Insights

As federal and state regulators alike continue to tout holding health care organizations accountable for alleged fraud, waste, and abuse as a top priority, ensuring compliance and minimizing enforcement risk has never been more imperative — or more challenging. Health care organizations operate at the intersection of rapid technological changes and within an increasingly complex regulatory landscape, where the rules governing scrutinized areas such as privacy, AI, billing integrity, and strategic transactions are being written, rewritten, and enforced in real time. Treating compliance as a periodic documentation exercise is simply not an option. Today, an effective risk mitigation strategy must be grounded in two complementary elements: a thorough understanding of evolving regulatory obligations and a candid internal assessment of potential points of exposure.

On June 22, 2026, House Energy and Commerce Committee Chairman Brett Guthrie (R-Ky.) and Ranking Member Frank Pallone (D-N.J.) announced a bipartisan agreement on a revised version of the KIDS Act (H.R. 7757), marking the most significant congressional advance on children's online safety legislation in years. The House passed H.R. 7757, as amended, on June 29, 2026, setting up a potential showdown with the Senate. The revised KIDS Act consolidates elements of 14 pending legislative proposals — including KOSA and COPPA 2.0, both of which have previously passed the Senate and cleared the House Energy and Commerce Committee — into a single, comprehensive framework. The announcement, however, was met immediately with objections from Senate sponsors and civil liberties groups, underscoring the difficult legislative road ahead.

RICO was built for the mob. But Congress gave trade secret victims access to it in 2016, and a recent U.S. Court of Appeals for the Fifth Circuit decision shows that access is real.

In June 2026, federal regulators and lawmakers continued their efforts to improve drug affordability through targeted reforms. These recent developments will primarily impact pharmaceutical manufacturers, managed care organizations, and pharmacy benefit managers (PBM) serving Medicare Part D program members. PBMs, Medicare Advantage organizations, and Part D sponsors should monitor these changes in the interest of maintaining compliance and providing input on regulatory proposals that may influence their business operations or compensation structures in the future.

On June 17, 2026, the U.S. Department of Justice’s (DOJ( National Security Division (NSD) announced that it had issued a declination for Robert Bosch GmbH (Bosch) relating to potential violations of the Export Control Reform Act, 50 U.S.C. § 4819 (ECRA). Specifically, the DOJ declined to criminally prosecute Bosch’s violations of the Export Administration Regulations’ (EAR) Foreign Direct Product Rule (FDPR), which apparently resulted from two Bosch subsidiaries’ export of products and software manufactured with equipment that was the direct product of U.S. software or technology to Huawei Technologies Co., Ltd. and its “Entity List” affiliates, including Huawei Tech. Investment Co., Ltd., Hong Kong (collectively, Huawei). The same day, the U.S. Department of Commerce Bureau of Industry and Security (BIS) announced a parallel civil administrative settlement with Bosch.

On December 11, 2025, New York Governor Kathy Hochul signed S.8420-A/A.8887-B into law. This first-in-the-nation legislation, called the New York AI Synthetic Performers Disclosure Law, is intended to protect consumers and promote transparency in the age of AI advertising. This law represents a meaningful shift in the legal landscape for AI advertising. For the first time in any U.S. jurisdiction, the mere use of an AI-generated human likeness in a commercial advertisement triggers an affirmative disclosure obligation. The practical implications are significant, particularly for e-commerce retailers, digital advertisers, and agencies that have integrated AI-generated human imagery into high-volume creative workflows.

On June 4, 2026, the U.S. Supreme Court unanimously held that the U.S. Securities and Exchange Commission (SEC) can continue to pursue disgorgement as an equitable remedy in securities fraud cases without showing pecuniary loss by investors. The Court’s ruling in Sripetch v. SEC resolves a split between the U.S. Court of Appeals for the Second Circuit, which concluded that the SEC must demonstrate pecuniary loss, and the U.S. Courts of Appeals for the First and Ninth Circuits, which declined to require such a showing.

Crowell & Moring’s International Trade Group Secures Top Rankings in Chambers USA 2026

The International Chamber of Commerce (ICC) has released its revised 2026 Arbitration Rules (the 2026 Rules), which entered into force on 1 June 2026. The revisions represent a significant update to the 2021 ICC Rules (the 2021 Rules) and reflect a clear institutional focus on efficiency, procedural flexibility, and expedited dispute resolution.

On April 30, 2026, the U.S. District Court for the Northern District of California issued a significant ruling in an insurance coverage dispute between a commercial general liability insurer and its policyholder. The decision addresses several critical issues in insurance law, including the scope and continuity of the duty to defend and the standard for insurer reimbursement of defense costs in mixed-claim actions. The court ruled largely in favor of the insured, SVO Building One, LLC ("SVO"), and the matter now heads toward settlement or trial on SVO's remaining counterclaims.

Last week, the U.S. Department of Justice (DOJ) Antitrust Division (the Division) revealed criminal charges against China International Marine Containers (Group) Co., Ltd. (CIMC) and several other major Chinese companies and executives involved in the manufacture and sale of standard dry shipping containers, which are used for shipping dry, unrefrigerated cargo on ships around the world. One of the executives was arrested at an airport in France and is awaiting extradition to the U.S. The indictment charged these defendants with violating Section 1 of the Sherman Act by conspiring to restrict output and fix prices of standard dry containers, including in the U.S. market, from 2019 to 2024.

On May 13, 2026, the U.S. Court of Appeals for the Federal Circuit affirmed a district court judgment of no infringement in Actelion Pharmaceuticals Ltd. v. Mylan Pharmaceuticals Inc., No. 24-1641. The decision offers important guidance for patent holders and generic manufacturers on the role of industry standards in interpreting scientific terminology during claim construction, prosecution history estoppel, and the disclosure-dedication rule.

On May 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the U.S. National Security Agency (NSA), the Australian Cyber Security Centre, the UK National Cyber Security Centre, the Canadian Centre for Cyber Security, and the New Zealand National Cyber Security Centre, published joint guidance on the “Careful Adoption of Agentic AI Services” (Guidance).

The U.S. Court of Appeals for the Seventh Circuit recently vacated the U.S. Tax Court’s decision in Hyatt Hotels v. Commissioner, a case concerning the taxation of loyalty programs. The Seventh Circuit remanded the case to the Tax Court for further review.

On April 29, 2026, the New York Department of Financial Services (NYDFS) announced the finalization of a $2.25 million settlement with Delta Dental of New York and Delta Dental Insurance Co., resolving allegations that the affiliated companies failed to comply with the state’s stringent cybersecurity, consumer data protection, and incident reporting requirements. For health insurers, managed care organizations, and their third-party service providers operating in New York, the announcement comes as the latest signal that the NYDFS intends to aggressively enforce its cybersecurity regulations — which are widely considered the strictest in the nation following a 2023 overhaul. These regulations, codified at 23 NYCkRR 500 (Cybersecurity Requirements for Financial Services Organizations), apply to any entity licensed under New York insurance law, including health insurers, managed care organizations, and their third-party service providers.

This news bulletin is provided by the International Trade Group of Crowell & Moring. If you have questions or need assistance on trade law matters, please contact Anand Sithian or Simeon Yerokun or any member of the International Trade Group.

Consistent with recent FDA initiatives directed at leveraging AI technologies and improving early-phase clinical trial conduct, the FDA has issued a Request for Information (RFI) for input on a proposed AI-enabled optimization pilot program for early-phase clinical trials. The issues for which FDA is requesting information fall into two categories:  (A) Pilot program design and implementation and (B) Program evaluation metrics and success criteria.

On April 13, 2026, President Trump signed into law the Small Business Innovation and Economic Security Act, which reauthorized the Small Business Innovation Research (SBIR) and Small Business Technology Transfer (STTR) programs.  These programs are Small Business Administration-sponsored initiatives intended to encourage small business contractors to conduct early-stage research and development (R&D) and help foster technological innovation related to U.S. government needs across several federal agencies, including the Department of War, Department of Energy, National Aeronautics and Space Administration, and National Institutes of Health.  SBIR/STTR are sometimes referred to as “America’s Seed Fund.”  Consistent with that characterization, SBIR contractors performing in the defense and technology space are often the focus of venture capital and private equity interest and investment.

The appropriate use of AI tools during the claims review process continues to be a major topic of debate within the health care industry — but in recent weeks, emerging litigation has inspired critics to turn their attention specifically to the technology’s application within federal health programs. On March 25, 2026, the Electronic Frontier Foundation (EFF) filed a lawsuit against the Centers for Medicare and Medicaid Services (CMS), citing the agency’s alleged failure to answer a Freedom of Information Act (FOIA) request for records the EFF believes will provide crucial insight into the design, safeguards, vendor relationships, and real-world performance of the Medicare Wasteful and Inappropriate Service Reduction (WISeR) Model, CMS’s  AI-driven prior authorization pilot program for certain Medicare services.

Several recent class actions filed against Tempus AI, Inc., a health care technology company that combines AI with molecular and clinical data to develop precision medicine services, are the latest in a series of cases illustrating a fast-growing legal risk: the repurposing of genetic and clinical data — collected for diagnostic or treatment purposes — for artificial intelligence (AI) model training, analytics, and downstream commercialization following corporate acquisitions. At the same time, state genetic privacy regulation is expanding rapidly, with Utah and South Dakota being the most recent states to enact new statutes, and legislation advancing in several additional states. Organizations holding genetic datasets need to treat data governance as a core enterprise risk issue, not a downstream compliance matter.