Virtual and Digital Health Digest
This digest covers key virtual and digital health regulatory and public policy developments during August and early September 2025 from the United States, United Kingdom, and European Union.
In this issue, you will find the following:
U.S. News
- Health Care Fraud and Abuse Updates
- Corporate Transactions Updates
- Provider Reimbursement Updates
- Privacy and AI Updates
- Policy Updates
U.S. Featured Content
On September 26, 2025, the White House Office of Science and Technology Policy issued a Request for Information seeking public input on federal laws and processes that may unnecessarily hinder artificial intelligence (AI) development and adoption in the U.S. The Request for Information outlines five categories of barriers: regulatory mismatches, structural incompatibility, lack of clarity, direct regulatory hindrance, and organizational limitations. Comments are due by October 27, 2025.
EU and UK News
EU/UK Featured Content
This month, the EU and UK have been actively processing the future of AI development and regulation in life sciences and health care through a combination of legislative initiatives, opportunities for stakeholder engagement, and investment in infrastructure. In the EU, the European Commission has published draft guidance on reporting serious AI incidents under the AI Act, and the European Medicines Agency has initiated a stakeholder survey to define AI priorities in medicines regulation. In the UK, the UK government has announced a National Commission on the Regulation of AI in Healthcare and a new AIR-SP cloud platform. These developments signal a shift from theoretical regulation to practical implementation. There have also been two important decisions from the Court of Justice of the European Union refining the legal boundaries of digital health services and data protection.
U.S. News
Health Care Fraud and Abuse Updates
Florida Marketer Sentenced for Genetic Testing Fraud and Kickback Scheme. On September 19, 2025, Robert Deselle, a Florida-based marketer, was sentenced for his participation in a genetic testing fraud and kickback scheme. Between June 2018 and December 2020, Deselle and his co-conspirators allegedly persuaded Medicare beneficiaries to take unnecessary genetic tests. Deselle then allegedly bribed telemedicine companies to supply orders for these tests, allowing clinical laboratories to bill Medicare for these tests. In return, the clinical laboratories paid kickbacks to Deselle and his co-conspirators in exchange for referrals. The scheme resulted in $11.5 million billed to Medicare, with Deselle personally earning $2.1 million.
Florida Durable Medical Equipment Suppliers Indicted for Medicare Fraud Scheme. On September 10, 2025, Kenneth Charles Kessler III and Michael Andrew Gomez were indicted in connection with their ownership of multiple durable medical equipment (DME) supply companies in Florida. Kessler and Gomez were both charged with conspiracy to commit health care and wire fraud, two counts of health care fraud, conspiracy to defraud the United States and to offer and pay health care kickbacks, and two counts of offering and paying kickbacks in connection with a federal health care program.
According to the indictment, Kessler and Gomez allegedly used deceptive and aggressive telemarketing campaigns to target Medicare beneficiaries. The charging documents allege that the pair obtained beneficiary information from telemedicine companies to generate doctors’ orders for unnecessary DME, such as orthotic braces and continuous glucose monitors. The scheme resulted in $34.8 million in claims submitted to Medicare.
Corporate Transactions Updates
DUOS Secures $130 Million To Expand AI-Powered Digital Health Platform and Set New Benchmark for Elder Care. On October 9, 2025, DUOS, a Minneapolis-based digital health company helping seniors live independently, raised $130 million in growth equity. The round was led by FTV Capital with participation from Forerunner Ventures. The funding will be used to scale DUOS’ AI-powered platform across Medicare Advantage, Medicaid, and Affordable Care Act marketplace plans, while improving interoperability with electronic health records.
DUOS’ platform uses artificial intelligence to simplify health care navigation for seniors, connecting them to underutilized benefits, government programs, and community resources. Its latest AI upgrade, Chat 2.0, leverages Retrieval Augmented Generation to deliver personalized, multilingual, Centers for Medicare & Medicaid Services-compliant responses and enables direct appointment booking. This raises DUOS’ total funding to over $160 million.
Strive Health Leverages AI-Driven Kidney Care Model To Land $550 Million Capital Raise at $1.8 Billion Valuation. On September 9, 2025, Strive Health, an AI-powered Denver-based national leader in value-based kidney care, closed its $550 million Series D round comprising $300 million in equity and $250 million in debt. Strive Health’s equity round was led by New Enterprise Associates, with participation from major investors CVS Health Ventures, CapitalG, Echo Health Ventures, Town Hall Ventures, Redpoint, and funds managed by affiliates of BlackRock. Hercules Capital led the debt financing.
Strive Health’s nephrologist-led platform allows its patients to receive kidney care via telehealth visits and home visits, which 90% of Strive Health’s patients elect to receive. The company also leverages machine learning models to provide clinicians with actionable insights to help create individualized care plans that improve patient outcomes. Strive Health plans to use the new funding to continue to build out its AI-driven tools and analytics to support the whole patient journey from chronic kidney disease to end-stage kidney disease.
Provider Reimbursement Updates
As we covered in our March 2025 Digest, Congress previously extended Medicare fee-for-service telehealth flexibilities through September 30, 2025. Those flexibilities expired on October 1, 2025 when the federal government shut down, meaning statutory limitations on telehealth services (that are not behavioral health services) once again took effect. Without telehealth flexibilities in place, many telehealth services provided to beneficiaries in their homes and outside of rural areas are not currently payable under Medicare.
Centers for Medicare & Medicaid Services (CMS) initially instructed Medicare Administrative Contractors (MACs) to hold claims for telehealth services for up to 10 business days, which the agency stated would prevent the need for reprocessing large volumes of claims in the event Congress reinstated telehealth flexibilities in the interim.
On October 15, 2025, after the end of the 10 business day hold, CMS issued new guidance, reportedly instructing MACs to hold all Medicare physician fee schedule claims. Later that day, CMS reversed, clarifying that the hold would only apply to telehealth services and other extenders that expired October 1, 2025. CMS also advised practitioners who continue to offer telehealth services not payable under Medicare to consider providing beneficiaries with an Advance Beneficiary Notice of Noncoverage.
If Congress reinstates Medicare telehealth flexibilities, telehealth claims currently being held by MACs will only be paid if Congress decides to apply the flexibilities retroactively.
Privacy and AI Updates
Senators Introduce the MIND Act To Spur Protection for Neural Data. On September 24, 2025, Senator Chuck Schumer (D-MA) and two other senators introduced a bill aimed at protecting neural data: the “Management of Individuals’ Neural Data Act of 2025” (the MIND Act of 2025). According to the bill’s prefatory statements, the “integration of neurotechnology, artificial intelligence systems, wearable devices, digital platforms, and global data infrastructure” poses risks to individual privacy, corporate accountability, and cognitive manipulation,” that apparently are not adequately addressed by existing law. The bill does not include actual standards for the processing of neural data, but rather requires the Federal Trade Commission (FTC) to examine how use of neural data — defined as “information obtained by measuring the activity of an individual’s central or peripheral nervous system through the use of neurotechnology” — should be regulated to mitigate risks of discrimination, profiling, surveillance, manipulation, and misuse.
The bill defines “neurotechnology” as any device, system, or procedure that interacts with the nervous system to monitor, influence, or restore its function — ranging from wearable devices like headbands and wristbands to implanted brain-computer interfaces. It directs the FTC to study how neural and related data from consumer devices are collected, used, and combined, assess the risks involved, and recommend regulatory actions. In doing so, the FTC must consult with federal agencies, including the Office of Science and Technology Policy and the U.S. Food and Drug Administration, as well as private sector and clinical research stakeholders.
Policy Updates
Reps. John Joyce (R-PA), Beth Van Duyne (R-TX), Scott Peters (D-CA), and Brad Schneider (D-IL) are reportedly planning to introduce a House version of the Health Tech Investment Act (S.1399). The Senate version of the bill is sponsored by Senate Artificial Intelligence Caucus co-chairs Mike Rounds (R-SD) and Martin Heinrich (D-NM), in addition to Marsha Blackburn (R-TN), Chris Coons (D-DE), and Jim Banks (R-IN). The legislation would create a technology ambulatory payment classification in the Medicare Outpatient Prospective Payment System for “algorithm-based healthcare services.”
On September 17, 2025, the Joint Commission and Coalition for Health Artificial Intelligence (CHAI) published initial guidance titled “Responsible Use of AI in Healthcare,” which intends to help U.S. health systems scale up AI tools safely and effectively. The report discusses ways that health organizations’ governance structures, safeguard procedures, and internal staff trainings must adapt to ensure that AI use is safe, transparent, equitable, and trustworthy. The Joint Commission and CHAI plan to publish additional guidance and governance “playbooks” to help inform the rollout of a voluntary “Joint Commission Responsible Use of AI” certification program in the future.
On September 19, 2025, CMS announced it will launch a new AI-powered search tool for Medicare enrollees’ prescription drug benefits before the end of 2025. Drawing from CMS data systems, the new AI tool is designed to offer a tailored alternative to the Medicare Plan Finder. This feature is part of a broader set of CMS initiatives for contract year 2026.
On September 26, 2025, the White House Office of Science Technology and Policy (OSTP) published a Request for Information (RFI) on “Regulatory Reform on Artificial Intelligence.” The RFI seeks input on “federal statutes, regulations, agency rules, guidance, forms, and administrative processes that unnecessarily hinder the development, deployment, and adoption of artificial intelligence (AI) technologies within the United States.” The deadline to provide comments on the RFI is October 27, 2025, and OSTP outlined the following five broad categories of barriers for AI adoption:
- Regulatory mismatches, where AI capabilities do not align with existing regulations
- Structural incompatibility, where legal or operational requirements do not fit for AI systems
- Lack of regulatory clarity, where insufficient guidance and rules that potentially cover AI prevent adoption
- Direct hindrance, where regulations prevent development, deployment, and adoption of AI directly
- Organizational factors, things that impact how existing policy frameworks and administrative tools are and are not used
On September 30, 2025, President Donald Trump issued an Executive Order (EO) titled “Unlocking Cures for Pediatric Cancer with Artificial Intelligence.” The EO aims to employ AI to build upon the Childhood Cancer Data Initiative (CCDI) to combat the increasing rate of pediatric cancer in the U.S. The CCDI, established under President Trump’s first administration in 2019, invests $50 million annually over 10 years to collect, generate, and analyze data on childhood cancer. Among other directives, the EO directs the Make America Healthy Again Commission, the U.S. Department of Health and Human Services, the Assistant to the President for Science and Technology, and the Special Advisor for AI and Crypto to accelerate AI-driven solutions and encourage the private sector to adopt advanced technologies, particularly AI, in the pursuit of cures for pediatric cancer.
EU AND UK NEWS
Regulatory Updates
European Commission Undertakes Public Consultation on AI Act Transparency Obligations. The consultation collected practical examples and sought to clarify the scope and application of the transparency obligations under the AI Act. The obligations, which apply to deployers and providers of AI systems, will come into effect on August 2, 2026. Feedback received will be taken into account in the upcoming European Commission guidelines and Code of Practice, which will provide practical examples within the scope of the transparency obligations, recommended disclosure practices, and further conceptual clarifications.
Global Harmonization Working Party (GHWP) Launches Call for Comments on Guidance on AI/Machine Learning (ML)-Based Computer-Assisted Detection (CADe) and Computer-Assisted Diagnosis Software as a Medical Device. The call will be open until October 27, 2025 at noon (GMT+8). Once feedback has been obtained, the GHWP, an international platform composed of experts from regulatory authorities and the industry, will finalize the guidance, which will apply broadly, not specifically to the EU. The guidance aims to guide manufacturers on regulatory considerations relating to the registration and pre-market approval of AI/ML-based software, either as stand-alone medical devices or as components integrated into other medical devices across jurisdictions. In particular, the guidance will provide details on the reporting protocols and risk-based strategies for managing modifications, including practical examples.
Court of Justice of the European Union (CJEU) Clarifies Legal Framework for Cross-Border Telemedicine. In Case C-115/24, the CJEU confirmed that telemedicine services are governed by the law of the country where the health care provider is established, rather than that of the country where the patient receives the service (i.e., country-of-origin principle). The CJEU also clarified that only services delivered entirely remotely via information and communication technologies qualify as “telemedicine” under the Directive on patients’ rights in cross-border health care (Directive 2011/24). Mixed models involving both telemedicine and in-person care are excluded from the definition. The CJEU also clarified that the country-of-origin principle extends beyond reimbursement, requiring telemedicine services to comply with applicable legislation and guidelines of the provider’s country of establishment.
MedTech Europe Calls for Urgent Regulatory Reform To Safeguard Innovation and Access to Medical Devices. MedTech Europe and the Association of British HealthTech Industries, along with 34 national associations, have issued an open letter to Commissioner Olivér Várhelyi urging swift action to secure access to medical technologies in Europe, with concerns about shortages having grown since the implementation of the Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR) in the EU. The letter highlights the need for both short-term relief measures and long-term regulatory reform of the Regulations. Key proposals include harmonized rules for notified bodies, a targeted postponement of re-certification requirements, and pilot regulatory pathways for marketing of pediatric, orphan, and breakthrough devices. The industry also calls for increased investment in regulatory governance and resources to ensure Europe remains globally competitive.
Draft Guidance on the Reporting of Serious AI Incidents Under the EU AI Act. The European Commission has published draft guidance and a reporting template to help providers of high-risk AI systems comply with new obligations under Article 73 of the AI Act. Reporting requirements will apply from August 2, 2026, and reports of serious incidents will need to be submitted to national market surveillance authorities no later than 15 days from the date of knowledge of the serious incident (with some limited exceptions). The guidance clarifies the definition of “serious incident,” offers practical examples to help determine whether an incident is serious, and addresses the interplay with other legal frameworks, including the MDR and IVDR. Given that all AI-enabled medical devices are classified as high risk under the AI Act, this guidance will apply to developers of such devices. However, the guidance makes clear that reporting for incidents relating to AI-enabled devices is limited to incidents involving fundamental rights violations only, to avoid duplication with reporting obligations under MDR/IVDR. Stakeholders are invited to submit feedback by November 7, 2025.
Launch of New UK National Commission on the Regulation of AI in Healthcare. The UK government has established a National Commission on the Regulation of AI in Healthcare (AI Commission) to accelerate the safe adoption of AI across the UK’s National Health Service (NHS). The AI Commission will advise the Medicines and Healthcare products Regulatory Agency on developing a new regulatory framework for AI in health care, due in 2026. It brings together experts from tech firms, clinicians, researchers, and patient advocates to address regulatory barriers and enable faster access to AI tools such as remote monitoring systems, diagnostics, and ambient voice technology. The initiative supports the NHS’ ongoing digital transformation and aims to position the UK as a global leader in responsible AI health care innovation. A formal call for evidence is expected shortly to allow stakeholders to share their views with the National Commission.
NHS to Trial AI Screening Tools Via New Cloud Platform. The UK government has announced an initiative to test AI tools to help analyze screening images and pinpoint abnormalities at scale across NHS’ screening services. A new “AIR-SP cloud platform,” an AI research screening platform in development by NHS England, will allow NHS trusts to participate in multisite trials by centralizing access to these “revolutionary AI tools,” to help overcome current barriers caused by fragmented IT systems. This initiative aims to reduce setup time and costs for AI research studies, and ultimately lead to patients receiving faster diagnoses and treatments. It is part of broader efforts to digitize NHS services and improve patient outcomes through innovative technology. The new platform is expected to be rolled out for research in 2027 and will be first used in a trial identifying changes indicative of breast cancer.
Pricing and Reimbursement Updates
NICE Expands HealthTech Evaluations To Accelerate NHS Innovation. The National Institute for Health and Care Excellence (NICE) has announced an expansion of its HealthTech evaluation program, aiming to assess medical devices, diagnostics, and digital tools against the same standards as medicines. Technologies meeting such standards will be recommended for NHS-wide adoption, accompanied by evidence-based guidance on their value and clinical effectiveness. This move is designed to ensure faster and more consistent access to innovations like AI diagnostics and wearable monitors across the NHS. The initiative supports the NHS 10-Year Health Plan and the UK government’s Life Sciences Sector Plan (discussed in our July 2025 BioSlice Blog). NICE has proposed changes to the evaluation methods, with a focus on high-impact technologies and a broader rollout planned in future years, and will now consider feedback received from stakeholders to produce an updated manual for technology appraisals.
Privacy Updates
Court of Justice of the European Union Clarifies Concept of Pseudonymized Data. In Case C 413/23 P, the CJEU held that pseudonymized data does not automatically constitute personal data in all cases and for every data recipient. Whether pseudonymized data qualifies as personal data depends on whether the specific data recipient is effectively prevented from identifying the data subject, assessed in light of the specific circumstances and factual context of the data processing in each individual case. This judgment is significant, as data that is no longer considered personal data falls outside of the scope of the Regulation (EU) 2016/679 (GDPR). For more details on the judgment, read our September 2025 BioSlice Blog.
General Court of the European Union (GCEU) Upholds the EU-U.S. Data Protection Framework (DPF). In Case T 553/23, the GCEU dismissed an action brought by a private citizen against the 2023 European Commission decision, which recognized that the DPF ensures an adequate level of protection for personal data transferred from the EU to the U.S. Under the GDPR, transfers of personal data to a third country (e.g., the U.S.) require protection “essentially equivalent” to that in the EU. The DPF succeeds the EU-U.S. Privacy Shield, invalidated by the CJEU in Schrems II (2020), and the EU-U.S. Safe Harbor Framework, invalidated by the CJEU Schrems I (2015). The GCEU confirmed that achieving an “essentially equivalent” protection does not require identical means to those in the EU. It is possible for the judgment to be appealed to the CJEU. For more details on the judgment, read our September 2025 Advisory.
IP Updates
U.S.-UK Tech Prosperity Deal To Advance Drug Discovery and Generate Employment. The UK and U.S. have signed their first Tech Prosperity Deal, a landmark technology partnership designed to accelerate advances in areas like AI, quantum computing, and nuclear innovation. A major focus is on using AI and quantum methods to revolutionize drug discovery and health care, enabling faster development of new therapies and more precise treatments. The pact includes over £30 billion of private investment from U.S. tech companies to expand the UK’s AI infrastructure. This includes data centers, such as graphic processing units, and supercomputing power alongside new initiatives, such as an AI Growth Zone in the North East of England, expected to create more than 5,000 jobs.
*The following individuals contributed to this Newsletter:
Eugenia Pierson is employed as a senior health policy advisor at Arnold & Porter’s Washington, D.C. office. Eugenia is not admitted to the practice of law.
Mickayla Stogsdill is employed as a senior policy specialist at Arnold & Porter’s Washington, D.C. office. Mickayla is not admitted to the practice of law.
Caroline Oliver is employed as a policy specialist at Arnold & Porter’s Washington, D.C. office. Caroline is not admitted to the practice of law.
Zainab Olowu is employed as a paralegal at Arnold & Porter’s London office. Zainab is not admitted to the practice of law.
© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.
Key Contacts
