Wade’s Health Law Highlights for November 10, 2026

Fraud & Abuse / Enforcement

• Texas secured a $45 million settlement with Gilead Sciences over manufacturer patient support programs it treated as illegal inducements under state law. The Texas Attorney General announced the settlement on October 22, four months after a $34 million settlement with AstraZeneca that resolved similar allegations. Both cases were brought under the Texas Health Care Program Fraud Prevention Act and the Texas Anti-Kickback Statute, and the Gilead case began as a qui tam filed by relator Health Choice Advocates in 2020. Texas characterized free nursing services and patient education as in-kind remuneration to prescribers, and the Gilead settlement releases that conduct as its own category without any marketing allegation. The state also targeted reimbursement support, such as prior authorization and appeals help, as work prescribers are “duty bound” to perform themselves. Source: Bass, Berry & Sims
• FDA issued a warning letter to Elgin, Texas-based RonanRx for false or misleading claims about compounded semaglutide and tirzepatide. The October 30, 2026 letter followed FDA’s September review of the company’s website and its posts on X. FDA cited product labels bearing the RonanRx name even though the company is not the compounder, website categories labeled “FDA-Approved Compounded Medications,” and a video comparing its products to Ozempic. The agency also found that describing the drugs as “American made” and “farm-to-table” was misleading because its records list no U.S.-registered manufacturer of the active ingredients, and it said disclaimers did not cure the overall impression. RonanRx has 15 working days to respond, and FDA warned that failure to correct the violations may lead to seizure or injunction. Source: U.S. Food and Drug Administration

Health Data Privacy

• The FTC, California, and Utah sued Hims & Hers, alleging the telehealth company shared consumers’ health data with advertising platforms without informed consent. The 48-page complaint, filed in the U.S. District Court for the Northern District of California, cites uploaded customer lists, Meta’s Pixel and Conversions API, and pixels tied to other ad platforms, set against privacy promises made in ads, influencer posts, and podcasts. The FTC also raised claims about subscription activation, billing disclosures, refill timing, and cancellation. California relied on its False Advertising and Unfair Competition Laws and Utah on its Consumer Sales Practices Act rather than on their consumer privacy statutes. Hims has denied the allegations and said it will defend the suit. Source: Gouchev Law

Data Breaches

• A Marathon Health data breach reportedly affected nearly 5.7 million individuals after an attacker posing as company IT staff obtained an employee’s credentials. The Indianapolis-based employer-sponsored primary care provider identified the activity on August 24, 2026, and the attacker exported data from a cloud-hosted application within a few hours that day. Law firm Emery Reddy reports that the Texas Attorney General was told 5,684,735 individuals are being notified, which would make it the fourth-largest breach reported by a HIPAA-regulated entity this year. The compromised data included names, contact information, dates of birth, Social Security numbers, and, according to some state notices, medical and health insurance information. Some recipients never received care from Marathon, because the company holds data on all enrolled plan members of its employer clients. Source: The HIPAA Journal
• Five health care organizations, including two in Texas, disclosed data breaches affecting more than 67,000 individuals combined. New York-based Cognitive Health Technologies reported unauthorized access to its network between February and April 2026 that exposed medical histories and treatment information of 49,467 individuals. City Ambulance Service in Spring, Texas, reported an email-related hacking incident affecting 14,324 individuals, and the Qilin ransomware group claimed responsibility and published the stolen data. Houston-based mental health provider Innovative Alternatives reported a ransomware attack that exposed clinical counselling notes of about 1,500 clients, employees, and donors. Baraga County Memorial Hospital in Michigan and The Speech Clinic in Georgia also reported incidents. Source: The HIPAA Journal

HIPAA Compliance

• Clinicians who text or call patients from personal cell phones put protected health information outside the organization’s control. HIPAA does not prohibit any device, but the Security Rule requires covered entities to safeguard ePHI that a device creates, stores, or transmits. Standard SMS lacks end-to-end encryption and administrative controls, and texts and voicemails can sync to personal tablets, computers, and cloud backups. When a clinician leaves, the organization cannot remove patient messages from a personal account or produce the audit trail HIPAA audit controls require. The author recommends routing patient calls and texts through an approved, clinic-managed service with access controls, retention rules, and a signed business associate agreement. Source: Healthcare IT Today
• Updates to the HIPAA Security Rule are expected to be finalized in July 2027 and would add new mandatory safeguards for practices. The proposed rule would eliminate the “addressable” category for implementation specifications, which OCR says some practices misread as optional. New requirements would include asset inventories and network maps, annual compliance audits, vulnerability scanning every six months, annual penetration testing, multifactor authentication, network segmentation, 72-hour system restoration procedures, and annual business associate verification. The Security Rule has not had a major overhaul since 2003. Practices are advised to conduct or update a Security Risk Analysis now, since a gap analysis or checklist does not satisfy the requirement. Source: California Dental Association

Artificial Intelligence

• AI-assisted medical coding requires workflows that give coders the time and authority to override the system’s recommendations. With AI tools, coders start from a suggested code rather than the record, and their job is to determine independently whether the documentation and coding guidance support it. Productivity expectations that reward quick acceptance can discourage coders from challenging the technology. Override rates should be read in context, since a falling rate may reflect better technology or growing coder reliance on it. Auditors should review whether documentation was actually examined and questionable recommendations challenged, not just whether the final code was correct. Source: VMG Health
• Texas A&M researchers have developed AI agents that check in patients, screen for early dementia, and accompany children through procedures. The team, led by Dr. Mark Benden of the School of Public Health, licensed the tools to a startup called Humanate. An AI medical receptionist that works in more than 100 languages, including American Sign Language, is being tested at sites in Texas and Mississippi. A virtual interviewer combines screening questions with facial expressions, response times, and biometrics to build a risk profile for apathy, an early indicator of neurodegenerative disease. The developers say the tools are designed to escalate to a person when needed rather than replace staff. Source: Fast Company

Patient Safety

• Police charged a former patient care technician at Carrollton Regional Medical Center with sexually assaulting a patient and believe there may be more victims. Ernest Ussin Jr., 46, faces one count of indecent assault by a health care or mental health provider after a patient reported waking to find him assaulting them in their hospital bed. Carrollton police responded to the hospital on Monday and arrested Ussin on Tuesday under a warrant. The hospital’s CEO said the hospital terminated Ussin’s employment and is cooperating with law enforcement. Police said the alleged conduct appears limited to the hospital setting. Source: CBS Texas