Insights

On April 11, 2025, the U.S. Department of Justice (DOJ) issued guidance regarding the implementation and enforcement of the newly enacted final rule, “Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons,” now referred to as the Data Security Program (DSP). The release included an Implementation and Enforcement Policy, a Compliance Guide, and Frequently Asked Questions (FAQs). Collectively, these documents are designed to help entities subject to the DSP understand and comply with the obligations set out under the Final Rule.

In its first healthcare proposed regulation, the Trump Administration, through the Centers for Medicare & Medicaid Services (CMS), displayed on March 10, 2025, a proposed rule titled, “2025 Marketplace Integrity and Affordability Proposed Rule” (the Proposed Rule), which proposes policy changes for the Health Insurance Marketplaces that impact health plans and insurers offering Affordable Care Act (ACA) coverage to consumers. Specifically, the Proposed Rule shortens the Annual Open Enrollment Period (OEP) for all individual market coverage; proposes standards related to income verification for Health Insurance Marketplaces (Marketplaces); modifies eligibility redetermination procedures; and eliminates eligibility for “Deferred Action for Childhood Arrivals” (DACA) recipients, among other provisions.  

On March 27, 2025, HHS announced a “dramatic restructuring” of its various agencies and offices in accordance with President Trump's Executive Order, “Implementing the President’s ‘Department of Government Efficiency’ Workforce Optimization Initiative.” HHS also published a Fact Sheet.

Growing focus on antitrust enforcement at the federal level in recent years has been accompanied by a similar trend at the state level. Notably, multiple states have enacted or are considering enacting various legislative or regulatory changes that would create new regulatory requirements for businesses and make antitrust suits significantly easier for state attorneys general and private plaintiffs. These include new pre-transaction notice requirements, as well as the expansion of existing state antitrust statutes to cover more types of conduct while shifting the burden and expense of litigation from plaintiffs to defendants. In several cases, states have expressed a clear intent to increase enforcement related to the private equity and healthcare industries specifically.

On February 28, the Department of Health and Human Services (HHS) announced that it was rescinding the Richardson Waiver, a policy in place since 1971 which said HHS would provide notice of proposed rulemaking in certain cases where it was not otherwise required to do so by law. This announcement signals a policy shift for the agency and suggests that where permitted by law, HHS will generally now issue rules relating to “agency management or personnel or to public property, loans, grants, benefits, or contracts” without providing notice and comment to stakeholders, and may otherwise find good cause to forego notice and comment procedures.

FY 2024 saw continued growth in False Claims Act enforcement, with a record year for new qui tam and government-initiated actions, and the highest total recovery in three years. Enforcement of pandemic-related fraud and cybersecurity noncompliance increased, and health care, procurement, and small business fraud violations were again priority areas. A groundbreaking opinion from the District Court for the Middle District of Florida may have teed up a potentially landscape-shifting decision about the viability of the qui tam mechanism in the not too distant future. And a landmark administrative law decision at the U.S. Supreme Court may impact many FCA cases to come. Significant decisions regarding retaliation, excessive fines, the first-to-file rule, and the public disclosure bar were also handed down by courts of appeals. Crowell attorneys discuss these highlights and others in a “Feature Comment” published in The Government Contractor.

On Friday, February 21, Rep. Brett Guthrie (R-KY) and Rep. John Joyce (R-PA), the Chairman and Vice Chairman of the U.S. House Committee on Energy and Commerce, issued a Request for Information (RFI) inviting stakeholders to provide comment as the Committee explores the development of a federal data privacy and security framework. After efforts to consider a bipartisan and bicameral bill failed last year under former Chair Cathy McMorris Rodgers (R-WA), Chairman Guthrie is starting the effort anew, forming a working group with the goal of developing comprehensive legislation “that can get across the finish line.”

Federal Trade Commission Chair Andrew Ferguson announced on February 24, 2025, that the FTC will create the agency’s “first-ever” labor task force, signaling the agency’s continued focus on competition in labor markets, answering an open question from companies as to the fate of the agency’s no-poach and non-compete enforcement priorities. On February 26 Chair Ferguson followed up on his announcement with a Directive Regarding Labor Markets Task Force, providing additional details on the task force and the agency’s priorities.

California’s Assembly Bill 824 (“AB 824”) was enacted in October 2019 to curb “reverse payment” settlements among pharmaceutical companies that are used to resolve or settle patent infringement claims. The law establishes a presumption that such settlement agreements, through which a brand-name manufacturer compensates a generic manufacturer to forego its patent challenges in exchange for an agreement to enter at a later date (but before the expiration of the branded company’s patents), are anticompetitive and unlawful. AB 824 imposes significant financial penalties, with violators facing civil fines of up to three times the value received from the agreement or $20 million, whichever is greater.

The United States Court of Appeals for the First Circuit issued a pivotal ruling earlier this week, finding that in order to establish falsity in a False Claims Act (“FCA”) case premised on Anti-Kickback Statute (“AKS”) liability, the kickback must have been the “but-for” cause of the submission of the claim. The court’s decision hinged on the meaning of the phrase “resulting from” within the 2010 amendment to the AKS, which provided that a claim that includes items or services “resulting from” a violation of the AKS constitutes a false or fraudulent claim for purposes of the FCA. The meaning of “resulting from” for purposes of establishing such FCA liability has been hotly debated by courts. The First Circuit now joins the Sixth and Eighth Circuits in adopting this stricter but-for standard, while the Third Circuit has opted for a much looser approach.

On February 18, President Trump issued an Executive Order titled “Ensuring Accountability for All Agencies” that directs independent agencies (as well as Cabinet Departments and their sub-agencies) to route all “proposed and final significant regulatory” and budgetary actions through the White House and the Office of Management and Budget. If implemented to its full extent, this action will significantly strengthen the authority of the White House by weakening the political autonomy of these independent agencies. As an assertion of the President’s inherent powers under Article II of the U.S. Constitution, it also stands to weaken congressional influence over these independent agencies, both through the appropriations and confirmation processes.

Since his inauguration on January 20, 2025, President Trump has issued a flurry of executive orders (“EOs”). Three of these EOs rescind Biden Administration guidance extending the nondiscrimination protections under Section 1557 of the Affordable Care Act (the “ACA”) to discrimination based on gender identity.[1] These protections have had a tumultuous history since Section 1557 was enacted in 2010, with each administration reversing course from the last. The new administration has reverted to the position taken in President Trump’s last presidency – that the protections against discrimination “on the basis of sex” do not apply to gender identity.

Days after President Trump issued an executive order (EO) taking aim at diversity, equity, and inclusion (DEI) programs and prohibiting federal recognition of gender identity apart from biological sex, previously issued draft guidance on diversity in clinical trials was removed from the website of the U.S. Food and Drug Administration (FDA). While the removed guidance was in draft form, it is highly unusual for FDA to revoke or alter draft guidance without issuing a statement or further guidance. This move raises questions about the applicability of statutory obligations to submit clinical trial Diversity Action Plans and the agency’s current thinking on best practices for clinical development.

Artificial intelligence is now a mainstay in our daily lives. It’s in our phones and computers. It helps us draft emails and learn math. It recommends purchases and guides our online searches. It’s everywhere—and every sign suggests that it’s here to stay.

With the coming of the new presidential administration, state antitrust enforcement is poised to intensify. We expect both Republican and Democratic Attorneys General (AGs) to actively pursue antitrust investigations and litigation. They will fill in where the U.S. Department of Justice and Federal Trade Commission reduce focus but are also sure to work, including on a bipartisan basis, with their federal counterparts. Below, we explore how state AGs are likely to shape the antitrust landscape in the coming four years, and the areas where we anticipate significant enforcement activity.

On January 6, with increased attention and scrutiny from patients, providers, developers, and payors on the accelerated approval pathway for drugs, the Food and Drug Administration (FDA) released new draft guidance for industry on what it means for a drug’s confirmatory trial to be “underway” under section 506(c) of the Federal Food, Drug, and Cosmetic Act.

On January 6, 2025, the Department of Health and Human Services’ Office for Civil Rights (“OCR”) published a notice of proposed rulemaking (the “NPRM”) entitled HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information. In light of evolving technologies and cybersecurity threats, the NPRM aims to modernize security regulations implementing the Health Insurance Portability and Accountability Act security standards (the “HIPAA Security Rule”) and strengthen protections for the confidentiality, integrity, and availability of electronic protected health information (“ePHI”). In particular, OCR is considering modifications to the HIPAA Security Rule to address:

Federal policy efforts to advance health data exchange and interoperability are continuing to change rapidly. The latest changes are the publication of two final rules by the Assistant Secretary for Technology Policy/Office of the National Coordinator for Health Information Technology (ASTP/ONC) finalizing parts of the of the Health Data, Technology, and Interoperability (HTI-2) Proposed Rule. These rules adopt requirements regarding the Trusted Exchange Framework and Common Agreement (TEFCA) (HTI-2 Final Rule), and create a new Information Blocking exception under Protecting Care Access (HTI-3 Final Rule), on December 16thand 17th, respectively.

On October 29, 2024, the Department of Justice (DOJ) published a Notice of Proposed Rulemaking (NPRM) to implement Executive Order 14117 “Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern” (the E.O.).  The E.O. addresses the national security threat posed by the continued effort of certain countries of concern to access and exploit certain kinds of Americans’ sensitive personal data, which includes health data and genetic data. This builds on DOJ’s Advance Notice of Proposed Rulemaking (ANPRM) published on March 5.  Comments are due on November 29, 2024.

Digital health companies, investors, and other healthcare organizations should follow policy developments with a strategic lens towards their market opportunities for key potential growth and risk mitigation. On a quarterly basis, we provide relevant legislative and regulatory updates on artificial intelligence (AI) and digital health policy developments.