Fall 2026

PERSPECTIVE: DINERSTEIN v. GOOGLE: WHEN AI MEETS HIPAA

Artificial Intelligence (AI) is the use of computer technology to perform human tasks such as reasoning and decision-making. The increasing reliance on AI raises the question of whether the use of AI within the health care industry creates privacy risks for patients and whether privacy protections and physician-patient confidentiality rules are adequate under the current framework.

The Department of Health and Human Services (DHHS), through the implementation of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), established such privacy practices. Rule 45 CFR §164.308 sets regulations for HIPAA security standards known as administrative safeguards. These provisions regulate the standardization of electronic health information requiring health plans to “implement policies and procedures to prevent, detect, contain, and correct security violations [by] conduct[ing] an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronically protected health information (PHI) held by the health plan.

However, HIPAA does not regulate health data provided by AI generated health systems with cloud services. HIPAA laws apply to more static human driven situations where one can easily extract PHI and identify patients from databases. Individual states determine how privacy protections are applied for the secure exchange of electronic health data. These laws support what HIPAA lacks in privacy protection.

The court case Dinerstein vs Google raised the issue of whether the sharing of electronic health records violated patient privacy rights. Google in conjunction with the University of Chicago and the University of Chicago Medical Center developed AI tools to predict patient health care needs and assist with clinical decision-making. The University provided Google with de-identified patient electronic medical records for AI research and development governed by a Data Use Agreement. The Data Use Agreement limited the sharing of data to research purposes and prohibited re-identification of patient records. The plaintiff, a patient whose medical records were shared, claims the data sharing practices violated privacy laws and breached contractual obligations.

In 2019, plaintiff filed a class action suit against Google and University of Chicago based on Illinois state privacy violations. The district court dismissed the case for failure to state a claim and for lack of standing. The appellate case focused on whether the injuries claimed amounted to Article III standing and whether any viable claim is at issue. Article III standing is found when (1) there is an injury in fact, (2) causation and (3) remedy.

The appellate court dismissed the case for lack of jurisdiction. The court held that based on the facts none of the injuries claimed were concrete, only theoretical. The appellate court concluded there was no actual harm, no economic injury, no invasion of privacy and no deceptive practices. As a result there is no viable claim the plaintiff could recover from.

The facts of this case show the plaintiff’s health data from the University of Chicago was used for development of an AI tool by Google to assess the likelihood of a given health outcome. Development was based on a risk prediction model. This process is called model training. According to IBM, model training is the process of “teaching” an AI model to optimize performance on a training dataset by learning its patterns and correlations relevant to the model’s eventual use cases so to make reliable predictions on new data. AI models are designed to rely on large volumes of sensitive patient data to predict patient outcomes.

Dinerstein vs Google is significant because it views privacy laws in a context that is blurred because precedent is challenged by the rise of AI and raises important policy questions of what rights patients have over non-HIPAA health information. Stronger safeguards are needed to ensure regulatory compliance of how health data is collected, stored and shared during the process of AI model training and development.

Standard
Summer 2026

PERSPECTIVE: UNDERSTANDING FEDERAL HEALTH LAW IMPLEMENTATION AND ENFORCEMENT

Federal health law is created by Congress. The Department of Health and Human Services (HHS) implements and enforces health laws created by Congress. HHS plays a central role in ensuring health care coverage is delivered to the American public as intended by Congress. The Centers for Medicare and Medicaid Services (CMS) is an agency within HHS that provides regulatory oversight by creating regulations and issuing guidance to ensure compliance with the laws passed by Congress.

HHS encompasses key agencies like the Centers for Disease Control (CDC), the National Institutes of Health (NIH) and the Food and Drug Administration (FDA). HHS administers health care coverage provided by Medicaid, Medicare, CHIP, the Affordable Care Act and employer-sponsored plans. Biomedical research, food and drug regulation and public health surveillance are all managed by HHS.

Federal law requires health insurance coverage to include preventive health care services. In 2010, §2713 of the Affordable Care Act (ACA) mandated health insurance coverage include preventive health services recommended with an “A” or “B” rating by the United States Preventive Task Force (USPTF). This mandate standardized the practice of rendering preventive health services in the United States.

Rendering preventive health services is a fundamental tenet of public health with the objective of improving health outcomes by preventing disease before onset; whereas traditional health care focuses on treating disease after onset. Scientific research of preventive health services demonstrates a reduction in chronic and infectious disease by early detection. Common preventive health practices include vaccination, public health education programs and health screenings.

The USPTF is an independent panel of health care professionals with the expertise of making evidence-based recommendations of preventive health services. The USPTF was first assembled in 1984 by the US Department of Health and Human Services. In 1999, the director of the Agency for Healthcare Research and Quality (AHRQ) was granted the authority by Congress to appoint new members to four-year terms; this process remains in place today.

A recent Supreme Court case addresses the issue of whether the USPTF has authority to make recommendations pursuant to the Affordable Care Act. In Kennedy v. Braidwood Management, Inc., the respondent is a small business owner that offers insurance to their employees. They argued that authority to appoint members to the Task Force is granted by the Appointments Clause and the structure of the Task Force violates the authority to make mandatory recommendations, making §2713 of the ACA unconstitutional.

The Appointments Clause of the U.S. Constitution gives the President the authority to nominate officers of the United States with the advice and consent of the Senate; “but the Congress may by law vest the Appointment of such inferior Officers, as they think proper, in the President alone, in the Courts of Law, or in the heads of Departments.”

The respondent argued that Task Force members are principal executive officers who must be appointed by the President with advice and consent from the Senate. HHS argued Task Force members are inferior executive officers who are supervised by the Secretary of the HHS. The Supreme Court agreed. The Court reasoned that Task Force members are inferior executive officers because their work is “directed and supervised” by the HHS Secretary. The Court recognizes two main sources of authority (1) the Secretary’s authority to remove Task Force members at-will and (2) the Secretary’s statutory authority to review recommendations. As such, the structure of the USPTF does not violate the Appointments Clause because the Secretary of Health and Human Services has authority to appoint Task Members making the preventive services mandate constitutional.

Federal implementation and enforcement are important in preserving the legislative intent of Congress. The legislative process paints a broad picture of what a law will accomplish, whereas regulators provide the details of how a law will be implemented. Therefore it is important that implementation of laws remain legally binding by ensuring the executive branch has the authority to enforce such laws.

Standard
Spring 2026

PERSPECTIVE: EXPANDING ACCESS TO GENERIC DRUGS

The pricing of prescription drugs has come under scrutiny recently, namely by consumers who believe manufacturers set an unreasonable price for highly sought-after prescription drugs. As a result, generic drugs are heavily relied upon by many Americans. Generic drugs offer an alternative for consumers who struggle with paying for rising drug prices and want expanded access to more affordable drugs.

The Federal Drug Administration (FDA) has determined generic drugs are ‘therapeutically equivalent to the brand drug in efficacy and composition.” An applicant for a generic patent is required to demonstrate its safety and efficacy to the FDA. The FDA is encouraged to issue guidance documents to assist the applicant through the application process. Once approved, the applicant receives a license that entitles them to manufacturing, marketing and sale of the generic drug.

There are several policies and regulations that determine how generic drugs will be developed and become available to the average consumer. First and most important, the Drug Price Competition and Patent Term Restoration Act, commonly referred to as the Hatch-Waxman Act, was enacted in 1984. The Act established a framework within the FDA that allows the entry of more affordable generic drugs into the marketplace. The legislation also created provisions for resolving patent litigation between brand and generic manufacturers.

Another key legislation is the Protecting Consumer Access to Generic Drugs Act. This legislation was introduced in 2009 and reintroduced in 2023 as a way curtailing rising prescription drug costs. Although the legislation was never enacted it highlighted the need to curtail antitrust agreements that delayed generic drug entry into the marketplace.

The legislation targeted “pay-for-delay” agreements. These agreements contain something of value that flows from the brand manufacturer to the generic manufacturer to delay the entry of generic drugs into the marketplace. These agreements prolong high drug prices by postponing the manufacturing and sale of more affordable generic drugs.

In 2013, a Supreme Court case addressed the issue of whether “pay for delay” agreements “can unreasonably diminish competition in violation of antitrust laws [1].” In FTC v. Actavis, a generic drug manufacturer, Actavis, made an agreement with a brand name patent holder of AndroGel, Solvay Pharmaceuticals, to delay the entry of the generic drug into the marketplace. Under the terms of the agreement Actavis agreed to delay the generic drug’s entry into the market for nine years and promote the brand name in exchange for an estimated $19 -$30 million annually during those nine years.

The Federal Trade Commission (FTC) challenged the agreement as a violation of antitrust laws. The Supreme Court ruled that although “pay-for-delay” agreements can sometimes violate antitrust laws, “an antitrust defendant may show in the antitrust proceeding that legitimate justifications are present, thereby explaining the presence of the challenged term and showing the lawfulness of that term under the rule of reason [2].”

A final regulation to consider is the Inflation Reduction Act implemented in 2023. The Act includes a provision to lower the cost of prescription drugs supplied in the Medicare program. The regulation establishes a pathway to allow the federal government to negotiate lower drug prices supplied through the program.

These regulations have helped to reshape the pharmaceutical industry by expanding access to affordable generic drugs and diminishing the likelihood that consumers will have to forgo the treatment they require.

[1] FTC v. Actavis, Inc., 570 U.S. 136 (2013).

[2] Id.

Standard
Winter 2025

PERSPECTIVE: THE IMPACT OF HEALTH MAINTENANCE ORGANIZATIONS ON HEALTH CARE COVERAGE

The well-established federal policy requiring employers to offer their employees health insurance has been the dominant policy for supplying health care coverage in the United States.

The Health Maintenance Organization Act of 1973 promoted the development of Health Maintenance Organizations (HMOs) to meet the demands of supplementing the health needs of those insured. The Act allowed the formation of HMOs as an alternative to traditional health care by introducing a new payment model for the delivery of health care services.

Historically speaking, managed health care plans arose with the aspiration of focusing on prevention. They incorporated more disease prevention strategies in line with payment mechanisms. However, this objective has not been fully attained. Health care providers and facilities within HMOs are contractually obligated to adhere to terms set by the HMO. These terms instruct how health care coverage is disbursed.

Generally, a managed health care plan provides a pre-determined fee for health care services in a structured delivery system with a primary care provider as the principal point of contact and any specialist to be determined by those enrolled in the plan.

In Pegram v Herdrich, the question presented was whether treatment decisions made by a HMO, acting through its physicians, are fiduciary acts within the meaning of the Employee Retirement Income Security Act (ERISA).  ERISA is a federal statute designed to protect employee and beneficiary interests in employee benefit plans.

The facts in this case determined that the patient (beneficiary) was covered by a HMO through her husband’s employer. The HMO required the patient to wait several days for an ultrasound at an HMO-contracted facility per HMO requirements. It was later determined that the patient was experiencing an inflamed abdomen that ruptured her appendix, causing peritonitis.

As a result of her injury, the patient filed a lawsuit alleging medical malpractice and two counts of fraud in state court. The HMO-contracted physician removed the case from state to federal court. The physician argued ERISA preempted the state fraud counts and requested a motion for summary judgment. The motion for summary judgment was granted as to one fraud count and a motion to leave to amend the complaint was granted to the other count.

The patient amended her complaint in federal court to allege that the HMO requirement of receiving an ultrasound at an HMO-contracted facility limited her medical care.  The complaint further alleged the care she received resulted in an inherent or anticipatory breach of an ERISA fiduciary duty because the physician is rewarded for making medical decisions in the interest of the HMO rather than in the exclusive interests of their enrollees.

The District Court dismissed the ERISA claim for failure to state a claim for which relief could be granted. It cited that the physician’s actions did not amount to a fiduciary duty under ERISA. The patient appealed the case to the Seventh Circuit Court of Appeals and the court determined a valid claim was stated; ruling in favor of the patient. The physician appealed the case to the Supreme Court.

The Supreme Court in Pegram v Hendrich noted:

“A fiduciary within the meaning of ERISA must be someone acting in the capacity of manager, administrator of financial advisor to a plan. Congress did not intend an HMO to be treated as a fiduciary to the extent that it makes mixed eligibility decisions acting through its physicians. In a fee-for-service system, a physician’s financial incentive is to supply more care, not less, so long as payment is forthcoming. The check on this incentive is a physician’s obligation to exercise reasonable medical skill and judgment in the patient’s interest [1]“.

The Supreme Court unanimously held that mixed treatment and eligibility decisions by HMO physicians are not fiduciary decisions under ERISA, ruling in favor of the physician.

This case established that managed care companies are shielded from federal liability for medical malpractice under ERISA. There is no fiduciary duty between patient and HMO because ERISA does not regulate treatment decisions made within HMOs . This precedent has strengthened the development of managed care companies into what they are today-an established way of how health care is delivered in the United States.

[1] Pegram v Hendrich, 530 U.S. 211 (2000). 

Standard
Fall 2025

PERSPECTIVE: APPLYING ANTITRUST IMMUNITY, A LEGAL SAFEGUARD

The Sherman Antitrust Act is a commerce regulation that prohibits monopolies by market participants and promotes free and fair trade competition in the marketplace. Antitrust immunity confers legal protection and exempts antitrust actions based upon regulatory actions. An issue of antitrust competition was brought forth to the Supreme Court in the case of  North Carolina Board of Dental Examiners v. FTC.

In this case, a North Carolina Board of licensing dentists whose “principle duty is to create, administer, and enforce a licensing system for dentists” prohibited the service of teeth-whitening by non dentists even though this is not a recognized dental service per North Carolina’s Dental Practice Act [1]. The service of teeth-whitening became popular in the 1990s and many non dentists began offering this service and charging lower fees than licensed dentists.

In 2007, the Board began sending cease and desist letters to non dentists who offered this service; this ultimately resulted in the termination of the service of teeth-whitening offered by non dentists in the state of North Carolina.

The Federal Trade Commission (FTC) determined that the Board violated antitrust laws by prohibiting this service from being offered by non dentists because several of the board members are market participants of the teeth-whitening industry.

The North Carolina Board of Dental Examiners invoked antitrust immunity under Parker v. Brown. Per this case, the Court recognized immunity is conferred on the anticompetitive conduct of States acting in their sovereign capacity [2].  The Court in this case noted FTC v. Phoebe Putney when determining that immunity is found “only if ‘the challenged constraint’ is clearly articulated and affirmatively expressed as state policy, and ‘the policy is actively supervised by the state [3].”

This Court agreed that when a State delegates control over a market to a non sovereign actor the Sherman Act confers immunity only if the State accepts political accountability for the anticompetitive conduct it permits and controls [4].”

This Court ultimately held “ [t]he Board’s actions [were] not cloaked with Parker immunity. The Court concluded per Midcal’s two-part test that the anticompetitive policy was not a policy of the state because (1) there was no expressed state policy the Board was acting pursuant to nor was the Board (2) actively supervised by the State [5].

The Court reasoned “a state board on which a controlling number of decision makers are active participants in the occupation the board regulates,” the Board must “resolve the ultimate question whether an anticompetitive policy is the policy of a State [6].”

The Court referenced FTC v. Phoebe Putney when reasoning a clearly identified state policy is determined when “the displacement of competition is the inherent, logical, or ordinary result of the exercise of authority delegated by state legislature and the active participation requirement is satisfied when “state officials have and exercise power to review particular anticompetitive acts of private parties and disapprove those that fail to accord with state policy [7].”

This Court clarified the significance of Midcal’s active supervision test as being an essential prerequisite of antitrust immunity for any sovereign entity controlled by active market participants. [8]”

[1] North Carolina Board of Dental Examiners v. FTC, 574 U.S. 494 (2015). 

[2] Parker v. Brown, 317 U.S. 341 (1943). 

[3] FTC v. Phoebe Putney Health System, Inc., 568 U.S. 216 (2013).

[4] North Carolina Board of Dental Examiners v. FTC, 574 U.S. 494 (2015). 

[5] Id.

[6] Id.

[7] Id.

[8] Id.

Standard