Virtual & Digital Health Digest

This digest covers key virtual and digital health regulatory and public policy developments during September and early October 2026 from the United States, United Kingdom, and European Union.

In this issue, you will find the following:

U.S. News

• Health Care Fraud and Abuse Updates
• Privacy and Artificial Intelligence (AI) Updates
• Policy Updates
• FDA Updates

U.S. Featured Content

This month’s most significant development comes from Capitol Hill, where the Senate unanimously passed the Health Care Cybersecurity and Resiliency Act of 2026, a sweeping measure that would update the Health Insurance Portability and Accountability Act (HIPAA) Security Rule to mandate minimum cybersecurity practices for regulated entities and directs the U.S. Department of Health and Human Services (HHS) and Cybersecurity and Infrastructure Security Agency (CISA) to coordinate on incident response across the health care sector, sending the bill to the House for further consideration. The month also saw active legislative and oversight debate on artificial intelligence (AI) and health data security, including a blocked attempt to advance the Artificial Intelligence Risk Management and Security Act and continued congressional scrutiny of the Wasteful and Inappropriate Service Reduction (WISeR) prior authorization model. On the fraud enforcement front, an Oklahoma chiropractor and business owner was sentenced to 14 years in prison for a $30 million Medicare, TRICARE, and U.S. Department of Veterans Affairs (CHAMPVA) scheme built on illegal kickbacks and sham telemedicine orders, while a Florida doctor was ordered to pay more than $3 million in restitution for signing fraudulent documentation tied to a multimillion-dollar genetic testing and durable medical equipment (DME) scheme. Rounding out the edition, the U.S. Food and Drug Administration (FDA) accepted two new participants into its Technology-Enabled Meaningful Patient Outcomes (TEMPO) digital health pilot, including an AI-powered cognitive behavioral therapy tool and a smartphone application targeting depression and anxiety in Medicare beneficiaries, and issued draft guidance on premarket submissions for robotically assisted surgical devices, with public comments due November 24, 2026.

EU and UK News

• Regulatory Updates
• Privacy Updates

EU/UK Featured Content

The most significant development this month in the UK is that the government has accepted all 44 of the AI Commission’s recommendations for a new framework governing AI in health care. The recommendations call for a proportionate, lifecycle-based approach to regulation, including staged authorizations, enhanced post-market monitoring, and greater transparency requirements. The Medicines and Healthcare products Regulatory Agency (MHRA) is also expanding its use of regulatory sandboxes as part of their AI Airlock program and in collaboration with the National Health Service.

Meanwhile, across the channel, September has been a month busy with consultations. The European Commission (EC) carried out a consultation on a draft implementing regulation for HealthData@EU, which is intended to form the infrastructure across Europe for the access of electronic data for secondary use under the European Health Data Space (EHDS) Regulation. The EC plans to adopt the implementing regulation in Q4 2026, and this regulation would then apply from March 26, 2029. In addition, the EC has had a consultation on high-risk AI classification guidelines, to which MedTech Europe has responded expressing concern over potential legal uncertainty for medical devices combining rule-based and AI-based functionalities. Further, the European Data Protection Board has launched a consultation (open until November 13, 2026) on their draft guidelines on the interplay between fines and other General Data Protection Regulation (GDPR) corrective powers.

U.S. News

Health Care Fraud And Abuse Updates

Medical Supply Company Owner Sentenced to 14 Years in Prison for $30 Million Medicare, TRICARE, and CHAMPVA Fraud. On August 13, 2026, Assistant Attorney General Colin M. McDonald issued a memorandum to all personnel in the National Fraud Enforcement Division, setting forth the enforcement priorities of the newly created division. The memorandum identified five priority areas: public trust and financial integrity, health care, internal revenue, global trade and commerce, and corporate misconduct. The memorandum states that the division will use, “cutting-edge data analysis to target exploitative health care fraud schemes,” expressly naming telemedicine programs and Medicare and Medicaid fraud. The memorandum further commits to “supercharging” the Health Care Fraud Strike Force model with additional resources, data analytics support, and technology. 

According to court documents, Loftis and his co-conspirators allegedly concealed from Medicare the ownership and management of their DME company and the unenrolled entities who were billing through it. Loftis also allegedly paid more than $1 million in illegal kickbacks to marketers, purported telemedicine companies, and a call center that persuaded elderly and disabled beneficiaries to disclose their personal information and accept unnecessary DME. He and his co-conspirators also allegedly purchased sham doctors’ orders generated by telemedicine physicians and nurse practitioners who never examined the beneficiaries, and frequently billed for multiple braces at once. In total, the conspirators submitted over $30 million in false claims and were paid more than $8 million.

Florida Doctor Sentenced for Making False Statements in Connection With Multi-Million-Dollar Health Care Fraud Scheme. On September 22, 2026, Simon Grinshteyn, a Florida doctor, was sentenced to four years of probation and ordered to pay more than $3.16 million in restitution for making false statements in connection with a scheme involving medically unnecessary genetic testing and DME. 

According to court documents, between February and June 2020, Grinshteyn allegedly worked with a telemedicine company to sign pre-populated medical documentation and doctors’ orders despite not having contact with the beneficiaries himself and had no provider-patient relationship with them. Yet, DME suppliers and laboratories submitted claims to Medicare based on his signed orders. In total, Medicare paid more than $3.1 million on claims based on the false documentation.

Privacy and AI Updates

U.S. Senate Passes Health Care Cybersecurity and Resiliency Act. On September 30, 2026, the U.S. Senate unanimously passed the Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315), sponsored by Senator Bill Cassidy (R-LA). The bill directs the Secretary of HHS and the Director of CISA to coordinate cybersecurity preparedness and incident response within the health care and public health sector. Among other things, the bill would require HHS to update the HIPAA Security Rule to mandate HIPAA-regulated entities, including digital health device manufacturers acting as HIPAA business associates, and certain critical infrastructure entities to adopt minimum risk-based cybersecurity practices, including multifactor authentication, encryption of protected health information, and monitoring such as penetration testing, informed by frameworks such as the National Institute of Standards and Technology Risk Management Framework. The bill now proceeds to the House of Representatives for consideration.

FDA Accepts New TEMPO Pilot Participants. The FDA recently approved two new participants for its TEMPO for digital health devices pilot. Manufacturers participating in the pilot are to collect, monitor, and report real-world data on their devices’ performance in the treatment of one of four conditions: early cardio-kidney-metabolic (hypertension, dyslipidemia, obesity or overweight with marker of central obesity, or prediabetes); cardio-kidney-metabolic (diabetes, chronic kidney disease, or atherosclerotic cardiovascular disease); musculoskeletal (chronic musculoskeletal pain); and behavioral health (depression or anxiety). The devices to be tested by the new participants are Limbic Inc.’s Unpacked, an AI-voice-agent-delivered cognitive behavioral therapy tool for Medicare beneficiaries with clinically significant depression and/or anxiety, and SonderMind Inc.’s Adjunctive Care Application, a smartphone application intended to reduce depression and anxiety in adults as an adjunct to psychotherapy or pharmacotherapy. The FDA intends to include up to 10 devices in each of the four clinical areas covered by the pilot.

Policy Updates

Senate Passes Health Care Cybersecurity and Resiliency Act of 2026. On September 30, 2026, the Senate passed the Health Care Cybersecurity and Resiliency Act of 2026 (S. 3315) by unanimous consent. The bill would authorize cybersecurity grants, strengthen federal coordination, update health data security standards, and require HHS to develop an incident response plan.

Senate Examines Threats From Autonomous AI Agents. On September 30, 2026, the Senate Homeland Security and Governmental Affairs Committee’s Subcommittee on Disaster Management, District of Columbia, and Census examined threats from autonomous AI agents. The American Hospital Association (AHA) submitted a statement describing risks from AI-assisted cyberattacks to hospital operations, patient care, and medical information, including patient data exposure and greater risks for rural hospitals with aging technology.

Senators Seek Unanimous Consent to Pass the Artificial Intelligence Risk Management and Security Act of 2026. On September 29, 2026, Sens. Mark Warner (D-VA), Brian Schatz (D-HI), and Andy Kim (D-NJ) sought unanimous consent to pass the Artificial Intelligence Risk Management and Security Act of 2026 (S. 5576), but Sen. Ted Cruz (R-TX) objected. The bill would establish enforceable model testing, security, and incident reporting requirements for advanced AI systems. Sen. Warner cited potential AI threats to hospitals that the legislation would partly address.

Senators Ron Wyden and Mark Warner Reintroduce the Health Infrastructure Security and Accountability Act of 2026. On September 17, 2026, Senate Finance Committee Ranking Member Ron Wyden (D-OR) and Sen. Mark Warner (D-VA) reintroduced the Health Infrastructure Security and Accountability Act of 2026 (S. 5443). The bill would establish mandatory cybersecurity standards, require security testing and audits, and provide $1.3 billion for hospital cybersecurity, including $800 million for rural and underserved hospitals.

Senators Urge OPM to Suspend Expanded Collection of Individual Health Claims Data. On September 16, 2026, Sen. Adam Schiff (D-CA) and five Democratic colleagues urged the Office of Personnel Management (OPM) to suspend expanded collection of individual health claims data. They raised concerns about re-identification, 30-year retention requirements, and automated fraud detection without documented human review.

Senator Patty Murray Questions HHS Deputy Secretary Nominee. On September 16, 2026, Senate Appropriations Committee Ranking Member Patty Murray (D-WA) questioned HHS Deputy Secretary nominee Chris Klomp about AI in Medicare prior authorization under WISeR. Klomp said contractor performance reports were forthcoming and committed that the model should not expand further unless it demonstrates improvements to patient care.

FDA Updates

FDA Draft Guidance, Robotically-Assisted Surgical Devices — Premarket Submissions. FDA issued new draft guidance on September 24, 2026. The guidance addresses the information FDA recommends sponsors include in premarket submissions for robotically assisted surgical devices (RASDs). This is intended to promote more consistent and efficient review of these systems, which FDA describes as teleoperated, software-controlled systems that assist qualified practitioners in positioning and controlling surgical instruments during open, minimally invasive, or endoluminal procedures. It does not address pre-operative planning or stereotaxic systems, remotely teleoperated systems, autonomous robots that independently perform significant aspects of surgery, or certain systems used to place interventional devices. Comments are due November 24, 2026. 

The draft guidance recommends that sponsors provide system level information and evidence addressing the RASD’s hardware, instruments and accessories, software, user interface, connectivity, and interoperability. Recommended support includes nonclinical performance testing; software validation, cybersecurity, and electromagnetic compatibility information; human factors testing; and evaluation of foreseeable failures and emergency procedures. The evidence needed for a particular submission will depend on the device and its proposed uses. FDA describes a least-burdensome approach under which bench and other non-clinical testing may be supplemented by animal studies or clinical data. FDA notes that clinical data will be expected for new RASDs or for significant changes, new uses, or particular performance claims, suggesting that clinical data may therefore not be necessary for other submissions. However, when considered necessary, such clinical support may come from prospective studies, real-world evidence, or literature, as appropriate. In the least-burdensome approach, FDA describes an “umbrella and covered procedure” approach under which in vivo data from a sufficiently complex, higher-risk procedure may support specified lower-risk procedures within the same surgical specialty without separate procedure-specific in vivo testing. 

EU and UK News

Regulatory Updates

UK Government Publishes Fact Sheet and Impact Assessments on Health Bill Medicines Reforms. The Department of Health and Social Care published a fact sheet explaining the health bill’s reforms to medicines and medical devices regulation. The bill would make it easier to update regulations by allowing ambulatory references to external standards, more proportionate consultation, and the negative procedure for minor technical changes. It would also give the MHRA clearer powers to share information with UK and international partners without relying on individual agreements. Finally, it contains the enabling power for a future medical device licensing regime, including software- or AI-enabled devices, which could involve the MHRA assessing and licensing devices directly, rather than relying on third-party UK approved bodies. The detail of such regime has been left to later regulations. The MHRA reforms impact assessments indicate that the information sharing powers could shorten time to market by three to six months in some cases.

MHRA Launches Call for Evidence on AI in Medicines Development. The MHRA and the Regulatory Innovation Office (RIO) have launched a call for evidence on the use of AI in medicines safety and development. The survey seeks input from companies, researchers, and other stakeholders on how AI is being used, or could be used, to improve the prediction and assessment of medicine safety by combining preclinical, clinical, and real-world data across different populations and conditions. In particular, the focus is on the Absorption, Distribution, Metabolism, Excretion, and Toxicity (ADMET) of medicines to help identify safety risks earlier. Feedback will help inform the development of the UK’s “Beyond ADMET: AI for Medicines Safety” regulatory sandbox, announced in June 2026, and shape future regulatory policy and engagement in this area. Responses can be submitted until December 22, 2026, and stakeholders are encouraged to submit examples to demonstrate current practice and challenges. 

UK Government Accepts UK AI Commission’s Recommendations for New AI Regulatory Framework in Health Care. In a significant development for AI governance in health care, the UK government has accepted all 44 recommendations made by the UK’s National Commission into the Regulation of AI in Healthcare and has set out how they will be used to create a future-ready regulatory framework for the development, regulation, and adoption of AI technologies. The move is intended to ensure that the UK remains at the forefront of safe and responsible AI innovation in health care. The commission, established by the MHRA, recommended that AI regulation should be proportionate, lifecycle-based, and system-wide, reflecting the evolving nature of AI technologies and their use in clinical practice. Key recommendations include staged authorizations for new AI models, enhanced and continuous post-market monitoring, greater transparency around the use and performance of AI systems, and strengthened enforcement powers if AI tools fail to meet requisite standards. 

MHRA Launches Phase 3 of the AI Airlock. The MHRA has announced the launch of Phase 3 of AI Airlock, its regulatory sandbox for AI-enabled medical devices. Following a successful pilot and Phase 2 program, AI Airlock has secured a further three years of government funding, underscoring continued support for innovation in this area.

Phase 3 will focus on post-market surveillance and lifecycle regulation, aligning closely with the themes at the heart of both the commission’s recommendations and the government’s response outlined above. Applications are now open for innovators wishing to participate in the program, with a webinar for prospective applicants scheduled for October 22, 2026.

MHRA and Manchester NHS Launch Health Innovation Sandbox. The MHRA and Manchester University NHS Foundation Trust have launched a partnership to test health technologies in real-world NHS settings. The Manchester Sandbox will generate evidence on technologies’ safety, effectiveness, and impact on routine use, with the aim of supporting informed adoption across the NHS. Initial projects are expected to include AI-enabled medical devices, such as tools that identify patients at higher risk of complications from long-term conditions. The program will bring together health care providers, regulators, and innovators to evaluate technologies under appropriate oversight and regulatory safeguards. Lessons from the sandbox will be shared across the NHS, and the MHRA plans to invite expressions of interest from medical device developers for the program’s next phase. 

EFPIA Supports European Commission’s Cloud and AI Proposal. The European Federation of Pharmaceutical Industries and Associations (EFPIA) has welcomed the EC’s proposed Cloud and AI Development Act (CADA), which aims to strengthen Europe’s cloud, computing, and AI infrastructure. EFPIA notes that AI and advanced computing are increasingly important across the health care and life sciences sectors, including for clinical research, real-world evidence generation, and pharmacovigilance. The industry body supports measures to expand access to computing capacity and promote AI adoption, while emphasizing the importance of maintaining interoperability and global scientific collaboration. EFPIA also highlights potential links with the European Health Data Space, which could support greater use of health data for AI-enabled research and innovation.

MedTech Europe Responds to Commission Consultation on High-Risk AI Classification Guidelines. MedTech Europe has responded to the EC’s consultation on draft guidelines for classifying high-risk AI systems under the AI Act, highlighting potential legal uncertainty for medical devices combining rule-based and AI-based functionalities. In particular, it calls for clarity on whether the whole system or only specific components should be considered AI, as well as on the definition of an AI system and the distinction between AI systems that are product components and those that are products in their own right. MedTech Europe also stresses the need to align the guidelines with the outcome of the Digital Omnibus on AI. For more details on the Digital Omnibus on AI generally, read our BioSlice Blog post. 

Privacy Updates

ICO Updates FOI Guidance on the Public Interest Test Following Supreme Court Ruling. The ICO has updated its guidance on the public interest test under the Freedom of Information Act 2000 following the Supreme Court’s judgment in Department for Business and Trade v. Information Commissioner [2025] UKSC 27. The Court confirmed that where multiple qualified exemptions apply to the same information, the public interest factors supporting those exemptions can be considered cumulatively when weighed against the combined public interest in disclosure. The guidance also clarifies what authorities should tell applicants in a refusal notice and what is expected of them if the ICO receives a complaint.

ICO Becomes the Information Commission. On September 30, 2026, the Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026 brought into force the Data (Use and Access) Act (DUAA) provisions abolishing the office of Information Commissioner and transferring its functions to the Information Commission, a new body corporate, led by a board (as flagged in our July edition). The government has confirmed that the commission takes over all of the ICO’s existing functions and responsibilities. No immediate action is required, but companies should update references to the regulator in privacy notices, data processing agreements, and breach-response procedures over time.

Italian DPA Fines IQVIA €7 Million Over Pseudonymized Health Data. On September 23, 2026, the Italian data protection authority (the Garante) fined IQVIA Solutions Italy €7 million under the GDPR. The decision concerns a database of patient records collected from around 800 general practitioners and covering around a million patients. See our BioSlice Blog for full details. 

Commission Consults on Draft Implementing Regulation for HealthData@EU. The commission has launched a consultation on a draft implementing regulation setting out the technical framework for HealthData@EU, the cross-border infrastructure for accessing electronic health data for secondary use under the European Health Data Space Regulation (Regulation (EU) 2025/327). The draft covers the infrastructure’s architecture, security, and interoperability requirements. The regulation would also establish an “Enforcement Information Exchange Tool” for health data access bodies to exchange information on enforcement measures. The consultation closed on September 29, 2026. The commission plans to adopt the regulation in Q4 2026, and the regulation would then apply from March 26, 2029.

EDPB Adopts Guidelines on the Interplay Between Fines and Other GDPR Corrective Powers. At its September 17, 2026 plenary, the European Data Protection Board (EDPB) adopted guidelines on the application of the power to impose administrative fines in relation to other corrective powers under the GDPR. The guidelines set out a five-step methodology for supervisory authorities deciding whether to fine an infringement, replacing the WP29 fining guidelines. They are open for public consultation until November 13, 2026.

EDPB Finalizes Guidelines on the Interplay Between the DSA and the GDPR. Following public consultation, the EDPB adopted the final version of its guidelines on the interplay between the Disabled Students’ Allowance (DSA) and the GDPR. The guidelines support consistent application of both instruments, particularly where DSA provisions on intermediary service providers rely on GDPR concepts and definitions.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Newsletter is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.