Healthcare Regulatory

Recently, Attorney General Pam Bondi purportedly issued an internal memorandum in response to Executive Order 14187 (“Protecting Children from Chemical and Surgical Mutilation”) concerning the treatment of transgender minors by medical practitioners, hospitals, clinics, and pharmaceutical companies. The memo set forth guidance for all Department of Justice (DOJ) employees to investigate individuals and entities who provide gender-affirming care to minor patients. To be clear, the memorandum—which has been posted in various locations on the internet and widely reported on by various media outlets but has not been verified as authentic by Husch Blackwell—is an internal policy statement directed to DOJ personnel and is not law. While it purports to issue “guidelines” pursuant to an executive order from the President, that executive order is itself under scrutiny (and has been partially enjoined).

Artificial intelligence (AI) continues to dominate headlines—not just for its technological leaps, but also for the policies shaping its future. In a major development, a new Republican-backed tax bill, released by the House Energy and Commerce Committee on May 11, 2025, seeks to preempt states from regulating AI models for the next decade. If passed, this bill would prevent state laws governing AI systems, allowing only limited exceptions for measures that simply facilitate or streamline AI development and deployment. Laws attempting to regulate artificial intelligence models, artificial intelligence systems, or automated decisions systems would be disallowed during the 10 year period.

This proposed federal approach aligns with the current administration’s emphasis on AI innovation over regulation, reflecting a belief that a unified, national policy will spur American competitiveness in this rapidly evolving field.

Judge's gavel on table in office

On February 20, 2025, the ERISA Industry Committee (ERIC) announced that its legal counsel submitted a letter to the U.S. Departments of Labor (DOL), Health and Human Services (HHS) and Treasury, requesting a stay of enforcement of the September 2024 Mental Health Parity and Addiction Equity Act (MHPAEA) Final Rule. In the letter, ERIC urged the Departments to exercise their authority under 5 U.S.C. § 705 to postpone the effective date of the Final Rule while litigation challenging its validity is ongoing. This request marks a significant development in the legal landscape surrounding mental health parity laws and could have far-reaching implications for employers, health plans, and other stakeholders in the health insurance industry.

Judge's gavel on table in office

On January 17, 2025, the ERISA Industry Committee (ERIC) filed a lawsuit in the U.S. District Court for the District of Columbia, claiming that the 2024 Mental Health Parity and Addiction Equity Act (MHPAEA) Final Rule oversteps legal bounds, breaches the Administrative Procedure Act (APA), improperly delegates the Departments of Labor, Health and Human Services and Treasury’s (Departments) executive power to private entities, and violates the Due Process Clause. ERIC argues that under the Mental Health Parity Act of 1996, the plan was not obligated to assess any disparate impact that a term, applicable to both medical/surgical (M/S) and mental health and substance use disorder (MH/SUD) benefits, might have had on access to MH/SUD benefits. The Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) similarly maintained the disparate treatment standard of liability, rather than the disparate impact standard. Moreover, the Departments acknowledged in the 2013 regulations that “disparate results alone” did not constitute a parity violation.

Healthcare-Data-HIPAA

On December 27, 2024, the U.S. Department of Health and Human Services (HHS), through its Office for Civil Rights (OCR), issued proposed changes to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Security Rule (the Proposed Rule) to strengthen the cybersecurity protections that HIPAA-regulated entities are required to maintain for electronic protected health information (ePHI).

Close up of doctor working on computer in doctor's office. Physician doing paperwork and administration.

Keypoint: With the increased frequency and severity of cyberattacks against healthcare systems, state and federal agencies strive to improve cybersecurity controls with varied success.

In November 2023, New York Governor Kathy Hochul announced proposed regulations that would be the first state regulations for hospitals in New York. The governor described the proposed regulation as a “nation-leading blueprint” that would complement the federal Health Insurance Portability and Accountability Act (HIPAA) Security Rule enforced by the U.S. Department of Health and Human Services (HHS).

Doctor writing survey, insurance and claim form for medical paperwork, document and script for patient records, test result and research in a hospital. Physician hands signing and planning healthcare

On September 9, 2024, the U.S. Department of Labor (DOL), Health and Human Services (HHS), and Treasury (collectively, the Departments) issued a Final Rule clarifying and adding additional requirements on health plans to provide equitable access to health insurance coverage for treatment of mental health and substance use disorders (SUDs), as required by the Mental Health Parity and Addiction Equity Act of 2008 (MHPAEA) and implementing regulations at 45 C.F.R. Part 146 and 147 (the 2024 Final Rule).

MHPAEA is a federal law that prevents group health plans and health insurance issuers (collectively, Health Plans) that provide mental health or substance use disorder benefits from imposing less favorable benefit limitations on those benefits than it does for a medical condition or surgical procedure. This means that Health Plans cannot impose additional financial requirements or apply non-quantitative treatment limitations (NQTLs) to these benefits more stringently than those applied to medical/surgical benefits.

On July 3, 2024, Judge Louis Guirola, Jr. of the federal district court in Mississippi issued a nationwide preliminary injunction prohibiting the U.S. Department of Health and Human Services (HHS) from “enforcing, relying on, implementing, or otherwise acting on” the gender identity provisions of a HHS Final Rule that purported to implement Section 1557 of the Patient Protection and Affordable Care Act (ACA) and was set to go into effect on July 5, 2024. The injunction was sought by a plaintiff group comprised of fifteen individual states that alleged the Final Rule violates existing statutory and constitutional law. The breadth of the injunction includes 42 C.F.R. §§ 438.3, 438.206, 440.262, 460.98, and 460.112; 45 C.F.R. §§ 92.5, 92.6, 92.7, 92.8, 92.9, 92.10, 92.101, 92.206-211, 92.301, 92.303, and 92.304 “in so far as these regulations are intended to extend discrimination on the basis of sex to include discrimination on the basis of gender identity.” While the injunction halts the gender identity provisions of the 2024 Final Rule, the remaining provisions of the 2024 Final Rule remain in effect.

In a landmark decision on June 28, 2024, the Supreme Court overturned a 40-year-old legal precedent known as Chevron deference. Established in 1984, Chevron deference mandated that judges defer to federal agencies concerning interpretations of ambiguous laws, as long as those interpretations were reasonable. This doctrine has been a cornerstone of administrative law, significantly impacting…

What Are the Changes?

On April 26, 2024, the U.S. Department of Health and Human Services (“HHS”) issued a final rule (the “Final Rule”) along with guidance updating the Health Insurance Portability and Accountability Act (“HIPAA”) regulations at 45 C.F.R. Parts 160 and 164 (the “Privacy Rule”). The Final Rule prohibits the use or disclosure of protected health information (“PHI”) for the purpose of (1) conducting criminal, civil, or administrative investigations into, or (2) imposing criminal, civil, or administrative liability on any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care that is legal when provided. The Final Rule also prohibits the use or disclosure of PHI in order to (3) identify any person for any of those purposes (the “Prohibition”).[1]