For market access, privacy, compliance, and government-affairs teams — every requirement classified by relevance type, obligation type, and an A–D actionability grade, tied to a source, with manufacturer-specific gaps clearly identified. Nothing is invented.
171 pharma-relevant signals across 50 states, by relevance type.
Manufacturer-specific topics absent from the source set. Source separately before relying on them.
Suggested sequencing to become a true manufacturer-obligation product.
Covered — number = pharma-relevant signals. All 50 states now have source research. A schematic cartogram: each square is one state in roughly its geographic position. Counts show direct, market-access, and adjacent signals only — provider context is excluded from the count and folded into each state profile.
| State | Certificate of Need | Malpractice cap | Medicaid expansion | PBM law | PDMP | Signals |
|---|---|---|---|---|---|---|
| AL | Active (comprehensive) | None (struck down) | No | Yes (27-45A-1) | Mandatory | 2 |
| AK | Active ($1.5M) | n/s | Yes (2015) | — | Yes | 11 |
| AZ | n/s | None (const. barred) | Yes | Yes | Yes | 4 |
| AR | Active | None | Yes (ARHOME) | — | Yes | 2 |
| CA | n/s | MICRA | Yes | — | Yes | 7 |
| CO | n/s | $530K (2026) | Yes | Yes | Yes | 4 |
| CT | Active | n/s | Yes | — | Active (CPMRS) | 2 |
| DE | n/s | None | Yes (Diamond State) | Yes (HB 212) | Yes (DELPROS) | 4 |
| FL | Residual | n/s | No | — | Yes | 4 |
| GA | Active | None (standard) | No (Pathways) | Regulated (Title 33) | Yes | 3 |
| HI | Active (SHPDA) | $375K (non-econ.) | Yes | Yes (HRS 431R) | Yes (mandatory) | 2 |
| ID | n/s | ~$510-538K (2026) | Yes (contested) | — | Yes | 4 |
| IL | Active | None (unconstit.) | Yes | Yes (from 01/2026) | Active | 3 |
| IN | None (repealed 2003) | $500K + PCF | Yes (HIP 2.0) | — | Active (INSPECT) | 2 |
| IA | n/s | n/s | Yes | Yes (SF 383) | n/s | 2 |
| KS | n/s | None; $250K (WD) | No | — | Yes | 3 |
| KY | Active | n/s | Yes | Yes | n/s | 3 |
| LA | n/s | $500K + PCF | Yes | — | Active (mandatory) | 4 |
| ME | Active | None | Yes (2019) | Active | Active (mandatory) | 2 |
| MD | Active | ~$920K | Yes | — | Active (CRISP) | 3 |
| MA | Active (review) | n/s | Yes | Yes (license) | Yes | 5 |
| MI | Active | ~$1.065M (2026) | Yes | — | Yes | 3 |
| MN | n/s | $500K (non-econ.) | Yes | Yes (Commerce) | Active (MN-PMP) | 3 |
| MS | Active (HB 3, 2026) | n/s | No | Yes (HB 17) | n/s | 3 |
| MO | n/s | $350K (Watts) | Yes (Amd. 2) | — | n/s | 3 |
| MT | Active | $250K (non-econ.) | Yes | Active | Active (PDR) | 2 |
| NE | Limited (LTC beds) | $2.25M (2025) | Yes | — | All-drug | 4 |
| NV | Yes (limited) | $590K (2026) | Yes | — | Yes (mandatory) | 2 |
| NH | Abolished (2016) | None (unconstit.) | Yes (Granite Adv.) | Yes (RSA 402-N) | Yes | 4 |
| NJ | Active | None (compensatory) | Yes | Active | Active (NJPMP) | 3 |
| NM | None | $750K (PCF) | Yes (Turquoise Care) | Regulated | Active (Pharmacy Bd) | 2 |
| NY | Active | n/s | Yes | — | n/s | 5 |
| NC | Active (reforming) | n/s | Yes (since 2023) | — | Mandatory (CSRS) | 6 |
| ND | Limited (LTC) | n/s | Yes | — | n/s | 2 |
| OH | Active | Yes (medical) | Yes | Active | Yes (OARRS) | 3 |
| OK | Limited | None (unconstit.) | Active (SoonerCare) | Active (HB 2677) | Mandatory | 2 |
| OR | Active | $500K (contested) | Yes | — | Yes | 4 |
| PA | n/s | Limited (punitive) | Yes | Yes (Act 110, 2020) | Yes (AWARxE) | 4 |
| RI | Reformed (2026) | None | Yes | Yes (data) | n/s | 3 |
| SC | Residual | $580,461 (2025-26) | No | — | Yes | 2 |
| SD | None | $500K (non-econ.) | Yes (2023) | Yes (SDCL 58-29E) | Yes | 3 |
| TN | Eased (2026) | Two-tier cap | No | — | Yes | 3 |
| TX | None (repealed 1985) | n/s | No | — | Yes | 6 |
| UT | n/s | $450K (non-econ.) | Yes (2020) | Regulated (31A-46) | Yes | 4 |
| VT | Active | Under review (H.427) | Yes | — | Active (VPMS) | 3 |
| VA | n/s | ~$2.70M (2025-26) | Yes | — | n/s | 3 |
| WA | n/s | n/s | Yes | — | n/s | 5 |
| WV | Active | n/s | Yes | Yes (HB 5430) | Yes | 3 |
| WI | Repealed | Yes | Yes (non-trad.) | Stalled | Yes | 4 |
| WY | Repealed | ~$2,007,977 | No | — | Active | 1 |
n/s = not specified in source (a gap, not "none"). "Malpractice cap" = noneconomic-damages cap, as stated in source; several are CPI-adjusted. "Signals" counts direct + market-access + adjacent items. Click a header to sort. Values reflect only the provided research. Click a state to filter the requirement list below.
Alabama did not expand Medicaid, maintains one of the nation's most comprehensive Certificate of Need programs (SHPDA), and applies the Alabama Medical Liability Act (AMLA) with strict procedural rules but no enforceable damages caps (repeatedly struck down by the Alabama Supreme Court). Prescription practices for controlled substances are strictly monitored via a mandatory PDMP. APRN practice follows a restricted/collaborative model requiring dual-board authorization.
Source documents: alabama_healthcare_legal_framework extended.docx; alabama_healthcare_legal_framework_12pg.docx
Alabama did not expand Medicaid; the Alabama Medicaid Agency administers Medicaid/CHIP under Ala. Code 22-6-1.
HIPAA governs privacy/security (state agencies adopt HIPAA policies); SUD records carry additional protection under 42 C.F.R. Part 2; ADPH facility rules require record retention of at least 5 years.
The AMLA (6-5-480 through 6-5-552) governs malpractice procedure, venue, expert qualifications, and burden of proof (substantial-evidence standard); Alabama has no enforceable damages caps after repeated state-supreme-court rulings.
One of the most comprehensive CON programs nationally, administered by SHPDA with the State Health Plan; civil penalties up to $25,000 per violation plus cease-and-desist and court-ordered closures.
ADPH licenses facilities under Title 22 (Admin. Code Title 420); ABME licenses physicians (34-24-1) and the Board of Nursing licenses RNs/APRNs (34-21-1).
Alaska reorganized its former DHSS into a standalone Department of Health and a Department of Family and Community Services (Executive Order 121, effective July 1, 2022), with the DOH serving as the single state Medicaid agency. The state is notably permissive on corporate structure — no codified Corporate Practice of Medicine doctrine, only a functional-control limit — while layering above-HIPAA privacy rules (Genetic Privacy Act; APIPA breach law) and a distinctive 80th-percentile out-of-network payment rule. Mid-2026 brought a cluster of enacted laws (SB 272 health-information-exchange modernization, HB 14 telehealth parity, SB 89 physician-assistant practice) plus permanent Medicaid MAT coverage.
Source documents: Alaska.docx
Alaska adopted ACA Medicaid expansion in 2015 (adults 19-64 to 138% FPL); after federal H.R. 1 (July 2025) introduced community-engagement/work-verification requirements, the DOH runs automated ex parte exemption checks through its ARIES eligibility platform (~61,169 expansion enrollees evaluated in early 2026, ~69% auto-exempted).
CMS approved Alaska Medicaid State Plan Amendment 25-0010 in January 2026, permanently integrating MAT into the baseline Medicaid plan and guaranteeing reimbursement for all FDA-approved opioid-treatment medications bundled with behavioral-health services.
A distinctive Alaska rule (3 AAC 26.110) requires commercial insurers to pay out-of-network providers at or above the 80th percentile of typical regional charges for a service, shielding patients from balance billing; insurers argue it inflates premiums and it remains under DCCED review.
The Division of Insurance requires prior-authorization decisions within 5 business days (routine) or 72 hours (urgent), with failure treated as implied approval; network-adequacy rules require covering out-of-network specialist care at the in-network rate where no in-network specialist is reasonably available.
HB 14 (enacted mid-2026) bars insurers from paying less for a telehealth service than for an equivalent in-person encounter, validates synchronous video, audio-only, and store-and-forward modalities, and allows the patient's home as an authorized originating site.
SB 272 with companion HB 285 (enacted mid-2026) codifies HealtheConnect Alaska as the single state-recognized health-information-exchange clearinghouse, mandates a standardized consumer opt-out at all connected endpoints, forces alignment with the federal TEFCA framework, and grants good-faith civil-liability immunity for compliant HIE disclosures.
The Genetic Privacy Act (AS 18.13.010) makes DNA and genetic-test results the individual's personal property and requires specific written informed consent before collecting, analyzing, retaining, or disclosing genetic data — tighter than HIPAA; mental-health records (AS 47.30.845) carry heightened confidentiality.
The Alaska Personal Information Protection Act (AS 45.48), independent of HIPAA, requires notifying affected residents without unreasonable delay and simultaneously notifying the Attorney General when a breach affects more than 500 residents; non-compliance can trigger civil penalties up to $25,000 per violation.
Alaska maintains no codified statutory or judicial CPOM doctrine, so a general corporation may employ physicians — subject only to a 'functional control exception' barring interference with clinical judgment. Professional corporations (AS 10.45.050) must be 100% owned by licensed professionals, and Alaska does not recognize the PLLC, leaving the PC or a general LLC with clinical carve-outs as the structuring options.
APRNs may practice independently (AS 08.68.850) with full prescriptive authority for Schedule II-V substances given DEA registration and PDMP use; pharmacists may enter collaborative practice agreements (AS 08.80.410) to manage drug therapy and may dispense naloxone under a standing order without an individual prescription.
Following federal trends, the Alaska Division of Insurance is evaluating formal guidelines governing the use of AI and algorithmic systems by commercial carriers in claims review and utilization management — no rule yet adopted as of mid-2026.
Alaska enforces a CON program (AS 18.07.031) requiring approval before establishing a new facility, making expenditures exceeding $1.5 million, or changing bed capacity; the DOJ and FTC have urged full repeal as anticompetitive, but the legislature retained CON through mid-2026 to protect rural access.
SB 89 (effective September 16, 2026) removes the state-approved collaborative-plan filing for PAs with more than 4,000 postgraduate clinical hours, shifts clinical-boundary governance to the practice level, and retains the statutory title 'physician assistant.'
Arizona delivers Medicaid entirely through managed care via AHCCCS (est. 1982) under a federal Section 1115 waiver (A.R.S. 36-2901 et seq.), licenses facilities through DHS (A.R.S. 36-401), and runs the CSPMP through the Board of Pharmacy. Insurance, HMOs and PBMs are regulated under Title 20 by DIFI; PBMs may not impose mid-year non-medical switching. Health information organizations operate under individual opt-out rules aligned with HIPAA. Arizona has no malpractice damages cap — the state constitution bars the legislature from creating one.
Source documents: Arizona_Healthcare_Legal_Framework_Extended_Version.docx; Arizona_Healthcare_Legal_Framework_Short_Version.docx
AHCCCS is Arizona's single state Medicaid agency operating under a 1115 Research and Demonstration Waiver (A.R.S. 36-2901 et seq.); managed-care delivery with flexible program design.
Health insurance, HMOs, and health-care-services organizations are regulated under Title 20 by the Department of Insurance and Financial Institutions.
The Board of Pharmacy operates the Controlled Substances Prescription Monitoring Program tracking Schedule II-V dispensing statewide.
AHCCCS and providers comply with the HIPAA Privacy Rule; Health Information Organizations operate under Laws 2011 Ch. 268 (and SB 1321 amendments) with individual opt-out rights.
DHS licenses health-care institutions under A.R.S. 36-401 et seq.; the Arizona Medical Board (Title 32, Ch. 14) and Board of Osteopathic Examiners license physicians, with Universal Licensing Recognition and IMLC pathways.
Arkansas pairs tort-reform features (a strict 2-year-from-occurrence statute of limitations expressly rejecting a broad discovery rule, a certificate-of-merit requirement in certain cases, and an 'I'm Sorry' apology-inadmissibility provision) with an established Certificate of Need program dating to the 1970s. Arkansas imposes no statutory cap on non-economic damages. The Arkansas PMP (A.C.A. 17-92-1101) supports opioid-diversion efforts, and Act 412 of 2021 established Full Practice Authority for APRNs.
Source documents: arkansas_healthcare_legal_framework.docx
Arkansas expanded Medicaid (historically via the 'private option' / ARHOME) with major reform beginning in 2013; the AID oversees HMOs/MCOs.
The Arkansas PMP (A.C.A. 17-92-1101 et seq.), administered by ADH, requires prescribers/dispensers to report and consult under specified circumstances as a key opioid-diversion tool.
Limitations run 2 years from discovery (not more than 3 years from the act/omission); a certificate of merit is required before filing in certain circumstances; the 'I'm Sorry' provision makes apologies/expressions of sympathy inadmissible.
Arkansas has operated a CON program since the 1970s alongside comprehensive hospital-licensing legislation.
Act 1220 of 2019 created a path to APRN independent practice after a supervised period, expanding scope of practice.
California operates the most expansive state healthcare framework, with a unique dual managed-care/insurance regulator (DMHC and CDI) and the new Office of Health Care Affordability setting enforceable cost-growth targets from 2026. Its privacy regime exceeds HIPAA — the Confidentiality of Medical Information Act expressly reaches pharmaceutical companies, and consumer-health-data from non-HIPAA apps falls under CCPA/CPRA. CPOM was recently codified by SB 351 (2025).
Source documents: California_healthcare_legal_framework.docx; california_healthcare_extended.docx
The Confidentiality of Medical Information Act (Civil Code 56 et seq.) is broader than HIPAA and expressly covers pharmaceutical companies and contractors, defining 'medical information' to include data in a pharmaceutical company's possession.
Health data from non-HIPAA digital-health, wellness, and reproductive-health apps is fully subject to CCPA/CPRA sensitive-personal-information rules.
OHCA (SB 184, 2022) sets statewide cost-growth targets (3.5% for 2025, non-enforceable; enforcement activates for 2026) and conducts Cost & Market Impact Reviews of material transactions.
DMHC regulates managed-care plans under the Knox-Keene Act (Health & Safety Code 1340 et seq.); CDI regulates indemnity/PPO products — a nationally unique dual-regulator model.
DHCS administers Medi-Cal (>14M enrollees), the largest single health program in the state, with managed-care contracting.
California's CPOM doctrine (Medical Board guidance under the Medical Practice Act, B&P Code 2000 et seq.) was codified by SB 351, signed Oct 6, 2025 (Ch. 409; adds Health & Safety Code Division 1.7, Sec. 1190), effective Jan 1, 2026, barring private-equity groups and hedge funds from interfering with physician/dental clinical decisions and voiding certain noncompete/nondisparagement clauses.
California bars professional discipline for care lawful in California, protects providers prescribing/distributing medication-abortion drugs, and (AB 260, 2025) affirms opposition to interference with mifepristone.
Colorado runs Medicaid (Health First Colorado, ~1 in 5 residents) through HCPF, licenses facilities through CDPHE under C.R.S. 25-3-101, and regulates professions and insurance through DORA; the Behavioral Health Administration licenses behavioral-health entities and controls substance-use treatment licensure. HB 24-1472 replaced static malpractice limits with a graduated non-economic damages cap rising to $530,000 for 2026 and $875,000 by 2029. PBM oversight is aggressive: HB 25-1094 bars percentage-of-cost compensation from 2027 and HB 25-1222 sets reimbursement floors protecting rural independent pharmacies. The Colorado Privacy Act layers state health-data duties above HIPAA.
Source documents: Colorado_Healthcare_Legal_Framework_Extended_Version.docx; Colorado_Healthcare_Legal_Framework_Short_Version.docx
HCPF is the single state Medicaid agency administering Health First Colorado (~1 in 5 Coloradans) and CHP+; expansion state.
The DORA Division of Insurance regulates Colorado insurers, rates, and consumer complaints with federal-state consistency.
HIPAA baseline plus the Colorado Privacy Act (CPA), which Colorado integrates for covered entities and certain health-related data handling.
The BHA (from January 1, 2024) oversees Controlled Substance Licenses for medication-assisted-treatment programs alongside the state PDMP and pharmacy regulation.
The Colorado Medical Board (3 CCR 713) requires education verification, postgraduate training, exams, and professional liability insurance of at least $1,000,000 per incident / $3,000,000 aggregate.
CDPHE licenses hospitals, critical-access and psychiatric hospitals, clinics, nursing/hospice/home-care, and ambulatory surgical centers under CRS 25-3-101 and 25-1.5-103.
Connecticut runs one of the nation's most active Certificate of Need programs (CGS 19a-638) with review by the Office of Health Strategy, licenses facilities and professionals through the Department of Public Health, and administers Medicaid (HUSKY) through DSS. Malpractice limitations run 2 years from discovery with a 3-year outside limit (CGS 52-584). APRN independent practice is permitted with experience.
Source documents: CT_Healthcare_Legal_Framework.docx
DSS administers Medicaid (HUSKY Health); Connecticut is an expansion state.
Health privacy governed by HIPAA with state confidentiality overlays; no comprehensive consumer-health-data statute identified.
One of the nation's most active CON programs under CGS 19a-638; before establishing, relocating, or making major capital expenditures, applicants must obtain Office of Health Strategy approval on need/feasibility/quality/cost.
Malpractice claims run 2 years from discovery with a 3-year outside limit from the act/omission (CGS 52-584); minority tolling applies.
DPH administers facility licensing, professional licensing boards, vital records, and epidemiology under Title 19a; APRNs with sufficient experience may practice without a collaboration agreement.
Delaware enacted PBM clawback reform (HS 1 for HB 212), cutting the retroactive overpayment-recovery window against pharmacies and providers from 24 months to 12. PBMs are regulated under 18 Del. C. 3351A et seq., and PDMP checks are mandatory through DELPROS under 16 Del. C. 4798. DHSS runs the Diamond State HealthPlan Medicaid expansion under a Section 1115 managed-care waiver and a state-funded Prescription Drug Payment Assistance Program. Delaware sets no statutory ceiling on economic or non-economic damages.
Source documents: Delaware_Healthcare_Legal_Framework.docx
HB 212 (HS1, 2025), companion to SB 12, bars PBM/insurer 'clawback' practices that force pharmacists to refund collected amounts when a copay exceeds the negotiated rate, and protects independent-pharmacy reimbursement.
Delaware Code Title 16 Ch. 30B establishes a state Prescription Drug Payment Assistance Program administered by DHSS for low-income residents who do not qualify for Medicaid pharmacy benefits.
Medicaid operates with a federal-partnership exchange (healthcare.gov); Delaware is an expansion state, regulated under Title 18 for insurance products.
Delaware expanded naloxone access through pharmacist standing orders, allowing dispensing without a patient-specific prescription.
DHSS's Office of Health Facility Licensing and Certification licenses facilities; the Division of Professional Regulation supports 27 health-related boards via the DELPROS system and an interstate telehealth registration program.
Florida regulates within a four-tier federal/state hierarchy with AHCA and DOH at the center. Malpractice procedure is statute-heavy (Chapter 766 pre-suit, Chapter 95 limitations), the long-controversial wrongful-death 'Free Kill' restriction survived a 2025 veto, and hospital CON was largely repealed in 2019 while residual CON remains for nursing homes. The 2025 session produced a large volume of provider-facing bills.
Source documents: FL_Healthcare_Legal_Framework_EXTENDED.docx; FL_Medical_Standard_of_Care_Research.docx
HB 6017, which would have repealed the noneconomic-damages restriction for certain adult relatives, passed by wide margins but was vetoed May 29, 2025; the restriction remains law.
PDMP operated under the Pharmacy Practice Act (Ch. 465); controlled substances cannot be prescribed via telehealth to a new patient without prior in-person evaluation, with limited exceptions (certain psychiatric meds, buprenorphine for OUD).
HB 519 (paramedics may administer controlled substances under supervision), HB 547 (medical-debt collection), HB 1421 (statewide VTE registry; hospital reporting from July 1, 2026), SB 1768 (first-in-nation non-FDA-approved stem cell therapy authorization), HB 647 (expanded APRN authority).
Privacy governed by HIPAA/HITECH plus 42 C.F.R. Part 2 for substance-use-disorder records (amended 2024); no comprehensive state consumer-health-data statute identified.
Chapter 766 governs pre-suit: a 90-day pre-suit notice to each prospective defendant (766.106) and a corroborating expert affidavit; standard of care for telehealth equals in-person under 456.47(4).
2-year limitations period for medical malpractice with a 4-year statute of repose; fraud exception applies.
Hospital CON largely repealed by HB 21 (2019); CON program authority remains under Chapter 408 for nursing homes and certain services.
Georgia has no noneconomic-damages cap for standard malpractice claims (struck down in Nestlehutt, 2010), though the wrongful-death cap question remains live after Turner (June 2025). An emergency-care gross-negligence standard applies in the ER, expert qualifications follow a 3-of-5-year rule with Daubert, and Georgia retains an active CON program. Medicaid is delivered through Georgia Families with the limited Georgia Pathways to Coverage.
Source documents: GA_Healthcare_SOC_Extended.docx; GA_Healthcare_SOC_QuickReference.docx
Administered by DCH via Georgia Families managed care; Georgia did not adopt full ACA expansion and instead operates the limited Georgia Pathways to Coverage.
Prescribers must check the PDMP before prescribing Schedule II-V controlled substances to new patients and in certain circumstances for existing patients; failure can support malpractice and GCMB discipline.
Privacy under HIPAA/HITECH with the federal fraud-and-abuse overlay; no comprehensive state consumer-health-data statute identified.
Statutory standard of care (51-1-27); no noneconomic-damages cap for standard malpractice after Nestlehutt (2010); punitive damages capped at $250,000 except for intentional conduct; modified-50% comparative fault.
Emergency-department care judged under a gross-negligence/clear-and-convincing standard (51-1-29.5); experts qualify under the 3-of-5-year active practice/teaching rule with Daubert; out-of-state experts need no Georgia license.
Active CON program (one of ~34 states) for new hospital beds, nursing-home construction, major equipment, and long-term-care services; administered by the CON Section at GDPH.
Hawaii imposes a statutory cap of $375,000 on non-economic damages in medical tort actions (HRS 663-8.7), with no cap on economic damages, and applies a 2-year-from-discovery limitations rule with a 6-year statute of repose (HRS 657-7.3). Facilities are licensed by the Department of Health and practitioners by the DCCA's Professional and Vocational Licensing Division; physicians complete 40 CME hours per biennium including controlled-substance and PDMP topics. A formal Certificate of Need program operates under HRS Chapter 323D through SHPDA, and PBMs are regulated under HRS Chapter 431R.
Source documents: Hawaii_Healthcare_Legal_Framework.docx
Medicaid (Med-QUEST) is administered by DHS; Hawaii is an expansion state and operates the Prepaid Health Care Act employer-coverage mandate.
The state PDMP supports controlled-substance prescribing oversight, reinforced by mandatory CME topics.
Hawaii imposes no statutory cap on malpractice compensatory damages; limitations run 2 years from discovery with a 6-year statute of repose (HRS 657-7.3), with a fraudulent-concealment exception.
DOH licenses facilities; the DCCA's PVLD licenses physicians, nurses, pharmacists, and allied professions; physicians complete 40 CME hours/biennium including controlled-substance/opioid prescribing and PDMP, suicide-prevention, and other mandated topics.
Idaho emphasizes limited government and provider conscience rights, administering Medicaid, behavioral health, and facility licensing through the Department of Health and Welfare, insurance through the Department of Insurance, and the PDMP through the Board of Pharmacy. HB 138 (2025), which sought Medicaid work requirements and enrollment caps, failed in Senate committee and is not in effect. Idaho has no malpractice-specific cap, but Idaho Code 6-1603 imposes a dynamic, wage-indexed cap on non-economic damages, roughly $510,000-$538,000 for 2025-2026; economic damages are uncapped. The Idaho Patient Act (Idaho Code 48-1601 et seq.) regulates medical-debt collection and billing transparency.
Source documents: Idaho_Healthcare_Legal_Framework.docx
DHW administers Idaho Medicaid (the state's largest coverage program); HB 138 (2025) passed the House seeking work requirements, a 50,000 enrollment cap (vs. >90,000 actual), lifetime limits, and trigger-repeal provisions.
The Department of Insurance licenses insurers and reviews rates/forms under Idaho Code Title 41; Idaho operates its own market structure.
The Board of Pharmacy operates a PMP collecting Schedule II-IV dispensing data; prescribers and dispensers must check the PMP before prescribing specified controlled substances.
Idaho Code Title 39 Ch. 3 governs SUD programs licensed by DHW; the state expanded MAT (buprenorphine, naltrexone) with SAMHSA block-grant funding.
DHW administers facility licensing and public-health districts (IDAPA 16).
Illinois splits its framework across IDPH (facilities and public health), IDFPR (professional licensing), HFS (Medicaid), and the Department of Insurance. The Illinois Supreme Court has repeatedly struck down statutory caps on non-economic damages, so no current cap applies. The Prescription Drug Affordability Act took effect January 1, 2026, regulating pharmacy benefit managers and banning spread pricing. The Illinois Prescription Monitoring Program is mandatory for controlled substances. The federal HIPAA reproductive-health privacy rule referenced in earlier guidance was vacated in June 2025.
Source documents: illinois_healthcare_extended.docx; illinois_healthcare_legal_framework.docx
HFS administers Medicaid for ~3.4M residents; the research projects significant coverage and federal-funding reductions under the 2025 federal budget law affecting rural hospitals.
IDOI regulates private insurance markets; behavioral-health parity and network-adequacy are active areas.
HIPAA baseline; the April 2024 federal reproductive-health privacy rule bars disclosing PHI to investigate lawful reproductive care, creating affirmative provider obligations; OCR penalties are tiered.
The Health Facilities Planning Act (20 ILCS 3960) requires CON approval before new facilities, added beds, or capital expenditures above thresholds; administered by the HFSRB on community-need and feasibility criteria.
IDFPR licenses 1.2M professionals across 114 professions (CORE system modernization under HB 2394); IDPH licenses hospitals under the Hospital Licensing Act (210 ILCS 85), with reduced fees for critical-access and safety-net hospitals.
Indiana runs a nationally distinctive combined Medical Review Panel + Patient's Compensation Fund system: only 'qualified providers' enrolled in the PCF get cap and panel protection, and a proposed complaint is filed with the IDOI before court. Provider liability is capped at $500K with the PCF covering up to a $1.8M total. CON was abolished in 2003, and Indiana expanded Medicaid via the Healthy Indiana Plan (HIP 2.0).
Source documents: IN_Healthcare_SOC_Extended.docx; IN_Healthcare_SOC_QuickReference.docx
Indiana expanded Medicaid under a Section 1115 waiver as HIP 2.0 with POWER-account premium contributions; ~2 million enrolled as of 2025; administered by FSSA.
Privacy under HIPAA/HITECH plus federal SUD confidentiality; no comprehensive state consumer-health-data statute identified.
Before filing in court, the claimant files a proposed complaint with the IDOI and a 3-provider review panel issues an admissible (non-conclusive) opinion; only PCF-enrolled 'qualified providers' receive cap/panel protection.
Individual provider liability capped at $500,000 with the Patient's Compensation Fund covering excess up to a $1.8M total; qualified providers pay an annual PCF surcharge.
Indiana abolished CON effective July 1, 2003 — one of ~16 states with no CON; facilities may be built and expanded without CON review.
ISDH licenses facilities under IC Title 16; IPLA houses the Medical Licensing Board, Board of Nursing, and Board of Pharmacy.
Iowa overhauled pharmacy regulation in 2025: the Board of Pharmacy replaced all rules (IAC 481 Chapters 550-557, effective August 1, 2025) and SF 383 imposed PBM transparency and reimbursement requirements, with enforcement subject to ongoing litigation over ERISA preemption. Malpractice claims run on a 2-year statute of limitations supported by a 60-day certificate-of-merit affidavit under Iowa Code 614.1. Facility oversight sits with the Department of Inspections, Appeals and Licensing.
Source documents: Iowa_Healthcare_Legal_Framework.docx
SF 383 (enacted June 11, 2025) establishes a comprehensive PBM regulatory framework: transparency for PBM compensation and spread pricing, reimbursement protections for independent pharmacies, and Iowa Insurance Division enforcement (Bulletin 25-06).
Medicaid (Iowa Health and Wellness Plan) administered by Iowa HHS; managed-care delivery (expansion state).
The Board of Pharmacy replaced existing rules (former 657 IAC) with new Chapters 550-557 under 481 IAC, effective August 1, 2025, requiring pharmacies/PBMs/plans to update compliance policies and contracts.
Malpractice claims run 2 years from discovery (Iowa Code 614.1(9)) with extensions for minors under 8; a certificate-of-merit affidavit from a qualified expert is due within 60 days of the answer (147.140; 147.139).
DIAL oversees hospital licensure, facility inspections, and professional licensing boards; Iowa HHS administers Medicaid and public-health programs.
Kansas has not adopted ACA Medicaid expansion; KanCare operates without it despite repeated legislative efforts. Following Hilburn v. Enerpipe Ltd. (2019), statutory caps on non-economic damages in personal-injury cases are unconstitutional, though a $250,000 cap remains for non-economic damages in wrongful-death actions (K.S.A. 60-1903). Claims run two years from discovery with a 10-year statute of repose (K.S.A. 60-513). KDHE handles facility licensing and KanCare, the Board of Healing Arts licenses practitioners, and the Board of Pharmacy runs the PDMP. Telehealth flexibilities from the COVID era are permanent.
Source documents: kansas_healthcare_legal_framework.docx
KDHE's Division of Health Care Finance administers KanCare; Kansas's expansion debate is longstanding, with a 2019 effort under Governor Kelly.
The Board of Pharmacy administers the Kansas PDMP; SUD and controlled-substance provisions apply.
Kansas made many COVID-era telehealth expansions permanent (audio-only visits, expanded originating sites).
Malpractice claims run 2 years from discovery (K.S.A. 60-513(a)(7)) with an 8-year statute of repose (60-513(c)) — one of the longer repose periods nationally.
Healthcare facilities licensed under K.S.A. Ch. 65 (65-5001 et seq.); professionals regulated by boards including KSBHA, the Board of Nursing, and the Board of Pharmacy.
Kentucky operates a comprehensive state-regulated system centered on the Cabinet for Health and Family Services with a robust Certificate of Need program (KRS Chapter 216B). Recent reforms include the nation's first criminal-liability shield for healthcare workers and a new medical-cannabis program. The Department of Insurance regulates PBMs, with pharmacy-network adequacy and reimbursement-floor provisions and anti-competitive-practice prohibitions.
Source documents: Kentucky_Healthcare_Legal_Framework.docx
The DOI regulates PBMs under KRS Chapter 304; provisions (304.17A-591 to 304.17A-599) require adequate pharmacy networks, minimum reimbursement standards, step-therapy override processes, and prohibit certain anti-competitive PBM practices.
Kentucky is an expansion state; the Governor retains authority to shape Medicaid eligibility by executive regulation, a recurring source of political tension.
2024-2025 legislation enacted the nation's first criminal-liability shield for healthcare workers and launched a medical-cannabis program; a March-2025 reform targets Medicaid expansion, drug-cost reduction, and rural access.
CHFS administers a robust CON program under KRS 216B.010 et seq. alongside health-facility licensure (216B.042); the Office of Health Policy handles CON functions.
CHFS is the primary agency for public health, Medicaid, CON, licensure, and behavioral health under KRS 194A.010.
Louisiana, a civil-law jurisdiction, centers governance in the Louisiana Department of Health and applies the 1975 Medical Malpractice Act with a mandatory pre-suit medical review panel, a Patient's Compensation Fund, and a $500,000 damages cap (excluding future medical costs); the limitations period is 1 year (3-year absolute). Telehealth reform (Act 322/2024) removed the in-person exam requirement except for controlled substances, and a 2024 non-compete reform (Act 273) limits physician non-competes.
Source documents: louisiana_healthcare_legal_framework.docx
Act 750 of 2024 (effective August 1, 2024) created the 'Hope for Louisiana Patients Law' (La. R.S. 40:1300.71-1300.79), authorizing individualized investigational treatments; Act 312 set claim review standards.
The Bureau of Health Services Financing administers Louisiana Medicaid (Healthy Louisiana) and LaCHIP; Louisiana is an expansion state.
Act 322 of 2024 (SB 66) eliminated the in-person exam requirement except for controlled substances and broadened the telehealth definition (effective August 1, 2024).
HIPAA governs PHI; Louisiana adds state protections for specific categories (HIV/AIDS status, mental-health and SUD records).
The 1975 MMA features a mandatory pre-suit medical review panel, a Patient's Compensation Fund, and a $500,000 damages cap (excluding future medical costs); limitations run 1 year (3-year absolute). Standard of care under 9:2794(A).
Act 273 of 2024 (effective January 1, 2025) amended La. R.S. 23:921 to limit non-competition provisions for primary-care and certain other physicians.
Maine expanded Medicaid in 2019; MaineCare now covers roughly 25% of the population (~350,000 people). DHHS runs facility licensing, MaineCare, and an active Certificate of Need program under 22 M.R.S.A. 328. There is no general statutory cap on compensatory damages, with limits applying only to non-economic damages in wrongful-death actions and to punitive damages. The Bureau of Insurance enforces PBM licensure, transparency, and reporting rules, and the PDMP is active and mandatory. From April 2026, L.D. 2201 requires enhanced review of healthcare transactions involving private-equity or hedge-fund capital.
Source documents: ME_Healthcare_Compliance_Framework.docx
Maine expanded Medicaid in 2019; MaineCare (administered by DHHS) covers ~25% of the population (~350,000), a critical payer for most Maine hospitals.
Maine regularly enacts privacy, consumer-protection, and behavioral-health laws exceeding federal minimums (general characterization in the framework).
Maine maintains an active CON program (22 M.R.S.A. 328 et seq.) covering a broad range of capital projects and new services; change of ownership requires 90-day advance notice to DLRS and may trigger CON review.
Hospitals are licensed by DHHS's Division of Licensing and Regulatory Services with annual renewal 60 days before expiration and unannounced surveys (22 M.R.S.A. 2064); MSBOM licenses physicians.
Maryland is distinctive for its all-payer hospital rate-setting through the Health Services Cost Review Commission, which from 2026 operates under the federal AHEAD Model extending focus from hospital costs to population health, alongside one of the nation's most comprehensive Certificate of Need programs. The Abortion Care Access Act of 2022 codified abortion rights and widened the range of professionals permitted to provide care. Malpractice claims run under CJP 5-109, five years from injury or three from discovery, whichever is earlier. The PDMP is active and integrated through CRISP.
Source documents: MD_Healthcare_Legal_Framework.docx
The Health Services Cost Review Commission sets all hospital rates under Maryland's unique all-payer model — a nationally distinctive cost-containment structure.
MDH administers Medicaid; Maryland is an expansion state operating within the all-payer waiver context.
Maryland affirmatively protects abortion access with no mandatory waiting period; the 2023 Abortion Care Access Act expanded access and provider protections.
Among the most comprehensive CON programs nationally (HG Title 19); applicants must show community need, feasibility, quality, and consistency with the State Health Plan before establishing or modifying facilities/services.
Malpractice limitations are the earlier of 5 years from injury or 3 years from discovery (CJP 5-109); noneconomic damages are capped at roughly $920,000 (about $1,380,000 for wrongful death with multiple claimants) under CJP 3-2A-09.
Massachusetts in 2025 (H.5159) broadened the 'material change' definition, requiring 60-day advance notice to the HPC, CHIA, and Attorney General, and barred acute-hospital licensure where the main campus is leased from a REIT, with a grandfather clause for facilities operating as of April 1, 2024. PBMs are now subject to full licensure on par with health plans. Under the 1115 waiver, a 2024-2025 ConnectorCare pilot extended eligibility to 500% FPL. Mental-health records carry heightened protection under M.G.L. c.123 s.36, and PDMP use is mandatory for all controlled-substance prescribing and dispensing.
Source documents: MA_Healthcare_Legal_Framework.docx; MA_Healthcare_Legal_Framework_Extended.docx
H.5159 expanded oversight of Pharmacy Benefit Managers with new licensing requirements aligning PBMs with the regulatory frameworks applied to health plans.
Massachusetts expanded Medicaid in 2014 (MassHealth CarePlus, 1115 waiver through 2027); a ConnectorCare expansion pilot (2024-2025) extended eligibility to 500% FPL with membership up 135%.
H.5159 (2025) expanded the 'material change' definition requiring 60-day advance notice to the HPC, CHIA, and AG, prohibited acute-hospital licensure/renewal where the main campus is leased from a REIT (grandfathered as of April 1, 2024), and added two new licensure categories.
Providers must satisfy HIPAA plus stricter Massachusetts requirements; mental-health records carry heightened protection under MGL c.123 36.
Electronic monitoring of controlled-substance prescribing/dispensing governs the state PDMP.
DPH and the Boards of Registration under the Division of Professional Licensure govern clinician licensure under MGL c.112.
Michigan's standard-of-care framework is detailed: a statutory standard (600.2912a), an affidavit-of-merit regime, strict expert-witness qualifications (600.2169), and an inflation-indexed noneconomic-damages cap (600.1483) with a higher catastrophic tier (announced ~$1.065M for 2026). Michigan retains CON and runs the MAPS PDMP. Malpractice settlements must be reported to LARA within 30 days.
Source documents: MI_Healthcare_SOC_Extended.docx; MI_Healthcare_SOC_QuickReference.docx
Administered by MDHHS under the Social Welfare Act; managed-care delivery (expansion state).
Michigan Automated Prescription System; prescribers of Schedule 2-5 controlled substances must check MAPS before prescribing to a new patient and at each subsequent controlled-substance visit.
Privacy under HIPAA/HITECH plus federal SUD confidentiality (42 C.F.R. Part 2); affidavit-expert identity protected unless designated a trial witness.
Statutory standard of care (600.2912a); affidavit of merit required; experts must meet board-certification/same-specialty and 1-year-practice tests under 600.2169.
Inflation-indexed noneconomic-damages cap (600.1483); higher catastrophic tier for enumerated injuries — announced approximately $1,065,100 for 2026.
Health facilities, health insurers, and malpractice insurers must report malpractice settlements and adverse judgments to LARA within 30 days; failure is itself a licensure violation.
Michigan retains an active CON program (one of ~34 states) for hospital beds, nursing-home beds, and certain specialized services; administered by the CON Commission.
Minnesota caps non-economic medical-malpractice damages at $500,000 and enforces a shortened 2-year statute of limitations (541.076) following recent statutory reforms, keeping the 180-day expert affidavit of merit (145.682). The Department of Commerce holds direct jurisdiction over PBM licensing, transparency, and business practices under Chapter 62W, while the Board of Pharmacy retains professional and facility oversight under Chapter 151. State privacy law (the Government Data Practices Act, MHRA, and breach statutes) frequently exceeds federal minimums. DHS runs Medical Assistance and MinnesotaCare.
Source documents: MN_Healthcare_Legal_Framework_Extended_v2.docx; MN_Healthcare_Legal_Framework_short.docx
The Board of Pharmacy's statutory jurisdiction (Ch. 151) expressly extends to pharmacy benefit managers alongside pharmacists, technicians, and facilities.
Medicaid (Medical Assistance) and the MinnesotaCare public program operate as Minnesota's coverage programs; HIPAA/ERISA/ACA preemption is frequently litigated.
HIPAA baseline plus the Government Data Practices Act (Ch. 13) and breach-notification statute (325E.61); Minnesota law is frequently more protective and controls.
Minnesota does not cap noneconomic or total malpractice damages; limitations run 4 years from the act/omission or discovery (541.076); a qualified expert affidavit of merit is due within 180 days or dismissal with prejudice follows (145.682).
MDH holds certificate-of-need and facility-licensing authority under the Department of Health powers statute (Ch. 144); assisted-living licensure framework effective Aug. 1, 2021 (144G).
Board of Medical Practice (147) licenses MDs/DOs/PAs; Board of Nursing (148); Board of Pharmacy (151); Board of Dentistry (150A).
Mississippi has not adopted ACA Medicaid expansion. MSDH handles facility and professional licensing, Certificate of Need, and clinical regulation; MDI regulates insurers, HMOs, PBMs, and prior authorization; the Division of Medicaid runs the state programs. HB 17 (2025) bars insurers and PBMs from denying coverage or penalising patients who receive physician-administered drugs from in-network providers, and mandates fair reimbursement. Recent Medicaid measures include presumptive eligibility for pregnant women (HB 539), 12-month postpartum coverage (SB 2212), biomarker-testing coverage (HB 565), and a small community hospital pilot (HB 1622). CON operates under Miss. Code 41-7-173 et seq., with HB 3 (2026) easing PRTF bed limits.
Source documents: Mississippi_Healthcare_Legal_Framework.docx
HB 17 (2025), the Protecting Patient Access to Physician-Administered Drugs Act, bars insurers and PBMs from denying coverage or imposing penalties when patients receive physician-administered drugs directly from in-network providers, and mandates fair provider reimbursement.
HB 539 (2024) presumptive eligibility for pregnant women; SB 2212 (2024) extended postpartum Medicaid to 12 months; HB 565 (2026) mandates biomarker-testing coverage; HB 1622 small-community-hospital pilot.
The Division of Medicaid administers Medicaid; Mississippi has not adopted full ACA expansion.
Mississippi maintains an active CON program (Miss. Code 41-7-173 et seq.) for hospitals, nursing/skilled-nursing, long-term-care, and PRTFs; HB 3 (2026) removed certain PRTF Medicaid bed limits and authorized specific new beds.
MSDH licenses facilities and professionals and promulgates clinical regulations; MDI regulates insurers, HMOs/PPOs, and prior authorization.
Missouri's framework spans RSMo Chapters 197-335 with DHSS as lead public-health agency. The state enacted a $350,000 noneconomic-damages cap (538.210), which the Missouri Supreme Court held unconstitutional as applied to jury-tried cases in Watts (2012). Medicaid expansion came by voter initiative (Amendment 2, 2020) and faced implementation litigation.
Source documents: missouri_healthcare_legal_framework.docx
Missouri voters approved Medicaid expansion via Amendment 2 (2020) to 138% FPL (MO HealthNet); implementation faced appropriation litigation.
Health privacy governed by HIPAA/HITECH plus state confidentiality statutes that in places exceed federal minimums.
Missouri (historically the last state to adopt a statewide PDMP) operates controlled-substance monitoring; verify current statewide-program scope.
Missouri enacted a $350,000 noneconomic-damages cap (538.210, Tort Reform Act of 2005); the Missouri Supreme Court in Watts (2012) held it unconstitutional as applied to jury-tried cases.
DHSS licenses facilities; the Division of Professional Registration oversees profession-specific boards under distinct RSMo chapters.
Montana runs a streamlined structure with DPHHS as the central authority. Medical malpractice is subject to a $250,000 cap on non-economic damages (MCA 25-9-411), with a 2-year limitations period extending to 3 years under the discovery rule (MCA 27-2-205). The Certificate of Need program dates to 1975 (MCA Title 50, Ch. 5, Part 3) and expressly exempts ambulatory surgery centres. The 2025 legislature extended Medicaid expansion and submitted a Section 1115 waiver amendment for community-engagement requirements. The Cannabis Control Division administers the medical marijuana registry and adult-use licensing under MCA Title 16, Ch. 12, and prescribing is monitored through the state Prescription Drug Registry.
Source documents: Montana_Healthcare_Legal_Framework.docx
The 2025 legislature extended Medicaid expansion; Montana submitted a Section 1115 waiver amendment to implement community-engagement requirements ahead of federal H.R. 1 mandates effective July 2026.
The Cannabis Control Division (Department of Revenue) administers the medical-marijuana registry and adult-use licensing under MCA Title 16, Ch. 12.
Malpractice limitations are 2 years general with a 3-year discovery rule (MCA 27-2-205); wrongful death is 3 years (27-2-204).
Montana's CON program (in operation since 1975; MCA Title 50, Ch. 5, Part 3) requires approval for new/expanded services and capital expenditures, but ambulatory surgical centers are explicitly exempt.
Facility licensing under MCA Title 50, Ch. 5 is administered by the DPHHS Licensure Bureau within the Office of Inspector General; hospitals licensed under 50-5-201.
Nebraska's defining feature is a pioneering PDMP: effective January 1, 2018 it became the first state to require reporting of all dispensed prescription drugs — not just controlled substances. Facility licensing runs under the Health Care Facility Licensure Act, and the Nebraska Telehealth Act governs telehealth. DHHS administers most functions, with the Department of Insurance regulating coverage.
Source documents: Nebraska_Healthcare_Legal_Framework_Extended_Version.docx; Nebraska_Healthcare_Legal_Framework_Short_Version.docx
Medicaid administered by DHHS; Nebraska adopted expansion (Heritage Health Adult) following voter initiative.
From January 1, 2018, all licensed and mail-order pharmacies report all dispensed prescription drugs — both controlled and non-controlled — to the Nebraska PDMP, the first such comprehensive program nationally.
Telehealth governed by the Nebraska Telehealth Act (71-8501 to 71-8512); Medicaid reimburses HIPAA/CMS-compliant two-way real-time telehealth.
Covered entities comply with the HIPAA Privacy Rule with safeguards, authorization, and breach notification; no comprehensive state consumer-health-data statute identified.
Facilities licensed under the Health Care Facility Licensure Act (71-401 to 71-452) and the Uniform Licensing Law (38-101 to 38-192); physician GME requirements may be waived for shortage areas (38-2027).
Nevada caps non-economic malpractice damages at $590,000 as of 2026, rising $80,000 a year to $750,000 in 2028 under AB 404, and applies a 3-year-from-injury / 2-year-from-discovery limitations rule, whichever is earlier, with a 3-year repose (NRS 41A.097). An affidavit or certificate of merit is strictly required to file suit (NRS 41A.071). Certificate of Need applies only in counties under 100,000 population for capital expenditure above $2 million. APRNs hold full practice authority, and the Board of Pharmacy runs a mandatory PDMP.
Source documents: Nevada_Healthcare_Legal_Framework.docx
DHHS administers Medicaid; Nevada is an expansion state.
HIPAA applies to covered entities/business associates; the Attorney General enforces state-level HIPAA violations in coordination with HHS.
Noneconomic malpractice damages are capped at $350,000; limitations run 3 years from injury or 1 year from discovery (whichever first) with a 3-year repose (NRS 41A.097); minority tolled to age 10.
Before filing, plaintiff's counsel must file an affidavit/certificate of merit from a qualified expert (NRS 41A.071); failure results in automatic dismissal without prejudice.
Nevada grants APRNs independent (full) practice authority under NRS 632 after a mandatory early collaborative period.
New Hampshire's market-based posture is reflected in the complete repeal of its Certificate of Need laws in 2016 and the absence of medical malpractice caps, earlier limits having been ruled unconstitutional. Hit hard by the opioid epidemic, the state runs the New Hampshire Controlled Drug Prescription Health and Safety Program. DHHS administers Medicaid through the Granite Advantage Health Care Program, the Insurance Department regulates health insurance including PBMs under RSA Title XXXVII Chapter 402-N, and the Office of Professional Licensure and Certification handles professional licensing.
Source documents: new_hampshire_healthcare_legal_framework.docx
DHHS's Division of Medicaid Services administers Medicaid; New Hampshire is an expansion state.
The Insurance Department regulates health insurance under RSA Title XXXVII.
New Hampshire's PDMP was enacted as part of its opioid-epidemic response amid among the highest per-capita overdose death rates nationally.
DHHS permanently incorporated many pandemic-era Medicaid telehealth flexibilities, retaining audio-only behavioral health as a covered service.
DHHS (Bureau of Health Facilities Administration) oversees facilities; OPLC and the Boards of Medicine/Nursing license professionals under RSA Titles X/XXX.
New Jersey maintains a comprehensive, heavily regulated framework including a Certificate of Need program with a State Health Planning Board, licensure and inspection of 2,000+ facilities through NJDOH, and commercial-insurance regulation under NJDOBI. There is no cap on compensatory damages, though punitive damages are capped. Medicaid (NJ FamilyCare) runs through DMAHS managed care. PBM regulation is robust, requiring transparency, fair pharmacy reimbursement, and anti-steering rules, and the NJPMP is mandatory for controlled dangerous substances. The New Jersey Data Privacy Act, fully effective January 2025, classifies consumer health data as sensitive and requires opt-in consent.
Source documents: New_Jersey_Healthcare_Legal_Framework.docx
NJDOBI regulates commercial health insurance under Titles 17 and 26, reviews rates/forms, and administers the IHC and SEHB programs.
NJDHS administers Medicaid/NJ FamilyCare through DMAHS via managed-care contracts; New Jersey is an expansion state.
Health privacy governed by HIPAA with consumer-protection overlays; no comprehensive consumer-health-data statute identified.
NJDOH administers a CON program for full-review applications, advised by the State Health Planning Board which holds public hearings and evaluates community need and feasibility before the Commissioner's decision.
NJDOH licenses and inspects 2,000+ facilities (hospitals, nursing homes, ASCs, home health, medical day care) and shares workforce licensure with the Division of Consumer Affairs.
New Mexico has no Certificate of Need program. The former Human Services Department has been fully replaced by the Health Care Authority, which administers Turquoise Care, the state's Medicaid program. The medical malpractice cap rests on NMSA 1978 Section 41-5-13 together with the Patient Compensation Fund structure, which remains unchanged, setting a $750,000 limit for PCF-qualified providers. The Board of Pharmacy administers the prescription monitoring programme, and PBMs are subject to additional state oversight.
Source documents: New_Mexico_Healthcare_Legal_Framework.docx
New Mexico is an expansion state administering Medicaid (Turquoise Care) through the Health Care Authority/Human Services.
The Board of Pharmacy administers controlled-substance monitoring; opioid-response provisions apply.
Malpractice limitations run 3 years from the alleged negligent act, subject to the discovery rule (NMSA 1978, 41-5-13); noneconomic damages are capped at $750,000 for PCF-enrolled providers under the Medical Malpractice Act.
NMDOH oversees public health, facility licensing, and epidemiology; professional boards license clinicians.
New York operates a single-regulator insurance model under the Department of Financial Services, which oversees all commercial health insurance, solvency, cybersecurity, and healthcare fraud. The state runs one of the nation's most rigorous Certificate of Need programs under Article 28 of the Public Health Law, governing facility transactions, ownership changes, and major capital projects. Corporate practice of medicine rests on a century of case law requiring physician ownership and control. The NY Health Information Privacy Act (S9269) passed both chambers in June 2026 and awaits gubernatorial action, following the 2025 veto of its predecessor.
Source documents: New_York_healthcare_legal_framework.docx; New York_healthcare_extended.docx
The New York Health Information Privacy Act (S9269, revised; introduced Feb 20, 2026) passed the Senate June 3 and the Assembly June 4, 2026 (substituting A10357) and awaits the Governor's action as of June 21, 2026; it regulates non-HIPAA 'regulated health information' collected or inferred by consumer-facing businesses and would take effect six months after enactment. The prior version (S929/A2141) was vetoed Dec 19, 2025 (Veto 135 of 2025). It exempts HIPAA-covered entities, Part 2/SUD records, clinical-trial/human-subjects data, and FDA-regulated activities.
Unlike California's dual model, DFS regulates all commercial health insurance (HMO, PPO, EPO, indemnity) plus solvency, cybersecurity, and healthcare fraud.
NYSDOH administers New York Medicaid (one of the largest programs nationally); expansion state.
Among the oldest, most embedded CPOM frameworks; combines Education Law and Business Corporation Law with a century of case law, administered through the State Education Department.
The Public Health Law (thousands of sections) governs facility operation, patient rights, public-health enforcement, Medicaid, and health-data collection.
CON under Article 28 PHL requires prior approval for new facilities, added beds/services/ORs, capital expenditures above thresholds, and — distinctively — ownership or governance changes.
North Carolina adopted Medicaid expansion on December 1, 2023, covering roughly 600,000 adults across Standard, Tailored, and specialty plans. Certificate of Need is being eased under SL 2023-7, though sector conflict continues. There is no unified corporate-practice statute: SB 570 failed in May 2025, but the Medical Board's 2024 guidance effectively implements much of what it proposed, creating a significant operational barrier for telemedicine and GLP-1 businesses. Data privacy is hybrid, governed by HIPAA plus state law. Checking the Controlled Substances Reporting System is mandatory when prescribing.
Source documents: NC_healthcare_standard.docx; NC_healthcare_extended.docx
No comprehensive consumer-health-data law comparable to CA CMIA or NY HIPA; non-HIPAA digital-health and wellness data falls primarily under the federal FTC Act.
Expansion launched December 1, 2023 (~600,000 adults); delivered through Standard Plans, Tailored Plans, and the Children and Families Specialty Plan with a 2027 Standard Plan reprocurement ahead.
CPOM enforced via Chapter 55B and Chapter 90; NCMB's August 2024 guidance meaningfully expanded reach over PE-backed and DTC telehealth arrangements (GLP-1, medication-abortion, telemental platforms drew scrutiny).
SB 570 would have codified sweeping CPOM restrictions modeled on California SB 351 but failed the May 8, 2025 crossover deadline; enforcement nonetheless stricter than pre-2024 via NCMB guidance.
No comprehensive state health-privacy statute; HIPAA baseline plus NC Identity Theft Protection Act breach notice, SUD confidentiality (GS 122C-52), and HIV/AIDS confidentiality (GS 130A-143).
State PDMP; prescribers of Schedule II-IV controlled substances must query the CSRS before a first controlled-substance prescription or where abuse is suspected.
NCMB position statement 5.1.4 holds telemedicine to the same standard of care as in-person care; provider must hold a valid NC license and verify patient identity and location.
One of the most restrictive CON programs nationally, being phased back by SL 2023-7 alongside Medicaid expansion; 2025 State Medical Facilities Plan governs remaining thresholds.
North Dakota runs a consolidated Health and Human Services department covering public health, facility oversight, Medicaid, and behavioral health, with licensing and the prescription monitoring programme under the Boards of Medicine and Pharmacy. The state is a Medicaid expansion state. Certificate of Need requirements have been relaxed over time and now apply principally to long-term care facilities and nursing-facility bed counts rather than general hospital services. Use of the prescription drug monitoring programme is mandatory for controlled-substance prescribing.
Source documents: ND_Healthcare_Legal_Framework.docx; ND_Healthcare_Legal_Framework short.docx
Medicaid administered by ND HHS; North Dakota is an expansion state.
Controlled-substance prescribing and the state PDMP are administered through the Board of Pharmacy.
Malpractice claims run 2 years from when the claimant knew or should have known of the injury (NDCC 28-01-18), with a 6-year statute of repose; for minors, the period does not start until age 18.
ND HHS (2022 merger of Health + Human Services) is the primary agency under Titles 23/25/50; North Dakota joined the Medical, Nurse, APRN, Physical Therapy, and Psychology interstate compacts and expanded APRN independent practice.
The research addresses CON status in a dedicated section; North Dakota has limited CON (verify current scope).
Ohio is a Medicaid expansion state delivering services through managed care. It is among the leading states regulating pharmacy benefit managers, with rules focused on transparency and accountability and aimed at preventing spread pricing. Limits on non-economic damages in malpractice claims are statutory but not an absolute defence and remain subject to judicial interpretation. Checking OARRS, the Ohio Automated Rx Reporting System, is mandatory when prescribing Schedule II-V controlled substances. ODH handles facility licensing and Certificate of Need.
Source documents: OH_Healthcare_SOC_QuickReference.docx; OH_Healthcare_extended_of_Care_Research.docx
Administered by the Ohio Department of Medicaid; Ohio is a Medicaid expansion state (managed-care delivery).
Ohio Automated Rx Reporting System; prescribers must check OARRS before prescribing Schedule II-V controlled substances to a new patient and at each subsequent controlled-substance visit.
Health privacy governed by HIPAA/HITECH with federal SUD confidentiality (42 C.F.R. Part 2); no comprehensive state consumer-health-data statute identified.
Limitations and repose for medical claims under 2305.113; noneconomic-damages cap for medical claims under 2323.43; comparative fault under 2315.33-.36.
Ohio retained CON (one of ~34 states); required for nursing-home beds and certain long-term-care services; not required for ambulatory surgery centers.
ODH licenses hospitals and facilities; the State Medical Board licenses physicians; pharmacy regulated by the Board of Pharmacy.
Oklahoma expanded Medicaid through SoonerCare in 2020 under Constitutional Article 55. Since Beason v. I.E. Miller (2019) the cap on non-economic damages has been unconstitutional, so patients may seek damages without a cap - a material insurance-risk consideration for hospitals. Oklahoma is a leading PBM regulator under HB 2677, restricting opaque pricing practices. PDMP checks are a legal obligation before prescribing controlled substances. Certificate of Need applies only to limited facility types such as nursing homes. Hospital operations run under the Oklahoma Hospital Standards Act (63 O.S. 1-701), and medical records must be retained for at least 10 years, double the federal minimum.
Source documents: OK_Healthcare_Compliance_Framework.docx
The Oklahoma Health Care Authority administers Medicaid (SoonerCare) under the dual federal/state hospital-compliance regime.
HIPAA governs privacy/security; OSDH facility rules require medical-record retention (10 years per the framework) exceeding the federal 5-year baseline.
All hospitals must obtain and maintain an OSDH license under the Oklahoma Hospital Standards Act (63 O.S. 1-701 et seq.); licenses renew annually and are non-transferable.
Hospitals seeking Medicare/Medicaid reimbursement must satisfy the federal Conditions of Participation (42 C.F.R. Part 482) via deemed status (TJC/DNV/HFAP) or direct state survey.
Oregon centralises oversight in the Oregon Health Authority, which runs the Oregon Health Plan, the Certificate of Need program, and the Sustainable Health Care Cost Growth Target program (ORS 442.386) setting annual spending limits. ORS 31.710 limits non-economic damages, but following Horton v. Oregon Health & Science University (2014) the constitutionality of those limits is frequently contested and warrants caution in risk assessment. Hospitals must meet federal CMS price-transparency rules plus additional OHA reporting. Physicians must register with the Oregon Prescription Drug Monitoring Program (ORS 431A.855).
Source documents: OR_Healthcare_Compliance_Framework.docx
Oregon's Sustainable Health Care Cost Growth Target program (ORS 442.386) holds hospitals and healthcare entities accountable to annual cost-growth benchmarks.
Hospitals must comply with the federal CMS hospital price-transparency rule (machine-readable file + shoppable services) plus additional OHA price-transparency reporting.
OHA administers the Oregon Health Plan (Medicaid) through coordinated care organizations; Oregon is an expansion state.
Physicians register with the Oregon Prescription Drug Monitoring Program (ORS 431A.855); the Oregon Medical Board administers licensure under ORS Ch. 677.
Oregon's CON program, administered by OHA, covers a broad range of capital projects, new services, and major changes.
Pennsylvania sets no cap on compensatory damages, but the MCARE Act caps punitive damages at 200% of compensatory damages and governs insurance obligations. PBMs are regulated under Act 110 of 2020, requiring licensure and restricting spread pricing. The PDMP (AWARxE) is mandatory. The state applies a strict corporate-practice doctrine requiring physician ownership of medical practices. Telehealth reimbursement parity is permanent under Act 98 of 2022 and Act 42 of 2024, with opioid-use-disorder treatment initiable via telehealth subject to an in-person exam within 14 days. Privacy follows the federal HIPAA baseline; no comprehensive state consumer health-data statute is in effect.
Source documents: Pennsylvania_Healthcare_Legal_Framework_Extended_Version.docx; Pennsylvania_Healthcare_Legal_Framework_Short_Version.docx
DHS administers Medicaid (Medical Assistance) and HealthChoices managed care; Pennsylvania is an expansion state.
Pennsylvania requires physician ownership of medical practices under a strict CPOM doctrine; medical-practice ownership is a distinct compliance focus.
Permanent telehealth reimbursement parity (Act 98 of 2022; Act 42 of 2024); OUD treatment may be initiated via telehealth through narcotic treatment programs with an in-person exam required within 14 days (DDAP Licensing Alert 01-2025).
Covered entities comply with the HIPAA Privacy Rule with safeguards, authorization, and breach-notification procedures; no comprehensive state consumer-health-data statute identified.
The State Board of Medicine licenses physicians and allied professionals under the Medical Practice Act of 1985 (63 P.S. 422.1-422.53), amended by Act 79 of 2021.
Rhode Island imposes no malpractice cap and is a Medicaid expansion state. Certificate of Need is governed by R.I. Gen. Laws Ch. 23-17, but June 2026 fiscal-budget amendments significantly simplified facility licensing: many services and items of equipment no longer require CON review and the capital-expenditure threshold was raised. PBM oversight sits with the Department of Business Regulation and centres on preventing unauthorised disclosure of patient pharmacy data. Corporate-practice restrictions remain as they were: HB 7721 and SB 2459, which would have tightened MSO contracting and practice ownership, were held for further study in April 2026 and did not pass.
Source documents: Rhode_Island_Healthcare_Legal_Framework.docx
Pharmacy Benefit Manager data practices are regulated under DBR oversight to prevent unauthorized disclosure of patient prescription patterns.
Medicaid operates alongside HealthSource RI (the state exchange) regulated under Title 27; Rhode Island is an expansion state.
HB 7721 and SB 2459 (2026) propose to strengthen CPOM restrictions by prohibiting unlicensed entities from owning practices or employing licensees and by regulating MSO contracts.
Rhode Island imposes no statutory cap on economic or noneconomic malpractice damages and requires no pre-suit certificate of merit or screening panel; malpractice limitations run 3 years (9-1-14.1) with a discovery rule.
RIDOH administers facility licensing (Ch. 23-17) with CON reviews conducted by the Health Services Council, which recommends to the Director of Health.
DHEC was abolished on July 1, 2024; all healthcare facility licensing now sits with the Department of Public Health, and references to DHEC are legally obsolete. Non-economic damages are capped under Section 15-32-220, CPI-indexed to $580,461 per provider for 2025-2026 and rising annually. Claims run on a 3-year discovery period with a 6-year statute of repose. South Carolina has no codified corporate-practice prohibition; the area is governed by case law and the Board of Medical Examiners, and Bill S. 46 (2025-2026), which would have codified it, is dead. Controlled-substance prescribing is regulated under Title 44, Chapter 53.
Source documents: SC_Healthcare_Legal_Framework_EXTENDED.docx; SC_Healthcare_Legal_Research_Framework.docx
S. 46 is a proposed CPOM/healthcare-contracts measure addressing corporate practice of medicine.
Controlled Substances Act (Title 44 Ch. 53) with PDMP and prescribing limits; SC Bureau of Drug Control registration is required (in addition to DEA) to prescribe controlled substances via telemedicine to SC patients.
DHEC was abolished July 1, 2024 (Act 60 of 2023); facility licensing (R.61 series) is now administered by the Department of Public Health — prior DHEC citations must be updated to DPH.
CPI-adjusted noneconomic-damages cap of $580,461 per provider (2025) under 15-32-220, with exceptions for gross negligence, felony, or DUI.
3-year discovery rule with a 6-year statute of repose (15-3-545); foreign-object exception; tolling by NOI. Governmental claims: 2 years under the SC Tort Claims Act.
Residual CON remains under Title 44 Ch. 7 after broader reform; patient-rights provisions at 44-7-260.
South Dakota caps non-economic damages in medical malpractice at $500,000 (SDCL 21-3-11), with no statutory maximum on economic damages. Claims run two years from the injury (SDCL 15-2-14.1); the discovery rule is very limited, so the clock generally starts at the harmful act. The state operates no Certificate of Need system, so opening or expanding facilities needs no state need-approval. The PDMP is mandatory under SDCL Ch. 34-20E: dispensers upload within 24 hours and practitioners must check before prescribing Schedule II and III opioids to new patients. PBMs are regulated under SDCL 58-29E.
Source documents: south_dakota_healthcare_legal_framework.docx
South Dakota Medicaid (DSS, SDCL Ch. 28-6) expanded coverage effective 2023 following a voter-approved initiative.
South Dakota's PDMP (SDCL Ch. 34-20E) requires dispensers to report within 24 hours; prescribers must query before prescribing Schedule II or III opioids to new patients; the program interfaces with PMPInterConnect.
Health privacy governed by HIPAA/HITECH plus targeted state confidentiality statutes for sensitive categories.
Malpractice claims against providers run 2 years (SDCL 15-2-14.1), generally from the negligent act/omission, with a discovery rule in appropriate cases.
SD DOH licenses facilities under SDCL Ch. 34-12; professionals are licensed by boards under SDCL Title 36 with Department of Labor and Regulation support.
Tennessee's Health Care Liability Act imposes a procedurally demanding 60-day pre-suit Notice of Intent with a HIPAA authorization (TCA 29-26-121) — described in the research as a 'graveyard' for technical defects — plus a two-tier noneconomic-damages cap (29-39-102) and contiguous-state expert rules. CON is retained. Governmental providers route through the Claims Commission with a $300,000 limit.
Source documents: TN_Healthcare_SOC_Extended.docx; TN_Healthcare_SOC_QuickReference.docx
Medicaid delivered through TennCare managed care; Tennessee has not adopted full ACA expansion.
Tennessee participates in the Interstate Medical Licensure Compact (63-6-234); controlled-substance monitoring and prescribing limits apply (PDMP framework).
Privacy under HIPAA/HITECH plus federal SUD confidentiality; the NOI HIPAA authorization is a distinctive litigation requirement.
A 60-day pre-suit NOI with a compliant HIPAA medical authorization is mandatory (29-26-121); proper service tolls limitations/repose by 120 days. Courts have dismissed cases for HIPAA-authorization defects.
Statutory standard of care (29-26-115(a)); experts must be licensed in Tennessee or a contiguous state (29-26-115(b)); two-tier noneconomic-damages cap (29-39-102).
Tennessee retains CON (one of ~34 states) for hospital beds, nursing-home beds, major equipment, and cardiac/obstetric/neonatal services; administered by the Health Services & Development Agency.
Claims against state providers go to the Tennessee Claims Commission ($300,000 limit, no punitive damages); practitioners and insurers must report malpractice payments to the Board of Medical Examiners.
Texas pairs the nation's largest uninsured population and a no-Certificate-of-Need market (since 1985) with one of the strictest, most actively litigated Corporate Practice of Medicine doctrines (a 2023 Travis County jury awarded $10M in a CPOM case). It has not expanded Medicaid. Privacy relies primarily on HIPAA plus Health & Safety Code Chapter 181, and the 89th Legislature (2025) produced significant fraud-enforcement and EHR-content legislation including the contested SB 1188.
Source documents: TX_healthcare_standard.docx; TX_healthcare_extended.docx
SB 1038 adds civil/administrative Medicaid fraud penalties; HB 142 updates HHSC-OIG overpayment review and recovery authority; SB 513 (rural pilot), HB 136 (lactation coverage) also enacted.
Texas has not expanded Medicaid (highest uninsured rate nationally, ~17-18%); managed care via STAR/STAR+PLUS/STAR Kids; expansion bills again died in 2025, next window 2027.
Among the strictest CPOM regimes; rooted in the Medical Practice Act (Occ. Code 164.052(a)(17)), TBOC Chapter 301, and TMB Rule 177.17. A 2023 Travis County jury awarded $10M for management-company control over physician decision-making.
HIPAA baseline plus Health & Safety Code Chapter 181 (broader 'covered entity' definition, HHSC + AG enforcement), Business & Commerce Code Chapter 521, and mental-health records Chapter 611.
Requires EHRs maintained in Texas to record biological sex at birth and incorporate it into AI clinical-decision tools; agencies (HHSC, TMB, TDI, TDLR) developing an implementation MOU; commentators flag ACA Section 1557 conflict.
Asynchronous DTC prescribing platforms (GLP-1, hair loss, birth control) raise CPOM and fee-splitting concerns where the platform sets protocols and compensates physicians per encounter.
Texas repealed CON in 1985; new facility entry is governed by licensure only — one of the most open facility markets in the country.
Comprehensive restrictions on physician/clinician non-competes effective September 1, 2025, limiting geographic scope and duration — significant for PE-backed structures.
Utah caps non-economic damages in medical malpractice at $450,000 under Utah Code 78B-3-410. Medicaid expanded fully on January 1, 2020 and is administered by DHHS. PBMs are regulated under Utah Code 31A-46, covering transparency and licensing. As of March 2026, SB 319 governs the use of artificial intelligence in health insurance, particularly prior authorization, to prevent bias and protect patient rights. Telehealth parity is required under 31A-22-618. Controlled substances fall under the Controlled Substances Act (58-37) and the Medical Cannabis Act (26B-4-1501).
Source documents: Utah_Healthcare_Legal_Framework_Extended_Version.docx; Utah_Healthcare_Legal_Framework_Short_Version.docx
Utah implemented full Medicaid expansion effective January 1, 2020; administered by DHHS with integrated behavioral-health managed care.
Insurers must cover telehealth with equivalent reimbursement and cost-sharing; audio-only behavioral health for established patients must be covered; telehealth meets the same standard of care.
Controlled-substance regulation under the Controlled Substances Act (58-37); medical cannabis under the Medical Cannabis Act (26B-4-1501 et seq.).
Covered entities comply with the HIPAA Privacy Rule; no comprehensive state consumer-health-data statute identified in the excerpts.
Facilities under the Health Care Facility Licensure Act (26B-2-201); physicians under the Utah Medical Practice Act (58-67-101 et seq.); DOPL administers clinician licensing.
Vermont runs one of the most heavily regulated healthcare environments in the country despite its small population. The Green Mountain Care Board is an unusually powerful regulator, enforcing all-payer rate-setting and controlling hospital budgets and tariffs, and it administers a Certificate of Need program that is among the most extensive in New England, covering capital expenditure, new services, and major equipment changes. The Department of Health licenses hospitals under 18 V.S.A. Ch. 43, a prerequisite for federal certification. State health-data privacy law exceeds federal minimums, and the Vermont Prescription Monitoring System is operational.
Source documents: VT_Healthcare_Compliance_Framework.docx
The Green Mountain Care Board is a uniquely powerful all-payer rate-setting body governing hospital budgets and rates.
The Department of Vermont Health Access administers Medicaid; Vermont is an expansion state operating within the all-payer model.
Vermont has enacted state-level health-information-privacy laws that exceed federal minimums.
Vermont's CON program — administered with the Green Mountain Care Board — is one of the most expansive in New England, applying to a wide range of capital expenditures, new services, and substantial service changes.
Hospitals must be licensed by VDH (18 V.S.A. Ch. 43); licensure is a prerequisite for CMS certification and participation in state payer programs.
Virginia's framework is anchored by a statutory standard of care (8.01-581.20) and a scheduled, inflation-rising medical-malpractice damages cap (8.01-581.15, roughly $2.65M-$2.70M). Pre-service expert certification is required, out-of-state experts must show familiarity with Virginia's statewide standard, and peer-review privilege is broad (expanded to wellness committees in 2025). Recent attempts to eliminate the cap failed.
Source documents: VA_Healthcare_SOC_QuickReference.docx; VA_Healthcare_Standard_of_Care_Research.docx
Medicaid administered by DMAS under 12 VAC 30; Virginia expanded Medicaid (referenced via DMAS administration and 12 VAC 30 rules).
SB 904 (2025) proposed complete elimination of malpractice damages caps and was passed by indefinitely in committee; SB 493 (2024) to remove the cap for patients age 10 and under failed to advance.
Privacy governed by HIPAA/HITECH with the federal fraud-and-abuse overlay (Stark, AKS, FCA, 42 C.F.R. Part 2); no comprehensive state consumer-health-data statute identified in the research.
Standard of care defined by statute; out-of-state experts must affirmatively demonstrate familiarity with Virginia's statewide standard (an accepted method is a Board of Medicine equivalency letter).
Medical-malpractice damages cap on a rising statutory schedule (approximately $2.65M-$2.70M), with annual increases; expert certification required pre-service with a 21-day automatic obligation.
Broad peer-review/quality-improvement privilege; quality-committee records not discoverable, with a 2025 expansion to wellness committees.
Virginia Birth-Related Neurological Injury Compensation Program provides a no-fault fund alternative; administered by VBNICP with claims heard by the Workers' Compensation Commission.
Washington's healthcare regulation currently centres on antitrust and transaction oversight, mental-health parity, Medicaid, and reproductive health. The Mini-HSR statute (RCW 19.420) requires notice of planned mergers and acquisitions, and HB 2548, effective March 2026, extended that oversight to ownership changes and asset transfers, tightening scrutiny of private equity. SB 5387, which would have barred the corporate practice of medicine and restricted PE ownership, failed. Insurers must provide adequate mental-health coverage and may not retroactively deny claims older than 180 days except for fraud. The Reproductive Privacy Act (RCW 9.02) is reinforced by shield-law protections.
Source documents: Healthcare_Legal_Framework_Washington_DeepResearch.docx
Carriers must offer meaningful MH coverage in each benefit classification, adopt federal parity rules, meet utilization-review timelines (auto-approval if missed), and may not retroactively deny claims older than 180 days (except fraud).
Medicaid (Apple Health) administered by the Health Care Authority; the research notes ASAM-criteria adoption timing changes for SUD treatment in managed care.
The Reproductive Privacy Act (RCW 9.02, voter-enacted 1991) guarantees abortion and contraception rights independent of Dobbs; a Shield Law and emergency hospital abortion rules add provider/patient protections.
SB 5387 would prohibit the corporate practice of medicine and limit PE/MSO ownership, effective Jan. 1, 2027 if passed; among the most consequential 2025 bills.
A Mini-HSR antitrust pre-merger notice law (RCW 19.420) took effect July 27, 2025; the Healthcare Entity Registry requires ownership/subsidiary disclosure (including PE-backed entities); the pending Keep Our Care Act would add 90-day notice and AG approval.
West Virginia remains a Medicaid expansion state with an active Certificate of Need program under W. Va. Code 16-2D. HB 5430, effective April 2026, regulates pharmacy benefit managers, prohibiting spread pricing and mandating transparency. The 2023 reorganization (HB 2006) split the former DHHR into three cabinet-level agencies from January 2024: Health, Human Services, and Health Facilities; facility licensing remains with OHFLAC. The state enforces strict opioid prescribing limits and mandatory PDMP consultation. Hospital licensing runs under W. Va. Code 16-2B-1 (CSR Title 64), renewed annually and non-transferable.
Source documents: WV_Healthcare_Compliance_Framework.docx
Hospitals must comply with the federal CMS hospital price-transparency rule, with WV-specific reporting as required.
Medicaid administered by the state health/human-resources agency; West Virginia is an expansion state.
West Virginia's opioid response is among the most aggressive nationally — prescriber limits, mandatory PDMP consultation, pharmacy dispensing restrictions, and hospital-based intervention programs.
The Health Care Facilities Certificate of Need program (administered by the state health department) covers a broad range of services and capital expenditures.
Hospitals must be licensed by the state health department through OHFLAC under W. Va. Code 16-2B-1 et seq. (CSR Title 64); licenses renew annually and are non-transferable.
Wisconsin caps medical-malpractice noneconomic damages (655.017; 893.55(4)) and repealed CON for most facilities. Patient-records confidentiality is detailed (146.81-146.84) with heightened HIV and mental-health protections, and the PDMP covers Schedule II-IV substances (961.385). Notably, PBM oversight legislation stalled in 2024, leaving Wisconsin without PBM transparency rules many neighbors have adopted.
Source documents: WI_Healthcare_Legal_Framework.docx
In 2024 the legislature considered but did not enact a Prescription Drug Affordability Review Board or broader PBM regulation; as of March 2026 Wisconsin lacks PBM oversight rules many neighboring states have, an active advocacy gap.
BadgerCare Plus (~1M members) administered by DHS via ForwardHealth; Wisconsin occupies a singular non-traditional-expansion position covering adults to 100% FPL without formal ACA expansion.
Patient health-care records are protected under 146.81-146.84 (broader than HIPAA in places), with heightened HIV (252.15) and mental-health (51.30, 51.61) protections including a right to refuse medication in non-emergencies.
Wisconsin operates a PDMP for Schedule II-IV controlled substances; prescribers are encouraged (and in some cases required) to check it before prescribing, and dispensers must report.
Noneconomic damages for malpractice on/after April 6, 2006 are capped under the Wisconsin statutes, distinguishing claimant and provider categories (the cap survived Ferdon-era challenges).
Wisconsin repealed CON for most healthcare facilities — a deregulatory posture that increased competition while raising over-building concerns in profitable service lines.
Wyoming maintains a market-driven environment with no Certificate of Need program, fully repealed, so facility entry follows market demand rather than state supply caps, though all facilities must hold active licensure through the Department of Health. The cap on non-economic damages in malpractice litigation is inflation-adjusted to roughly $2,007,977. Claims must be filed within 2 years of discovery, with tolling for minors until age 8 and a mandatory expert affidavit under W.S. 1-12-102. The Wyoming Prescription Drug Monitoring Program (W.S. 35-7-1060) is operational under WDH. Wyoming has not adopted ACA Medicaid expansion.
Source documents: WY_Healthcare_Legal_Framework.docx
WDH administers Medicaid; Wyoming has not adopted ACA expansion.
Wyoming repealed CON; facilities may be established by market demand but must be licensed by the WDH Healthcare Licensing and Surveys section under W.S. Title 35.
Wyoming caps noneconomic damages in malpractice cases at an inflation-adjusted amount (approximately $2,007,977) under W.S. 1-1-132.
Malpractice claims run 2 years from discovery of injury (W.S. 1-3-107); for minors, tolled until age 8 then 2 years; expert-affidavit requirements apply (W.S. 1-12-102).
WDH licenses facilities and oversees public health, behavioral health, and Medicaid.
These are the obligations pharma teams typically expect from a state compliance product. None appeared in the uploaded research, so none are represented as findings above. Each must be sourced from primary law before it can be added — this list is the build specification, not a dataset.
Treat this report as the boundary of the product. Marketing or relying on the page as covering these topics would misrepresent it.
This page is built only from a fixed set of uploaded state research documents (reviewed 2024 to June 2026, each marked "current as of" its own review date). Every entry is tied to a source statute, agency, or document name. Where the source set is silent, the entry reads Not found in provided research and the field is hidden rather than guessed — nothing is inferred from outside the documents.
What the source set is. General state healthcare-law frameworks and medical standard-of-care research, written from a provider, hospital, and health-plan perspective. A pharma-relevance lens is applied on top: every requirement is a Direct manufacturer-facing signal, Market access / reimbursement, Commercial / prescribing / privacy adjacent, or Provider context only (the last is demoted to a collapsed block per state).
Obligation type and actionability. Each record also carries an obligation type — affirmative obligation, restriction, reporting duty, licensing duty, coverage/market-access context, liability standard, no state-specific obligation found, or proposed — so that an absence of law is never mislabeled as a duty. And each carries an actionability grade: A primary-source verified with action, deadline, agency, and penalty all filled; B verified but operational fields incomplete; C document-level only; D low confidence or attorney review required. Today the distribution is A 1 / B 0 / C 256 / D 23 — i.e. most records are still document-level and should not be relied on as verified law.
What this is not — and the gap. This is not complete pharmaceutical-manufacturer compliance coverage. Drug price transparency, manufacturer/HCP-payment (Sunshine) reporting, sales-representative licensing, gift bans, sample/coupon rules, and manufacturer/wholesaler/distributor licensing were not present in the source set and are catalogued in the Gap report rather than represented as findings.
Verification & sources. Verified items link to the official primary source (e.g., California LegInfo, the New York Senate). 2 are verified so far — California SB 351 (graded A) and the New York Health Information Privacy Act / S9269 (graded D, pending) — shown with a Verified badge. All other entries remain document-level pending the same pass.
Counts. All 50 states are now covered, with 280 cited requirements; the accompanying JSON contains 280 records (one per requirement). Alaska was added in June 2026 from a later-provided single source document and is marked accordingly.
Informational only — not legal advice. Beta. A research and navigation aid for compliance, legal, regulatory-affairs, market-access, and government-affairs teams. It does not constitute legal advice or create an attorney-client relationship and is not complete manufacturer-compliance coverage. Confirm any requirement against the primary source and qualified counsel before acting.
Every item carries a confidence level and a last-reviewed date. Items flagged for attorney review or with pending legislation are marked on the card. Where a primary source was not verified during research, sparse fields are omitted rather than guessed.
This page is an informational research layer compiled from state statutes, regulations, and agency guidance. It is not legal advice, may be incomplete or out of date, and must not be relied on for compliance decisions. Consult qualified counsel and verify all requirements against primary sources.
Of 280 cited requirements across 50 states: 5 direct manufacturer-facing signals, 77 market-access/reimbursement, 89 commercial/prescribing/privacy adjacent, and 109 provider context only. Roughly 171 pharma-relevant signals — meaningful, but not a substitute for a dedicated manufacturer-obligation dataset.
A 1 (verified + complete) · B 0 (verified, incomplete) · C 256 (document-level) · D 23 (low confidence / review). 23 records are flagged attorney review required. Use the Verified only and Needs attorney review filters to triage.
Primary-source verified against official sources: CA SB 351 (LegInfo; Ch. 409; effective Jan 1, 2026 — grade A) and NY HIPA / S9269 (NY Senate; passed both chambers June 2026, awaiting Governor — grade D). Everything else is document-level.
States with both short and extended documents and six or more requirements: NC, TX, CA, FL, MI, TN, VA, CO, GA, IN, MA, MN, NY, OH, SC. Single-source states: 28 of 50; thinner single-source with multiple low-confidence entries: MO.
Alaska was previously uncovered (empty source folder); a single extended framework document was supplied in June 2026 and is now integrated. As a single-source state its damages-cap/SOL specifics were not detailed — verify separately.
South Carolina materials predating July 1, 2024 cite DHEC, abolished and split into DPH (Act 60 of 2023). West Virginia agency naming is mid-reorganization. Several 2025–2026 sessions referenced were still in progress.
No, and the page says so. It is state healthcare regulatory intelligence with a pharma-relevance lens, built from a fixed research set. Manufacturer-specific obligations (price transparency, Sunshine/HCP-payment reporting, sales-rep licensing, gift bans, sample/coupon rules, manufacturer/distributor licensing) are not covered and are listed in the Gap report.
Every requirement is tagged by relevance type (Direct manufacturer-facing / Market access / Adjacent / Provider context) and by obligation type (affirmative obligation, restriction, reporting duty, licensing duty, coverage context, liability standard, no state-specific obligation found, or proposed). A "no law found" signal is never shown as a duty. Provider context is collapsed under each state.
A = primary-source verified with action, deadline, agency, and penalty filled; B = verified but operational fields incomplete; C = document-level only; D = low confidence or attorney review required. Most records are C today. Filter to 'verified only' or 'needs attorney review' to triage.
Most entries are document-level. Verified items link to the official primary source - so far CA SB 351 (California LegInfo) and NY HIPA/S9269 (New York Senate). Treat unverified entries as research leads, not legal conclusions.
Yes, as of June 2026. Alaska was the one previously uncovered state (its source folder was empty); a single extended framework document was later provided and is now integrated like any other state, flagged as single-source.
The Gap report doubles as a roadmap: a dedicated manufacturer-obligation dataset, plus primary-source URLs and operational fields (action, deadline, agency, penalty) filled for the highest-value records first - PBM, consumer health data, Medicaid, controlled substances, and pending legislation.
No. Confirm any requirement against the primary source and qualified counsel before acting.
Beta: Healthcare-law signals for pharma teams. Not complete manufacturer compliance coverage. Informational only — not legal advice. Compiled solely from a fixed set of uploaded state healthcare-law research documents (reviewed 2024 to June 2026) with a pharmaceutical-relevance lens applied. It does not constitute legal advice and does not create an attorney-client relationship. Statutes, regulations, and agency structures change; pending bills may never become law. Verify every requirement against the primary source and qualified counsel before acting.
Data current to June 2026 · 50 states · 280 cited requirements (5 direct / 77 market-access / 89 adjacent / 109 provider context) · JSON has 280 records · actionability A1/B0/C256/D23 · 2 primary-source verified · source set reviewed 2024 to June 2026.