Virtual and Digital Health Digest
This digest covers key virtual and digital health regulatory and public policy developments during October and early November 2025 from the United States, United Kingdom, and European Union.
In this issue, you will find the following:
U.S. News
U.S. Featured Content
On November 4, 2025, Senate Health, Education, Labor and Pensions Committee Chairman Bill Cassidy (R-LA) introduced the Health Insurance Privacy Reform Act (S.3097), which would establish privacy protections for health data collected by new technologies such as smartwatches and health apps. The bill directs the Secretary of the U.S. Department of Health and Human Services and the Federal Trade Commission to develop regulations that set equivalent privacy, security, and breach notification standards for health data that is outside of the scope of the Health Insurance Portability and Accountability Act (HIPAA).
EU and UK News
EU/UK Featured Content
October saw significant progress in the artificial intelligence space, with international initiatives, of which the UK and EU play a central role, underscoring a shared global commitment to innovation, patient safety, and regulatory alignment.
In the UK, the Medicines and Healthcare products Regulatory Agency (MHRA) published findings from its AI Airlock pilot phase, which has now advanced to Phase 2, involving seven manufacturers tackling key regulatory challenges for AI medical devices. The MHRA also launched a new AI regulatory approach, seeking input on the proposed AI Growth Lab — a pioneering cross-economy sandbox designed to support responsible innovation.
In the EU, the European Commission introduced two major strategies: Apply AI, aimed at driving industrial adoption of AI technologies, and AI in Science, focused on advancing AI use in research and fostering collaboration. Additional initiatives include a Call for Projects Boosting Digital Health, reinforcing the EU’s commitment to digital transformation.
Together, these efforts highlight the UK and EU’s determination to engage stakeholders, accelerate technological progress, and ensure sustainable growth in critical sectors.
U.S. News
Corporate Transactions Updates
Wearables Attract Major Capital in Digital Health. On October 14, 2025, ŌURA announced it raised over $900 million in funding led by Fidelity Management & Research Company, with participation from ICONIQ, Whale Rock, and Atreides. This round brings ŌURA’s valuation to approximately $11 billion. The company plans to use the capital to accelerate product innovation, expand distribution, and develop new health features for its popular Oura Ring devices. This financing follows ŌURA’s milestone of selling more than 5.5 million Oura Rings since its 2015 debut, with more than half of those sales occurring in the past year.
Beacon Biosignals Raises $86 Million for AI-Driven Brain Health Insights. On November 13, 2025, Boston-based neurotechnology company Beacon Biosignals announced an oversubscribed $86 million Series B round to scale its Waveband headband device, which measures brain electrical activity (EEG) during sleep and wakefulness. Investors included Innoviva, Google Ventures (GV), Nexus NeuroTech Ventures, S32, Catalio Capital Management, and Takeda, with continued support from General Catalyst.
Beacon’s platform, which received U.S. Food and Drug Administration (FDA) clearance in September 2023, combines large-scale, clinically validated EEG data with advanced AI to generate objective biomarkers of brain function through sleep. Data collected from the Waveband headband will help train its AI-powered platform on millions of hours of real-world brain data, ultimately aiming to improve patient diagnosis and treatment.
Provider Reimbursement Updates
Physician Fee Schedule Final Rule. On October 31, 2025, CMS released the calendar year (CY) 2026 Medicare Physician Fee Schedule (PFS) final rule. CMS finalized several proposed updates to payment and coverage policies for telehealth services, remote monitoring services, and digital therapeutics, as we covered in the July 2025 Digest.
Telehealth Services. CMS finalized the following proposals relating to Medicare coverage of telehealth services:
- Beginning for the CY 2026 Telehealth List, CMS will use a simplified process for making additions, deletions, or changes to the Medicare Telehealth Services List, focusing on whether the service is: (1) separately payable under the PFS; (2) subject to the statutory provision governing the Medicare Telehealth Services List; and (3) capable of being furnished using an interactive telecommunications system.
- CMS eliminated the “permanent” and “provisional” designation for telehealth services. All services will be considered permanent, but CMS reserves the right to remove services from the list based on internal review or external feedback.
- For CY 2026, CMS will add the following services to the Telehealth Services List: multiple-family group psychotherapy (CPT code 90849), group behavioral counseling for obesity (CPT code G0473), infectious disease add-on services (CPT code G0545), and auditory osseointegrated sound processor services (CPT codes 92622 and 92623) (see Table A-D2, Final Rule).
- CMS will permanently remove frequency limitations for how often telehealth may be used with regard to subsequent care services in inpatient and nursing facility settings, as well as for critical care consultation services.
Direct Supervision. CMS also finalized its proposal to permanently expand the definition of “direct supervision” to include audio-video real-time communications for all services “incident to” a physician’s professional service described under 42 C.F.R. § 410.26, except for services that have a global surgery indicator of 010 or 090. CMS maintains that this exclusion is meant to ensure the ability of the supervising practitioner to intervene if complications arise during complex, higher-risk procedures.
Virtual Presence. In the proposed rule, CMS proposed rolling back its policy that allows teaching physicians to satisfy supervision requirements through their virtual presence, in clinical instances when the service is furnished virtually (e.g., a three-way telehealth visit). However, in response to public comments highlighting the extent to which this flexibility has been integrated into clinical practice, CMS instead finalized the policy on a permanent basis to allow such virtual presence.
Remote Monitoring. As part of its valuation of codes for CY 2026, CMS finalized new codes for remote physiologic monitoring (RPM) and remote therapeutic monitoring (RTM) services (see Tables A-E11 and A-E12, Final Rule). Among other changes, CMS finalized new codes for certain RPM and RTM services with two to 15 days of data transmission within a 30-day period (CPT codes 99445, 98984, 98985, 98986), as well as RPM or RTM management services requiring less than 20 minutes of communication with a patient or caregiver per month (CPT codes 99470 and 98979).
Digital Therapeutics. As we discussed in our July 2024 digest, CMS previously created three codes (G0552, G0553, and G0554) for purposes of paying practitioners for furnishing digital mental health treatment (DMHT) devices furnished incident to or integral to professional behavioral health services in association with ongoing treatment under a plan of care by the billing practitioner. As a condition of payment, CMS required DMHT devices to be classified under U.S. Food and Drug Administration (FDA) regulations as computerized behavioral therapy devices for psychiatric disorders.
In the CY 2026 final rule, CMS expanded its payment policies for these codes to also make payment for DMHT devices classified under FDA regulations as digital therapy devices for Attention Deficit Hyperactivity Disorder.
Extension of Medicare Telehealth Flexibilities. The Continuing Resolution passed by Congress and signed into law by the president on November 12, 2025 (H.R. 5371, the Continuing Appropriations Act, 2026) extends key Medicare telehealth flexibilities (e.g., home as the originating site for non-behavioral care, audio-only Medicare visits, expanded providers) through January 30, 2026.
Telehealth Prescribing Flexibilities. On November 10, 2025, the U.S. Drug Enforcement Administration (DEA) published a notice indicating the agency will once again extend telehealth prescribing flexibilities — first established during the COVID-19 public health emergency (PHE) — for the prescribing of controlled substances. It would be the agency’s fourth such extension. DEA has not yet acted on its January 2025 proposal to create a special registration framework for the prescription of controlled substances via telehealth, which would incorporate several more restrictive requirements compared to the flexibilities established during the COVID-19 PHE.
Privacy and AI Updates
Senate HELP Committee Chair Introduces Bill to Impose Federal Health Data Privacy Requirements on Non-HIPAA-Regulated Entities. On November 4, 2025, Senator Bill Cassidy (R-LA), who chairs the Senate Health, Education, Labor and Pensions (HELP) Committee, introduced legislation aimed at filling the gaps in federal privacy law’s protection of personal health data. As stated in the HELP Committee’s announcement of the bill, Cassidy’s proposed Health Information Privacy Reform Act (HIPRA) is specifically designed to protect information collected through technologies such as smartwatches and health apps, which generally is not subject to HIPAA privacy regulations.
HIPRA would require the Secretary of the U.S. Health and Human Services (HHS), in consultation with the Federal Trade Commission (FTC), to promulgate regulations protecting the privacy and security of “Applicable Health Information” (AHI) and requiring notification of breaches in the security of such information. Those regulations would have to set standards that are “at least commensurate with,” and wherever feasible, appropriately “harmonize with” the HIPAA privacy, security, and breach notification requirements.
The bill’s definition of “AHI” is based on the HIPAA definition of “protected health information” but, unlike the HIPAA definition, is not limited to information collected or created by a particular type of entity. And the bill would impose restrictions and requirements to protect AHI on all persons and entities other than (1) government authorities and their service providers, and (2) HIPAA-covered entities and their business associates.
For entities that offer digital technologies capable of generating “wellness data” (data generated to prevent illness or to promote health, including step counts, vital statistics, and records of drug administration) the bill would require notification to the individual to whom the data relates, before generating that data, that the data will not be protected by HIPAA, and provision of a mechanism for the individual to opt out of the data’s generation.
HHS would have authority, in consultation with the FTC, to enforce HIPRA, and to impose civil monetary penalties in the same manner as authorized under HIPAA for imposition on HIPAA-regulated entities.
Policy Updates
American Medical Association Launches Center for Digital Health and AI. On October 20, 2025, the American Medical Association (AMA) announced a new Center for Digital Health and Artificial Intelligence, which will focus on involving physicians in the evolving digital health landscape. The center plans to work with regulators, policymakers, and technology leaders “to shape benchmarks for safe and effective use of AI in medicine and digital health tools,” as well as support clinical workflow integration, education, training, and collaboration.
American Hospital Association Responds to OSTP RFI on Artificial Intelligence. On October 27, 2025, the American Hospital Association (AHA) published the organization’s response to the White House Office of Science and Technology Policy’s (OSTP) request for information (RFI) on artificial intelligence (AI). The AHA outlined four main recommendation categories:
(1) Synchronizing and leveraging existing policy frameworks to avoid redundancy
(2) Removing regulatory barriers and addressing the patchwork of state privacy laws
(3) Ensuring the safe and effective use of AI across a broad range of varying privacy standards
(4) Addressing organizational and infrastructural incentive factors to promote provider readiness and patient adoption
FDA Digital Health Advisory Committee Meeting Examines Regulation of AI Chatbots. On November 6, 2025, the FDA’s Digital Health Advisory Committee (DHAC) met to discuss generative AI-enabled mental health medical devices. During the meeting, DHAC members advocated for increased regulatory oversight for AI chatbots and other similar devices. Members also expressed concerns about lack of oversight for AI products that do not qualify as “devices.” Recommendations from the committee to regulators included examining clinical trial evidence and implementing post-market surveillance. FDA’s public docket for comments following the meeting is open through December 8, 2025, for consideration by the agency.
EU and UK News
Regulatory Updates
Stronger Collaboration Between the UK and U.S. on the Regulation of Medical Technology. The MHRA and FDA have announced a deeper partnership to advance the regulation of medical technologies. A key development is the MHRA’s new AI Commission on the Regulation of AI in Healthcare (highlighted in the October 2025 Digest) which will include input from U.S. experts as well as multinational tech companies. The commission aims to shape recommendations for governing medical technologies with an AI component.
In addition, the MHRA has also confirmed that incoming international reliance routes will enable medical devices approved by trusted regulators — such as the FDA — to gain faster access to the UK market.
Key Insights From the MHRA’s AI Airlock Pilot Report. The MHRA has issued its report on the pilot phase of the AI Airlock, revealing critical regulatory challenges for AI in health care. One notable gap relates to AI validation of AI. For example, one manufacturer in the pilot used a large language model (LLM) to generate synthetic radiology reports and then applied both automated and human valuation. However, uncertainty arose when using this LLM-generated data to assess outputs from another LLM, due to concerns about reinforcing errors and bias. It was concluded that the AI validation of AI needs to be further explored to ensure safety, reliability, and trust in future medical technologies.
UK MHRA’s AI Airlock Begins Phase 2. As highlighted in our June 2024 and July 2025 Digests, the AI Airlock is the MHRA’s pioneering initiative to tackle challenges posed by AI medical devices (AIaMD). The project is now entering its next phase, with seven manufacturers of AI-powered health care technologies selected to participate. The selected technologies span clinical note-taking tools, advanced cancer diagnostics, eye disease detection tools, and treatment support systems for obesity. Phase 2 focuses on three key regulatory challenges: regulating evolving AI applications, post-market surveillance for AIaMDs, and the effective regulation of AI for diagnostics. Insights from this phase will inform the future regulation of AI in life sciences, including recommendations to the MHRA’s National Commission into the Regulation of AI in Healthcare. Phase 2 is scheduled to run until March 2026.
UK Government Announces New AI Regulatory Approach To Drive Innovation. Central to this strategy is the introduction of the AI Growth Lab, a regulatory sandbox designed to help companies test innovative AI products in real-world conditions under temporarily relaxed regulatory requirements. A call for views on the AI Growth Lab to inform policy development is open until January 2, 2026.
UK Government Announces Deployment of New Digital Platforms, and AI Has Halved the Approval Time for Clinical Trials. The average approval time was reduced from 91 days to 41 days. In addition, AI will be introduced to assist with the review of complex data, although the final decision will remain with experienced assessors.
National Institute for Health and Care Excellence Announces New Initiative To Expand Health Technology Assessment To Include Medical Devices, Diagnostics, and Digital Tools. Technologies like wearable diabetes monitors and AI diagnostics tools will receive recommendations for NHS-wide implementation if they meet the relevant standards. The initiative is intended to address longstanding inequalities in technology adoption across different NHS regions and to eliminate “postcode lottery” access to health technology treatments.
European Commission Launches the EU Strategy To Apply AI EU Strategy and AI in Science. Following recent consultations (see our May 2025 Digest), the European Commission has unveiled two new AI-related initiatives:
- Apply AI EU Strategy aims to promote new industrial uses of AI technologies in strategic industrial sectors and boost innovation in EU companies. Proposed actions include establishing European Networks of Expertise on AI Deployment in Healthcare to consolidate guidelines and best practices; or, launching an AI Medicine Discovery Challenge to discover new medicines targeting unmet medical needs and hard-to-treat diseases. Other actions include developing guidelines on the classification of high-risk AI systems and on the AI Act’s interplay with other European Union legislation.
- EU Strategy for AI in Science aims to advance AI use and development in scientific research. Highlights include launching a campaign to encourage private sector pledges to support AI in science, and a policy report from the Joint Research Centre, analyzing the use of AI in the scientific process and the AI-in-science landscape.
European Commission Launches Calls for Projects Boosting Digital Health Innovation. The chosen projects, which will obtain EU funding, should accelerate the deployment and use of innovative digital technologies across Europe. The projects include:
- €22.5 million for projects that support biomedical research and the roll out of personalized health care through the European Genomic Data Infrastructure
- €14.4 million for the deployment of AI-based solutions in medical imaging
Proposals can be submitted on the EU Funding & Tenders Portal for the call on Genomic Data Infrastructure and for the call on the deployment of AI-based solutions in medical imaging.
European Commission Launches Scaleup Europe Fund for Strategic Technology Companies. The fund, a multi-billion euro funding mechanism, will be co-financed by the European Commission and private investors selected by the European Commission. The fund is designed to accelerate European companies developing strategic technologies (e.g., medical technology and biotechnology) with direct equity investments in the range of €100 million and above. It is open to companies located in any EU Member State or countries associated with Pillar III of Horizon Europe.
Six New Sites Have Been Selected To Host European AI Factories. The European High Performance Computing Joint Undertaking — a collaboration between the EU, member states, and private partners — has announced the selection of sites for the next wave of AI factories, set to be deployed in 2026. The factories aim to accelerate innovation by enabling new industrial applications of AI in sectors such as health care. Factories will provide access to AI-optimized high-performance computing resources, experimental platforms to test AI models, and other advanced AI tools to support industry and research. Notably, the AI factory in Spain will feature an experimental platform for developing and testing innovative AI models and applications, as well as promoting collaboration across Europe. This brings the total to 19 AI factories in the EU (see our January 2025 Digest).
MedTech Europe Publishes Recommendations on the European Innovation Act. MedTech Europe, the European trade association for the medical technology industry, has submitted recommendations in response to the European Commission’s call for evidence on the upcoming European Innovation Act, expected to come into force in 2026. MedTech Europe’s recommendations include (1) streamlining pathways from research to market for medical technologies while ensuring coherence across policies affecting medical technologies; (2) explicitly recognizing medical technology as a strategic sector; and (3) facilitating EU and national funding of medical technologies and introducing a dedicated process for procurement of breakthrough innovations involving medical technologies.
IP Updates
UK Information Commissioner’s Office (ICO) Opens Call for Views on the Guidance for Enforcement of Breaches of Data Protection Legislation. The guidance aims to enhance transparency about the approach taken by the ICO when an organization is suspected of non-compliance with data protection legislation. The guidance covers, for example, how the decision is made to open an investigation, what is to be expected during the investigation, and how the outcome is decided. The consultation is open until January 23, 2026.
*The following individuals contributed to this Newsletter:
Sonja Nesbit is employed as a senior policy advisor at Arnold & Porter’s Washington, D.C. office. Sonja is not admitted to the practice of law.
Eugenia Pierson is employed as a senior health policy advisor at Arnold & Porter’s Washington, D.C. office. Eugenia is not admitted to the practice of law.
Mickayla Stogsdill is employed as a senior policy specialist at Arnold & Porter’s Washington, D.C. office. Mickayla is not admitted to the practice of law.
Caroline Oliver is employed as a policy specialist at Arnold & Porter’s Washington, D.C. office. Caroline is not admitted to the practice of law.
© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.
Key Contacts
