The most active current legal challenges in healthcare cluster around a handful of fights: what states can do about abortion after Dobbs, how patient data is protected when it leaves a doctor’s office, who pays when a surprise bill lands, whether telehealth prescribers can keep operating past 2026, what hospitals and insurers must disclose about prices, who is liable when clinical AI gets it wrong, how far federal fraud and antitrust enforcement will reach, and whether states can cap malpractice awards. Each has direct consequences for what care costs, whether you can get it, and what happens to your records afterward.
Reproductive Care After Dobbs
The Supreme Court’s 2022 decision in Dobbs v. Jackson Women’s Health Organization eliminated the federal constitutional right to abortion and returned regulatory authority to the states. Roughly a dozen states now ban the procedure almost entirely. Others have set gestational limits ranging from six weeks to around 22 weeks, and a smaller group imposes no gestational restrictions. State-court litigation has produced a shifting patchwork of injunctions, with access sometimes changing within a single state over a matter of weeks as advocates argue that state constitutional guarantees of privacy, bodily autonomy, or equal rights cover reproductive decisions.
Mifepristone and FDA Authority
A group of pro-life medical associations sued the FDA in FDA v. Alliance for Hippocratic Medicine, arguing the agency exceeded its authority by approving mifepristone in 2000 and loosening prescribing rules in 2016 and 2021. The Supreme Court unanimously rejected the challenge in June 2024, holding the plaintiffs lacked standing because they did not prescribe or use the drug and were not compelled to do anything.1Supreme Court of the United States. Food and Drug Administration et al. v. Alliance for Hippocratic Medicine et al. The merits of the FDA’s authority went untouched, so a future plaintiff with stronger standing could bring a similar challenge.
EMTALA and Emergency Abortions
A separate, unresolved question is whether federal law requires hospitals in ban states to provide emergency abortions. The Emergency Medical Treatment and Labor Act requires Medicare-participating hospitals to stabilize patients with emergency medical conditions, defined broadly to include conditions that could place health in serious jeopardy or cause serious impairment to bodily functions.2Office of the Law Revision Counsel. 42 USC 1395dd – Examination and Treatment for Emergency Medical Conditions and Women in Labor The federal government argued in Moyle v. United States that EMTALA preempts state abortion bans when termination is the medically necessary stabilizing treatment, even without an immediate threat to life.
The Supreme Court declined to resolve the conflict. In June 2024 it dismissed the case as improvidently granted and lifted its stay, reinstating a lower court injunction that blocks Idaho from enforcing its ban in EMTALA-qualifying emergencies.3Supreme Court of the United States. Moyle v. United States That injunction reaches only Idaho. Physicians elsewhere still face the tension between federal emergency-care duties and state criminal law with no definitive guidance on which controls.
Patient Data Privacy and Cybersecurity
HIPAA sets the national floor for protecting health information, requiring providers, health plans, and their business associates to implement administrative, physical, and technical safeguards and to notify individuals and the government when a breach occurs.4Department of Health and Human Services. Summary of the HIPAA Privacy Rule The HHS Office for Civil Rights investigates breaches and can impose civil monetary penalties.
Ransomware and Risk Analysis Failures
Healthcare organizations are a prime ransomware target. Attackers encrypt hospital data and demand payment, sometimes shutting down entire health systems for days and forcing ambulance diversions and delayed surgeries. When OCR investigates, it frequently finds the organization failed to conduct the risk analysis required by the HIPAA Security Rule at 45 CFR ยง 164.308.5Department of Health and Human Services. Guidance on Risk Analysis That analysis is meant to find vulnerabilities before an attacker does, and it remains one of the most commonly cited failures in enforcement actions.
The Health App Gap
HIPAA does not cover all health data. It applies only to covered entities and their business associates. Information you enter into a fitness tracker, cycle app, or mental health journal unaffiliated with your doctor or insurer falls outside HIPAA, and the developer may share, sell, or lose that data with few federal restrictions under the privacy rule itself.4Department of Health and Human Services. Summary of the HIPAA Privacy Rule
The FTC’s Health Breach Notification Rule, updated in July 2024, partially fills the gap. Makers of health apps and connected devices not covered by HIPAA must notify affected users, the FTC, and in some cases the media within 60 days of discovering a breach of health data. Breaches affecting 500 or more residents of a single state trigger a duty to notify prominent local media outlets as well.6Federal Trade Commission. Complying with FTC’s Health Breach Notification Rule The rule addresses notification, not collection or sharing.
Substance Use Disorder Records Move Closer to HIPAA
Federal rules under 42 CFR Part 2 have long imposed stricter privacy protections on substance use disorder treatment records than HIPAA imposed elsewhere, which made it hard for treating physicians to see the full medical history and created dual compliance burdens. An HHS final rule aligns Part 2 with HIPAA, with a compliance deadline of February 16, 2026. A single patient consent now authorizes disclosure of SUD records for treatment, payment, and healthcare operations, and HIPAA-covered entities can redisclose under standard HIPAA rules. Breach notification, penalties, and patient rights mirror HIPAA. SUD records still cannot be used against patients in civil, criminal, or administrative proceedings without a separate consent or court order.7Department of Health and Human Services. Fact Sheet 42 CFR Part 2 Final Rule
Surprise Medical Bills
Before 2022, patients regularly received unexpected bills after treatment by an out-of-network provider at an in-network facility. The federal No Surprises Act, effective January 1, 2022, prohibits out-of-network balance billing for emergency services and for non-emergency care delivered at in-network facilities. You pay only your normal in-network cost-sharing, and the provider and insurer settle the rest between themselves.8Centers for Medicare & Medicaid Services. No Surprises Act Protections – Status of Implementation
Arbitration Backlogs and Litigation
When providers and insurers cannot agree on payment, either can submit the dispute to Independent Dispute Resolution, where a certified arbitrator selects one offer. The volume has been enormous. At the start of 2025 more than 600,000 disputes were awaiting resolution, with 69 percent older than the 30-business-day target. By mid-2025 certified IDR entities were closing more disputes per month than were being filed.9Centers for Medicare & Medicaid Services. Fact Sheet – Clearing the Independent Dispute Resolution Backlog Provider groups have separately sued to challenge the regulations, arguing that instructions telling arbitrators to consider the insurer’s median in-network rate favor insurers.10Centers for Medicare & Medicaid Services. Qualifying Payment Amount Calculation Methodology Several suits have succeeded in vacating parts of the rules, forcing agency rewrites.
Ground Ambulances and Good Faith Estimates
Two gaps remain. Ground ambulance services are excluded from the No Surprises Act’s balance-billing protections. Air ambulances are covered.11Centers for Medicare & Medicaid Services. No Surprises Act Overview of Key Consumer Protections For uninsured and self-pay patients, the Act created a Good Faith Estimate requirement. Providers must tell self-pay patients an estimate is available and deliver it within set timeframes; when a service is scheduled at least three business days out, the estimate must arrive within one business day. It must itemize expected charges from the primary provider and any co-providers reasonably expected to be involved.12eCFR. 45 CFR 149.610 – Requirements for Provision of Good Faith Estimates for Uninsured or Self-Pay Individuals If the final bill exceeds the estimate by $400 or more, the patient can dispute the charges through a separate resolution process.13Consumer Financial Protection Bureau. What Is a Surprise Medical Bill and What Should I Know About the No Surprises Act
Telehealth Regulation
The most persistent barrier to telehealth is licensing. Each state controls who may practice medicine within its borders, and a physician generally must be licensed in the state where the patient sits during the visit. The Interstate Medical Licensure Compact offers an expedited pathway for qualified physicians to obtain licenses in participating states and now covers 43 states and two territories.14Interstate Medical Licensure Compact. Physician License It is not a single national license; a physician still holds a separate license in each state. States outside the compact still require individual applications, and comparable compacts for nurses, psychologists, and other professionals have their own memberships and criteria.
The Controlled Substance Prescribing Cliff
A high-stakes issue is whether physicians can prescribe controlled substances by video without a prior in-person exam. The Ryan Haight Act generally requires an in-person medical evaluation before prescribing Schedule II through V controlled substances. Pandemic-era waivers suspended that requirement, and the DEA has extended them four times. The current extension allows telehealth prescribing of controlled substances without a prior in-person visit through December 31, 2026, provided the prescription serves a legitimate medical purpose and is issued during a real-time interactive video or audio session.15Federal Register. Fourth Temporary Extension of COVID-19 Telemedicine Flexibilities for Prescription of Controlled Medications The DEA has proposed permanent rules but has not finalized them through repeated extension cycles. A lapse would force millions of patients on medications like buprenorphine or stimulants to schedule in-person visits to continue treatment.
Reimbursement Parity
Whether insurers must pay the same rate for a virtual visit as for an in-person one remains unresolved. Some states have enacted payment parity laws, but coverage, eligible specialties, and application to commercial plans versus Medicaid vary widely. Expiration of pandemic-era federal payment rules has left providers navigating an inconsistent framework.
Federal Price Transparency
Two federal rules are pushing prices into daylight. The Hospital Price Transparency Rule, in effect since January 2021, requires hospitals to post standard charges for all items and services in a machine-readable file and to offer a consumer-friendly display of at least 300 shoppable services. Penalties are tiered by bed count, ranging from up to $300 per day for the smallest hospitals to up to $5,500 per day for the largest, and are adjusted annually for inflation.16eCFR. 45 CFR Part 180 – Hospital Price Transparency
The Transparency in Coverage Rule requires group health plans and insurers to provide cost-sharing information to members through an online self-service tool, letting patients look up estimated out-of-pocket costs before receiving care.17Centers for Medicare & Medicaid Services. Transparency in Coverage Proposed Rule – CMS 9882-P Compliance has been uneven. CMS is stepping up enforcement reviews and publishing outcomes, though many patients do not know the tools exist.
Artificial Intelligence in Clinical Care
AI tools now assist with tasks like flagging abnormal radiology scans and predicting sepsis or hospital readmission. The HHS Office of the National Coordinator for Health IT finalized its HTI-1 rule, which establishes the first federal transparency requirements for AI and other predictive algorithms in certified health IT. Developers must give clinicians a consistent set of information about each algorithm so users can evaluate fairness, validity, effectiveness, and safety.18Office of the National Coordinator for Health Information Technology. HTI-1 Final Rule
Liability is where the harder legal question sits. When an AI-assisted diagnostic tool misses a cancer or recommends the wrong treatment, who is responsible? Under existing malpractice doctrine, physicians are held to the standard of care for their specialty regardless of what an algorithm recommends. Early case law and legal analysis suggest doctors bear the burden of errors from AI output because they have an independent duty to evaluate any recommendation before acting on it. Legislatures may need to address whether developers should share liability as tools grow more autonomous.
Fraud and Abuse Enforcement
The federal government recovers billions of dollars annually from healthcare fraud enforcement, and the legal tools it uses shape compliance for every provider that touches Medicare or Medicaid.
The False Claims Act
The False Claims Act is the government’s primary civil enforcement tool. It imposes liability on anyone who knowingly submits a false claim for payment to a federal healthcare program. “Knowingly” does not require intent to defraud; deliberate ignorance or reckless disregard of whether a claim is accurate is enough. Penalties include triple the government’s losses plus per-claim penalties adjusted annually for inflation.19Office of Inspector General, U.S. Department of Health and Human Services. Fraud and Abuse Laws Because each service billed counts as a separate claim, a practice affecting hundreds of patients can generate enormous exposure. Private whistleblowers can file suit on the government’s behalf and receive a share of the recovery, which is why many fraud cases start with tips from employees or competitors.
The Anti-Kickback Statute
The federal Anti-Kickback Statute makes it a felony to knowingly offer, pay, solicit, or receive anything of value to induce or reward referrals for services covered by a federal healthcare program. Violations carry up to five years in prison and fines up to $25,000 per offense.20GovInfo. 42 USC 1320a-7b – Criminal Penalties for Acts Involving Federal Health Care Programs The statute reaches arrangements that most people would not think of as bribes, like above-market rent paid to a referring physician’s practice or free services provided to a hospital that sends patients.
Safe harbor regulations exempt specific arrangements that meet detailed requirements. Recent updates added safe harbors for value-based care arrangements where providers share financial risk for outcomes. Arrangements involving full financial risk have more relaxed requirements, while care coordination arrangements with limited risk must meet conditions including the recipient paying at least 15 percent of the cost of any in-kind benefits received.21eCFR. 42 CFR 1001.952 – Exceptions
Antitrust Enforcement
Federal antitrust agencies have grown more aggressive on healthcare consolidation. The FTC and DOJ jointly issued updated Merger Guidelines in December 2023 establishing a structural presumption: a merger is presumed illegal if it produces a highly concentrated market (an HHI above 1,800) with a significant increase in concentration, or if it creates a firm with a market share above 30 percent.22Federal Trade Commission. Merger Guidelines 2023 Merging parties can try to rebut the presumption, but the burden is on them.
Private Equity Roll-Ups
Regulators have zeroed in on private equity firms that acquire dozens of small physician practices in a specialty and region to build market dominance without any individual deal being large enough to trigger federal reporting. The landmark case involved Welsh, Carson, Anderson & Stowe, which created U.S. Anesthesia Partners and systematically acquired nearly every large anesthesia practice in Texas. The FTC alleged the roll-up gave USAP power to demand higher prices. A January 2025 settlement requires Welsh Carson to freeze its investment in USAP, reduce its board representation, and obtain prior approval for any future anesthesia investments nationwide.23Federal Trade Commission. FTC Secures Settlement with Private Equity Firm in Antitrust Roll-Up Scheme Case The FTC, DOJ, and HHS have launched a joint public inquiry into corporate ownership’s impact on cost, quality, and staffing.24Federal Trade Commission. FTC, DOJ, and HHS Launch Cross-Government Inquiry on Impact of Corporate Greed in Health Care
Clinician Non-Compete Agreements
Non-compete clauses in physician and nurse employment contracts sit at the intersection of antitrust and labor law. The FTC tried to ban most non-competes nationwide through a 2024 rule, but a federal district court enjoined it in August 2024, and the FTC subsequently withdrew from defending it in court. The ban is not in effect. The FTC has said it will continue enforcing antitrust law against non-competes case by case. In September 2025 the FTC Chairman sent warning letters to several large healthcare employers and staffing companies, urging them to review their non-competes and warning that unjustified or overbroad restrictions violate Section 5 of the FTC Act.25Federal Trade Commission. FTC Chairman Ferguson Issues Noncompete Warning Letters to Healthcare Employers and Staffing Companies The blanket ban is dead; the litigation risk of overreaching non-competes has risen.
Medical Malpractice Damage Caps
Whether state legislatures can cap what juries award in malpractice cases remains one of the most contested issues in health law. Roughly half of states impose some limit on non-economic damages, typically ranging from $250,000 to $750,000, with a few states setting limits above $1 million for catastrophic injuries or wrongful death. The other half impose no statutory caps.
These caps face recurring constitutional challenges. Plaintiffs argue damage limits violate state constitutional rights to jury trial, equal protection, and access to courts. Results vary widely: some state supreme courts have upheld caps, others have struck them down. The legal picture shifts whenever a state enacts, amends, or repeals a cap, and each state’s constitutional text produces different outcomes even when the arguments are nearly identical. For patients, a cap can mean that even a jury convinced of severe negligence cannot award damages that reflect the full harm.