Categories
Health Law Highlights

Wade’s Health Law Highlights for February 10, 2026

Ambulatory Surgery Centers

  • Ambulatory surgery centers now treat patients with conditions far beyond their original design parameters. ASCs increasingly care for patients with diabetes, obesity, cardiovascular disease, arrhythmias, anticoagulation therapy, pulmonary disease, and renal impairment, often in combination. Facilities face operational challenges including tracking postoperative infections when patients receive dialysis multiple times per week, determining whether to accept data from personal devices like continuous glucose monitors, and lacking equipment such as Hoyer lifts for non-ambulatory patients. Medicare expands the list of procedures eligible for ASC performance annually, adding total joint replacements, spine interventions, and cardiac and vascular procedures that bring longer operative times and higher risk. Accrediting organizations now require evidence of how care is delivered rather than just written policies, while staff confront questions about preoperative assessment responsibility when patients see multiple specialists. Source: VMG Health

Advisory Opinions

Drug & Device

  • The FDA issued revised guidance in January 2026 that establishes when clinical decision support software and wellness products fall outside medical device regulation. For software to qualify as non-device CDS, it must meet four criteria: it cannot analyze medical images or diagnostic signals, must display patient data or medical information, can support but not replace clinician judgment, and must allow clinicians to review the reasoning behind recommendations. Wellness products can avoid regulation when intended only for general wellness use, present low risk, remain non-invasive, and do not diagnose, treat, or substitute for FDA-authorized devices. The guidance permits wellness wearables to measure blood pressure, oxygen saturation, blood glucose, and heart rate variability if outputs are validated and limited to wellness contexts. Marketing claims and intended use determine whether products trigger FDA oversight, as references to diseases, clinical thresholds, or unvalidated data can make software or wearables subject to regulation. Source: Arnall Golden Gregory LLP
  • The FDA has shifted toward reducing development burdens for biosimilar products through an abbreviated licensure pathway under Section 351(k) of the Public Health Service Act. A biosimilar must be highly similar to the reference product and have no clinically meaningful differences in safety, purity, and potency, while sponsors can now demonstrate biosimilarity through analytical assessments and pharmacokinetic or pharmacodynamic data rather than Phase 3 trials. Interchangeable biosimilars must meet two additional requirements: producing the same clinical result in any given patient and showing that switching between products carries no greater risk than continuing the reference product, though the FDA’s June 2024 draft guidance indicates switching studies are no longer required in most cases. Biosimilars operate under different statutory frameworks than generics, permitting labeling flexibility and product presentation differences, as evidenced by the FDA’s January 2025 approval of the first interchangeable biosimilar in an autoinjector format while the reference product was available only in vial or prefilled syringe formats. The first licensed interchangeable biosimilar receives exclusivity under Section 351(k)(6) of the PHSA, blocking approval of subsequent interchangeable biosimilars for defined periods. Source: Alston & Bird

Fraud & Abuse

HIPAA

  • The healthcare industry faced a regulatory transformation in 2025 as federal and state agencies implemented changes to privacy and security requirements. In December 2024, HHS proposed the first update to the HIPAA Security Rule since 2013, eliminating the distinction between required and addressable safeguards and mandating multi-factor authentication, encryption, and 24-hour breach notifications from business associates, with the rule expected to become effective in July or August 2026. A federal court vacated the reproductive health privacy rule on June 18, 2025, while multiple states enacted privacy laws and HHS intensified enforcement, issuing its 53rd Right of Access action in March 2025 with a $200,000 penalty and warning that information blocking violations could result in penalties up to $1 million per violation. Healthcare data breaches affected 184 million individuals in 2024 and over 31 million in the first half of 2025, prompting regulators to focus on vendor oversight and supply chain security. On March 27, 2025, HHS announced a reorganization that will reduce its workforce from 82,000 to 62,000 employees and create a new Assistant Secretary for Enforcement to oversee all enforcement functions. Source: Healthcare Law Insights
  • Covered entities must update their Notice of Privacy Practices by February 16, 2026, and must account for state laws that impose stricter requirements than HIPAA. HIPAA establishes minimum privacy protections through “floor preemption,” allowing states to enact more demanding standards for health information privacy. State laws qualify as “more stringent” when they provide greater privacy protections, such as Colorado prohibiting disclosure of patient information for out-of-state investigations of gender-affirming care or reproductive healthcare, New Mexico requiring consent for electronic record disclosures, and Montana and Nevada mandating faster patient access to records than HIPAA requires (10 days and 10-20 working days respectively). The updated notices must reflect these more restrictive state rules where applicable, though many state privacy laws exempt HIPAA covered entities from their requirements. Covered entities that fail to analyze and incorporate applicable state laws risk noncompliance with both federal preemption requirements and state control mandates. Source: Holland & Hart LLP
  • Part 2 Programs and HIPAA covered entities that process substance use disorder records must update their Notice of Privacy Practices by February 16, 2026, under federal rulemaking. The requirement applies to providers that handle Part 2 SUD records from federally-assisted treatment facilities, including opioid treatment programs, hospital-based addiction counselors, and residential or outpatient treatment centers. HIPAA covered entities that process SUD records but are not Part 2 providers must disclose that SUD records carry heightened confidentiality protections, require written consent for most uses and disclosures, and cannot be used in legal proceedings without patient consent or a court order. Part 2 Programs must include a revised header, descriptions of permitted uses and disclosures, patient rights notifications, and program obligation statements in their updated NPPs. Part 2 programs may choose to integrate these revisions into their HIPAA NPP or create a separate document. Source: Roetzel & Andress

Licensure

Non-Competes

  • The FTC will pursue noncompete enforcement through case-by-case actions rather than pursuing a national ban, according to statements made at a recent workshop featuring commissioners and agency attorneys. Commissioner Ferguson stated the FTC lacks statutory authority to issue a rule banning noncompetes but will focus enforcement on agreements that are overly broad or used solely to prevent competition, applying a reasonableness test that requires companies to show a legitimate business interest. Commissioner Meador expressed concern about noncompetes being used as scare tactics in professions like nursing, bartending, and internships, particularly for lower-wage or non-specialized workers. Both commissioners recommended that employers consider alternatives such as non-solicitation agreements and intellectual property protections instead of noncompetes. The agency will continue to bring targeted enforcement cases, including its ongoing action against U.S. Anesthesia Partners in Texas, to demonstrate which types of noncompete agreements it considers illegal. Source: Polsinelli

Pharmacy Benefits Managers

Reproductive Rights