Virtual and Digital Health Digest

This digest covers key virtual and digital health regulatory and public policy developments during November and early December 2025 from the United States, United Kingdom, and European Union.

In this issue, you will find the following:

U.S. News

• Health Care Fraud and Abuse Updates
• Corporate Transactions Updates
• Provider Reimbursement Updates
• Privacy and AI Updates
• Policy Updates
• FTC Updates

U.S. Featured Content

This month’s issue covers major developments in health care fraud enforcement, corporate investment trends, and policy updates shaping the future of digital health and artificial intelligence (AI). We highlight two significant telehealth fraud cases, including the conviction of executives behind a $100 million Adderall distribution scheme and an indictment tied to a $2.7 million telehealth billing fraud. On the innovation front, startups Function Health and Angle Health raised funds to scale AI-powered platforms for preventive care and benefits management.

We also dive into the Centers for Medicare & Medicaid Services’ (CMS) new ACCESS pilot, which will test an outcome-aligned payment (OAP) approach for technology-enabled chronic care, and review the calendar year (CY) 2026 Medicare Hospital Outpatient Prospective Payment System (OPPS) final rule, including CMS’ interest in creating a payment framework for software as a service (SaaS). Additional updates include the White House’s Request for Information (RFI) on enhanced research under the Genesis Mission, U.S. Health and Human Services’ (HHS) AI strategy rollout, U.S. Food and Drug Administration’s (FDA) TEMPO digital health pilot, and Federal Trade Commission’s (FTC) $27.6 million consumer refund announcement.

EU and UK News

• Regulatory Updates
• Privacy Updates
• IP Updates

EU/UK Featured Content

This month saw tighter governance of AI and digital technologies in the UK and EU life sciences and MedTech sectors, underscoring that innovation must advance alongside strengthened accountability.

In the UK, new funding for Medicines and Healthcare products Regulatory Agency (MHRA) and National Institute for Health and Care Excellence (NICE) signals growing recognition of the need for stronger oversight around digital mental health tools, while Proprietary Association of Great Britain’s (PAGB) report of AI in consumer health care advertising highlights the increasing scrutiny on how AI is used in public-facing health communications.

Across the EU, the introduction of an AI Act whistleblower tool reflects efforts to create a more transparent and risk-aware regulatory environment, and the European Commission’s Digital Omnibus proposals further demonstrate the EU’s intent to harmonize expectations across AI, data protection, and cybersecurity.

Together, these developments indicate that, while opportunities for AI in health continue to grow, regulators are continuing to take measures to ensure safety, trust, and consistency across the sector.

For life sciences and MedTech companies, this points to a regulatory landscape where expectations around transparency regarding ongoing oversight for AI systems and AI-enabled communications are becoming increasingly defined.

U.S. News

Health Care Fraud and Abuse Updates

Telehealth Executives Convicted for Adderall Distribution and Health Care Fraud Scheme. On November 18, 2025, a federal jury in San Francisco convicted two executives of a digital health company for their roles in a years-long scheme to illegally distribute Adderall online. The jury found that Ruthia He, the founder and CEO of Done, and David Brody, the clinical president of Done, used deceptive advertising to prescribe over $100 million worth of Adderall and other stimulants.

According to the court documents, the defendants allegedly spent $40 million on social media advertising and paid for keyword search advertisements to attract drug seekers. The defendants also allegedly kept initial clinical appointments to half the usual length to maximize profits and paid nurse practitioners high salaries to refill prescriptions without clinical interactions. Additionally, patients were allowed to auto-refill their prescriptions without any clinical oversight. Further, as part of the scheme, the defendants allegedly defrauded insurers by submitting false and fraudulent prior authorization requests, resulting in Medicare, Medicaid, and the commercial insurers paying over $14 million.

Telemedicine Company Owner Indicted for $2.7 Million Telehealth Scheme. On November 21, 2025, a federal grand jury in the Middle District of Florida indicted Marek Rex Vernon Harrison, the owner and manager of CTD Network LLC (CTD), a telemedicine company, for allegedly submitting fraudulent claims for telehealth services. The indictment alleges that CTD employed medical providers to authorize prescriptions for genetic tests for Medicare beneficiaries referred by marketing companies or laboratories. These providers signed orders for tests that were medically unnecessary for beneficiaries, and they did not use the test results for treatment. CTD then allegedly billed Medicare for these telehealth services, submitting over $2.7 million in false and fraudulent claims, of which Medicare paid more than $600,000.

Corporate Transactions Updates

Function Health Raises $298 Million Series B Funding Round To Democratize AI-Powered Preventive Care. On November 19, 2025, Function Health, an Austin-based startup with a membership-based digital health platform offering biomarker lab testing, MRI and CT scans, and AI-powered insights, announced that it closed an oversubscribed $298 million Series B round at a $2.5 billion valuation. The funding round was led by Redpoint Ventures and had participation from, among others, Nat Friedman and Daniel Gross’ NFDG, Andreessen Horowitz, and Aglaé Ventures.

With the funding announcement, Function Health announced the launch of Medical IntelligenceLab, a generative AI model trained by physicians that provides personalized health insights for members using their data. Function Health members can also now access an AI chatbot through Function Health’s platform, which pulls from their lab results, doctor’s notes, and imaging scans to answer questions and provide tailored guidance. In an attempt to “further democratize health,” Function Health announced it is lowering its membership price to $365 a year, or $1 a day, down from $499.

Angle Health Raises $134 Million Series B Funding Round To Expand AI-Powered Health Benefits Platform. On December 3, 2025, Angle Health, a San Francisco-based startup with the first vertically integrated AI platform for health care benefits, announced a $134 million oversubscribed Series B funding round led by Portage and had participation from, among others, Blumberg Capital, Mighty Capital, PruVen Capital, and SixThirty Ventures. Angle Health offers a full-stack, AI-enabled platform that helps small- and mid-sized businesses meet employees’ health care needs while stabilizing costs. Angle Health’s proprietary AI models, which are trained on millions of de-identified patient records, help employers design health plans to best support their employees. The funding round, which included both equity and debt, brings Angle Health’s total funding to $200 million as it scales its AI-driven benefits platform.

Provider Reimbursement Updates

CMS Launches ACCESS Pilot To Test Tech-Enabled Chronic Care Model. On December 4, 2025, CMS announced a voluntary pilot model called Advancing Chronic Care with Effective, Scalable Solutions (ACCESS), which will test an outcome-aligned payment approach in Original Medicare to “expand access to new technology-supported care options that help people improve their health and prevent and manage chronic disease.” Care organizations that enroll in the model are expected to offer “integrated, technology-supported care,” which may include using FDA-authorized devices or software. Participating organizations will receive recurring payments for managing patients’ chronic conditions, with full payment tied to achieving certain health outcomes, such as lowering blood pressure by 10 mHg. According to CMS, the ACCESS model will “give[] clinicians greater flexibility to deliver modern technology-supported care in ways that best improve patient health.” The ACCESS model will have its first performance period beginning July 1, 2026, and applications must be submitted by April 1, 2026.

CMS Releases Hospital Outpatient Prospective Payment System Final Rule. On November 25, 2025, CMS published the CY26 Medicare Hospital OPPS final rule.

As we covered in our November 2025 Digest, in the CY26 Physician Fee Schedule final rule, CMS permanently expanded the definition of “direct supervision” to include audio-video real-time communications for all services “incident to” a physician’s professional service described under 42 C.F.R. § 410.26, except for services that have a global surgery indicator of 010 or 090. In the CY26 OPPS final rule, CMS adopted the same standard for cardiac rehabilitation, intensive cardiac rehabilitation, pulmonary rehabilitation, and diagnostic services furnished to hospital outpatients, except for diagnostic services that have a global surgery indicator of 010 or 090.

As we covered in our July 2025 Digest, CMS included a comment solicitation in the proposed rule on how it should consider paying for “software as a service” (SaaS) under the OPPS. In the final rule, CMS noted that commenters generally supported a dedicated payment policy for innovative technologies, and requested that CMS establish an evidence-based, flexible framework that encourages the use and innovation of SaaS. Other commenters expressed concern, however, that a new payment policy specific to SaaS could increase costs and administrative burden. In response to these comments, CMS recognized “the need for a payment policy that accounts for the unique and heterogenous characteristics of SaaS” and stated it “remain[s] interested in ensuring that any such payment policy reflects the value provided to Medicare providers and beneficiaries.” CMS stated it would take the comments submitted into consideration for future rulemaking.

Telehealth Prescribing Flexibilities. On December 30, 2025, the U.S. Drug Enforcement Administration (DEA), jointly with HHS, issued a fourth extension of telemedicine flexibilities for the prescribing of controlled medications through December 31, 2026. This extension affords the DEA additional time to establish a permanent rule. As noted in prior digests, the DEA released a proposed rule in January 2025.

Privacy and AI Updates

White House Office of Science and Technology Policy Issues Request for Information Related to New “Genesis Mission.” On November 26, 2025, two days after President Trump signed an executive order launching the “Genesis Mission” to expand the productivity and impact of federal research and development, the White House Office of Science and Technology Policy issued a Request for Information regarding enhancements to the federal government’s role in supporting scientific research. According to the RFI, the rapid progress in AI development and deployment demands “continuous improvement in how the federal government supports scientific research.” Stakeholders may respond to any or all of 13 questions, including:

• “What policy changes to Federal funding mechanisms, procurement processes, or partnership authorities would enable stronger public-private collaboration and allow America to tap into its vast private sector to better drive use-inspired basic and early-stage applied research?”
• “How can Federal policies strengthen the role played by small- and medium-sized businesses as both drivers of innovation and as early adopters of emerging technologies?”
• “What reforms will enable the American scientific enterprise to pursue more high-risk, high-reward research that could transform our scientific understanding and unlock new technologies, while sustaining the incremental science essential for cumulative production of knowledge?”
• “What specific Federal statutes, regulations, or policies create unnecessary barriers to scientific research or the deployment of research outcomes? Please describe the barrier, its impact on scientific progress, and potential remedies that would preserve legitimate policy objectives while enabling innovation.”
• “How can the Federal government strengthen research security to protect sensitive technologies and dual-use research while minimizing compliance burdens on researchers?”

Policy Updates

Rural Health Transformation Program Applications Prioritize Digital Health and AI. Applications for the $50 billion Rural Health Transformation Program (RHTP) created by the One Big Beautiful Bill Act (OBBBA) (P.L. 119-21) were due on November 5, 2025. CMS confirmed that all states submitted applications for the RHTP. Review of applications reveals states prioritized digital health, including remote patient monitoring, wearables, telehealth, and AI. CMS is expected to announce awards by the end of the year.

House Passes Acute Hospital Care at Home Legislation. On December 1, 2025, the U.S. House of Representatives passed, by a voice vote, the Hospital Inpatient Services Modernization Act (H.R. 4313/S. 2237), which extends CMS’ Acute Hospital Care at Home (AHCAH) program through September 30, 2030. Waiver authorities under the AHCAH are currently tied to government funding bills. The latest extension of AHCAH was included in the Fiscal Year 2026 Continuing Resolution (H.R. 5371). The bill faces an uncertain path to passage in the Senate.

FDA Announces TEMPO Digital Health Devices Pilot. On December 5, 2025, FDA announced a new Technology-Enabled Meaningful Patient Outcomes (TEMPO) pilot, which will allow up to 40 manufacturers of digital health devices to provide care under the Center for Medicare and Medicaid Innovation’s new ACCESS model. Under the TEMPO pilot, FDA will exercise “appropriate” enforcement discretion in order for participating manufacturers to provide care under the ACCESS model. The interagency collaboration on the initiative aligns with HHS Secretary Kennedy’s focus on digital health technology.

Department of Health and Human Services Releases AI Strategy. On December 4, 2025, HHS released its AI Strategy, which is aligned with the Trump administration’s AI Action Plan, AI-related executive orders, and guidance from the U.S. Office of Management and Budget. The strategy’s five pillars include: (1) ensuring governance and risk management for public trust; (2) designing infrastructure and platforms for user needs; (3) promoting workforce development and burden reduction for efficiency; (4) fostering health research and reproducibility through gold standard science; and (5) enabling care and public health delivery modernization for better outcomes. The strategy includes a “OneHHS” approach, meaning that all HHS divisions will collaborate to develop department-wide AI infrastructure aimed at streamlining workflows and enhancing cybersecurity.

FTC Updates

EU and UK News

Regulatory Updates

MHRA and NICE Receive Additional Funding To Develop the Regulation of Digital Mental Health Technologies. Wellcome has awarded £2 million to MHRA and NICE to strengthen the safety and effectiveness of digital mental health technologies through enhanced regulatory frameworks and evaluation standards. The funding, which runs until autumn 2028, will support initiatives such as a digital mental health technology AI “airlock” sandbox enabling developers to test innovations before National Health Service (NHS) adoption and efforts to align international standards for digital health regulation. Both agencies aim to provide clearer guidance for clinicians and patients on how these technologies are assessed, while improving post-market monitoring. A research report commissioned by MHRA and NICE found that a low awareness of the Yellow Card reporting system was the major barrier to reporting harms. To address this, developers are encouraged to embed reporting functions directly within apps, using clear in-app messaging and incorporating self-monitoring features to detect risk.

PAGB Publishes Report on AI in Consumer Health Care Advertising. The PAGB report highlights that AI is increasingly used in consumer health care advertising for creative content generation and compliance monitoring, though adoption remains cautious due to regulatory and ethical concerns. Key risks identified include inaccurate or misleading claims, data privacy issues, and unclear accountability. These risks reinforce the need for human oversight and robust governance. PAGB recommends clear internal policies and risk management frameworks, transparency in AI use, and proactive engagement with regulators to ensure compliance with UK advertising rules. The report also notes that PAGB is exploring how it can use AI solutions to improve efficiency and support members — for example, by developing a regulatory support agent and chatbot tool to help members navigate PAGB guidance.

MedTech Europe Calls for Digital Labelling for Medical Devices. MedTech Europe, together with other industry groups, has published a joint position paper calling for the adoption of digital labels to provide mandatory information on European-authorized representatives (such as, country- and region-specific symbol information) and importers of medical devices (including their registered place of business and contact address). The proposal aims to inform ongoing discussions on the revision of the Medical Devices Regulation (MDR) and In Vitro Diagnostic Medical Devices Regulation (IVDR). According to the paper, digital labeling would reduce administrative burden, improve accuracy and traceability, and support supply-chain efficiency. Importantly, the approach is designed to achieve these benefits without undermining patient safety or regulatory oversight.

European Commission Launches Pilot Initiative Resource for AI Science (RAISE). RAISE is a virtual European institute designed to strengthen Europe’s capacity for AI-enabled scientific research. RAISE will provide coordinated access to high-performance computing, strategic datasets, research funding, and expert networks across EU Member States and industry partners. The initiative aims to accelerate AI-driven advances across key scientific fields, including health, and forms part of the Apply AI Strategy and the European Strategy for AI in Science (see our November 2025 Digest). The pilot will receive €107 million EU funding and is intended to play a pivotal role in fostering collaboration and innovation across Europe.

European Commission Launches Whistleblower Tool for the Artificial Intelligence Act. The Whistleblower Tool has been introduced to support early detection of non-compliance with AI Act obligations or any activity of an AI system that may affect fundamental rights, including health. The tool enables individuals to confidentially and anonymously report suspected breaches directly to the European AI Office, the European Commission’s center of AI expertise. For companies developing or deploying AI, this increases the likelihood that potential issues, such as non-compliance or health risks of high-risk AI systems used in medical technologies, will be reported directly to regulators. To mitigate risk, companies should ensure they have clear internal reporting channels, documented risk-management processes, and robust oversight of AI system performance and safety.

Privacy Updates

European Data Protection Supervisor Publishes Guidance on Managing Data Protection Risks in AI Systems. The guidance is focused on identifying and mitigating personal data protection risks when developing, procuring, or deploying AI systems. The guidance highlights the need for interpretability and explainability to enable effective oversight and ensure compliance with core data-protection principles, including fairness, accuracy, data minimization, security, and data-subject rights. These principles are broken down into specific risk areas with practical mitigation measures. For example, fairness risks — such as bias from poor-quality training data — may be reduced through regular data-quality audits. While primarily aimed at EU institutions, the guidance is also relevant for companies developing or deploying AI systems, as it provides a clear approach to managing data-protection risks across the entire AI lifecycle.

European Commission Publishes Proposals to Amend EU Rules Governing AI, Data Protection, and Cybersecurity. The two proposals — “Digital Omnibus on AI” and “Digital Omnibus” — aim to streamline and align key EU laws, including the GDPR, AI Act, Data Act, e-Privacy Directive, and Network and Information Security Directive 2 (NIS2). Key elements include:

• AI Act: clearer alignment with the MDR/IVDR, potential for single conformity assessment, and expanded real-world testing for more AI systems, including medical devices
• GDPR: clearer definitions of non-personal data and scientific research, and an exemption for incidental processing of special-category data in AI development and operation
• ePrivacy: simplified cookie rules and a single consent choice requirement
• Data Act: stronger protection for trade secrets where there is a high risk of unlawful access or disclosure
• Incident reporting: single EU-level entry point for cybersecurity incident notifications under NIS2, GDPR, and related frameworks

The proposals will now be reviewed by the European Parliament and Council of the European Union. You can read more in our November 2025 BioSlice Blog.

IP Updates

Updated NHS IP Guidance: Unlocking Healthcare Innovation. The UK government has published its first major update to the NHS Intellectual Property (IP) guidance since 2002, aiming to remove barriers to innovation and accelerate technology adoption.

The guidance positions NHS-generated IP as a strategic asset, demanding robust management to protect value, ensure transparency, and secure fair returns while creating a predictable environment for industry negotiations. It emphasizes flexibility, with the retention of IP ownership no longer being the sole route to creating value for the NHS. Transfer of IP may be preferable, particularly for rapidly deployed technologies like AI tools, digital platforms, and diagnostics.

The guidance mandates clearer governance requiring NHS organizations to appoint a Senior Responsible Officer for IP, publish policies, and standardize decision-making to avoid delays. Detailed rules for structuring licenses and an emphasis on obligations under competition law aim to ensure fair market value and protect public interest. Resources, including model agreements, non-disclosure agreements, and governance templates, should ease negotiations and reduce burdens for both the NHS and industry.

*The following individuals contributed to this Newsletter:

Sonja Nesbit is employed as a senior policy advisor at Arnold & Porter’s Washington, D.C. office. Sonja is not admitted to the practice of law.
Mickayla Stogsdill is employed as a senior policy specialist at Arnold & Porter’s Washington, D.C. office. Mickayla is not admitted to the practice of law.
Sophia Kim is employed as a trainee solicitor at Arnold & Porter’s London office. Sophia is not admitted to the practice of law.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.