Health Law Advisor

[This material was presented as part of Epstein Becker Green’s Counsel to Counsel Roundtable on Monday, May 4, 2026. Co-presenters were Professor Kathleen M. Boozang and Professor David W. Opderbeck of Seton Hall School of Law.]

In 2026, several federal cases are poised to shape regulatory risk, reimbursement, and False Claims Act exposure, as well as innovation pathways across the health care and life sciences sectors. These include cases decided in 2024 and 2025 that continue to have ongoing impacts, as well as more recent cases involving cutting-edge technology. This article highlights five cases to monitor (or their progeny), why these cases matter to in-house legal teams, and practical steps for health care and life sciences general counsel (GC) to consider.

Over the past several years, the number of states with comprehensive consumer data privacy laws has increased exponentially from just a handful—California, Colorado, Virginia, Connecticut, and Utah—to up to twenty by some counts. Many of these state laws will go into effect starting Q4 of 2024 through 2025. We have previously written in more detail on New Jersey’s comprehensive data privacy law, which goes into effect January 15, 2025, and Tennessee’s comprehensive data privacy law, which goes into effect July 1, 2025. Some laws have already gone into effect, like Texas’s Data Privacy and Security Act, and Oregon’s Consumer Privacy Act, both of which became effective July of 2024. Now is a good time to take stock of the current landscape as the next batch of state privacy laws go into effect. 

Over the next year, the following laws will become effective:

1. Montana Consumer Data Privacy Act (effective Oct. 1, 2024)
2. Delaware Personal Data Privacy Act (effective Jan. 1, 2025)
3. Iowa Consumer Data Protection Act (effective Jan. 1, 2025)
4. Nebraska Data Privacy Act (effective Jan. 1, 2025)
5. New Hampshire Privacy Act (effective Jan. 1, 2025)
6. New Jersey Data Privacy Act (effective Jan. 15, 2025)
7. Tennessee Information Protection Act (effective July 1, 2025)
8. Minnesota Consumer Data Privacy Act (effective July 31, 2025)
9. Maryland Online Data Privacy Act (effective Oct. 1, 2025)

These nine state privacy laws contain many similarities, broadly conforming to the Virginia Consumer Data Protection Act we discussed here.  All nine laws listed above contain the following familiar requirements: