The Compliance Crucible: Navigating Evolving Data, Drug, and Digital Health Regulations

2026-08-05

The past week delivered critical updates across healthcare compliance, from landmark data privacy enforcement to major shifts in telehealth regulation and drug prescribing. TrueEval dissects these pivotal developments, offering healthcare leaders actionable insights to navigate a rapidly evolving landscape.

The landscape of healthcare compliance is not merely shifting; it is undergoing a profound transformation. From unprecedented federal enforcement actions targeting digital health data practices to critical extensions for telehealth prescribing and fundamental changes in drug labeling, the past week has underscored the urgent need for robust, proactive compliance strategies. For telehealth founders, national practice operators, compliance officers, and healthcare investors, understanding these developments is not optional – it is foundational to safeguarding operations, mitigating risk, and seizing opportunities in a highly regulated environment. This TrueEval briefing synthesizes the most impactful compliance intelligence, offering a strategic lens on what these changes mean for your business.

> For more on this topic, see our analysis: [Regulatory Tides Turn: Escalating Enforcement, Telehealth Stability, and Critical Compliance Imperatives](/blog/regulatory-tides-escalating-enforcement-telehealth).

Unprecedented Scrutiny: Data Privacy and Deceptive Practices Under the Microscope

The Federal Trade Commission (FTC) has unequivocally signaled its aggressive stance on consumer health data privacy and transparent business practices, delivering a stark warning to all digital health platforms and healthcare providers operating online. Two significant enforcement actions this past week underscore this commitment, particularly under the Health Breach Notification Rule (HBNR) and the FTC Act's prohibition against unfair and deceptive practices.

First, the FTC, alongside regulators from Utah and California, filed a lawsuit against telehealth provider Hims & Hers. The allegations are severe, claiming the company engaged in deceptive practices by sharing consumers' sensitive health information with third-party advertisers and by implementing deceptive billing and challenging subscription cancellation processes. This multi-state action highlights the coordinated effort among federal and state agencies to protect consumers from practices that erode trust and compromise personal data.

Simultaneously, the FTC initiated its first-ever HBNR enforcement action against GoodRx, alleging the company illegally shared consumers' sensitive health information with advertising platforms like Facebook and Google. GoodRx now faces a $1.5 million civil penalty and a permanent prohibition on sharing user health data for advertising purposes. This case is a critical precedent. It clarifies that even if a platform is not a HIPAA-covered entity, it is not exempt from federal oversight regarding health data. The HBNR applies to a broader range of entities that collect or maintain individually identifiable health information, often filling regulatory gaps where HIPAA may not reach. This means digital health platforms, medspas, wellness apps, and even traditional practices with robust online presences must be acutely aware of how they handle, share, and monetize *all* consumer health information, regardless of their HIPAA status.

What this means for your practice:

Rethink Data Flows: Every healthcare business must conduct a meticulous audit of how patient data flows from intake through treatment, billing, and particularly, any interaction with third-party analytics, marketing, or advertising platforms. Assume *all* health data is sensitive and subject to scrutiny.
Explicit Consent is Non-Negotiable: Ensure your privacy policies are not only robust and comprehensive but also crystal clear, accurately reflecting *all* data sharing practices. Crucially, obtain explicit, informed consent for any data use beyond direct patient care, especially for marketing or research.
Transparency in Billing and Services: The Hims & Hers case highlights the need for absolute transparency in pricing, subscription terms, and cancellation processes. Ambiguous language or difficult cancellation procedures are now direct targets for regulatory action.
Beyond HIPAA: Understand that the FTC Act and HBNR provide broad authority to regulate health data privacy and consumer protection. A HIPAA-compliant entity can still be found in violation of these broader federal statutes.

DEA and FDA Vigilance: Prescribing, Precursors, and Professional Integrity

Federal agencies continue to refine their oversight of controlled substances, drug product integrity, and the qualifications of healthcare professionals. These recent developments illustrate a two-pronged approach: providing temporary flexibility where needed for patient access, while simultaneously tightening controls and upholding ethical standards across the drug supply chain.

First, a major relief for the telehealth sector: The U.S. Department of Health and Human Services (HHS) and the Drug Enforcement Administration (DEA) announced a fourth temporary extension of telemedicine flexibilities for prescribing controlled medications through December 31, 2026. This critical extension averts the anticipated 'telemedicine cliff' that would have reintroduced pre-pandemic in-person visit requirements. It provides much-needed stability for providers, particularly those treating mental health conditions and substance use disorders, ensuring continuity of care. However, practices must view this as a temporary reprieve. The emphasis remains on the eventual finalization of permanent rules, including the proposed 'Special Registration for Telemedicine.' This period should be used to meticulously review and update prescribing protocols, ensuring strict adherence to existing federal and state laws regarding legitimate medical purpose and licensed practice, and to prepare for the inevitable changes when permanent regulations are issued.

Next, the FDA has mandated significant class-wide labeling changes for all approved testosterone products, integrating new safety data from the TRAVERSE clinical trial. This update removes the previous Boxed Warning related to increased cardiovascular risk but adds a new, mandatory warning regarding increased blood pressure based on postmarket studies. Critically, the 'Limitation of Use' language for age-related hypogonadism remains, meaning testosterone is not approved solely for age-related 'low T' without an associated medical condition. For men's health clinics, medspas, and general practitioners, this necessitates immediate updates to informed consent processes, patient education materials, and clinical protocols to emphasize vigilant blood pressure monitoring and appropriate prescribing practices.

The DEA also proposed expanding the definition of 3,4-MDP-2-P methyl glycidic acid (PMK Glycidic Acid) as a List I Chemical under the Controlled Substances Act (CSA), to include its esters, salts, and isomers. While this precursor chemical is not typically handled by most telehealth, medspa, dental, or chiropractic practices, this action underscores the DEA's proactive and broad authority in preventing the diversion of chemicals used in illicit drug manufacturing. It signals a broader trend of the DEA continuously closing regulatory loopholes, which could indirectly affect the supply chain for various healthcare-related substances and highlights the need for comprehensive awareness of evolving drug control measures.

Finally, the FDA issued final debarment orders against two individuals, Angela Anatilde Baquero and Ricardo Andres Acuna, permanently barring them from providing services related to drug product applications. These actions stem from felony convictions related to drug product development or approval. These debarment orders are crucial reminders for *all* healthcare businesses, regardless of whether they directly develop drugs, about the critical importance of rigorous due diligence in hiring and contracting. Engaging with debarred or excluded individuals, even in seemingly unrelated capacities, can expose an organization to significant regulatory risk, including potential exclusion from federal healthcare programs, substantial penalties, and severe reputational damage. Regularly checking federal databases, such as those maintained by the FDA and HHS-OIG, is a non-negotiable best practice.

Telehealth's Evolving Landscape: Stability and Strategic Expansion

The trajectory for telehealth continues to solidify, moving from an emergency response to a permanent fixture in healthcare delivery. Regulatory bodies are providing increased certainty and expanding opportunities for compliant growth.

CMS has finalized a new, simplified 3-step process for adding services to the Medicare Telehealth Services List, making all services identified for 2026 permanent. This landmark update also removes certain frequency limits, permits direct supervision for specific diagnostic imaging via telehealth, and incorporates new behavioral and infectious disease services. For telehealth providers, this represents significant regulatory certainty, enabling more confident long-term investments in infrastructure and staffing. The removal of frequency limits enhances care flexibility, while the expansion of direct supervision for diagnostic imaging could improve patient access and optimize workflows. Practices should immediately review their service offerings against this finalized list and updated supervision requirements to maximize compliance and leverage these new opportunities for patient care and reimbursement.

At the state level, Massachusetts House Bill H.2393, aimed at authorizing the state's entry into the Interstate Medical Licensure Compact (IMLC), has advanced favorably through the legislative process. Should Massachusetts join, it would significantly streamline the process for physicians to obtain licenses in the state, and for Massachusetts-licensed physicians to practice in other compact states. This development would reduce administrative burdens, accelerate expansion opportunities for telehealth platforms and multi-state practices, and enhance the ability to recruit providers and expand patient access across state lines. This trend toward compacts is vital for any practice with national expansion ambitions.

Underlying Financial and Supply Chain Shifts

While not directly impacting most telehealth, medspa, dental, or chiropractic practices, a significant development in drug pricing signals broader shifts across the healthcare ecosystem. The U.S. Department of Health and Human Services (HHS), through its Health Resources and Services Administration (HRSA), announced a revised 340B Rebate Model Pilot Program. This pilot will implement a rebate mechanism for certain drugs, shifting from upfront discounts to rebates for qualifying manufacturers to effectuate the 340B ceiling price. This initiative, while targeted at specific covered entities, is a testament to HRSA's continued efforts to refine and enforce drug pricing compliance. For businesses partnering with or referring patients to 340B covered entities, understanding these underlying shifts in pharmaceutical financial frameworks is crucial for strategic planning and navigating the complexities of the broader healthcare supply chain.

What This Means For Your Practice: Actionable Compliance Directives

The recent wave of regulatory developments underscores several critical imperatives for all healthcare businesses:

Prioritize Data Privacy with Urgency: The FTC's aggressive posture on health data sharing and deceptive practices is a wake-up call. Conduct immediate, comprehensive audits of your data handling practices, particularly concerning third-party advertising and analytics. Ensure your privacy policies are explicit, accurate, and regularly updated, and that you obtain unambiguous, informed consent for any data use beyond direct patient care. Review billing and subscription cancellation processes for absolute transparency.
Proactive Prescribing Protocol Updates: While the DEA's telehealth controlled substance extension provides breathing room, use this time wisely. Review and update all prescribing protocols to ensure strict adherence to state and federal laws, and begin planning for the eventual 'Special Registration for Telemedicine.' For practices prescribing testosterone, immediately update patient counseling, consent forms, and monitoring protocols to reflect the new FDA labeling changes.
Rigorous Due Diligence is Non-Negotiable: The FDA debarments serve as a potent reminder: employ robust background checks for all personnel, contractors, and affiliates against federal exclusion and debarment lists (e.g., FDA, HHS-OIG). Ignorance is not a defense; engaging with excluded individuals carries severe penalties.
Leverage Telehealth Stability for Strategic Growth: CMS's permanent telehealth service list provides unprecedented regulatory certainty. Strategically evaluate your service offerings and invest with confidence in expanding compliant virtual care delivery. Monitor state-level movements on multi-state licensure compacts like the IMLC to inform your national expansion strategy.
Cultivate a Culture of Continuous Compliance: The pace of change is accelerating. Regulatory vigilance, proactive policy adaptation, and ongoing staff training are essential to mitigate risk and ensure sustainable growth. Invest in compliance infrastructure that can track, interpret, and implement evolving requirements across diverse regulatory landscapes.

In this dynamic environment, TrueEval remains your indispensable partner, providing the clarity and actionable intelligence needed to navigate the compliance crucible and secure your organization's future.