Twenty US states have enacted comprehensive privacy laws that regulate health data usage in digital advertising. The Federal Trade Commission and state regulators have expanded definitions of health data to include browsing histories, location information, and medical purchases, with Washington and Nevada implementing specific consumer health data laws requiring detailed consent. The Dobbs v. Jackson Women’s Health decision has accelerated concerns about health data privacy, particularly regarding reproductive healthcare information. Companies are adapting through various strategies including national opt-in consent standards, data suppression in certain states, increased due diligence, and demographic-based targeting instead of individual health data. Despite potential changes in federal enforcement under new administration, state-level regulation of health data is expected to increase, particularly in Democratic-leaning states.
Artificial Intelligence
AI in healthcare currently faces mixed results across different applications. AI-powered ambient scribing tools for clinical documentation show varying effectiveness, with some studies indicating time savings while others suggest increased time spent on records. Clinical decision support tools, particularly for sepsis detection, struggle with accuracy and false positives, though tools like Sayvant offer promise in medical decision-making documentation. AI also shows potential for medical record summarization, though current limitations necessitate a measured approach focused on targeted innovations rather than transformation.
OpenAI and Oracle have announced the Stargate AI infrastructure project, a $500 billion initiative backed by Softbank and MGX to develop next-generation AI infrastructure over four years. Project leaders claim it will revolutionize healthcare through capabilities like 48-hour personalized cancer vaccines and improved disease treatments, while studies show AI can match doctor accuracy in diagnoses. However, experts suggest there are implementation challenges including payment systems, clinician training, and integration across healthcare facilities.
Corporate Practice of Medicine
Physician Practice Management (PPM) structures split operations between a physician practice professional corporation and a management services organization to comply with medical practice laws. Combining employees from both entities under one health plan creates a multiple employer welfare arrangement (MEWA), which faces regulatory burdens and potential state law violations. To avoid MEWA complications, organizations can implement mirror plans with pooled stop-loss insurance, establish separate level-funded plans, or purchase coverage through a professional employer organization (PEO). These alternatives help PPM entities maintain compliant health coverage while avoiding the complexities of MEWA regulations. The solutions enable cost savings through larger group ratings while preserving the intended separation between clinical and business operations.
Fraud, Abuse and Waste
The U.S. Department of Justice filed a False Claims Act complaint against an Idaho home health agency and its owner on February 25, 2025. The agency received $1.8 million in PPP loans in 2020 while certifying they were not engaged in illegal activity, but the owner later pled guilty to Medicaid fraud covering 2018-2021, resulting in a 180-day jail sentence and $146,000 restitution order. The Justice Department now seeks $5.4 million plus penalties from the agency and its owner, arguing the SBA would not have forgiven the PPP loans had they known about the fraudulent Medicaid billing. The case demonstrates how past certifications can create additional liability when criminal conduct is discovered, even years after the fact.
The Fourth Circuit Court of Appeals has rejected a challenge from the Pharmaceutical Coalition for Patient Access regarding an unfavorable advisory opinion on their proposed Medicare Part D assistance program. The Coalition had planned to implement a program where drug manufacturers would subsidize copayments for cancer patients meeting specific income criteria who were prescribed their medications. The Office of Inspector General (OIG) determined this program could violate the Anti-Kickback Statute by inducing patients to select specific drugs based on financial incentives rather than medical necessity and allowing manufacturers to charge higher prices. The Fourth Circuit upheld the OIG’s opinion, interpreting “induce” and “remuneration” broadly under the Anti-Kickback Statute and dismissing arguments about multiple manufacturers negating quid pro quo arrangements. The court also ruled that claims of disparate treatment were unreviewable since enforcement decisions lie solely with the agency.
The 2016 21st Century Cures Act established rules against information blocking in healthcare electronic records to promote data sharing and competition. The Department of Health and Human Services and Federal Trade Commission collaborated to implement these rules, requiring fair licensing terms for protected health information. In January 2024, Real Time Medical Systems filed the first lawsuit under these rules against PointClickCare Technologies, alleging that PCC blocked access to health records through unsolvable CAPTCHA walls to hinder competition. The District Court of Maryland granted Real Time a preliminary injunction, and the case is now on appeal to the Fourth Circuit. The case marks the first enforcement action of the Cures Act’s information blocking provisions since its enactment.
Insurance
A new American Medical Association survey reveals that prior authorization requirements create barriers to patient care, with physicians reporting increased denials over the past five years and concerns about AI-driven review systems. The survey found that prior authorization led to care delays, with 77% of physicians reporting patients had to attempt ineffective treatments first, and 23% noting hospitalizations due to authorization delays. A Senate report indicated that AI systems deny claims up to 16 times more frequently than human reviewers, prompting the AMA to warn against unregulated AI in medical decision-making. Despite lawmaker scrutiny and legal challenges, experts predict insurers will continue implementing AI review systems, potentially forcing providers to adopt their own AI tools for claims submission.
A new American Medical Association survey reveals that 61% of doctors worry about insurers using AI to increase treatment pre-approval denials. The survey found that 93% of physicians report prior authorization delays care, while 82% say patients sometimes abandon treatment due to these delays. Despite 66% of doctors using AI in their practices, 49% want increased regulatory oversight of how insurers employ AI in the approval process. Hospitals report increasing claim denials attributed to AI tools, with 89% of doctors stating that prior authorization battles contribute to burnout. The process impacts patient care, with 29% of doctors reporting serious adverse events due to authorization delays, and 23% noting patients requiring hospitalization as a result.
Security
The Department of Health and Human Services has proposed updates to the HIPAA Security Rule on January 6, 2025, with comments open until March 7, 2025. The updates eliminate the distinction between “required” and “addressable” standards, making all security measures mandatory for healthcare entities. The new requirements include encryption, multifactor authentication, regular security audits, vulnerability scans, data backup procedures, and network mapping. The Privacy Rule changes reduce patient record request fulfillment time from 30 to 15 days and allow patients to photograph their health information in designated private areas. Healthcare providers must implement these changes and retrain staff on the new requirements once finalized.
The U.S. Department of Health and Human Services proposes updates to the HIPAA Security Rule due to widespread adoption of electronic health records, with 80% of physicians’ offices and 96% of hospitals using them as of 2021. The updates aim to address increased cybersecurity risks in healthcare delivery systems and establish centralized security standards, as current voluntary guidelines have seen inconsistent implementation. HHS chose a prescriptive approach rather than recognizing existing frameworks for safe harbor incentives, despite the 2021 HITECH Act amendments. The proposed changes, which have a public comment deadline of March 7, 2025, would raise security standards and potentially burden smaller providers, though HHS maintains the rules allow for flexibility in implementation.
Taxation
The Fifth Circuit Court upheld the Tax Court’s denial of tax-exempt status for Memorial Hermann Accountable Care Organization (MHACO) under Section 501(c)(4). MHACO, formed in 2012 as a not-for-profit corporation, participated in the Medicare Shared Savings Program while also serving patients with Medicare Advantage and employer-sponsored health plans. The court applied the substantial-nonexempt-purpose test, determining that MHACO’s operations primarily benefited commercial insurers rather than promoting social welfare, as 81% of its patients had employer-sponsored insurance. The court noted that MHACO’s members-only structure, which excluded uninsured individuals, failed to benefit the greater Houston community and thus did not qualify for tax exemption.
Transgender Care
Texas has filed a lawsuit against Dr. Hector Granados and two other doctors for allegedly violating a 2023 law banning gender-affirming care for minors. The state claims Granados prescribed testosterone to a 16-year-old patient after the ban, while he maintains he only prescribed it for hormone deficiencies, not gender transition. Texas is among 27 states that have restricted or banned treatments like puberty blockers and hormone therapy for minors, with some families now seeking care in states like New Mexico where such treatments remain legal. The trial is set for October, and if found guilty, Granados and his co-defendants, Dr. May Lau and Dr. M. Brett Cooper, could lose their medical licenses and face fines. Attorney General Ken Paxton states his office will enforce the ban, while doctors must choose between their ethical duties and maintaining their ability to practice medicine.
