increased denials and enhanced documentation requirements before the 2026 launch. Source: Jones Day

Physician Compensation

• Texas Senate Bill 1318 will impose new restrictions on noncompete agreements for physicians and healthcare workers beginning September 1, 2025. The law extends noncompete requirements beyond physicians to include dentists, professional and vocational nurses, and physician assistants for the first time. All noncompete agreements entered into or renewed after the effective date must include a buyout cap not exceeding the employee’s annual salary, limit geographic scope to a five-mile radius, restrict the term to one year, and state all conditions in writing. The legislation voids physician noncompete agreements when the doctor is terminated without “good cause,” defined as conduct, performance, or employment record issues. The new requirements apply only to medical practice roles, with an exception for physicians and healthcare practitioners serving solely in administrative capacities. Source: Haynes Boone
• CMS proposes payment increases and cost-cutting measures in its 2026 Medicare Physician Fee Schedule. The Centers for Medicare and Medicaid Services proposed rule establishes two conversion factors that would increase payments by 3.83% for providers participating in Advanced Alternative Payment Models ($33.59) and 3.62% for non-participants ($33.42). The proposal includes a new mandatory Ambulatory Specialty Model launching in 2027 that focuses on heart failure and lower back pain management, requiring providers to take on two-sided financial risk. CMS also proposes to cut skin substitute payments by approximately 90% by reclassifying them from biologicals to incident-to supplies, and to create three new G-codes for behavioral health integration services. Healthcare providers have until September 12 to submit public comments before CMS finalizes the rule. Source: MSLaw Blog