On June 11, 2025, the Department of Health and Human Services Office of Inspector General (OIG) issued a favorable advisory opinion on a proposed arrangement where a physician practice managed by a management services organization (MSO) would engage telehealth-based practices and platforms (collectively, Telehealth Companies) to provide telehealth services, including leasing health care professionals and maintaining the telehealth platform. The physician practice would submit claims for the telehealth services under its own private and government payor contracts. This advisory opinion addresses an increasingly common telehealth delivery model aimed at increasing the availability of health plan coverage for telehealth services, particularly in recent years with the rise in popularity of GLP-1 drugs for managing obesity.  

The following is a summary comparison between the currently passed NY HIPA and WA MHMDA.

The latest entrant in a national wave of policymakers enacting health care market oversight laws that have a significant impact on providers and investors, Massachusetts Governor Maura Healey has signed into law House Bill 5159, “An Act enhancing the health care market review process” (the Act). The product of nearly five months in conference committee following disagreeing votes of the House and Senate, the Act substantially broadens the applicability of one of the oldest state health care market review laws in the country.  The changes brought about by the Act will increase financial transparency and the Commonwealth’s ability to examine both the anticipated and long-term impact of health care transactions. The Act expands the authority of the Massachusetts Attorney General’s Office (AGO), the Center for Health Information and Analysis (CHIA), and the Health Policy Commission (HPC) to require financial, structural, and operational information from a wide array of health care providers and those seeking to provide them with investment, management, and other services. 

Telehealth companies and other industry stakeholders have had a watchful eye towards the end of 2024 and the impending “telehealth cliff” as COVID-era Drug Enforcement Agency (DEA) flexibilities and Medicare expanded telehealth coverage are set to expire. Although a recent temporary joint rule from the DEA and the Department of Health and Human Services (HHS) along with the 2025 Medicare Physician Fee Schedule final rule has provided some hope, questions regarding telehealth access in 2025 and under a new Administration remain unclear. Further, calls continue for increased oversight of telehealth services. 

Commencing October 2024, CMS will start off-cycle revalidations of all Skilled Nursing Facilities (SNFs).  As part of the revalidation process, SNFs must disclose the additional information required under CMS’ final rule, “Disclosures of Ownership and Additional Disclosable Parties Information for Skilled Nursing Facilities and Nursing Facilities,” which was  released November 17, 2023 (“Final SNF Disclosure Rule”).  

Last week, Texas Attorney General Ken Paxton filed a complaint in federal district court against HHS and the Office for Civil Rights (OCR) challenging a recently issued rule strengthening protection of protected health information (PHI) related to reproductive health. As summarized in a previous post, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy (Final Rule), generally prohibits disclosure or use of PHI by a covered entity or their business associate for purposes of criminal, civil, or administrative investigations into persons for seeking, obtaining, providing, or facilitating reproductive health care under lawful circumstances. In its complaint, Texas argues that the Final Rule is unlawful and seeks to have it vacated.

A recent court split about whether awards granted through arbitration under the No Surprises Act (NSA) are enforceable through litigation has created uncertainty around an already complicated process.  A Texas judge recently held that the NSA does not grant parties a right to bring suit to enforce arbitration awards, while last year a New Jersey court granted enforcement of a similar award.  The resulting split raises questions about the enforceability and utility of the NSA and its Independent Dispute Resolution (IDR) process. 

Earlier this week, the Biden-Harris Administration, through the Office for Civil Rights (OCR) announced a Final Rule aimed at protecting protected health information (PHI) related to lawfully provided reproductive health care services.  As we discussed last year, the HIPAA Privacy Rule to Support Reproductive Health Care Privacy was proposed in response to concerns about the confidentiality of PHI related to reproductive health care following the decision in Dobbs v. Jackson Women’s Health Organization.  In the executive summary of the Final Rule, OCR emphasized that the changing post-Dobbs legal landscape “increases the likelihood that an individual’s PHI may be disclosed in ways that cause harm to the interests that HIPAA seeks to protect, including the trust of individuals in health care providers and the health care system.”  The Final Rule defines “reproductive health care” as “health care…that affects the health of an individual in all matters relating to the reproductive system and to its functions and processes.” 

Lawyers for Good Government, in partnership with the American College of Obstetricians and Gynecologists, initiated a vital project known as The Policy Resource Hub in 2022.

As we reflect on the flurry of activity in the health care data privacy and security space in 2023 and look ahead to what will continue to be a busy 2024, we are seeing the early stages of federal agency movement to align the regulatory environment with modern health care delivery, cutting-edge technologies, and innovative data-sharing techniques. Some of this work has been done in the form of federal agency guidance in which health care organizations will be looking for additional updates and there are also a handful of pending U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) proposals that call for substantial changes to the HIPAA Privacy Rule.