Dechert Cyber Bits

FTC, States File Complaint Against TeleHealth and Wellness Platform 

The Federal Trade Commission (“FTC”), along with the Utah Division of Consumer Protection and the California Attorney General, recently filed a Complaint for Permanent Injunction, Monetary Judgment, Civil Penalty Judgment, and Other Relief (the “Complaint”) in the Northern District of California against Hims & Hers Health, Inc. (“Hims & Hers”), alleging violations of various privacy and consumer protection laws. The Complaint alleges, among other things, that Hims & Hers: (i) shared consumers’ sensitive health information, including information about users’ medical conditions, with third-party advertising platforms in violation of promises made to users; (ii) misrepresented its intake practices; (iii) failed to conspicuously disclose material terms related to transactions and billing; and (iv) failed to obtain consumers’ express informed consent prior to enrolling them in a subscription treatment plan. In a press release issued the same day, Hims & Hers responded that it has “internal practices [] designed to protect [consumers’] information” and that the platform was built “with a focus on transparency, informed decision-making, and a deep respect for the privacy of the people [it] serve[s].” 

Specifically, the Complaint alleges violations of Section 5 of the FTC Act, the Restore Online Shoppers’ Confidence Act (“ROSCA”), California’s False Advertising and Unfair Competition Laws, and Utah’s Consumer Sales Practices Act. Among other things, the Complaint seeks a permanent injunction and civil penalties.

Takeaway: Unlike most cases, it looks like Hims & Hers plans to fight the allegations, rather than enter into a settlement/Consent Order with the FTC or the state attorneys general. This is refreshing, as most companies do not have the resources or the inclination to do so. This action shows, once again, that U.S. regulators are deep in the business of scrutinizing third-party data flows that involve what they consider to be “sensitive health information.” Digital health companies (or brick and mortars with website portals) are well advised to undertake a thorough review of all third-party tech integrations to assess whether their data sharing practices will pass muster. Companies will also want to work to design creative tech solutions to mitigate their platforms’ exposure and develop defense strategies that balance business needs with regulatory and litigation risk. We do not expect state regulators, the FTC or private litigants to pivot from their focus on health tech anytime soon and the potential exposure is massive as it often implicates claims with statutory damages.

HHS Takes Aim at Another Healthcare System Following a Ransomware Event 

On July 29, 2026, the Office for Civil Rights (“OCR”) at the U.S. Department of Health and Human Services (“HHS”) marked its 21st ransomware enforcement action by announcing a Resolution Agreement (the “Settlement”) with OSF Healthcare System (“OSF”) for alleged violations of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) Privacy, Security, and Breach Notification Rules.

OCR alleged that on April 23, 2021, OSF discovered files infected with ransomware on its systems and further discovered on August 24, 2021 that protected health information (including driver’s license numbers, treatment information, and prescription information) of over 53,000 patients was stolen by a threat actor. The company notified HHS and its patients of the breach on October 1, 2021.

OCR further alleged that OSF failed to conduct adequate risk analyses of its systems and to timely notify affected individuals. Notable portions of the Settlement include OSF’s agreement to pay $552,250 to HHS and to comply with a Corrective Action Plan (“CAP”). The CAP requires OSF to, among other things: (i) conduct a comprehensive risk analysis to determine security threats and system vulnerabilities, and (ii) create a risk management plan focused on mitigating those vulnerabilities. OCR will monitor the CAP for two years. OSF did not admit any wrongdoing in connection with the Settlement.

Takeaway: It disturbs us whenever we see yet another company that has been the victim of cybercriminals extorting them (and all the accompanying costs associates with that) having to face what many would call a second victimization from the government. This is especially true where the company has done the right thing and notified HHS and where many government agencies themselves have fallen victim to these cyber threat actors as well. OCR’s take undoubtedly would be that it pursues enforcement where it believes core HIPAA obligations have not been met. Companies handling protected health information will want to take stock of where they stand on compliance with HIPAA’s foundational requirements so that if they do suffer a breach, they are ready for this type of scrutiny of their entire program, whether a deficiency led to the breach or not. We expect OCR’s enforcement in this space to continue to ramp up, making this a timely moment for companies to assess strengthening their existing HIPAA compliance programs.

European Commission Publishes Final Guidance on the Cyber Resilience Act 

Manufacturers navigating the EU’s Cyber Resilience Act ("CRA") can now benefit from comprehensive guidance from the European Commission published on July 27, 2026. The final text builds on a draft guidance that had been published for consultation in March 2026, and while its core positions carry through largely unchanged, the Commission added a number of clarifications, new worked examples and substantive additions.

The CRA is designed to establish minimum standards of cybersecurity for connected products. From December 11, 2027, in-scope products will need to meet various security requirements before they are put on the market. The CRA also imposes obligations to address vulnerabilities on an ongoing basis once products are on the market, as well as reporting obligations in respect of actively exploited vulnerabilities and severe incidents impacting the security of in-scope products.

The guidance addresses key issues, such as which products fall within the CRA's scope, what counts as a "substantial modification" (an important concept to determine if products launched before December 11, 2027, need to conform with the CRA’s security standards), guidance on support periods, and reporting and risk assessment obligations.

Takeaway: The core requirements to conform to cybersecurity standards will not come into effect until December 11, 2027, and the Commission has sought to publish the guidelines sufficiently in advance of that deadline that they can inform the design of products intended to be marketed after that date. However, more pressingly the reporting obligations are effective from September 11, 2026, including stringent time periods to make reports to relevant authorities (24 hours for initial reports). In-scope organizations will want to review, and where appropriate revise, their incident response plans promptly in light of the CRA reporting regime. 

AI Act Amendments Enter into Force under Digital Omnibus on AI 

The Digital Omnibus on AI (the "AI Omnibus") has amended the EU AI Act. The AI Omnibus is the AI-specific portion of the wider Digital Omnibus Package the European Commission unveiled on November 19, 2025 (which we previously covered in Cyber Bits Issue 87). The rest of that package, touching the GDPR, the ePrivacy Directive, NIS2 and the Data Act, remains under negotiation. The AI-focused piece was fast-tracked so that revised deadlines for high-risk AI obligations could take effect before the AI Act's original August 2, 2026, enforcement date. It was published in the Official Journal on July 24, 2026, and entered into force on July 27, 2026.

Among the most noticeable changes are:

1. a new, fixed timeline for high-risk AI system obligations: those requirements now apply from December 2, 2027, for stand-alone high-risk systems, and from August 2, 2028, for high-risk systems embedded as a safety component in other products;
2. a grace period until December 2, 2026, for providers of AI systems to comply with watermarking requirements for AI-generated content;
3. the prohibition to use AI to generate child sexual abuse material or non-consensual sexual and intimate content, applicable from December 2, 2026; and
4. a clarification on AI in machinery products which are only required to comply with sectoral safety rules and not with the AI Act in case of overlapping requirements.

Takeaway: EU legislators announced the agreement of the AI Act with pride in December 2023 as the “world’s first comprehensive AI law.” However, it looks like they jumped the gun. A large part of the AI Act is now significantly delayed, including, importantly, the regulation of “high risk” AI systems, which is the category of AI that is subject to the most detailed compliance requirements. With December 2027 some time away and the EU looking to simplify digital regulation more broadly, there is scope for further political and technological change in the interim to further reshape the AI Act.

Dechert Tidbits 

New Jersey Bans Surveillance Pricing for Groceries & Other Foodstuffs

New Jersey Governor Mikie Sherrill recently signed the Fair Price Protection Act into law, making New Jersey the third U.S. state to restrict certain forms of surveillance pricing—the practice of creating individualized prices based on a consumer’s personal data—by prohibiting the surveillance pricing of “groceries and other foodstuffs.”

Vermont Attorney General Joins Bipartisan Consortium of Privacy Regulators

On August 4, 2026, the Vermont Attorney General announced that Vermont would be the twelfth member to join the bipartisan Consortium of Privacy Regulators (the “Consortium”). Launched in 2025, the Consortium is comprised of the California Privacy Protection Agency and various state attorneys general and is tasked with the implementation and enforcement of its member states’ consumer privacy laws. The announcement follows closely on the heels of the passage of the Vermont Data Privacy and Online Surveillance Act in June, which is covered here.

Trump Administration Announces Artificial Intelligence Framework

President Trump issued an Executive Order on June 2, 2026, that mandates the creation of a voluntary framework for government oversight of advanced artificial intelligence (“AI”) models before and after their deployment. The White House reports that the framework has been completed, but it has not yet been released to the public.