ARTICLE / INTERNATIONAL NEWS
July 1, 2025
Read time: 7 min
The European Union’s European Digital Identity Framework Regulation (eIDAS 2.0) introduces a standardised framework for digital identity and trust services across all EU Member States, massively benefiting anti-money laundering efforts while still protecting individuals’ personal data.
eIDAS 2.0, which came into effect at the end of 2024, complements the regulatory requirements of the Second Payment Services Directive (PSD2), particularly in implementing Strong Customer Authentication, which is a key requirement of PSD2. One of the primary uses of eIDAS 2.0 will be digital Know-Your-Customer (KYC) identification in compliance with relevant Anti-Money Laundering (AML) laws. One of the key benefits, therefore, is streamlined and secure customer onboarding, particularly in the financial sector.
One of the primary uses of eIDAS 2.0 will be digital KYC identification.
As a direct result, eIDAS 2.0 facilitates the implementation of EUDI-Wallets, which are expected to come into effect from 2027, and will make all online financial services requiring customer identification, easier and more reliable, even across borders. This will reduce friction and improve the user experience by allowing for easy and safe online authentication and verification across the entire European Union, covering services such as bank account opening, qualified electronic signatures, and mobile driving licenses. The introduction of EUDI-Wallets under eIDAS 2.0 aims to provide a unified and secure way for individuals to store and manage their electronic identification data. EUDI-Wallets will enable users to selectively disclose their data, ensuring that only the necessary information is shared with the respective service providers. This selective disclosure mechanism is crucial for maintaining privacy while easily accessing various digital services.
eIDAS 2.0 will have a material impact on the digitalisation of EU markets and, accordingly, provide for various innovative business opportunities. Digital businesses can develop new services, such as identity-verified digital wallets, automated contract execution, and seamless cross-border payments. The harmonised legal framework will also reduce compliance complexity and operational costs.
eIDAS 2.0 facilitates the implementation of EUDI-Wallets.
Electronic Identification and Trust Services
The primary goals of eIDAS 2.0 are to:
- Create harmonised conditions under which EU Member States can acknowledge electronic identification to provide for and recognise EUDI-Wallets. eIDAS 2.0 also allows that EUDI-Wallets must be open-source licensed. The rationale is to ensure general transparency so that the software can be scrutinised properly for potential security vulnerabilities, thereby protecting user data from potential breaches. Member States may, however, restrict the disclosure of specific components for justified reasons, balancing transparency with security.
- Establish rules for trust services, in particular for electronic transactions, to ensure that electronic documents and transactions are tamper-proof and legally binding.
- Create a legal framework for electronic signatures, seals, time stamps, documents, registered delivery services, archiving, and ledgers, amongst others.
eIDAS 2.0 promotes interoperability and the standardisation of electronic identification and trust services across the European Union. This ensures that technical as well as privacy and data protection standards are consistently applied, regardless of the Member State in which the services are used. Standardisation in this context is also expected to facilitate the development of secure and privacy-enhancing technologies that can be widely adopted.
Given the value of the information that will be stored digitally as a result of eIDAS 2.0, it is crucial to examine its privacy and data protection implications.
eIDAS 2.0 will have a material impact on the digitalisation of EU markets.
Data Protection Under eIDAS 2.0
eIDAS 2.0 is designed to ensure that users of electronic identification means and trust services have full control over their personal data. Accordingly, service providers must ensure the confidentiality, integrity, and authenticity of the data processed.
Under the General Data Protection Regulation ((EU) 2016/679, GDPR), data subjects have the right to access, rectify, and fully erase their data. The GDPR takes precedence over eIDAS 2.0, empowering individuals to securely manage their digital identities.
In addition, eIDAS 2.0 emphasises the importance of user consent and transparency in the processing of personal data. Service providers are – in line with and subject to GDPR – required to obtain explicit consent from users before processing their data, and must provide clear and transparent information about how the data will be used. This ensures that users are fully informed and can make confident decisions about their data.
Trust services under eIDAS 2.0, such as electronic signatures and seals, are designed with data minimisation principles in mind. These services ensure that only the necessary data is processed for the intended purpose, reducing the risk of unnecessary and unwanted data exposure. eIDAS 2.0 facilitates cross-border data transfers by establishing a harmonised framework for electronic identification and trust services across the entire European Union. This is particularly relevant for ensuring that data protection standards are maintained when personal data is transferred between EU Member States and will help reduce the risks associated with cross-border data transfers.
In the event of a security breach, eIDAS 2.0 requires service providers to notify the relevant supervisory bodies and affected users without undue delay. This prompt notification helps mitigate the impact of breaches on user privacy and ensures that protective and corrective measures are taken swiftly. eIDAS 2.0 also outlines the responsibilities of supervisory bodies in investigating and addressing such breaches. Insofar as this regards financial services, eIDAS 2.0 must be read in conjunction with the Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA).
In addition, eIDAS 2.0 explicitly promotes the use of pseudonyms, allowing users to engage in certain transactions without revealing their true identities, thereby additionally enhancing privacy. The exception is where the identification of the user is required by EU or national law, as would be the case in most financial services transactions, where stricter rules require a complete set of clear personal data for KYC purposes.
How eIDAS 2.0 Affects the Future of the EU AML Regime
The new Regulation on the Prevention of the Use of the Financial System for the Purposes of Money Laundering or Terrorist Financing ((EU) 2024/1624 Anti-Money Laundering Regulation, AMLR) emphasises the high importance of customer due diligence in preventing money laundering and terrorist financing. eIDAS 2.0 is expected to play a significant role in this context as money laundering and terrorist financing often involve a high number of cross-border transactions involving multiple jurisdictions. The interoperability of electronic identification processes under eIDAS 2.0 enables financial institutions and other entities to verify the identity of customers from different EU Member States seamlessly. This EU-wide standardisation will also likely simplify spotting suspicious customers or activities across borders.
The AMLR advocates for a risk-based approach to managing financial transactions and correlating AML risks. eIDAS 2.0 provides the necessary tools for implementing this approach smoothly and cost-effectively by using secure electronic identification and trust services. These tools also enable obliged entities to know their clients and assess and effectively mitigate the risks associated with their customers and transactions.
The Cornerstone of a Trustworthy Digital Environment
The provisions of eIDAS 2.0 for electronic identification and trust services empower users to control their personal data and engage in secure electronic transactions. By aligning with the GDPR and promoting transparency, user control, and data minimisation, eIDAS 2.0 ensures that privacy and data protection standards are still upheld in this new digital landscape.
Furthermore, the integration of eIDAS 2.0 with the new AMLR enhances the effectiveness of anti-money laundering measures by providing reliable electronic identification means and facilitating cross-border co-operation, while upgrading and simplifying the customer experience of KYC.
As the reliance on secure digital services continues to grow, the robust privacy, data protection, and AML framework established by and around eIDAS 2.0 will be crucial in maintaining user trust and safeguarding personal data in the European Union’s digital future.
Client alert, US Policy
New executive order shifts US AI policy toward national security

New US Data Security Program limits sensitive data transfers
ARTICLE / INTERNATIONAL NEWS
July 1, 2025
Read time: 7 min
The United States Data Security Program (DSP) represents a significant regulatory undertaking by the US government to control the flow of bulk sensitive data to specific foreign countries, for national security purposes.
The DSP came into effect 8 April 2025, operationalised through a Final Rule promulgated by the US Department of Justice (DOJ), which introduced a framework of prohibitions and restrictions on certain data transactions. Specifically, the DSP regulates the transfer of, or provision of access to, bulk US sensitive personal data and US government-related data to “countries of concern.”
US Data Security Program Scope
A key aspect of the Program is its designation of “countries of concern,” which the US government has identified as presenting heightened risks to national security.
The current list names China (including Hong Kong and Macao), Cuba, Iran, North Korea, Russia, and Venezuela. However, the scope of the DSP extends beyond these countries to apply to “covered persons,” a category defined within the DSP to encompass specific individuals and entities sufficiently connected to these countries, such as by a foreign individual residing in a country of concern or a foreign entity organised under the laws of a country of concern.
To ensure the Program’s adaptability to evolving threats, the DSP empowers the US Attorney General to designate, on a case-by-case basis, any individual or entity, regardless of location, as a “covered person.” Such designations will be made public through official announcements in the Federal Register, maintaining a transparent record within the National Security Division’s list of covered persons.
The establishment of the DSP and the implementation of the DOJ Final Rule is rooted in a national emergency declared by Former President Biden in a 2019 Executive Order. The declaration acknowledged the “…unusual and extraordinary threat… to the national security and foreign policy of the United States…” posed by the access of foreign adversaries to “…vast amounts of sensitive information…” pertaining to Americans.
The DOJ has specifically addressed the national security risks associated with “countries of concern” exploiting advanced technologies. Of particular concern is the potential use of technologies like artificial intelligence (AI) to analyse and manipulate bulk sensitive personal data, which the government fears could enable foreign adversaries to engage in activities detrimental to US interests, such as espionage, influence campaigns, and kinetic or cyber operations, and could lead to the pursuit of other strategic advantages.
Of particular concern is the potential use of technologies like artificial intelligence.
Sensitive Data Covered by the DSP
Under the DSP, US businesses are prohibited from engaging in “data brokerage,” which is defined to include the sale or licensing of access to certain bulk data. The DSP establishes specific thresholds for determining what constitutes “bulk” sensitive personal data, and these thresholds vary depending on the level of sensitivity the US government associates with each data type. Thresholds for all sensitive data, including health, biometric, financial, and location data, especially for multinational companies with a large corporate presence, are fairly low and reflect the government’s fears regarding how such data, even at low thresholds, can be leveraged against the United States and its residents.
Under the DSP, US businesses are prohibited from engaging in “data brokerage.”
The types of “sensitive personal data” covered by the DSP are similar to those set forth in regulations issued by the Committee on Foreign Investment in the United States (CFIUS), an inter-agency body responsible for reviewing foreign investments in US businesses for potential national security concerns. The DSP, however, has a broader scope of what constitutes “sensitive personal data” compared with CFIUS, and has much lower thresholds as CFIUS generally focuses on investments in businesses that collect the sensitive personal data of one million or more US persons.
The DSP’s prohibitions and restrictions on data transfers to countries of concern are intentionally broad and industry-agnostic. The DSP provides a limited set of narrow exemptions for certain transactions, including, but not limited to, those typically associated with business operations, or required or authorised by law; investment agreements; and drug, biological product, and medical device authorisations. Because of the wide scope of the DSP and its narrow exemptions, the DSP will have a particularly outsized impact on healthcare and health-related data transactions, financial services and financial-related data transactions, and intercompany and vendor data transactions.
Companies engaging in prohibited data transactions must cease those practices, while those engaging in similar transactions subject to vendor, employee, and investment agreements, which intend to continue engaging in such transfers, must utilise system and data-level protections outlined by the US Cybersecurity and Infrastructure Security Agency (CISA). Companies seeking to engage in restricted transactions by leveraging CISA’s requirements may find that, in implementing these strict security controls, the resulting end data may be impractical or unhelpful to the intended data recipient.
Companies engaging in prohibited data transactions must cease those practices.
Penalties for Violating the DSP
US persons and entities in violation of the DSP may find themselves subject to both civil and criminal penalties, with penalties for wilful violations of up to US $1 million (subject to inflation adjustment) and 20 years in prison. The severity of the penalties is a clear message that the US government is serious about protecting sensitive data, and companies must take proactive and comprehensive measures to ensure compliance.
The Big Picture on Handling Sensitive Data
While the United States is implementing these new restrictions, numerous other countries have already established their own regulations governing cross-border data transfers and the interplay of data protection and national security. For instance, the European Union’s General Data Protection Regulation (GDPR), which came into effect in 2018, includes stringent rules on transferring personal data outside the European Economic Area (EEA), requiring specific safeguards or adequacy decisions for companies intent on transferring European personal data outside the EEA. Similarly, countries like China and Russia have implemented data localisation laws, mandating that certain types of personal data must be stored and processed within their national borders.
These examples highlight a global trend towards greater scrutiny and control over the international movement of personal information. Alongside the DSP, they underscore the delicate balance every government is attempting to strike between fostering international commerce and safeguarding its national security interests.
For US businesses or foreign businesses with a US presence, the DSP signals a more protectionist stance on data, potentially influencing future international data transfer agreements and raising questions about reciprocity from the targeted countries. It necessitates a fundamental reassessment of international data handling practices, impacting everything from vendor relationships and employment agreements to investment strategies, research collaborations, and the location of operations.
The restrictions and the accompanying cybersecurity and compliance obligations will likely lead to increased operational complexities and costs for businesses with ties to these nations.
Client alert, US Policy
New executive order shifts US AI policy toward national security

Healthcare Regulatory Check-Up Newsletter | May 2025 Recap
REPORT
June 2025
Read time: 6 min
This issue of McDermott’s Healthcare Regulatory Check-Up highlights regulatory activity for May 2025, including the rollout of a new Centers for Medicare & Medicaid Services (CMS) strategy to expand and enhance Medicare Advantage (MA) audits. We discuss several enforcement actions focusing on allegations under the Anti-Kickback Statute (AKS), the Stark Law, the False Claims Act (FCA), and other fraud and abuse laws, including allegations related to the submission of fraudulent claims to Medicare for reimbursement of over-the-counter COVID-19 test kits and billing federal healthcare programs for medically unnecessary services. This issue also discusses developments related to the One Big Beautiful Bill Act, the Make America Healthy Again Commission, and a jointly issued request for information on how to improve prescription drug price transparency.
Click each heading below for a sneak peek of related content.
Notable Enforcement Resolutions and Activities
PHARMA COMPANY SETTLES ANTITRUST CLASS ACTION FOR $50 MILLION
A pharmaceutical company agreed to pay $50 million to settle a class action lawsuit accusing the company of scheming with another drug manufacturer to delay the release of a generic version of a narcolepsy drug, causing health plans to pay higher prices, in violation of US antitrust law.
$3.6 MILLION SETTLEMENT RESOLVES FENTANYL FALSE CLAIMS ALLEGATIONS
A pharmaceutical company agreed to pay $3.6 million to resolve claims that it violated the FCA by causing the submission of false claims for a transmucosal immediate-release fentanyl (TIRF) drug for individuals who did not have breakthrough cancer pain.
TWO CHARGED IN $227 MILLION MEDICARE FRAUD SCHEME RELATED TO COVID-19 TEST KITS
An Illinois man and a foreign national were arrested on criminal charges related to their alleged submission of more than $227 million in fraudulent claims to Medicare.
HEALTH SYSTEM RESOLVES ALLEGATIONS OF STARK LAW VIOLATIONS FOR MORE THAN $3 MILLION
A health system agreed to pay $3.29 million to resolve allegations that it knowingly submitted or caused to be submitted false claims to Medicare that were the result of Stark Law violations.
THIRD CIRCUIT REJECTS CHALLENGE TO DRUG PRICE NEGOTIATION PROGRAM
On May 8, 2025, the US Court of Appeals for the Third Circuit ruled against a pharmaceutical company’s challenge to the Drug Price Negotiation Program.
JUDGE DISMISSES SUIT ON GROUNDS THAT FCA QUI TAM PROVISIONS ARE UNCONSTITUTIONAL
On May 29, 2025, Judge Kathryn Kimball Mizelle of the District Court for the Middle District of Florida dismissed an un-intervened FCA qui tam lawsuit against a construction company and an insurance company, holding that the FCA’s qui tam provisions are unconstitutional because they violate the Appointments Clause under Article II of the US Constitution.
MAGISTRATE JUDGE HOLDS THAT FCA QUI TAM PROVISIONS ARE CONSTITUTIONAL
A magistrate judge in the District Court for the Western District of New York rejected an FCA defendant’s challenge to the FCA’s whistleblower provisions as unconstitutional.
COURT ALLOWS FCA QUI TAM SUIT AGAINST EMERGENCY MEDICAL SERVICES CONTRACTOR TO PROCEED
The District Court for the Northern District of California denied an FCA defendant’s motion to dismiss for failure to state a claim and rejected its argument that the FCA’s qui tam provisions are unconstitutional.
CMS Regulatory Updates
CMS ROLLS OUT AGGRESSIVE STRATEGY TO ENHANCE, ACCELERATE MA AUDITS
On May 21, 2025, CMS announced that it will expand its auditing of MA plans by auditing all eligible MA contracts for each payment year and by investing additional resources to expedite the completion of audits for payment years 2018 through 2024.
CMS RELEASES DRAFT GUIDANCE FOR THIRD CYCLE OF MEDICARE DRUG PRICE NEGOTIATION
On May 12, 2025, CMS released draft guidance for public comment regarding the third cycle of negotiations under the Medicare Drug Price Negotiation Program.
Other Notable Developments
HHS SUED OVER REMOVAL OF HEALTH DATA
Nine organizations representing physicians, nurses, medical researchers, hospitals, and public health practitioners sued HHS, alleging that it violated the APA by illegally purging websites containing critical public health information related to transgender individuals, HIV care, vaccines, and prevention of communicable disease outbreaks.
BILLING DISPUTE CONSULTING COMPANY SUED OVER ALLEGED NO SURPRISES ACT VIOLATIONS
An insurance company sued a billing dispute consulting company and two hospital-based providers, alleging that they conspired to exploit the No Surprises Act (NSA) when they won higher reimbursements through the act’s independent dispute resolution system.
HHS, LABOR, AND TREASURY AIM TO BOOST HEALTHCARE PRICE TRANSPARENCY
On May 22, 2025, HHS and the US Departments of Labor and the Treasury (collectively, the departments) issued a joint request for information on how to improve prescription drug price transparency, specifically prescription drug price disclosure requirements, including information on existing prescription drug file data elements and information on implementation generally.
MAHA COMMISSION ISSUES MAKE OUR CHILDREN HEALTHY AGAIN REPORT
On May 22, 2025, the Make America Healthy Again (MAHA) Commission released its Make Our Children Healthy Again Assessment (also referred to as the MAHA report) as directed by EO 14212, released on February 13, 2025.
HHS ISSUES PROPOSED FY2026 BUDGET
On May 2, 2025, the Trump administration, through the Office of Management and Budget (OMB), released its proposed fiscal year (FY) 2026 discretionary budget request, which seeks to cut $163 billion in nondefense discretionary funding across the federal government, including cuts to programs administered by HHS.
ONE BIG BEAUTIFUL BILL ACT PROCEEDS TO SENATE
On May 22, 2025, the US House of Representatives passed the One Big Beautiful Bill Act, which now is under US Senate review. The act seeks to cut billions of dollars in Medicaid spending by, for example, introducing new work requirements for otherwise eligible Medicaid recipients, requiring states to impose mandatory cost-sharing for certain services provided to individuals enrolled through the Medicaid expansion with incomes above the federal poverty line (and allowing providers to deny services to any individual who cannot pay the required co-payment), and blocking implementation of rules finalized by CMS in September 2023 and April 2024 intended to improve Medicaid and Children’s Health Insurance Program eligibility and enrollment systems.
NO SURPRISES ACT UPDATE: CMS PUBLISHES IDR PUBLIC USE FILES, SUPPLEMENTAL TABLES FOR Q3, Q4 2024
On May 28, 2025, the departments released NSA independent dispute resolution (IDR) public use files (PUFs) and federal IDR supplemental tables for the third and fourth quarters of 2024.

Credit Conditions: The latest private credit and debt market trends | Q2 2025
REPORT
June 2025
Read time: 2 min
Welcome to this edition of Credit Conditions, a quarterly publication that analyzes recent debt market trends.
The second quarter of 2025 saw tariff turbulence and an on-hold Federal Reserve reshape risk pricing and capital deployment in both the M&A and credit markets. Dealmakers faced a volatile landscape, with some M&A processes stalling while others sped up to outrun uncertainty. Credit markets responded unevenly as well, with the broadly syndicated loan (BSL) market freezing and then thawing while private credit continued to fund but at widening credit spreads. Access the full newsletter below.
On June 18, we hosted a webinar that broke down the current financing market conditions, following the release of our quarterly editorial. Watch the “Credit Conditions Webinar: Key Debt Market Trends” recording to learn more.
For more, access our Credit Conditions resource page.

Healthcare Regulatory Check-Up Newsletter | April 2025 Recap
REPORT
May 2025
Read time: 5 min
This issue of McDermott’s Healthcare Regulatory Check-Up highlights regulatory activity for April 2025, including Centers for Medicare & Medicaid Services (CMS) updates to Medicare Advantage (MA) and other Medicare programs. This month features a landmark US Court of Appeals for the Seventh Circuit decision reversing a conviction in a marketing case under the Anti-Kickback Statute (AKS). We also discuss several enforcement actions focusing on allegations under the AKS, the False Claims Act (FCA), and other fraud and abuse laws, including familiar themes such as kickbacks related to durable medical equipment (DME) prescribing via telemedicine and billing federal healthcare programs for medically unnecessary services. This issue also examines a favorable advisory opinion issued by the Office of Inspector General (OIG) regarding a community health center’s proposed arrangement to connect members of its community with primary care services. Finally, we discuss a new bill that proposes to repeal certain elements of the Affordable Care Act (ACA) that prohibit the expansion and creation of new physician-owned hospitals.
Click each heading below for a sneak peek of related content.
Notable Cases, Settlements, and Related Agency Activity
Seventh Circuit Reverses DME Distributor Conviction in AKS Marketing Case
On April 14, 2025, the US Court of Appeals for the Seventh Circuit in United States v. Sorensen reversed the conviction of Mark Sorensen, owner of a Medicare-registered distributor of DME, in an opinion that redefines the boundaries of permissible marketing practices under the AKS.
Medical Practice, Physician Owner Agree to Pay $152,000+ to Resolve Telehealth Billing FCA Allegations
A West Virginia-based medical practice and its physician owner agreed to pay the United States more than $152,000 to resolve civil allegations that they violated the FCA by submitting false claims to the Medicare and Medicaid programs and falsely certifying compliance with program requirements related in part to the practice’s telehealth billing patterns.
Rehabilitation Facility Will Pay $19.75M to Resolve FCA Allegations Related to Unlicensed Care
A New Jersey drug and alcohol rehabilitation facility agreed to pay nearly $20 million to resolve allegations that it violated the FCA by allegedly submitting claims to the Community Care Program of Veterans Health Administration and New Jersey’s Medicaid program for short-term residential treatment and partial hospitalization care.
Florida Man Pleads Guilty to Medicare Fraud Scheme Involving $8.4+M in COVID-19 Test Kit False Claims
A Florida man pleaded guilty to causing more than $8.4 million in false and fraudulent claims to be submitted to Medicare using Medicare identification numbers that the man had unlawfully purchased.
Sales Director Pleads Guilty in Transcranial Doppler Kickback Scheme
A New York-based national sales director pleaded guilty to conspiring to offer and pay kickbacks to doctors in exchange for ordering medically unnecessary brain scans.
Marketing Company Operators Sentenced for Roles in Telemedicine DME Kickback Scheme
Two operators of a New Jersey marketing company were sentenced to 51 months and 80 months in prison, respectively, and ordered to pay more than $127 million in restitution for their roles in a fraud and kickback scheme.
CMS Regulatory Updates
CMS Releases Final Rule Regarding Contract Year 2026 Policy and Technical Changes to the MA Program, Medicare Prescription Drug Benefit Program, Medicare Cost Plan Program, PACE
On April 15, 2025, CMS issued a final rule revising the MA, Medicare Prescription Drug Benefit (Part D), Medicare cost plan, and Programs of All-Inclusive Care for the Elderly (PACE) regulations.
CMS Announces CY 2026 MA Capitation Rates, Part C and Part D Payment Policies
On April 7, 2025, CMS released its Announcement of Calendar Year (CY) 2026 MA Capitation Rates and Part C and Part D Payment Policies.
Office of Inspector General Updates
OIG Issues Favorable Advisory Opinion on Community Health Center’s Primary Care Proposal
OIG issued a favorable advisory opinion regarding a community health center’s proposal to connect individuals in the community with primary care services.
Other Notable Developments
Texas District Court Strikes Down CMS Nursing Home Staffing Rule
On April 7, 2025, the US District Court for the Northern District of Texas struck down a CMS rule mandating certain staffing requirements for nursing homes participating in Medicare and Medicaid.
Senate Republicans Introduce Physician Led and Rural Access to Quality Care Act
On April 9, 2025, Senator James Lankford (R-OK) and eight other Republican senators introduced S. 1390 to enact the Physician Led and Rural Access to Quality Care Act, which would repeal certain elements of the ACA’s prohibition on the expansion and creation of new physician-owned hospitals.

Antitrust M&A Snapshot | Q1 2025
REPORT
May 2, 2025
Read time: 2 min
McDermott’s global competition practice can assist clients with antitrust M&A issues in various jurisdictions around the world. Feel free to contact one or more of our partners in our various offices. The individuals below can assist or can refer you to one of our many other lawyers in our competition team who can help with a specific question.
United States: Jon Dubrow, Joel Grosberg, Ray Jacobsen, Stephen Wu, Ryan Tisch, Lisa Rumin, and Elai Katz
Europe: Jacques Buhart, Christian Krohs, Hendrik Viaene, Frédéric Pradelles, Stéphane Dionnet, and Axel Schulz

Healthcare Regulatory Check-Up Newsletter | March 2025 Recap
REPORT
April 2025
Read time: 5 min
This issue of McDermott’s Healthcare Regulatory Check-Up highlights key regulatory and enforcement activity for March 2025. This month features:
- Noteworthy enforcement actions demonstrating that the Anti-Kickback Statute (AKS) remains a significant source of compliance risk.
- A proposed rule from the Centers for Medicare & Medicaid Services (CMS) that would materially modify various components of the Affordable Care Act (ACA) implementing regulations.
- A revised statement of organization from the Office of Inspector General (OIG) signaling potential changes in how the OIG Office of General Counsel engages in AKS and other enforcement and policymaking in the future.
Click each heading below for a sneak peek of related content.
Notable Cases, Settlements, and Related Agency Activity
Jury Finds No Liability in “Usual and Customary” Pricing Case That Set SCOTS Scienter Standard
Fourteen years after the False Claims Act (FCA) case against Supervalu, Inc., was filed in the US District Court for the Central District of Illinois, a jury found that the plaintiffs had not proved damages to either the federal or state government caused by Supervalu’s pharmaceutical pricing system.
Clinical Research Facility Owners Plead Guilty to Conspiracy to Commit Wire Fraud
Two owners of a clinical research company in Florida that conducted clinical trials of prospective new drug treatments on behalf of drug sponsors seeking approval from the US Food and Drug Administration (FDA) pleaded guilty to conspiracy to commit wire fraud.
Providers, Lab Marketers Agree to Pay More Than $1.9 Million to Settle AKS Allegations
Four medical practices and a marketing company agreed to pay more than $1.9 million to resolve alleged violations of the federal FCA and AKS.
Medical Device Company Will Pay Up to $14.25 Million to Resolve Alleged FCA, State Law Violations Related to Vision Testing
A medical device company based in Pennsylvania agreed to pay up to $14.25 million to resolve allegations that it violated the federal FCA and various state laws by allegedly knowingly submitting, or causing others to submit, false claims for payment to Medicare and Medicaid in connection with certain vision testing services.
DC District Court Rejects Pharmaceutical Company’s Attempt to Limit AKS Scope
A pharmaceutical company lost at summary judgment in its challenge to an OIG advisory opinion in the US District Court for the District of Columbia.
CMS Regulatory Updates
CMS Publishes Marketplace Integrity and Affordability Proposed Rule
On March 10, 2025, CMS released its first proposed rule under the Trump administration, the Marketplace Integrity and Affordability Proposed Rule.
CMS Announces Second Round of Medicare Drug Price Negotiation Program
Beginning March 1, 2025, CMS will begin the second round of the Medicare Drug Price Negotiation Program, which gives Medicare the ability to directly negotiate the prices of certain drugs with manufacturers.
OIG Updates
OIG Issues FY 2024 Medicaid Fraud Control Unit Report
The annual report highlights OIG recovery actions in 2024. Highlights include 1,151 convictions for patient abuse and neglect and fraud; 1,042 individuals or entities excluded from federally funded programs; 493 civil settlements or judgments; and $1.4 billion recovered.
OIG Report: MACs Did Not Consistently Meet Medicare Cost Report Oversight Requirements
On March 18, 2025, CMS published the results of an audit that reviewed individual Medicare Administrative Contractors’ (MACs) compliance with the Medicare cost report oversight requirements for fiscal years 2019 through 2021.
OIG Report: Medicare, Medicaid Payments Are at Risk of Diversion Through Electronic Funds Transfer Fraud Schemes
On March 6, 2025, OIG published a report that found that Medicare and Medicaid payments are at risk of diversion through a scheme in which fraudulent actors pretend to be hospital providers and submit incorrect electronic funds transfer (EFT) information to MACs and state Medicaid programs.
HHS Office of General Counsel Issues Revised Statement of Organization Signaling Expansion of Authority
On March 14, 2025, the US Department of Health and Human Services (HHS) issued a revised statement of organization for the Office of the General Counsel (OGC).
Other Notable Developments
Proposed Massachusetts Laws Would Impact Healthcare Transaction Notice Requirements, PPM Structures
Three proposed laws would impact health transaction notice requirements in Massachusetts. All three of these laws were referred to the Senate and House committees for further consideration on February 27, 2025.
Health Plan Wins Ruling on $2 Billion in Alleged Medicare Overpayments
A health plan claimed a major victory on March 4, 2025, when a court-appointed special master found that DOJ did not have sufficient evidence to support a billion-dollar fraud case against the plan regarding overpayments for patients on Medicare Advantage plans.

Healthcare Regulatory Check-Up Newsletter | February 2025 Recap
REPORT
March 2025
Read time: 7 min
This issue of McDermott’s Healthcare Regulatory Check-Up highlights regulatory activity for February 2025, including long-awaited proposed and final rules regarding the Health Insurance Portability and Accountability Act (HIPAA) and controlled-substance prescribing via telemedicine. Active False Claims Act (FCA) cases include two hospitals defending against criminal and civil charges related to their alleged complicity in medically unnecessary surgeries. Settlements from this month include allegations related to the Anti-Kickback Statute (AKS), such as a dental pay-per-referral marketing arrangement, and allegations concerning fraudulent durable medical equipment (DME) prescribing via telemedicine. The Office of Inspector General (OIG) issued a favorable advisory opinion on a pharmaceutical manufacturer’s program to provide free infusion drugs to patients with financial need, and the new Trump administration issued a flurry of executive orders and regulatory freezes.
Click each heading below for a sneak peek of related content.
Notable Cases and Settlements
Health System Agrees to $29 Million Settlement Related to Military Care Overpayments
On February 18, 2025, a healthcare system and the US Department of Justice agreed to a $29 million settlement to resolve allegations that the system retained erroneous overpayments for medical services provided to retired military members by a healthcare plan participating in the US Family Health Plan.
DME Executive Pleads Guilty in Conspiracy Scheme Related to $1 Billion in False Charges
On February 20, 2025, a vice president of a DME company pleaded guilty to operating an internet-based platform that generated false doctors’ orders for orthotic braces, pain cream, and other DME supplies.
SNF Fraudulent Billing Suit Alleges Upcoding Complexity of Services Rendered
On February 19, 2025, the US Attorney’s Office filed a complaint with the Massachusetts Attorney General’s Office under the federal and Massachusetts FCA against 19 skilled nursing facilities (SNFs) in Massachusetts and Connecticut and their present and former managers.
OIG Regulatory Updates
OIG Modifies Advisory Opinion 21-13m
OIG issued a modification to Advisory Opinion No. 21-13 regarding a proposal to subsidize Medicare cost-sharing obligations for a clinical study involving positron emission tomography (PET) scans of patients with mild cognitive impairment or dementia for the presence of beta amyloid plaque – a core feature of patients diagnosed with Alzheimer’s disease.
Proposed State Bills
California SB 351 Proposes Changes to Corporate Practice Prohibitions
The California legislature introduced Senate Bill (SB) 351, which targets private equity groups and hedge funds managing physician or dental practices in California. This bill follows Assembly Bill (AB) 3129, passed in 2024 and vetoed by Governor Gavin Newsom.
Illinois SB 1998 Would Add Notification Requirements to Certain Healthcare Transactions
The Illinois state legislature introduced SB 1998, aiming to amend the Illinois Antitrust Act by adding a layer of scrutiny to covered transactions that are financed by private equity groups or hedge funds.
Healthcare Transaction Notification Proposed as Part of Wisconsin Appropriations Bill
The Wisconsin state legislature introduced AB 50, a comprehensive 2,000-page budget bill for Wisconsin’s 2025 – 2027 fiscal term. Among myriad other appropriations proposals, the bill would establish procedures for review, oversight, and transparency when healthcare entities propose to undergo material change transactions.
Other Notable Developments
Litigation Over Executive Orders 14168 and 14187
In January 2025, US President Donald Trump signed executive orders (EOs) directing federal agencies to define “sex” as an immutable binary biological classification and remove recognition of the concept of gender identity (EO 14168) and targeting the provision of gender-affirming care to minors (EO 14187).
EO 14192: Unleashing Prosperity Through Deregulation
EO 14192 was signed by President Trump on January 31, 2025, and published in the Federal Register on February 6, 2025. This EO establishes an executive branch policy to be prudent and financially responsible in the expenditure of public and private funds and to alleviate unnecessary regulatory burdens.
EO 14212: Establishing the President’s Make America Healthy Again Commission
EO 14212 was signed by President Trump on February 13, 2025, and published in the Federal Register on February 13, 2025. This order establishes as federal policy an obligation to combat chronic disease challenges facing US citizens, including mental health disorders, obesity, and diabetes.
EO 14214: Keeping Education Accessible and Ending COVID-19 Vaccine Mandates in Schools
EO 14214 was signed by President Trump on February 14, 2025, and published in the Federal Register on February 20, 2025. This order states that discretionary federal funds should not be used to directly or indirectly support or subsidize educational institutions that require students to have received a COVID-19 vaccine in order to attend in-person programs.
EO 14221: Making America Healthy Again by Empowering Patients With Clear, Accurate, and Actionable Healthcare Pricing Information
EO 14221 was signed by President Trump on February 25, 2025, and published in the Federal Register on February 28, 2025. This order establishes a US policy to put patients first and ensure that they have the information necessary to make well-informed healthcare decisions.
Policy Statement From HHS Regarding Richardson Waiver
In 1971, the US Department of Health, Education and Welfare (now HHS) issued a notice stating that any rulemaking issued by the agency would go through the notice-and-comment process. On February 28, 2025, HHS issued a policy statement that rescinded this long-standing agency policy.
District Court Enjoins NIH 15% Indirect Cost Rate
On February 7, 2025, the National Institutes of Health (NIH) circulated an official notice (NOT-OD-25-068) titled Supplemental Guidance to the 2024 NIH Grants Policy Statement: Indirect Cost Rates.

Credit Conditions | Q4 2024
REPORT
February 2025
Read time: 2 min
Welcome to this edition of Credit Conditions, a quarterly publication from McDermott Will & Emery that analyzes recent debt market trends.
The fourth quarter of 2024 marked a pivotal moment in the debt market, as the Federal Reserve’s strategic two quarter-point rate cuts brought the year-end top line rate to 4.50%, setting the stage for a dynamic financial landscape. This coupled with a strong rebound in the private equity M&A sector, where exits surged by nearly 50% in count and 16% in value year over year, totaling $413.2 billion across 1,501 deals, sets the stage for continued growth in 2025. Access the full newsletter below.
On March 18, 2025, we hosted a webinar on hybrid capital, following the release of our quarterly editorial. Watch the “Credit Conditions: Hybrid Capital” webinar recording to learn more.
For more, access our Credit Conditions resource page.

Healthcare Regulatory Check-Up Newsletter | January 2025 Recap
REPORT
February 2025
Read time: 9 min
This issue of McDermott’s Healthcare Regulatory Check-Up highlights regulatory activity for January 2025. This month features long-awaited proposed and final rules regarding the Health Insurance Portability and Accountability Act (HIPAA) and controlled-substance prescribing via telemedicine. Active False Claims Act (FCA) cases include two hospitals defending against criminal and civil charges related to their alleged complicity in medically unnecessary surgeries. Settlements from this month include familiar themes such as lavish physician speaker programs, a dental pay-per-referral marketing arrangement, and fraudulent durable medical equipment (DME) prescribing via telemedicine. The Office of Inspector General (OIG) issued a favorable advisory opinion on a pharmaceutical manufacturer’s program to provide free infusion drugs to patients with financial need. Finally, the change of presidential administration has resulted in a flurry of executive actions and regulatory freezes.
Click each heading below for a sneak peek of related content.
Notable Cases, Enforcement Resolutions, and Related Activity
Fourth Circuit Upholds District Court Ruling Against PCPA, Adopts Broad Interpretations of Key AKS Terms
On January 23, 2025, the US Court of Appeals for the Fourth Circuit ruled against Pharmaceutical Coalition for Patient Access’s (PCPA) challenge to an unfavorable OIG advisory opinion concerning a charitable patient assistance program.
Pharmaceutical Company Agrees to Pay $59.7 Million to Resolve AKS, FCA Allegations Related to Migraine Drug
A pharmaceutical company has agreed to pay $59.7 million to resolve allegations that its subsidiary violated the Anti-Kickback Statute (AKS) by providing kickbacks to healthcare providers to induce prescriptions of its migraine drug, resulting in false claims to Medicare.
Hospice Providers Challenge CMS’s Special Focus Program Methodology in Federal Court
A coalition of hospice providers filed suit in Texas federal court challenging the Biden administration’s Hospice Special Focus Program, which identifies and publicly lists facilities failing to meet Medicare requirements.
Health System to Pay $135 Million to Resolve Additional FCA Claims in Whistleblower Suit
A health system has agreed to pay $135 million to resolve remaining FCA allegations brought by its former chief financial officer (CFO) and chief operating officer in a qui tam action.
Medical Center Indicted for Healthcare Fraud Related to Unnecessary Surgical Procedures
A federal grand jury has indicted a medical center on criminal charges of healthcare fraud and conspiracy to defraud the United States for allegedly enabling and profiting from unnecessary surgeries performed by a surgeon.
CMS Will Not Pursue an Appeal in Medicare Advantage Ratings Case
CMS abandoned plans to appeal a health plan’s Medicare Advantage star ratings win.
The Supreme Court Will Hear Arguments Regarding the Constitutionality of the US Preventative Services Task Force
The Supreme Court of the United States will hear arguments in Braidwood v. Becerra, a case that could significantly impact health insurance coverage of preventive care.
Health Plan Settles FCA Allegations Involving the AKS
On January 17, 2025, a health plan reached a settlement resolving FCA allegations against a health maintenance organization (HMO) that the health plan acquired in 2022.
Laboratory Granted Summary Judgment on Independent Contractor Marketing Allegations
A laboratory that uses the services of independent contractor marketing agents successfully defended against allegations that its commission-based compensation structure violated the AKS and FCA.
Connecticut Dentist and Practices Pay $608,296 to Resolve FCA, AKS Allegations Involving Patient Referral Kickbacks
A Connecticut dentist and her former dental practices have agreed to pay $608,296 to resolve allegations that they violated the federal and state FCA and AKS.
Iowa Healthcare Practitioners Pay $164,326 to Resolve DME Telemedicine Scheme Allegations
Two Iowa healthcare practitioners have agreed to pay a combined $164,326 to resolve FCA allegations involving fraudulent Medicare billing through a telemedicine scheme.
CMS Regulatory Updates
CMS Adds New Product Category for Respiratory Devices to DMEPOS Enrollment Form
As of January 27, 2025, CMS has announced that it will now permit suppliers of durable medical equipment, prosthetics, orthotics, and supplies (DMEPOS) to bill Medicare for supplying multifunction respiratory devices (excluding ventilators).
New Payment Bundle for Advanced Primary Care Management Services Available January 1, 2025
Starting January 1, 2025, primary care providers enrolled in Medicare may utilize a new payment bundle for advanced primary care management (ACPM) services.
Physician Nonmonetary Compensation Limits Updated for 2025
CMS made its annual inflation-adjusted updates to financial limits on physician nonmonetary compensation, medical staff incidental benefits, and the “limited remuneration” definition.
Office of Inspector General Updates
OIG Issues Favorable Advisory Opinion Regarding Manufacturer’s Free Medication Program
OIG issued a favorable advisory opinion regarding a pharmaceutical manufacturer’s program to provide free access to an infusion drug for patients with demonstrated financial needs. The drug in question targets dementia and cognitive impairment.
Other Notable Developments
New Massachusetts Law Impacts Healthcare Private Equity Investors
Healthcare private equity investors will now encounter increased oversight under a new Massachusetts law. The law expands the definition of “material change” to encompass additional transactions that require pre-closing notice to the Massachusetts Health Policy Commission.
HHS Chooses 15 Drugs for Medicare Drug Price Negotiations
On January 17, 2025, HHS announced price negotiations for 15 drugs that are covered under Medicare Part D. The drugs treat a wide range of conditions ranging from cancer to diabetes to asthma.
OCR Proposes Extensive Changes to HIPAA Security Rule
The HHS Office for Civil Rights (OCR) published a proposed rule on January 6, 2025, proposing extensive changes to the HIPAA Security Rule.
DEA, HHS Release Final Rules Expanding Controlled Substance Prescribing via Telemedicine
On January 17, 2025, the Drug Enforcement Administration (DEA) and HHS issued a final rule that allows practitioners to prescribe schedule III-V controlled substances for the treatment of opioid use disorder, including buprenorphine, via telemedicine (including audio-only encounters).
DEA Announces Long-Awaited Proposed Rule on Telehealth Special Registrations
DEA published a proposed rule on January 17, 2025, that would establish three special registrations that create a pathway for certain healthcare professionals to prescribe certain controlled substances via telemedicine once current telehealth flexibilities expire on December 31, 2025.
Trump Administration Halts Publishing of Regulations and Postpones Effective Dates
On January 20, 2025, US President Donald Trump issued an executive memorandum implementing a regulatory freeze.
Trump Administration Issues a Flurry of Executive Orders Impacting Healthcare
President Trump has released several executive orders impacting healthcare. These include orders withdrawing the US from the World Health Organization (EO 14155), directing federal agencies to define “sex” as a binary immutable biological classification and remove recognition of the concept of gender identity (EO 14168), and targeting the provision of gender-affirming care for minors (EO 14187), among others.
Disclaimer
Do not send any information or documents that you want to have treated as secret or confidential. Providing information to McDermott Will & Schulte via email links on this website or other introductory email communications will not create an attorney-client relationship; will not preclude McDermott Will & Schulte from representing any other person or firm in any matter; and will not obligate McDermott Will & Schulte to keep confidential the information you provide. McDermott Will & Schulte cannot enter into an attorney-client relationship with you until McDermott Will & Schulte has determined that doing so will not create a conflict of interest and until you and McDermott Will & Schulte have entered into a written agreement or engagement letter that sets forth the terms of our relationship.
