This week

• Cybersecurity
• Drugs and Devices
• Laboratories
• Mergers & Acquisitions
• Private Equity
• Reproductive Rights

Cybersecurity

• Healthcare remains the sector with the costliest data breaches, with incidents averaging $7.42 million in damages and marking the 12th consecutive year the industry topped breach costs. Health records sell for up to $250 on the dark web. It is projected that ransomware will impact 40% of US healthcare systems by 2026, causing care delivery disruptions at 60% of hospitals. The 2025 HIPAA Security Rule updates propose mandatory multi-factor authentication, 60-day breach reporting deadlines, and network segmentation requirements. NIST has introduced post-quantum cryptography standards including ML-KEM and ML-DSA to protect against future quantum computing threats. Technologies like federated learning and differential privacy enable AI development while protecting patient data, and Zero Trust Architecture has become standard for healthcare security. Source: Cybernews

Drugs and Devices

• AI is transforming healthcare and biotechnology through advancements in drug discovery, genomics, medical imaging, and personalized medicine, with the global AI market expanding rapidly through 2032. By 2030, AI is predicted to play a role in developing more than half of new drugs. The researchers examined multimodal AI models, drug discovery algorithms, precision medicine platforms, genomics tools, and automated diagnostics, finding rapid growth in AI-related publications and patents. However, the authors identified challenges including publication bias favoring outcomes, limited access to unpublished data, underreporting of failures, and concerns about accessibility in English-language publications. The researchers recommend systematic reviews of gray literature, inclusion of insights, and adoption of bias-aware bibliometric techniques to ensure balanced assessment of AI’s impact. Source: Foley & Lardner LLP
• Medical device manufacturers must address three elements when handling FDA recalls and CAPA investigations: recurrence prevention, escape analysis, and fraud considerations, according to the REF Rule framework. The U.S. will formally harmonize 21 CFR 820 with ISO 13485 and ISO 14971 in three months from October 2025. Device corrections can result in voluntary recalls, mandatory recalls, or market removal, with each non-conformance requiring documented CAPA investigation. The costs of device recalls and non-compliance reach $7.5 to $9 billion annually, with an additional $1 to $2 billion in lost sales and product development, according to a 2023 study. In September 2025, Exactech Inc. paid $8 million to settle false claims allegations for selling defective knee replacement implants to the Department of Veterans Affairs. Source: Gardner Law
• Texas Attorney General Ken Paxton sued Johnson & Johnson and Kenvue, claiming they deceptively marketed Tylenol to pregnant women despite alleged links to autism and other disorders. The lawsuit marks the first from a state government since President Donald Trump claimed in September that Tylenol use during pregnancy is linked to autism, though no published study has found a direct cause and effect. Kenvue stated that acetaminophen is the safest pain reliever for pregnant women and that the claims lack legal merit and scientific support. Louisiana Republican Senator Bill Cassidy said the lawsuit should be thrown out because the evidence is weak, while the American College of Obstetricians and Gynecologists continues to recommend acetaminophen as the safest painkiller during pregnancy. A similar civil suit against Kenvue was thrown out by a judge citing lack of evidence and is under appeal with hearings set in November in New York. Source: ABC News

Laboratories

• The Centers for Medicare and Medicaid Services will transition the Clinical Laboratory Improvement Amendments program to paperless operations on March 1, 2026. After this date, CMS will no longer send paper fee coupons, paper CLIA certificates, or CLIA update notifications to laboratories. Laboratories can update their email addresses through three methods: contacting their state agency, completing an updated CMS 116 Application form, or for accredited laboratories, contacting their Accreditation Organization. Following the March 1 deadline, CLIA certificates will be sent electronically and fees will be processed through the Pay.gov platform. CMS will work with state agencies and accreditation organizations until May 2026 to assist laboratories that miss the cutoff date. Source: Polsinelli

Mergers & Acquisitions

• Compliance programs have become determinants of liability and valuation in healthcare mergers and acquisitions under current DOJ and OIG enforcement policies. The DOJ and HHS Office of Inspector General require healthcare entities to maintain functional compliance systems with seven foundational elements including written policies, leadership oversight, training, risk assessment and corrective action. Acquirers face successor liability for target companies’ pre-closing violations if they continue operations without addressing past misconduct or fail to integrate targets into their compliance infrastructure. The DOJ-HHS False Claims Act Working Group, revived in 2025, coordinates cross-agency enforcement that traces corporate misconduct across mergers and reorganizations. Companies can reduce exposure through the DOJ’s Voluntary Self-Disclosure Policy, but the Corporate Whistleblower Awards Pilot Program allows insiders to report violations directly to the government for financial rewards. Source: Stevens & Lee
• The One Big Beautiful Bill Act has cut Medicaid payments to states by approximately $1 trillion over 10 years, causing US healthcare M&A activity to fall to the lowest level in over a decade. The 15% cut to the federal program has created valuation uncertainty, with initial offers now coming in one to two EBITDA turns lower than deals from a year ago. The number of transactions in 3Q25 fell 28% year-over-year to 290, the lowest quarterly total since 1Q15, according to Mergermarket data. MedSuite ended its sale process in early September after sponsor Greater Sum Ventures paused due to market conditions, while Abound Health pulled its sale process in September after three rounds of bids amid valuation concerns tied to rate cuts in North Carolina. Colorado imposed 1.6% spending cuts across the board to healthcare providers after needing to fill a $783 million budget hole, of which $90 million was attributable to federal Medicaid cutbacks. Source: ION Analytics
• Healthcare mergers and acquisitions increased from Q2 to Q3 2025, with the physician practice management sector recording 130 deals and reaching a quarterly high for the year. The One Big Beautiful Bill Act, signed into law on July 4, changed Medicaid eligibility and provisions of the Affordable Care Act. Sycamore Partners completed a $10 billion acquisition of Walgreens Boots Alliance on August 28, while UnitedHealth closed a $3.3 billion purchase of Amedisys in August after two years of regulatory review. Private equity firms and their portfolio companies announced 507 healthcare transactions through September, with 35% occurring in the physician practice management sector. The dental space accounted for 53% of physician practice management transactions in Q3, with 183 reported deals. Source: Bass, Berry & Sims PLC

Private Equity

• Regulators have intensified scrutiny of private equity firms in healthcare, pursuing enforcement actions against both physician practices and investment firms for improper billing, coding violations, and management fees that exceed fair market value. Investigators now target management fees and physician compensation as primary areas of concern, with regulators arguing that non-FMV management fees suggest PE firms are operating medical practices in violation of state corporate practice of medicine laws. PE firms have been fined for charging management fees outside FMV parameters and for coding practices at practice locations. Post-close monitoring has become essential, with purchase price allocation and goodwill impairment testing serving as foundations for financial management and audit readiness. PE firms use income repair mechanisms, rollover equity opportunities, and junior physician equity pathways to retain physicians during the hold period. Source: VMG Health
• The California Governor signed two bills that will regulate private equity and hedge fund involvement in healthcare transactions starting January 1, 2026. Assembly Bill 1415 expands the California Office of Health Care Affordability authority to review transactions involving private equity groups and hedge funds that were previously outside its jurisdiction. Senate Bill 351 prohibits these entities from interfering with physician and dentist judgment on matters including diagnostic testing, referrals, patient care, and workload, and bars them from controlling decisions on medical records, staff hiring based on competence, payor contracts, coding, billing, and equipment selection. The legislation also bans non-compete clauses and restrictions on departing professionals from expressing opinions about quality of care or business practices in management agreements. The bills apply when private equity groups or hedge funds are “involved in any manner” with physician or dental practices, though transactions involving hospital-owned management services organizations are exempt. Source: Healthcare Law Insights

Reproductive Rights

• A New York county judge dismissed a Texas lawsuit Friday that sought to enforce a $113,000 judgment against an abortion provider. Justice David M. Gandin ruled in favor of Ulster County Clerk Taylor Bruck, who refused to file the Texas judgment against Dr. Margaret Daley Carpenter, citing New York’s shield law that protects abortion providers from legal penalties and extradition orders. Texas Attorney General Ken Paxton attempted to send the judgment to Bruck’s office twice along with a court summons, arguing under the Constitution’s Full Faith and Credit Clause that states must recognize other states’ laws. Gandin did not evaluate that constitutional argument, noting that Texas did not request a declaration on the shield law’s constitutionality. Texas has 30 days to appeal the ruling but has not announced plans to do so. Source: The Hill