Category: Blog

Between 2019 and 2021, the market for mental health and wellness apps such as Calm, Headspace, and BetterHelp increased by 54.6%. In 2020 alone, the top 100 wellness apps were installed over 1.2 billion times. This increase can be attributed to the Covid-19 pandemic. Lockdowns and the rise of remote work led to an increased number of people turning to mobile apps to work on their health and fitness goals from home. Studies have also shown that individuals with existing mental health problems reported that their symptoms worsened during the pandemic. In this case, the convenience of mental health apps has enabled users to connect with therapists and mental health coaches from the comfort of their home. Today, an increasing number of physicians recommend their patients to use mental health apps to reduce stress and improve sleep habits, with apps such as Calm allowing patients to access content through their health insurance plan. 

But as mental health apps continue to grow in popularity, researchers have begun raising privacy concerns surrounding the collection of user data. For instance, the Federal Trade Commission (FTC) issued a proposed order in 2023 banning BetterHelp, an online counseling service, from sharing sensitive information about mental health challenges for advertising. This included requiring the app to pay a $7.8 million settlement to consumers. In this case, it is useful to consider what the current privacy concerns are as well as policy solutions to address the issue. One of the main issues concerns the volume of data that is collected by mental health apps. For instance, data collection can include geolocation information such as clinic visits and purchase history for healthcare services. Furthermore, mental health apps may collect other sensitive information such as a user’s full name, date of birth, or home address, as well as health biometrics on a user’s mood, sleep habits, or symptoms. In the case of BetterHelp, the app’s privacy policy now states that they are not paid for user data, but that they may share visitor data with third party advertisers such as Meta, TikTok, Snap, and Reddit. 

This leads to the question of what improvements can be made to protect sensitive data of users on mental health apps and what solutions are available to developers and policymakers. Currently, HIPAA regulations do not apply to most mental health apps unless it involves a covered entity, a business associate relationship, and the disclosure of electronic protected health information (ePHI). However, there are various steps that can be taken to safeguard user data. One study created a list of actions that stakeholders could take to ensure data privacy. This includes a variety of recommendations, including the creation of a privacy impact assessment and having readable privacy policies with accessible language. De-identification is another option that developers can take to protect user data, which can involve removing specific identifiers such as names and addresses. In addition, apps that do not fall under HIPAA regulations are now required to follow the FTC’s Health Breach Notification Rule, released in June 2023, which requires apps providing health care services or supplies to to notify consumers, the FTC, and often the media of data breaches. Overall, both new and current developers behind mental health apps can take these steps to better protect sensitive data and to build trust among users in the digital space. 

In the rapidly evolving world of reproductive technologies, in vitro fertilization (IVF) stands out as a beacon of hope for countless individuals striving to conceive. As this technology advances, it is increasingly confronted with complex ethical, legal, and medical challenges. These challenges highlight the ongoing struggle to maintain a balance between facilitating medical innovation and ensuring rigorous regulatory practices while also prioritizing comprehensive patient care.

A recent incident involving CooperSurgical, a major supplier in the fertility industry, brings to light this balance between innovation and regulation in the fertility industry. The company is facing several lawsuits from patients who claim that one of its products—a nutrient-rich liquid that helps fertilized eggs develop into embryos—was defective, destroying the embryos for potentially thousands of patients worldwide. This incident not only underscores the vulnerabilities inherent in assisted reproductive technology (ART) industries but also the critical importance of ensuring that the advancements in ART are matched with effective legal frameworks and ethical standards. Addressing these challenges is essential to safeguarding patient interests, and ensuring the pursuit of fertility treatment is safe and effective.

This week, the Food and Drug Administration (FDA) issued a notice stating that CooperSurgical recalled three lots of the liquid used for embryo transfer in multiple clinics during November and December. While CooperSurgical notified the affected clinics on December 13^th, it is unclear how many bottles of the botched media they used before the recall. In lawsuits filed by impacted patients, the plaintiffs assert that the defective product purportedly lacked magnesium, a key nutrient whose absence halted the development of their embryos, rendering those embryos unviable for transfer. These lawsuits further demonstrate the challenging and emotional journey of IVF for individuals seeking fertility treatment that is further complicated by corporate negligence and product recall. In the most recent of eight lawsuits filed, a couple received a phone call on Thanksgiving notifying them that all the embryos had stopped growing. Unaware of the product recall, the plaintiff attributed this failure to herself, blaming her age, before being notified two months later that the clinic used the defective CooperSurgical media on her embryos.

Infertility affects approximately 1 in 8 couples in the United States, many of whom turn to IVF as a solution. Fertility medicine and ART are relatively new fields with the first live birth from IVF occurring in 1978. However, since this breakthrough, IVF has rapidly become a common remedy for those seeking infertility treatment and now accounts for 1.6% and 4.5% of all live births in the United States and Europe. The growing demand for IVF incentivizes companies like CooperSurgical to position themselves as leaders in a largely unregulated industry. The regulatory landscape of assisted reproduction is complex as the U.S. Department of Health and Human Services exerts only limited oversight over fertility clinics. The lack of stricter federal regulatory practices incentivizes corporations to prioritize economic considerations over ethical principles in their decision-making. CooperSurgical owns multiple large sperm and egg banks, bringing in $1.2 billion in revenue last year with 40 percent coming from fertility services and supplies. This lucrative market for fertility treatment underscores the recent trend in manufacturing issues resulting from rapid growth and consolidations in those companies that supply the industry with their products. The IVF journey, while filled with hope for individuals facing infertility, is fraught with challenges that demand attention from medical professionals, regulatory bodies, and legal authorities. The issues that arise out of the case against CooperSurgical are a stark reminder of the devastating impact that corporate oversights, a lack of stricter regulatory practices, and overall disregard for an already emotional process can have on individuals’ lives. As the field of reproductive medicine continues to evolve, it must do so with a commitment to protecting patient care and ethical standards.

As we approach the holidays, we are encouraged to consider what we are grateful for. Walking around the WCL campus and seeing the posterboards, I am struck by how many people express open gratitude for therapy and psychiatric medication. Over the last week, I’ve seen notes that say: “I’m grateful for my meds” and “I am grateful for Celexa” (An antidepressant). In past years, I’ve seen: “I’m grateful for Prozac” and “I’m grateful for Lexapro.” These are also antidepressants. These notes indicate to me that there is not only less shame in disclosing mental health conditions and treatments, but more desire to speak openly about how we live with these conditions. Considering the stressful, highly competitive nature of law school, students on psychiatric medications should be aware their conditions can become unmanageable and require treatment in a psychiatric hospital ward. This raises the question: Are they aware of their rights once they have voluntarily accepted or have been forced into treatment? It is important to understand the basic rights of involuntarily committed patients because these patients are often vulnerable to misuse of their information and arrive at the hospital in a state not conducive to self-advocacy. Even in the midst of a mental health crisis, patients have a right to privacy and humane treatment.

What follows is a summary of rights of mental health patients in the D.C. metropolitan area. A person can be involuntarily committed for psychiatric treatment in Washington D.C. when a psychiatrist, qualified physician, or qualified psychologist has examined the person and has determined that the person has a mental illness which makes them a danger to themself or others, and that hospitalization is the least restrictive setting that meets the person’s needs. If the patient is a minor (under 18), their parent or legal guardian must be served notice of the patient’s admission to the hospital no more than 24 hours after admission. If the patient is an adult, the patient must authorize the Department to serve notice to their spouse, domestic partner, or legal guardian as long as the notice is consistent with the District of Columbia Mental Health Information Act of 1978 D.C. Code §7-1201-0.1. Patients cannot be detained for more than 48 hours, unless the chief officer of the department files a written petition with the court for emergency observation and diagnosis of the patient, in which case, the patient’s detention cannot exceed seven days from the time the order is entered. Patients are entitled to a complete record of their treatment as a patient. Not all mental health conditions qualify for involuntary commitment. A national survey of psychiatrists in the United States revealed that most believe simply having a mental illness that is diagnosable using the DSM should not be grounds for involuntary commitment, but being a danger to one’s self or others should be grounds for involuntary commitment. Most psychiatrists that were surveyed believed conditions that included a psychotic component should be grounds for involuntary commitment. Fifty-one percent of psychiatrists believed that having depression should be grounds for commitment.

We fear what we do not understand. Mental health commitment is not something to be feared. Psychiatric wards offer a place to rest and disconnect from the stresses of daily life until we are ready to face them again.  The goal of involuntary commitment is to prepare patients for a successful re-entry into society. Commitment may seem frightening at first, but it will likely be an experience you are grateful you had.

ChatGPT is a natural language processing tool created by OpenAI, a research company specializing in artificial intelligence tools such as DALL-E 2, an AI art generator. Since its launch in November 2022, ChatGPT has become one of the fastest-growing apps in recent memory. By January 2023, the chatbot reached 100 million active users, with an average of 13 million visitors per day. Available for both desktop and mobile devices, ChatGPT employs a dialogue format similar to messaging apps where users can type in prompts and ask questions on a variety of topics. Numerous articles provide tips to users on the best prompts to ask ChatGPT, from drafting cover letters, solving complex math problems, and editing videos. Given its ability to form human-like responses, some users have turned to ChatGPT for medical advice. Patients can ask general questions on health conditions and use AI tools for summaries or resources to prepare for medical visits. However, the popularity of ChatGPT and its accelerated development has led industries to question how artificial intelligence may affect patient care in the near future, including privacy concerns and clinical care. As a result, it is worth asking how AI tools such as ChatGPT may be used to improve the standards of quality healthcare and the risks that are involved. 

Prior to ChatGPT, people frequently turned to the Internet to self-diagnose. Studies have shown that between 67.5% to 81.5% of American adults have searched for health information online. While this is not a new phenomenon, the conversational aspects of ChatGPT and a lack of regulation around artificial intelligence involves considering the ethical and moral implications of using AI tools. Generally, health experts have recommended against using ChatGPT for medical advice. However, doctors have reported that using AI tools may be useful for patients to learn more about certain conditions such as COVID, including the symptoms, causes, risk factors, and treatments as well as side effects of prescription drugs. Early studies have also indicated that AI models including ChatGPT could be used to screen patients for mental health conditions such as depression or anxiety and to determine treatment options. 

While ChatGPT has the potential to change the medical field in terms of diagnosis and treatment of various health conditions, it also raises new liability risks for health care providers. Physicians who rely on AI tools may be subject to greater liability for medical malpractice, as courts would likely find it unreasonable for health professionals to rely on AI-generated content. In addition, companies have noted that there is no way for physicians to use ChatGPT with protected health information (PHI) of patients while remaining compliant with HIPAA. For instance, if a physician chose to use ChatGPT to transcribe handwritten notes or recordings from a general appointment, they may potentially violate HIPAA regulations without knowing it.

Although the use of artificial intelligence in healthcare settings is fairly limited today, researchers have begun considering how AI systems can be built to improve the efficiency and effectiveness of medical services. This includes proposals for “human-centered AI” that employs a problem-solving approach to key issues in clinical care. One possible method is to train AI models by analyzing large amounts of data to look for certain health conditions in specific populations. In recent news, Stanford School of Medicine and the Stanford Institute for Human-Centered Artificial Intelligence (HAI) announced the creation of RAISE-Health (Responsible AI for Safe and Equitable Health), an initiative to integrate AI into healthcare. This includes developing a platform for responsible use of AI systems by enhancing clinical services as well as educating patients and providers on best practices.   

As ChatGPT becomes an increasingly prominent aspect of medicine and other industries, it is important to consider how AI tools have the potential to streamline the work of healthcare systems while also cautioning physicians of the legal and ethical risks involved in its use.

Between 1970 and 2019, the number of local hospitals that consolidated into a larger healthcare system increased from 10% to 67%. The healthcare industry is slowly monopolizing. Some believe that this merger-centric healthcare economy is good for patients, especially those in rural communities, where mergers are especially prevalent. One particular characteristic of rural acquisitions stands out: the healthcare organizations involved in these mergers come from out-of-market. A recent study found that 17% of rural hospitals merged with healthcare organizations outside of the local geographic market. These out-of-market mergers increase large healthcare corporations’ market share, lowering the amount of potential competition, and further monopolizing the landscape. Supporters of both in-market and out-of-market mergers argue that they play a vital role in preserving rural communities’ access to care. Small and financially vulnerable hospitals in rural areas may seek out a merger with a large healthcare organization to improve their financial outcomes or to increase the quality of their services to patients.

While supporters insist that mergers are a logical solution to getting patients better access to specialty care, skeptics worry about the downsides. Primarily, these mergers often shift the costs of care to the patients. One study found that after examining 366 mergers and acquisitions of hospitals occurring between 2007 and 2011, prices for patients increased by over 6%. Adding insult to injury, the same study found that prices at hospitals with a monopoly of patients were on average 12% higher than those in markets with four or more competing care centers.

How should we address the financial burden patients endure from hospital mergers? Well, this is where we look to anti-trust oversight and enforcement procedures. Anti-trust laws exist to protect consumers by preventing monopolies and encouraging competition to drive efficiency, improve quality, and lower prices for the everyday American. Three primary cornerstone federal antitrust laws collectively govern the regulation of competition: the Sherman Antitrust Act of 1890, the Clayton Antitrust Act of 1914, and the Federal Trade Commission Act of 1914. Additionally, most states possess parallel statutes that provide antitrust enforcement procedures within their jurisdiction. To address antitrust-related activities that occur in out-of-market merger scenarios, Congress has passed the Hart-Scott-Rodino Antitrust Improvement Act, which mandates that notice be sent to the Federal Trade Commission when a transaction exceeds $101 million. This threshold is concerning when looking through the lens of hospital mergers, where acquisitions rarely exceed the threshold for reporting. Today, eleven states lack processes for tracking and/or challenging healthcare provider transactions that go beyond the aforementioned federal antitrust laws. In contrast, only four states require notice of all transactions between healthcare entities.

State legislatures have a few options to remedy this issue, though one is particularly compelling: state policymakers can develop state statutes that prohibit anti-competitive clauses in health merger and acquisition contracts, thus preventing providers from using their enormous market power to strongarm patients into paying more. By taking this step, legislators can protect their states from mass consolidation of their healthcare markets and protect their constituent’s access to affordable healthcare.

            Under the administrative simplification provision of the Health Insurance Portability and Accountability Act (HIPAA), there are pertinent regulations that lead to compliance obligations for employer-sponsored group health plans. In accordance with 45 CFR § 160.103, the HIPAA Privacy Rule can only be applied to the groups that are listed and deemed to be covered entities. For purposes of the Privacy Rule, covered entity means any health plan, health care clearinghouses, and health care providers who transmit health information in electronic form in connection with a transaction.  Within the list of covered entities, health plans are defined as an individual or group plan that provides, or pays for the cost of medical care.  Further, a group health plan means an employee welfare benefit plan, including fully insured and self-insured plans, to the extent that the plan provides medical care.This provision includes items and services paid for as medical care to employees or their dependents directly or through insurance, reimbursement. The HIPAA Privacy Rule will also apply to a plan that has 50 or more participants, or is administered by an entity other than the employer that established and maintains the plan. Thus, the group health plan is deemed to be an entity that is entirely separate from the employer and plan sponsors that provide the requisite care or insurance to the employees. 

            While the usage of group health plans is clearly significant within the context of the HIPAA Privacy Rule, it is certainly helpful to distinguish between the types of plans that are frequented by employers. A fully insured health plan is commonly considered to be the traditional method of insuring employees that work within their companies. Within this framework, employers pay a fixed premium to a large insurance provider (Aetna, Kaiser Permanente, United Health) for their employees, and the provider covers the cost of the employee’s medical expenses. While fully insured plans are typically more expensive for the employer, the premium rates are annually fixed based on number of enrolled employees. The insurance provider will handle claims in accordance with the plan outline that is selected by the employer, and employees are responsible for reaching a deductible or copays depending on the types of medical services the plan covers. On the contrary, self-insured health plans are more flexible than fully insured plans because it enables the employer to select a plan that best meets the individualized medical needs of their employees. More specifically, this plan cuts out the preset framework from insurance providers, and employers are responsible for determining the costs of their own plan. Commonly, employers will use a form of stop-loss insurance in order to mitigate the cost if one of their employees is well beyond the coverage window.  While there are benefits and downsides to both types of health plans, the HIPAA Privacy Rule will apply to both in a variety of different circumstances. First off, if the company heath plan is administered by a third party it will not matter whether the plan is fully or self-insured and these parties will always be subjected to the Privacy Rule. However, if the health plan is truly self-administered (no third parties), has under 50 total participants, and does not handle protected health information (PHI), then the Privacy Rule will not apply.  Consequently, it is extremely uncommon for a fully insured plan to be subjected to the standards of the Privacy Rule because the relationship between the employer and insurance provider will attempt to eliminate PHI being transferred. Additionally, ERISA requires that if an individual is titled as the “plan administrator” but does not carry out daily functions of the plan then self-administration cannot possibly apply.

            Navigating HIPAA and the complex application to group health plans can be challenging for many businesses and organizations to conceptualize. Therefore, it is essential for employers to select the type of plan that best suits their employee’s needs, but they also need to remain cognizant of the restraints that both ERISA and the HIPAA Privacy Rule attach to group health plans.