As the California Legislature’s 2025 session draws to a close, lawmakers have advanced over a dozen AI bills to the final stages of the legislative process, setting the stage for a potential showdown with Governor Gavin Newsom (D). The AI bills, some of which have already passed both chambers, reflect
Continue Reading California Lawmakers Advance Suite of AI BillsLatest Cybersecurity False Claims Act Settlement with Diagnostics Provider Focuses on Sensitive Health Systems
In a recently announced settlement agreement with the U.S. Department of Justice (“DOJ”), Illumina, Inc. (“Illumina”) agreed to pay $9.8 million to resolve claims arising from alleged cybersecurity vulnerabilities in genomic sequencing systems that the company sold to federal agencies. The case is the latest in a series of False Claims Act (“FCA”) settlements under the current administration that evidence DOJ’s continued focus on cybersecurity obligations for government contractors, particularly those that maintain sensitive data and personal information on behalf of federal customers.
Continue Reading Latest Cybersecurity False Claims Act Settlement with Diagnostics Provider Focuses on Sensitive Health SystemsDistrict Court Enjoins Privacy Rule Modifications Regarding Reproductive Health Care
On June 19, 2025, the U.S. District Court for the Northern District of Texas vacated the majority of the Biden Administration rule (the “2024 Rule”) modifying the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”) under the Health Insurance Portability and Accountability Act (“HIPAA”) regarding protected health information (“PHI”) concerning reproductive health. As discussed in further detail in our previous blog post, the 2024 Rule “limit[ed] the circumstances in which provisions of the Privacy Rule permit the use or disclosure of an individual’s PHI about reproductive health care for certain non-health care purposes.”
Continue Reading District Court Enjoins Privacy Rule Modifications Regarding Reproductive Health CareMultiple States Enact Genetic Privacy Legislation in a Busy Start to 2025
Since the beginning of 2025, there have been a flurry of bills introduced at the state and federal level related to genetic privacy, which follows a similar trend over the past several years. These bills have focused on a range of issues, including general genetic privacy, national security implications of “foreign adversaries” accessing genetic information, the privacy practices of direct-to-consumer (“DTC”) genetic testing companies, and the transfer of genetic data as part of bankruptcy proceedings, among others. We summarize a subset of such bills moving through state and federal legislatures below.
State Legislation
Montana SB 163
On May 1, the Montana governor signed SB 163 to amend the state’s Genetic Information Privacy Act (“MT GIPA”), which was originally enacted in 2023. Effective October 1, 2025, there will be several changes to the law, including:
- Creating Deidentification Exemption: The original version of MT GIPA did not contain an express exemption for deidentified data. SB 163 amends the law to include an express exemption for the use of deidentified genetic data for certain research purposes. Specifically, SB 163 includes an exemption for “deidentified genetic data obtained from a third party to the extent that the data is used to conduct internal, medical, or scientific research.” The deidentification standard is similar to the standard adopted under many comprehensive state privacy laws and other state DTC genetic privacy laws.
- Waiver of Certain Rights in the Clinical Trial Context: The law provides that consumers’ rights to access and delete data, destroy samples, and revoke consent must be waived in a limited context related to the collection of genetic data as part of a clinical trial if certain conditions are met, including prescriptive requirements for consent. Specifically:
- The relevant entity generally must obtain express and informed written consent for participation in a clinical research trial, including the collection and use of any genetic data, which must, among others, be in accordance with the good clinical practice (“GCP”) guideline issued by the international council for harmonisation of technical requirements for pharmaceuticals for home use and include the entity’s biological sample and data retention, sharing, and use policies.
- The biological sample and genetic data must be utilized for clinical research purposes only.
SB 163 states that these requirements are meant to “supersede all exceptions to, and waivers of” informed consent pursuant to the federal Common Rule. However, it is not clear how this new limited exemption is meant to interact with the existing exemption for entities that are engaged in collecting, using, or analyzing genetic data or biological samples in the context of scientific or clinical research with express consent of the individual and in accordance with human subject research frameworks, including GCP, the federal Common Rule, or FDA’s human subjects research regulations at 21 C.F.R. parts 50 and 56.
Continue Reading Multiple States Enact Genetic Privacy Legislation in a Busy Start to 2025Trump Administration Issues Executive Order on “Most-Favored-Nation” Prescription Drug Pricing
On May 12, 2025, President Trump issued an Executive Order titled “Delivering Most-Favored-Nation Prescription Drug Pricing to American Patients” and an accompanying “Fact Sheet: President Donald J. Trump Announces Actions to Put American Patients First by Lowering Drug Prices and Stopping Foreign Free-riding on American Pharmaceutical Innovation
Continue Reading Trump Administration Issues Executive Order on “Most-Favored-Nation” Prescription Drug PricingEuropean Health Data Space Published
On March 5, 2025, the Regulation on the European Health Data Space (“EHDS”) was published in the Official Journal (see here). The text enters into force on March 25, 2025, however it only becomes applicable in a staggered manner over several years.
The section on secondary use of the
Continue Reading European Health Data Space PublishedMHRA Consultation on Individualised mRNA Cancer Immunotherapies – Unique opportunity for a streamlined risk based regulatory framework?
The UK’s Medicines and Healthcare products Regulatory Agency (“MHRA”) is seeking industry feedback on its new draft guideline on individual messenger ribonucleic acid (“mRNA”) cancer immunotherapies (the “Draft Guidance”). Building on the success of mRNA vaccine technology in response to the Covid-19 pandemic, the technology is now being adapted to target diseases such as cancer. The MHRA aims to provide a streamlined robust regulatory framework for the approval of such personalised mRNA-based cancer vaccines without compromising safety.
The Draft Guidance covers the regulatory classification of these novel cancer treatments, product design and manufacture, non-clinical and clinical development, pharmacovigilance and the distribution of information to the wider public. Notably, the MHRA explicitly acknowledges that the regulatory and scientific principles discussed in the Draft Guidance could broadly apply to other disease indications or technologies that could benefit from personalisation or individualisation. Therefore, industry should be aware that the scope of the Draft Guidance may be extended in the future beyond mRNA cancer immunotherapies that use lipid nanoparticle delivery systems to other delivery systems and disease areas. Manufacturers, developers, patient organisations and other stakeholders have until 31 March 2025 to comment on the Draft Guidance.
We explore some of the interesting regulatory considerations arising from the Draft Guidance below.
Regulatory Classification
The classification of a medicinal product is key to determining what requirements and guidelines apply to the development, manufacture and delivery of that product. For example, advanced therapy medicinal products (“ATMPs”) have specific Good Manufacturing Practice (“GMP”) requirements (see e.g., ‘Guidelines on Good Manufacturing Practice specific to Advanced Therapy Medicinal Products’), strict traceability requirements and additional pharmacovigilance requirements.
Currently, individual mRNA cancer immunotherapies are classified under the Human Medicines Regulations 2012 (as amended) (“HMRs”) as ATMPs and are sub-classified as gene therapies. However, current mRNA therapies do not fit neatly under the ‘gene therapy’ umbrella because, unlike conventional gene therapies, which are designed to edit a person’s genome to treat or cure a disease, mRNA therapies do not involve integration into the host genome.
The Draft Guidance reveals that “a new ATMP sub-classification for nucleic acids that do not edit the patient’s genome is being considered.” A practical advantage of a new sub-classification would be the opportunity to create bespoke and risk proportionate requirements and guidelines for mRNA therapies. This would avoid overburdensome risk mitigations for these products as compared to similar products such as COVID-19 vaccines.
The Draft Guidance also predicts that mRNA therapies could be chemically synthesised (i.e., not manufactured by biotechnology). Such therapies would fall outside the scope of the current definition of a gene therapy as they would not be a biological product. The MHRA is considering the classification of relevant chemically synthesised mRNA therapies as ATMPs.
Continue Reading MHRA Consultation on Individualised mRNA Cancer Immunotherapies – Unique opportunity for a streamlined risk based regulatory framework?The Covington European Life Sciences Symposium 2025
On 23 January 2025, we hosted the 2025 edition of the Covington European Life Sciences Symposium. The Symposium brought together colleagues from London, Brussels, Frankfurt and Dublin with our industry connections to explore the evolving challenges and opportunities facing the European life sciences sector.
Throughout the day our speakers shared their perspectives on a range of legal, regulatory, and business trends, including the evolving regulatory frameworks in the EU and UK; information exchange in ongoing collaboration; investigations and whistleblowing; key ESG topics, and the complexity of options to acquire in pharma deals.
We have set out some of the discussion from the sessions below.
European Life Sciences – The Changing Landscape for Pharma and Biotech
Grant Castle, Head of Covington’s European Life Sciences Regulatory Practice, Peter Bogaert, Marie Doyle-Rossie and Anna Wawrzyniak kicked off with a discussion about the Changing Landscape for Pharma and Biotech.
The UK and EU both aim to deliver access to innovative and transformative medicines and foster international competitiveness in the life sciences industry. Despite the practical challenges faced by the UK Medicines and Healthcare products Regulatory Agency (MHRA) in recent years, it has emerged as an ambitious regulator and is establishing innovative regulatory frameworks, including an international reliance scheme (see our update here), point of care manufacturing regulations, and the relaunch of the Innovative Licensing and Access Pathway (ILAP).
The EU is also pursuing a wave of legislative reform, including wide ranging revisions to the EU’s pharmaceutical legislation, the EU’s supplementary protection certificates (SPC) rules, and proposals for a compulsory licensing scheme.
There can sometimes be a tension between the UK’s and EU’s aims and the practical impacts of regulatory reform, especially in the early stages of implementation.
Continue Reading The Covington European Life Sciences Symposium 2025European Commission Publishes Action Plan on Cybersecurity of Hospitals and Healthcare Providers
On 15 January 2025, the European Commission published an action plan on the cybersecurity of hospitals and healthcare providers (the “Action Plan”). The Action Plan sets out a series of EU-level actions that are intended to better protect the healthcare sector from cyber threats. The publication of the Action Plan follows a number of high-profile incidents in recent years where healthcare providers across the European Union have been the target of cyber attacks.
Whilst the Action Plan primarily focuses on healthcare providers including hospitals, clinics, care homes, rehabilitation centres and others, the plan identifies interdependence between those providers and the healthcare industry. Therefore, some of the measures proposed address risks affecting the broader healthcare supply chain and ecosystem, and will potentially have implications for pharmaceutical and biotechnology industry players as well as medical device manufacturers.
The action that will be of most significance for industry is the plan for Member States to request that entities subject to the NIS2 Directive, including healthcare organisations, must report on ransom payments when reporting significant incidents to the competent authority under the NIS2 Directive (section 3.3, p.14). The Action Plan rationalizes this proposal by stating that the collection of further data is needed to understand the effectiveness of measures taken against ransomware attacks, and noting that such reporting would support the effective investigation of incidents. Reporting of ransomware payments is not required by the NIS2 Directive, so this would represent a significant change for in-scope entities. While this is titled a ‘national action’ to be implemented by Q4 2025, it is not immediately clear from the Action Plan if the proposal would take the form of a new EU law that imposes the obligation on Member States or otherwise.
Continue Reading European Commission Publishes Action Plan on Cybersecurity of Hospitals and Healthcare ProvidersUnique Injuries No Bar to Class Certification Pursuing Economic Damages
Despite a lead plaintiff with unique injuries, the Northern District of Indiana recently certified a class seeking economic damages under Indiana’s consumer protection statute in a case challenging contaminated hand sanitizer manufactured by 4e Brands North America, LLC. Callantine v. 4e Brands North America, LLC, 2024 WL 4903361 (N.D.
Continue Reading Unique Injuries No Bar to Class Certification Pursuing Economic Damages