Virtual & Digital Health Digest
This digest covers key virtual and digital health regulatory and public policy developments during July and early August 2026 from the United States, United Kingdom, and European Union.
In this issue, you will find the following:
U.S. News
- Health Care Fraud and Abuse Updates
- Privacy and Artificial Intelligence (AI) Updates
- Policy Updates
- FDA Updates
U.S. Featured Content
During July and August 2026, U.S. regulators and lawmakers sharpened their focus on how artificial intelligence (AI)-enabled tools intersect with health data privacy, medical device oversight, and consumer protection. The Federal Trade Commission (FTC) sued telehealth provider Hims & Hers Health over deceptive subscription practices and undisclosed sharing of consumers’ health data with third-party ad platforms, while a separate $36.4 million False Claims Act settlement targeted unnecessary genetic testing kickback schemes, underscoring continued scrutiny of both privacy practices and billing integrity in digital health. On Capitol Hill, the Senate Committee on Health, Education, Labor and Pensions (HELP Committee) advanced legislation extending Health Insurance Portability and Accountability Act (HIPAA)-like protections to wellness data collected by non-HIPAA-covered digital health companies, and Senator Warner released a sweeping AI policy framework with bills addressing consumer-facing AI agents and pre-deployment safety testing. U.S. Government Accountability Office (GAO) and Congressional Research Service (CRS) reports added to the conversation, flagging open questions around wearable health technology accuracy and the growing patchwork of state liability frameworks for health AI. Meanwhile, the U.S. Food and Drug Administration’s (FDA) Digital Health Center of Excellence opened public comment on a discussion paper proposing a risk-based, “competency-based” framework for evaluating generative AI-enabled medical devices across their premarket and post-market lifecycle. Together, these developments show U.S. regulators converging around the same core tension their EU and UK counterparts are navigating: building meaningful guardrails for health AI without stalling the pace of innovation.
EU and UK News
EU/UK Featured Content
During July 2026, regulators in the EU and UK continued to focus on the practical implementation of AI and digital health regulation.
In the EU, the Digital Omnibus on AI introduced the first substantive amendments to the AI Act, while policymakers and industry groups turned their attention to how AI requirements will interact with existing frameworks. This included new principles on the use of AI in Joint Clinical Assessment dossiers under the Health Technology Assessment Regulation, the European Federation of Pharmaceutical Industries and Association’s (EFPIA) call for trusted AI testing environments and proportionate AI governance in its response to the Biotech Act consultation, and further debate on the treatment of software and AI-enabled technologies in the ongoing Medical Device Regulation (MDR)/In Vitro Diagnostic Regulation (IVDR) revision. Together, these developments reflect a growing focus on ensuring that AI-specific requirements integrate effectively with existing regulatory frameworks.
In the UK, regulators published a series of guidance documents addressing questions about when AI-enabled products qualify as medical devices and how they should be regulated. New Medicines and Healthcare products Regulatory Agency (MHRA) guidance on ambient voice technologies and updated guidance on digital mental health technologies provide greater clarity on the medical device boundary, while additional outputs from the AI Airlock program highlight the challenges associated with qualification, intended purpose, and lifecycle management of AI systems. These developments suggest that regulators are increasingly focused on addressing practical implementation questions.
U.S. News
Health Care Fraud And Abuse Updates
Texas Laboratory, Former CEO, and Florida Businessman Pay a Total of $36.4 Million to Settle Allegations of Kickbacks and Unnecessary Genetic Testing. On July 30, 2026, Access DX Laboratory of Houston, Texas, its former CEO Michael Stewart, and Florida businessman Harold Shatz agreed to pay a combined $36.4 million to resolve False Claims Act allegations for medically unnecessary genetic testing. The government alleged that, from January 2018 through January 2020, the defendants paid kickbacks to marketers in exchange for patient referrals for genetic testing, unbundled billing codes, and paid telemedicine providers for false and fraudulent doctors’ orders, resulting in the submission of false claims to Medicare and Medicaid. As part of the settlement, Access DX entered into a five-year Corporate Integrity Agreement, and both Stewart and Shatz agreed to plead guilty to related criminal kickback conspiracy charges.
Privacy and AI Updates
Online Telehealth Company Sued for Undisclosed Sharing of Consumers’ Health Information. On July 29, 2026, the FTC, attorneys for the People of California, and the Utah Division of Consumer Protection filed a federal court complaint against online telehealth provider Hims & Hers Health, Inc. (HHH) for alleged violations of the FTC Act, the Restore Online Shoppers’ Confidence Act, California’s Unfair Competition Law and False Advertising Law, and the Utah Consumer Sales Practices Act. According to the complaint, HHH misled consumers into believing that submitting a medical intake form did not obligate them to subscribe to a provider’s recommended treatment, when in fact HHH routinely charged and enrolled consumers in subscriptions almost immediately after intake, with no opportunity for the consumers to consent to the recommended treatment. In addition, HHH allegedly obscured the timing of recurring refill charges, making it difficult for consumers to cancel their subscriptions, and, while declaring that its platform was “100% online, private, and secure” and consumers’ sensitive health information would only be accessed by HHH medical providers, allegedly shared consumers’ personal health information with third-party advertising platforms through tracking tools such as the Meta Pixel. Plaintiffs seek a permanent injunction, monetary and civil penalties, and other relief.
Senate HELP Committee Approves Health Information Privacy Reform Act. On July 30, 2026, the Senate Health, Education, Labor and Pensions Committee unanimously voted to approve S. 3097, the proposed Health Information Privacy Reform Act, which would impose standards comparable to HIPAA’s privacy, security, and breach notification requirements on non-HIPAA-regulated entities. Such entities offering digital health technologies to generate “wellness data” about an individual (such as step counts, vital statistics, and records of drug administration) would have to provide the individual with advance notice that the data will not be protected by HIPAA, and an opportunity to opt out. The U.S. Department of Health and Human Services (HHS) would have authority, in consultation with the FTC, to enforce the law and to impose civil monetary penalties in the same manner as authorized under HIPAA for HIPAA-regulated entities. The bill next proceeds to the full Senate for consideration.
Policy Updates
Senator Warner Releases AI Policy Framework and Legislation. On July 21, 2026, Sen. Mark Warner (D-VA) released the “Framework for America’s AI Future” — an AI policy framework accompanied by several legislative proposals. Among the most notable bills are the AI Artificial Intelligence Access, Gatekeeper Exchange, and Nondiscriminatory Transfer (AGENT) Act (S. 5051), which would establish privacy, cybersecurity, and interoperability requirements for consumer-facing AI agents, and the Secure Artificial Intelligence Development Act (S. 5061), which would require pre-deployment testing and create a voluntary safety incident reporting system for advanced AI models. Although the package addresses AI broadly, the proposals would have significant implications for digital health technologies, including AI-powered health assistants and chatbots that process sensitive health information.
GAO Examines Clinical Use of AI-Enabled Wearable Health Technologies. On August 6, 2026, the GAO released a technology assessment titled, Wearable Technologies: Potential Benefits and Challenges in Clinical Decision-Making (GAO-26-107847). GAO found AI-augmented wearables that track individuals’ health data can support quicker diagnoses, more personalized care, and greater access to remote monitoring. The assessment found that wearable health devices — such as smart watches and continuous glucose monitors (CGMs) — can vary in accuracy and sometimes are difficult to integrate into clinical workflows. GAO offered several policy options for lawmakers, including consideration to better integrate wearables into clinical workflows and incentivizing device performance via a future public database of independently certified devices.
CRS Highlights State Legal Issues Surrounding Health AI. On August 10, 2026, the CRS published a “Legal Sidebar” titled, Artificial Intelligence in Health: Overview of Selected State Liability Frameworks (LSB11467), surveying state-by-state litigation over health-related AI technologies. Such lawsuits across the U.S. fall into two primary categories: health plans’ use of AI in coverage determinations and consumer-facing health AI apps. For Congress, CRS flags open questions on federal preemption, the limits of the FDA’s jurisdiction with HIPAA, a patchwork of state AI-health laws, and pending bills including the Youth AI Privacy Act (S. 4199) and the Senior Chatbot Protection Act of 2026 (S. 5117).
FDA Updates
FDA Seeks Public Feedback on Regulatory Approach for Generative AI-Enabled Medical Devices. On August 18, 2026, FDA’s Digital Health Center of Excellence (DHCoE) within the Center for Devices and Radiological Health (CDRH) issued a discussion paper seeking stakeholder input on the regulation of generative artificial intelligence (GenAI)-enabled medical devices (Discussion Paper). Amongst other topics, the discussion paper covers considerations for the assessment of risk for GenAI-enabled medical devices, considerations for premarket evaluation of GenAI-enabled medical devices, and post-market monitoring for GenAI-enabled medical devices.
CDRH describes a two-axis framework as a possible organizing heuristic for thinking about the risk of GenAI-enabled software functions. The framework places independence of device activity on one axis and consequences or severity of harm of relying on an incorrect device output on the other axis, implying a gradient of increasing risk. Consistent with prior FDA digital health guidance policies, the framework recognizes that the risk of a software function depends in part on how independently it directs or takes action (e.g., providing a non-directive risk score for a future cardiovascular event versus directing a patient to seek emergency care). The Discussion Paper notes that the distinction between “non-directive” and “action-directing” information may not be binary but rather would likely involve a continuum.
For premarket review, CDRH is considering a “competency-based” evaluation approach that would combine non-clinical device benchmarking with clinical confirmation, with the level of evidence tailored to the device’s intended use and risk. The competency-based model is inspired by how human clinicians are evaluated and credentialed, but would be adapted for the technical, practical, and legal considerations applicable to the regulation of medical devices. Benchmarking could evaluate clinical knowledge, analytic capabilities, safety behavior, communication, and generalizability. Clinical confirmation could range from retrospective testing and “shadow deployment” to clinician decisions or prospective clinical studies, depending on the device and its risk profile. CDRH is also considering whether qualified independent third parties could support benchmarking, maintain evaluation datasets, or serve as expert clinical adjudicators.
The Discussion Paper also describes a variety of potential approaches to post-market oversight for monitoring Gen-AI-enabled devices, including periodic re-benchmarking, periodic sample-based clinician review, and performance degradation monitoring. CDRH also seeks input on considerations for post-market modifications of GenAI-enabled devices.
The Discussion Paper is nonbinding, is not a draft or final guidance, and does not propose changes to FDA policy or establish evidentiary expectations for future marketing submissions.
Comments are due by October 19, 2026, and should be submitted under docket number FDA-2026-N-7874 on Regulations.gov.
EU and UK News
Regulatory Updates
EU Adopts Digital Omnibus on AI to Simplify Implementation of the AI Act. The EU has adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744), introducing targeted amendments to the AI Act aimed at reducing regulatory burden and improving alignment with sector-specific legislation. Key changes include clarifying the scope of high-risk AI systems and safety components, expanding AI regulatory sandbox provisions, strengthening the powers of the EU AI Office, and clarifying the interaction between the AI Act and other frameworks, including the Cyber Resilience Act. The Digital Omnibus on AI entered into force on July 27, 2026, with staggered application dates for various amended EU AI Act provisions.
European Parliament Publishes Draft Report in Response to the European Commission’s Proposal to Amend Regulation (EU) 2017/745 (MDR) and Regulation (EU) 2017/746 (IVDR). The draft report shows broad support for the European Commission’s reforms, while suggesting further targeted amendments. The European Parliament proposes additional measures to support access to “niche” medical technologies and to streamline classification and conformity assessment processes. For digital health companies, it includes further revisions to the proposed software classification rules and supports more structured pre-submission engagement with notified bodies, although it is not expected to significantly expand the circumstances in which software can qualify as a Class I device. Read our July 2026 BioSlice Blog for more details on the proposed amendments.
EFPIA Publishes Response to the EU Biotech Act Consultation. Following its position paper last month (see our July 2026 Digest), EFPIA has now published its response to the European Commission’s consultation on the proposed EU Biotech Act. The submission condenses and reinforces its key recommendations, which include measures to support data- and AI-driven innovation. In particular, EFPIA supports clarification of the processing and reuse of clinical trial data, greater harmonization of GDPR requirements, the introduction of regulatory sandboxes, and the development of trusted AI testing environments. The submission also emphasizes that AI and data governance should be proportionate, risk-based, and aligned with existing legislation, while avoiding unnecessary duplication.
Team-NB Proposal for Risk Adaptive Surveillance System. Team-NB has published a position paper setting out a proposal for revisions to the EU IVDR to establish a risk-adaptive surveillance system for In Vitro Diagnostics (IVDs), which would include software- and AI-based IVDs. Under the proposal, manufacturers would initially be subject to enhanced surveillance following certification, with the possibility of reduced oversight over time where they demonstrate sustained compliance, effective quality management systems, and strong post-market performance. The proposal is intended to support the European Commission’s ongoing work to move away from fixed certificate validity periods and towards a system of periodic reviews, with the intensity of notified body oversight determined by the risk profile and compliance history of the device and manufacturer.
European Commission Adds New Exemptions to Portable Battery Removal Requirements. The European Commission has adopted a delegated act adding six new product categories to the list of exemptions from the Batteries Regulation requirement that portable batteries be removable and replaceable by consumers. The new exemptions include certain wearable devices (such as smartwatches and fitness trackers), meaning that batteries in those products may instead be removable and replaceable by independent professionals. The European Commission has updated its guidance on battery removability and replaceability to assist manufacturers in applying the new derogations. The delegated act will now be scrutinized by the European Parliament before it can enter into force.
MDCG Publishes Position Paper on UDI Assignment Between Manufacturers and Distributors. The Medical Device Coordination Group (MDCG) has published a position paper clarifying responsibility for assignment of Unique Device Identifiers (UDI-DIs) under the MDR and IVDR. The document addresses instances where distributors have assigned their own UDI-DIs to products marketed under their brand name, creating uncertainty about how devices should be identified and registered in EUDAMED. The position paper notes that responsibility for UDI assignment and registration remains with the manufacturer. While devices marketed under different brand names may have different UDI-DIs, those identifiers should remain linked to the manufacturer in EUDAMED.
HTA Coordination Group Publishes Principles on AI Use in Joint Clinical Assessment Dossiers. The European Commission has published new General Principles on the use of AI in the preparation of the Joint Clinical Assessment dossier under the EU Health Technology Assessment Regulation. The principles acknowledge that AI may be used in evidence synthesis and dossier preparation, but make clear that its use does not alter the legal, methodological or evidential requirements applicable to Joint Clinical Assessment (JCA) submissions.
UK Government Reports on Progress of Life Sciences Sector Plan. The government has published a progress report on the delivery of the Life Sciences Sector Plan, launched in July 2025 (see our July 2025 BioSlice Blog on the plan’s publication). The update reports progress on four headline targets: (1) increasing investment in commercial research and development; (2) improving access to “scale-up” capital; (3) accelerating patient access to medicines and medicinal tech; and (4) increasing foreign direct investment. The report highlights the government’s efforts to accelerate the adoption of digital health and medtech innovation through the National HealthTech Access Programme, value-based procurement reforms, and streamlined NHS adoption pathways. It also emphasizes investment in digital health infrastructure, including the new Health Data Research Service and regulatory initiatives such as the MHRA’s AI Airlock program. Together, these measures are intended to support faster patient access to innovative technologies and strengthen the UK’s position as a leading location for health technology innovation.
MHRA Publishes Guidance on Ambient Voice Technology-Enabled Products. The MHRA has published new guidance on ambient voice technology (AVT)-enabled products. AVTs are AI-powered tools that automatically capture and convert spoken words into text and/or other outputs. Increasingly, AVTs are GenAI-based, with powerful, general-purpose Large Language Models underlying. The guidance provides practical examples of when an AVT-enabled product will not qualify as a medical device, including: (1) ambient scribes intended to provide a transcript or summary of a clinical conversation between a clinician and a patient; (2) AVT products that format information from an encounter for a clinician to review, edit, and confirm; and (3) AVT products that suggest possible clinical codes for clinician review based on a clinical conversation. The guidance also provides examples of AVT products that will qualify as medical devices, such as AVT products that can provide “generated insights” that suggest diagnoses or treatment options. There is also guidance on the risk classification of AVT products that qualify as a medical device.
MHRA Updates Guidance on Digital Mental Health Technologies. The MHRA has updated its guidance on the qualification and classification of digital mental health technologies (DMHT), which is intended to help manufacturers determine whether their products qualify as software as a medical device (SaMD). The revisions include additional information on the circumstances in which a technology would not be a medical device. For example, the guidance explains that some digital technologies will be made up of various software modules where some qualify as SaMD and others do not. Manufacturers can choose to regulate the DMHT modules that qualify as SaMD as separate products or all the modules as one product. The guidance has also been updated for consistency with the new guidance on AVTs discussed above.
MHRA Updates Guidance on Registration of Medical Devices. The MHRA has updated its guidance on registering medical devices placed on the market or put into service in Great Britain. The guidance clarifies the MHRA’s expectations with regard to registration of devices that are “put into service” but not “placed on the market,” in that MHRA registration is encouraged for such devices, though this is not legally required. New guidance also provides practical examples of when a device should be considered to be “put into service.”
UK Parliament Launches Work on Regulation of AI in Drug Discovery. The Parliamentary Office of Science and Technology (POST) has announced a new project examining how AI models used in drug discovery are evaluated and regulated in the UK. The work will explore the growing use of AI to design novel molecules, predict drug behavior before clinical testing, and support decisions on which drug candidates progress into development, alongside questions about validation, bias, reliability, and regulatory oversight. POST notes that the global AI drug discovery market is estimated at approximately $1.7 billion in 2024 and could exceed $8 billion by 2030. Stakeholders have been invited to contribute evidence until September 18, 2026, with publication of the final outcome expected in December 2026.
MHRA Publishes Case Studies From AI Airlock Sandbox Phase 2. The MHRA has published case reports from Phase 2 of its AI Airlock Sandbox, providing practical insights into regulatory challenges faced by developers of AI as a medical device. The case studies informed the recommendations set out in the AI Airlock Sandbox Phase 2 program report (as reported in our July 2026 Digest) and cover a range of topics, including intended purpose and validation, AI-powered in vitro diagnostic devices, regulatory intelligence, post-market surveillance, and the management of software changes. MHRA has also updated Recommendation 20 of the report aimed at manufacturers of AI as a medical device. It states that qualification as a medical device cannot effectively rely on wording choices or disclaimers alone and product function and purpose should be demonstrated through example outputs and user journeys. Where products sit near the qualification boundary, manufacturers are encouraged to engage with the MHRA prior to deployment.
Privacy Updates
EDPB Adopts Guidance on AI Web Scraping Anonymization and Blockchain. On July 7, 2026, the European Data Protection Board (EDPB) adopted draft guidelines on web scraping for generative AI training (legal basis for scraping; conditions for processing special category data) and on anonymization (a practical framework for assessing when data is successfully anonymized). Both guidelines are open for public consultation until October 30, 2026, and further details about the anonymization guidelines can be read in our July 2026 BioSlice Blog. The EDPB also finalized its guidelines on blockchain processing following consultation.
UK Government Opens Calls for Evidence on Data/AI Regulation and International Transfers. On July 15, 2026, the UK government launched a call for evidence on how personal and non-personal data regulation interacts with AI and other data-intensive technologies, and whether further guidance, targeted changes, or more fundamental reform is needed. A parallel call for evidence sought views on whether the UK’s international data transfer regime is enabling trusted data flows. Both close on September 9, 2026.
ICO Publishes Draft Corporate Strategy. On July 10, 2026, the Information Commissioner’s Office (ICO) published its draft corporate strategy for 2026-2028, intended to bridge its current model to the future Information Commission governance structure (transition expected in autumn 2026). Four priorities are confirmed: protecting children, promoting trust and transparency in AI, improving public sector use of personal data, and building cyber resilience. The ICO aims to set clear expectations for the responsible use of personal data in AI, to reduce regulatory uncertainty and to alleviate concerns about safety, fairness, bias, and transparency in order to realize the full benefits of AI in society.
Product Liability Updates
UK Jurisdiction Taskforce Publishes Final Legal Statement on Liability for AI Harms. Following a public consultation, the UK Jurisdiction Taskforce has published its final legal statement on liability for AI harms under the private law of England and Wales. The statement concludes that existing English law is generally capable of addressing harms caused by AI without the need for AI-specific legislation. It identifies contract and the common law of negligence as the principal mechanisms through which liability may arise, and considers how established doctrines such as professional liability, vicarious liability, non-delegable duties, product liability, and causation apply in an AI context. The statement also addresses liability for AI-generated statements, including chatbot outputs, and confirms that outcomes will depend on established legal principles applied to the particular facts of each case.
IP Updates
UKIPO Clarifies Patent Examination Practice for AI Inventions Following Emotional Perception. On July 14, 2026, the UK Intellectual Property Office (UKIPO) published a practice note on the search and examination of UK patent applications following the Supreme Court of the United Kingdom’s decision in Emotional Perception AI Limited v. Comptroller General of Patents, Designs and Trade Marks [2026] UKSC 3, covered in our March and May 2026 Digests. The practice note provides practical direction on how patent examiners should assess computer-implemented inventions, including inventions involving AI and artificial neural networks (ANNs). The practice notice confirms that the long-standing Aerotel approach should no longer be followed and reflects the Supreme Court’s move towards closer alignment with the European Patent Office. In particular, examiners must first determine whether a claimed invention satisfies the patent-eligibility threshold by applying an “any hardware” test. They must then identify, on a feature-by-feature basis, which aspects of the claimed invention contribute to its technical character before assessing novelty and inventive step. Only those features which contribute to the technical character of the invention may be taken into account for the purposes of inventive step. The practice note is particularly relevant for applicants seeking patent protection for AI-enabled technologies. While the Supreme Court confirmed that ANNs may constitute computer programs for the purposes of the Patents Act 1977, the UKIPO has made clear that the central question will often be whether the claimed invention makes a technical contribution capable of supporting patentability. The practice note, therefore, provides greater clarity on how AI-related patent applications will be examined in the UK, although its practical impact will depend on how the revised framework is applied during examination.
*Jack Chisem contributed to this Newsletter. Jack is employed as a paralegal in Arnold & Porter’s London office.
© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.
Key Contacts
