Health Care

State of play.

• The FTC and state AGs have opened a multi-front enforcement campaign against digital health platforms. The FTC, California, and Utah sued Hims & Hers for sharing sensitive health data with Meta and Snap while marketing itself as private, and for charging customers before any provider consultation occurred — a complaint that doubles as an enforcement roadmap for the entire DTC telehealth sector .
• A 16-state coalition has sued HHS and DHS to block Medicaid health data from flowing to ICE for immigration enforcement, seeking an immediate injunction and testing whether states can restrict federal agency access to social services data — a question with no settled answer .
• Seven states have enacted AI therapy chatbot restrictions with no federal floor, creating a fragmented compliance landscape for any mental health platform operating across jurisdictions; Colorado's law bars AI therapy entirely while other states vary in scope and enforcement mechanism .
• The Mayo Clinic whistleblower suit has introduced False Claims Act retaliation as a vehicle for AI safety challenges in clinical settings, with allegations of suppressed error rates, IRB bypass, and patient data mishandling during deployment of the MAYA digital assistant .
• For counsel advising telehealth companies, health systems, or digital health platforms, the practical baseline is simultaneous exposure across health-data privacy enforcement, AI deployment liability, and a federal-vs.-state data-sharing conflict that is actively in litigation.

Where things stand.

• FTC enforcement against DTC health platforms is now in active litigation. The Hims & Hers complaint — following a nearly three-year investigation — targets pixel-based health data sharing with ad platforms and pre-consultation billing as overlapping violations of the FTC Act, ROSCA, and state consumer protection statutes; the case will produce discovery on how tracking technologies transmit health information to third parties .
• Federal Medicaid data-sharing with DHS is under injunction litigation. A 16-state coalition challenges HHS's grant of unrestricted ICE access to Medicaid beneficiary health information; the outcome will determine whether states can impose use-limitation conditions on federally administered health data .
• State AI therapy restrictions are enacted law, not pending regulation. Seven states — Colorado, Maine, Rhode Island, Tennessee, Vermont, Illinois, and Nevada — have enacted restrictions ranging from outright prohibition to licensing and disclosure requirements; no federal standard governs the space, and dozens of additional state bills remain active .
• AI whistleblower litigation in healthcare has reached federal court. The Mayo Clinic suit under the False Claims Act's retaliation provision alleges suppression of a 67% error rate in the MAYA tool and IRB bypass — the first major case to test FCA retaliation as a vehicle for AI safety concerns in a clinical deployment .
• State AGs are pursuing pandemic-era accountability through state-law self-dealing theories. Florida, West Virginia, and Louisiana have issued investigative subpoenas to Dr. Fauci; a federal pardon does not shield against state investigations, making the jurisdictional scope of these probes a live question for practitioners tracking pandemic-era liability .
• ACA marketplace design is in active litigation. A 21-state coalition challenges the Trump administration's 2027 Notice of Benefit and Payment Parameters, alleging it unlawfully expands catastrophic plan eligibility and resurrects provisions a federal court previously vacated; HHS's own estimates project 2 million coverage losses in 2027 rising to 5 million by 2030 .
• Healthcare governance disputes are producing competing civil extortion and financial misconduct claims. The American Healthcare Systems litigation — involving a five-hospital Florida network, $14 million in disputed funds, and an amended complaint that reverses the original plaintiff-defendant alignment — illustrates control-failure risk in founder-led health systems .
• International AI safety frameworks are hardening around healthcare as a high-risk sector. The UN International AI Safety Report 2026, drawing on World Bank and World Economic Forum research, identifies healthcare AI as an area where capability is outpacing governance; the WEF ranked adverse AI outcomes as the fifth most critical global risk .
• AI scribe consent litigation remains a pattern. Class actions against Sutter Health and MemorialCare follow the Sharp HealthCare template, placing institutional liability — not vendor liability — on health systems for ambient recording without patient consent under CIPA, CMIA, and the Federal Wiretap Act .
• Genetic data de-identification is contested doctrine. Tempus AI's defense that transferred Ambry Genetics data was de-identified faces the argument that genetic information is inherently identifiable — unresolved under state genetic privacy statutes .

Latest developments.

• FTC, California, and Utah file federal complaint against Hims & Hers alleging health data sharing with Meta and Snap and pre-consultation billing; case pending in N.D. Cal.
• 16-state coalition sues HHS and DHS in N.D. Cal. to block Medicaid beneficiary health data transfers to ICE; injunction sought
• Seven states have enacted AI therapy chatbot restrictions in 2025-2026; Colorado's law, effective June 3, bars AI therapy entirely; no federal standard exists
• Former Mayo Clinic research director files FCA retaliation suit alleging suppressed 67% error rate in MAYA tool, IRB bypass, and patient data mishandling
• Florida, West Virginia, and Louisiana AGs issue investigative subpoenas to Dr. Fauci in coordinated multi-state self-dealing probe; federal pardon does not bar state action
• 21-state coalition challenges Trump administration 2027 ACA marketplace rule alleging unlawful expansion of catastrophic plan eligibility and resurrection of previously vacated provisions
• American Healthcare Systems files amended complaint against former in-house counsel Faisal Gill for extortion and takeover scheme; litigation involves control of five Florida hospitals
• UN releases International AI Safety Report 2026 identifying healthcare AI governance gap; WEF ranks adverse AI outcomes as fifth most critical global risk

Active questions and open splits.

• Whether pixel-based health data transmission to ad platforms constitutes an FTC Act violation independent of HIPAA coverage. The Hims & Hers complaint proceeds under FTC Act and ROSCA — not HIPAA — meaning the case will test whether FTC consumer protection authority reaches health data sharing that falls outside HIPAA's covered entity framework .
• Whether states can impose use-limitation conditions on federally administered Medicaid data. The HHS-DHS data-sharing litigation presents a structural question about state authority over federal program data — no circuit has resolved it; a preliminary injunction ruling will be the first significant signal .
• Whether the FCA retaliation provision extends to AI safety concerns in clinical AI deployments. The Mayo Clinic suit is the first major test; if courts sustain the FCA theory, every health system deploying clinical AI tools faces a new whistleblower exposure vector tied to validation documentation and error-rate disclosure .
• What compliance framework satisfies the seven-state AI therapy patchwork for multi-jurisdiction mental health platforms. State approaches range from outright prohibition (Colorado) to licensing and disclosure requirements — with no federal floor and dozens of additional bills pending; a platform compliant in one state may be unlawful in another .
• Whether HHS can reintroduce ACA provisions previously vacated by federal courts through new rulemaking. The 21-state coalition's challenge to the 2027 marketplace rule turns on this question; if sustained, it constrains executive authority over ACA marketplace design going forward .
• Whether health systems or vendors bear primary liability for AI scribe consent failures. The Sutter/MemorialCare complaints name only health systems — not Abridge — but vendor agreements, BAA structures, and indemnification provisions will determine ultimate allocation; courts have not yet resolved the institutional-vs.-vendor split .
• Whether genetic data can be meaningfully de-identified under state genetic privacy statutes. Tempus AI's de-identification defense remains untested at the class action level; the outcome governs post-acquisition data integration and downstream licensing structures across life sciences M&A .

What to watch.

• Preliminary injunction ruling in the HHS-DHS Medicaid data-sharing case — the first judicial signal on whether states can restrict federal agency use of health program data for immigration enforcement .
• Early motions practice in the Hims & Hers case — particularly whether the court sustains FTC Act claims for health data sharing with ad platforms absent HIPAA coverage, which would extend the enforcement template to every DTC health platform using tracking pixels .
• Whether additional states enact AI therapy restrictions following the 2026 wave — the absence of a federal standard means the patchwork will continue to expand .
• Discovery in the Mayo Clinic FCA retaliation suit — specifically how courts treat internal AI validation documentation, error-rate suppression, and IRB bypass as predicate facts for FCA retaliation claims .
• New York Court of Appeals resolution of the certified no-fault eligibility question — outcome reshapes insurer fraud-defense strategy across the no-fault market .
• Whether the multi-state Fauci investigation produces formal charges — and whether other state AGs join, which would test the outer limits of state-law self-dealing theories applied to federal public health officials .