For market access, privacy, compliance, and government-affairs teams — every requirement classified by relevance type, obligation type, and an A–D actionability grade, tied to a source, with manufacturer-specific gaps clearly identified. Nothing is invented.
171 pharma-relevant signals across 50 states, by relevance type.
Manufacturer-specific topics absent from the source set. Source separately before relying on them.
Suggested sequencing to become a true manufacturer-obligation product.
Covered — number = pharma-relevant signals. All 50states now have source research. A schematic cartogram: each square is one state in roughly its geographic position. Counts show direct, market-access, and adjacent signals only — provider context is excluded from the count and folded into each state profile.
| State | Certificate of Need | Malpractice cap | Medicaid expansion | PBM law | PDMP | Signals |
|---|---|---|---|---|---|---|
| AL | Active | None (struck down) | No | - | n/s | 2 |
| AK | Active ($1.5M) | n/s | Yes (2015) | - | Yes | 11 |
| AZ | n/s | n/s | Yes | - | Yes | 4 |
| AR | Active | n/s | Yes | - | Yes | 2 |
| CA | n/s | MICRA | Yes | - | Yes | 7 |
| CO | n/s | n/s | Yes | - | Yes | 4 |
| CT | Active | n/s | Yes | - | n/s | 2 |
| DE | n/s | n/s | Yes | Yes (HB 212) | n/s | 4 |
| FL | Residual | n/s | No | - | Yes | 4 |
| GA | Active | None (standard) | No (Pathways) | - | Yes | 3 |
| HI | n/s | None | Yes | - | Yes | 2 |
| ID | n/s | n/s | Yes (contested) | - | Yes | 4 |
| IL | Active | n/s | Yes | - | n/s | 3 |
| IN | None (repealed 2003) | $500K + PCF | Yes | - | n/s | 2 |
| IA | n/s | n/s | Yes | Yes (SF 383) | n/s | 2 |
| KS | n/s | n/s | Yes (contested) | - | Yes | 3 |
| KY | Active | n/s | Yes | Yes | n/s | 3 |
| LA | n/s | $500K + PCF | Yes | - | n/s | 4 |
| ME | Active | n/s | Yes (2019) | - | n/s | 2 |
| MD | Active | ~$920K | Yes | - | n/s | 3 |
| MA | Active (review) | n/s | Yes | Yes (license) | Yes | 5 |
| MI | Active | ~$1.065M (2026) | Yes | - | Yes | 3 |
| MN | n/s | None | Yes | Yes (Board) | n/s | 3 |
| MS | Active | n/s | No | Yes (HB 17) | n/s | 3 |
| MO | n/s | $350K (Watts) | Yes (Amd. 2) | - | n/s | 3 |
| MT | Active | n/s | Yes | - | n/s | 2 |
| NE | n/s | n/s | Yes | - | All-drug | 4 |
| NV | n/s | $350K | Yes | - | n/s | 2 |
| NH | n/s | n/s | Yes | - | Yes | 4 |
| NJ | Active | n/s | Yes | - | n/s | 3 |
| NM | n/s | $750K (PCF) | Yes | - | n/s | 2 |
| NY | Active | n/s | Yes | - | n/s | 5 |
| NC | Active (reforming) | n/s | Yes | - | Yes | 6 |
| ND | Unclear | n/s | Yes | - | n/s | 2 |
| OH | Active | Yes (medical) | Yes | - | Yes | 3 |
| OK | n/s | n/s | n/s | - | n/s | 2 |
| OR | Active | n/s | Yes | - | Yes | 4 |
| PA | n/s | n/s | Yes | - | Yes | 4 |
| RI | Active | None | Yes | Yes (data) | n/s | 3 |
| SC | Residual | $580K (2025) | No | - | Yes | 2 |
| SD | n/s | n/s | Yes (2023) | - | Yes | 3 |
| TN | Active | Two-tier cap | No | - | Yes | 3 |
| TX | None (repealed 1985) | n/s | No | - | Yes | 6 |
| UT | n/s | n/s | Yes (2020) | - | Yes | 4 |
| VT | Active | n/s | Yes | - | n/s | 3 |
| VA | n/s | Scheduled (~$2.65M) | Yes | - | n/s | 3 |
| WA | n/s | n/s | Yes | - | n/s | 5 |
| WV | Active | n/s | Yes | - | Yes | 3 |
| WI | Repealed | Yes | Yes (non-trad.) | Stalled | Yes | 4 |
| WY | Repealed | ~$2.0M | No | - | n/s | 1 |
n/s = not specified in source (a gap, not "none"). "Malpractice cap" = noneconomic-damages cap, as stated in source; several are CPI-adjusted. "Signals" counts direct + market-access + adjacent items. Click a header to sort. Values reflect only the provided research. Click a state to filter the requirement list below.
Alabama did not expand Medicaid, maintains one of the nation's most comprehensive Certificate of Need programs (SHPDA), and applies the Alabama Medical Liability Act with strict procedure but no enforceable damages caps (repeatedly struck down by the Alabama Supreme Court). APRN practice follows a reduced/collaborative model.
Source: alabama_healthcare_legal_framework extended.docx; alabama_healthcare_legal_framework_12pg.docx
Alabama did not expand Medicaid; the Alabama Medicaid Agency administers Medicaid/CHIP under Ala. Code 22-6-1.
HIPAA governs privacy/security (state agencies adopt HIPAA policies); SUD records carry additional protection under 42 C.F.R. Part 2; ADPH facility rules require record retention of at least 5 years.
Alaska reorganized its former DHSS into a standalone Department of Health and a Department of Family and Community Services (Executive Order 121, effective July 1, 2022), with the DOH serving as the single state Medicaid agency. The state is notably permissive on corporate structure — no codified Corporate Practice of Medicine doctrine, only a functional-control limit — while layering above-HIPAA privacy rules (Genetic Privacy Act; APIPA breach law) and a distinctive 80th-percentile out-of-network payment rule. Mid-2026 brought a cluster of enacted laws (SB 272 health-information-exchange modernization, HB 14 telehealth parity, SB 89 physician-assistant practice) plus permanent Medicaid MAT coverage.
Source: Alaska.docx (Alaska Healthcare Legal Framework, June 2026)
Alaska adopted ACA Medicaid expansion in 2015 (adults 19-64 to 138% FPL); after federal H.R. 1 (July 2025) introduced community-engagement/work-verification requirements, the DOH runs automated ex parte exemption checks through its ARIES eligibility platform (~61,169 expansion enrollees evaluated in early 2026, ~69% auto-exempted).
CMS approved Alaska Medicaid State Plan Amendment 25-0010 in January 2026, permanently integrating MAT into the baseline Medicaid plan and guaranteeing reimbursement for all FDA-approved opioid-treatment medications bundled with behavioral-health services.
A distinctive Alaska rule (3 AAC 26.110) requires commercial insurers to pay out-of-network providers at or above the 80th percentile of typical regional charges for a service, shielding patients from balance billing; insurers argue it inflates premiums and it remains under DCCED review.
The Division of Insurance requires prior-authorization decisions within 5 business days (routine) or 72 hours (urgent), with failure treated as implied approval; network-adequacy rules require covering out-of-network specialist care at the in-network rate where no in-network specialist is reasonably available.
HB 14 (enacted mid-2026) bars insurers from paying less for a telehealth service than for an equivalent in-person encounter, validates synchronous video, audio-only, and store-and-forward modalities, and allows the patient's home as an authorized originating site.
SB 272 with companion HB 285 (enacted mid-2026) codifies HealtheConnect Alaska as the single state-recognized health-information-exchange clearinghouse, mandates a standardized consumer opt-out at all connected endpoints, forces alignment with the federal TEFCA framework, and grants good-faith civil-liability immunity for compliant HIE disclosures.
The Genetic Privacy Act (AS 18.13.010) makes DNA and genetic-test results the individual's personal property and requires specific written informed consent before collecting, analyzing, retaining, or disclosing genetic data — tighter than HIPAA; mental-health records (AS 47.30.845) carry heightened confidentiality.
The Alaska Personal Information Protection Act (AS 45.48), independent of HIPAA, requires notifying affected residents without unreasonable delay and simultaneously notifying the Attorney General when a breach affects more than 500 residents; non-compliance can trigger civil penalties up to $25,000 per violation.
Alaska maintains no codified statutory or judicial CPOM doctrine, so a general corporation may employ physicians — subject only to a 'functional control exception' barring interference with clinical judgment. Professional corporations (AS 10.45.050) must be 100% owned by licensed professionals, and Alaska does not recognize the PLLC, leaving the PC or a general LLC with clinical carve-outs as the structuring options.
APRNs may practice independently (AS 08.68.850) with full prescriptive authority for Schedule II-V substances given DEA registration and PDMP use; pharmacists may enter collaborative practice agreements (AS 08.80.410) to manage drug therapy and may dispense naloxone under a standing order without an individual prescription.
Following federal trends, the Alaska Division of Insurance is evaluating formal guidelines governing the use of AI and algorithmic systems by commercial carriers in claims review and utilization management — no rule yet adopted as of mid-2026.
Arizona delivers Medicaid through AHCCCS (established 1982) under an 1115 waiver, licenses facilities through DHS (A.R.S. 36-401), and runs the Controlled Substances Prescription Monitoring Program (CSPMP) through the Board of Pharmacy. Health information organizations operate under opt-out and HIPAA-aligned rules. Insurance is regulated under Title 20 by DIFI.
Source: Arizona_Healthcare_Legal_Framework_Extended_Version.docx; Arizona_Healthcare_Legal_Framework_Short_Version.docx
AHCCCS is Arizona's single state Medicaid agency operating under a 1115 Research and Demonstration Waiver (A.R.S. 36-2901 et seq.); managed-care delivery with flexible program design.
Health insurance, HMOs, and health-care-services organizations are regulated under Title 20 by the Department of Insurance and Financial Institutions.
The Board of Pharmacy operates the Controlled Substances Prescription Monitoring Program tracking Schedule II-V dispensing statewide.
AHCCCS and providers comply with the HIPAA Privacy Rule; Health Information Organizations operate under Laws 2011 Ch. 268 (and SB 1321 amendments) with individual opt-out rights.
Arkansas pairs tort-reform features (2-year-from-discovery limitations capped at 3 years from the act, a certificate-of-merit requirement in certain cases, and an 'I'm Sorry' apology-inadmissibility provision) with an established Certificate of Need program dating to the 1970s. The Arkansas PMP (A.C.A. 17-92-1101) supports opioid-diversion efforts, and Act 1220 (2019) created an APRN independent-practice path.
Source: arkansas_healthcare_legal_framework.docx
Arkansas expanded Medicaid (historically via the 'private option' / ARHOME) with major reform beginning in 2013; the AID oversees HMOs/MCOs.
The Arkansas PMP (A.C.A. 17-92-1101 et seq.), administered by ADH, requires prescribers/dispensers to report and consult under specified circumstances as a key opioid-diversion tool.
California operates the most expansive state healthcare framework, with a unique dual managed-care/insurance regulator (DMHC and CDI) and the new Office of Health Care Affordability setting enforceable cost-growth targets from 2026. Its privacy regime exceeds HIPAA — the Confidentiality of Medical Information Act expressly reaches pharmaceutical companies, and consumer-health-data from non-HIPAA apps falls under CCPA/CPRA. CPOM was recently codified by SB 351 (2025).
Source: California_healthcare_legal_framework.docx; california_healthcare_extended.docx
The Confidentiality of Medical Information Act (Civil Code 56 et seq.) is broader than HIPAA and expressly covers pharmaceutical companies and contractors, defining 'medical information' to include data in a pharmaceutical company's possession.
Health data from non-HIPAA digital-health, wellness, and reproductive-health apps is fully subject to CCPA/CPRA sensitive-personal-information rules.
OHCA (SB 184, 2022) sets statewide cost-growth targets (3.5% for 2025, non-enforceable; enforcement activates for 2026) and conducts Cost & Market Impact Reviews of material transactions.
DMHC regulates managed-care plans under the Knox-Keene Act (Health & Safety Code 1340 et seq.); CDI regulates indemnity/PPO products — a nationally unique dual-regulator model.
DHCS administers Medi-Cal (>14M enrollees), the largest single health program in the state, with managed-care contracting.
California's CPOM doctrine (Medical Board guidance under the Medical Practice Act, B&P Code 2000 et seq.) was codified by SB 351, signed Oct 6, 2025 (Ch. 409; adds Health & Safety Code Division 1.7, Sec. 1190), effective Jan 1, 2026, barring private-equity groups and hedge funds from interfering with physician/dental clinical decisions and voiding certain noncompete/nondisparagement clauses.
California bars professional discipline for care lawful in California, protects providers prescribing/distributing medication-abortion drugs, and (AB 260, 2025) affirms opposition to interference with mifepristone.
Colorado integrates Medicaid (Health First Colorado, ~1 in 5 residents) through HCPF, facility licensing through CDPHE, and 60+ professions through DORA, which also houses the Division of Insurance. Physician licensure requires liability insurance minimums ($1M/$3M). The Colorado Privacy Act overlays HIPAA, and the BHA modernized controlled-substance licensing for medication-assisted treatment from January 1, 2024.
Source: Colorado_Healthcare_Legal_Framework_Extended_Version.docx; Colorado_Healthcare_Legal_Framework_Short_Version.docx
HCPF is the single state Medicaid agency administering Health First Colorado (~1 in 5 Coloradans) and CHP+; expansion state.
The DORA Division of Insurance regulates Colorado insurers, rates, and consumer complaints with federal-state consistency.
HIPAA baseline plus the Colorado Privacy Act (CPA), which Colorado integrates for covered entities and certain health-related data handling.
The BHA (from January 1, 2024) oversees Controlled Substance Licenses for medication-assisted-treatment programs alongside the state PDMP and pharmacy regulation.
Connecticut runs one of the nation's most active Certificate of Need programs (CGS 19a-638) with review by the Office of Health Strategy, licenses facilities and professionals through the Department of Public Health, and administers Medicaid (HUSKY) through DSS. Malpractice limitations run 2 years from discovery with a 3-year outside limit (CGS 52-584). APRN independent practice is permitted with experience.
Source: CT_Healthcare_Legal_Framework.docx
DSS administers Medicaid (HUSKY Health); Connecticut is an expansion state.
Health privacy governed by HIPAA with state confidentiality overlays; no comprehensive consumer-health-data statute identified.
Delaware in 2025 enacted PBM clawback reform (HB 212, championed by the Department of Insurance) protecting independent pharmacies and ensuring patients are not charged copays above actual drug cost. It runs a state Prescription Drug Payment Assistance Program (Title 16 Ch. 30B), expanded naloxone access via pharmacist standing orders, and licenses facilities through DHSS's Office of Health Facility Licensing and Certification.
Source: Delaware_Healthcare_Legal_Framework.docx
HB 212 (HS1, 2025), companion to SB 12, bars PBM/insurer 'clawback' practices that force pharmacists to refund collected amounts when a copay exceeds the negotiated rate, and protects independent-pharmacy reimbursement.
Delaware Code Title 16 Ch. 30B establishes a state Prescription Drug Payment Assistance Program administered by DHSS for low-income residents who do not qualify for Medicaid pharmacy benefits.
Medicaid operates with a federal-partnership exchange (healthcare.gov); Delaware is an expansion state, regulated under Title 18 for insurance products.
Delaware expanded naloxone access through pharmacist standing orders, allowing dispensing without a patient-specific prescription.
Florida regulates within a four-tier federal/state hierarchy with AHCA and DOH at the center. Malpractice procedure is statute-heavy (Chapter 766 pre-suit, Chapter 95 limitations), the long-controversial wrongful-death 'Free Kill' restriction survived a 2025 veto, and hospital CON was largely repealed in 2019 while residual CON remains for nursing homes. The 2025 session produced a large volume of provider-facing bills.
Source: FL_Healthcare_Legal_Framework_EXTENDED.docx; FL_Medical_Standard_of_Care_Research.docx
HB 6017, which would have repealed the noneconomic-damages restriction for certain adult relatives, passed by wide margins but was vetoed May 29, 2025; the restriction remains law.
PDMP operated under the Pharmacy Practice Act (Ch. 465); controlled substances cannot be prescribed via telehealth to a new patient without prior in-person evaluation, with limited exceptions (certain psychiatric meds, buprenorphine for OUD).
HB 519 (paramedics may administer controlled substances under supervision), HB 547 (medical-debt collection), HB 1421 (statewide VTE registry; hospital reporting from July 1, 2026), SB 1768 (first-in-nation non-FDA-approved stem cell therapy authorization), HB 647 (expanded APRN authority).
Privacy governed by HIPAA/HITECH plus 42 C.F.R. Part 2 for substance-use-disorder records (amended 2024); no comprehensive state consumer-health-data statute identified.
Georgia has no noneconomic-damages cap for standard malpractice claims (struck down in Nestlehutt, 2010), though the wrongful-death cap question remains live after Turner (June 2025). An emergency-care gross-negligence standard applies in the ER, expert qualifications follow a 3-of-5-year rule with Daubert, and Georgia retains an active CON program. Medicaid is delivered through Georgia Families with the limited Georgia Pathways to Coverage.
Source: GA_Healthcare_SOC_Extended.docx; GA_Healthcare_SOC_QuickReference.docx
Administered by DCH via Georgia Families managed care; Georgia did not adopt full ACA expansion and instead operates the limited Georgia Pathways to Coverage.
Prescribers must check the PDMP before prescribing Schedule II-V controlled substances to new patients and in certain circumstances for existing patients; failure can support malpractice and GCMB discipline.
Privacy under HIPAA/HITECH with the federal fraud-and-abuse overlay; no comprehensive state consumer-health-data statute identified.
Hawaii imposes no statutory cap on medical-malpractice compensatory damages (contrasting Nevada's $350,000 and New Mexico's $750,000 caps) and applies a 2-year-from-discovery limitations rule with a 6-year repose (HRS 657-7.3). Licensing runs through the Department of Health (facilities) and the DCCA's Professional and Vocational Licensing Division; physicians must complete CME including controlled-substance/opioid and PDMP topics.
Source: Hawaii_Healthcare_Legal_Framework.docx
Medicaid (Med-QUEST) is administered by DHS; Hawaii is an expansion state and operates the Prepaid Health Care Act employer-coverage mandate.
The state PDMP supports controlled-substance prescribing oversight, reinforced by mandatory CME topics.
Idaho emphasizes limited government and provider conscience rights, administering Medicaid, behavioral health, and facility licensing through the Department of Health and Welfare. It runs a Prescription Drug Monitoring Program for Schedule II-IV substances and has expanded medication-assisted treatment for opioid use disorder. A 2025 bill (HB 138) sought to add work requirements and enrollment caps to Medicaid expansion or trigger repeal.
Source: Idaho_Healthcare_Legal_Framework.docx
DHW administers Idaho Medicaid (the state's largest coverage program); HB 138 (2025) passed the House seeking work requirements, a 50,000 enrollment cap (vs. >90,000 actual), lifetime limits, and trigger-repeal provisions.
The Department of Insurance licenses insurers and reviews rates/forms under Idaho Code Title 41; Idaho operates its own market structure.
The Board of Pharmacy operates a PMP collecting Schedule II-IV dispensing data; prescribers and dispensers must check the PMP before prescribing specified controlled substances.
Idaho Code Title 39 Ch. 3 governs SUD programs licensed by DHW; the state expanded MAT (buprenorphine, naltrexone) with SAMHSA block-grant funding.
Illinois splits its framework across IDPH (facilities/public health), IDFPR (professional licensing for 1.2M professionals), HFS (Medicaid for ~3.4M), and IDOI (insurance). It retains a Certificate of Need process through the HFSRB. HIPAA was supplemented in 2024 by a federal reproductive-health data rule with affirmative provider obligations; the research flags federal Medicaid funding cuts as a major risk to rural hospitals.
Source: illinois_healthcare_extended.docx; illinois_healthcare_legal_framework.docx
HFS administers Medicaid for ~3.4M residents; the research projects significant coverage and federal-funding reductions under the 2025 federal budget law affecting rural hospitals.
IDOI regulates private insurance markets; behavioral-health parity and network-adequacy are active areas.
HIPAA baseline; the April 2024 federal reproductive-health privacy rule bars disclosing PHI to investigate lawful reproductive care, creating affirmative provider obligations; OCR penalties are tiered.
Indiana runs a nationally distinctive combined Medical Review Panel + Patient's Compensation Fund system: only 'qualified providers' enrolled in the PCF get cap and panel protection, and a proposed complaint is filed with the IDOI before court. Provider liability is capped at $500K with the PCF covering up to a $1.8M total. CON was abolished in 2003, and Indiana expanded Medicaid via the Healthy Indiana Plan (HIP 2.0).
Source: IN_Healthcare_SOC_Extended.docx; IN_Healthcare_SOC_QuickReference.docx
Indiana expanded Medicaid under a Section 1115 waiver as HIP 2.0 with POWER-account premium contributions; ~2 million enrolled as of 2025; administered by FSSA.
Privacy under HIPAA/HITECH plus federal SUD confidentiality; no comprehensive state consumer-health-data statute identified.
Iowa overhauled pharmacy regulation in 2025: the Board of Pharmacy replaced all rules (new IAC 481 Chapters 550-557, effective August 1, 2025) and the legislature enacted Senate File 383, a comprehensive PBM-reform statute with spread-pricing transparency and independent-pharmacy reimbursement protections enforced by the Iowa Insurance Division. Malpractice uses a 2-year limitations period with a 60-day certificate-of-merit affidavit.
Source: Iowa_Healthcare_Legal_Framework.docx
SF 383 (enacted June 11, 2025) establishes a comprehensive PBM regulatory framework: transparency for PBM compensation and spread pricing, reimbursement protections for independent pharmacies, and Iowa Insurance Division enforcement (Bulletin 25-06).
Medicaid (Iowa Health and Wellness Plan) administered by Iowa HHS; managed-care delivery (expansion state).
Kansas frames health policy around limited government; after a decade of resistance it expanded Medicaid (KanCare) only partially through ongoing political debate, with the documents noting Governor Kelly's 2019 expansion effort. Malpractice limitations run 2 years from discovery with an unusually long 8-year statute of repose (K.S.A. 60-513). Licensing is distributed across KDHE, the Board of Healing Arts, and others; KDHE administers KanCare.
Source: kansas_healthcare_legal_framework.docx
KDHE's Division of Health Care Finance administers KanCare; Kansas's expansion debate is longstanding, with a 2019 effort under Governor Kelly.
The Board of Pharmacy administers the Kansas PDMP; SUD and controlled-substance provisions apply.
Kansas made many COVID-era telehealth expansions permanent (audio-only visits, expanded originating sites).
Kentucky operates a comprehensive state-regulated system centered on the Cabinet for Health and Family Services with a robust Certificate of Need program (KRS Chapter 216B). Recent reforms include the nation's first criminal-liability shield for healthcare workers and a new medical-cannabis program. The Department of Insurance regulates PBMs, with pharmacy-network adequacy and reimbursement-floor provisions and anti-competitive-practice prohibitions.
Source: Kentucky_Healthcare_Legal_Framework.docx
The DOI regulates PBMs under KRS Chapter 304; provisions (304.17A-591 to 304.17A-599) require adequate pharmacy networks, minimum reimbursement standards, step-therapy override processes, and prohibit certain anti-competitive PBM practices.
Kentucky is an expansion state; the Governor retains authority to shape Medicaid eligibility by executive regulation, a recurring source of political tension.
2024-2025 legislation enacted the nation's first criminal-liability shield for healthcare workers and launched a medical-cannabis program; a March-2025 reform targets Medicaid expansion, drug-cost reduction, and rural access.
Louisiana, a civil-law jurisdiction, centers governance in the Louisiana Department of Health and applies the 1975 Medical Malpractice Act with a mandatory pre-suit medical review panel, a Patient's Compensation Fund, and a $500,000 damages cap (excluding future medical costs); the limitations period is 1 year (3-year absolute). Telehealth reform (Act 322/2024) removed the in-person exam requirement except for controlled substances, and a 2024 non-compete reform (Act 273) limits physician non-competes.
Source: louisiana_healthcare_legal_framework.docx
Act 750 of 2024 (effective August 1, 2024) created the 'Hope for Louisiana Patients Law' (La. R.S. 40:1300.71-1300.79), authorizing individualized investigational treatments; Act 312 set claim review standards.
The Bureau of Health Services Financing administers Louisiana Medicaid (Healthy Louisiana) and LaCHIP; Louisiana is an expansion state.
Act 322 of 2024 (SB 66) eliminated the in-person exam requirement except for controlled substances and broadened the telehealth definition (effective August 1, 2024).
HIPAA governs PHI; Louisiana adds state protections for specific categories (HIV/AIDS status, mental-health and SUD records).
Maine, a small, rural, progressive state (first to enact universal-coverage legislation via DirigoHealth), expanded Medicaid in 2019 — MaineCare now covers ~25% of the population, making payer compliance a financial priority. It maintains an active Certificate of Need program (22 M.R.S.A. 328) and licenses facilities through DHHS's Division of Licensing and Regulatory Services with annual renewal and CON-triggering change-of-ownership rules.
Source: ME_Healthcare_Compliance_Framework.docx
Maine expanded Medicaid in 2019; MaineCare (administered by DHHS) covers ~25% of the population (~350,000), a critical payer for most Maine hospitals.
Maine regularly enacts privacy, consumer-protection, and behavioral-health laws exceeding federal minimums (general characterization in the framework).
Maryland is distinctive for its all-payer hospital rate-setting through the Health Services Cost Review Commission and one of the nation's most comprehensive Certificate of Need programs (HG Title 19). Malpractice uses a 5-year-from-injury / 3-year-from-discovery limitations rule (CJP 5-109) and an inflation-adjusted noneconomic cap (about $920,000; higher for wrongful death with multiple claimants). Maryland affirmatively protects abortion access (2023 Abortion Care Access Act).
Source: MD_Healthcare_Legal_Framework.docx
The Health Services Cost Review Commission sets all hospital rates under Maryland's unique all-payer model — a nationally distinctive cost-containment structure.
MDH administers Medicaid; Maryland is an expansion state operating within the all-payer waiver context.
Maryland affirmatively protects abortion access with no mandatory waiting period; the 2023 Abortion Care Access Act expanded access and provider protections.
Massachusetts in 2025 (H.5159) broadened the 'material change' definition requiring 60-day advance notice to the HPC, CHIA, and Attorney General, and barred acute-hospital licensure where the main campus is leased from a REIT (with a grandfather exemption). It added new PBM licensing requirements, runs a dual HIPAA/state privacy framework, and expanded coverage via MassHealth CarePlus and a ConnectorCare expansion to 500% FPL.
Source: MA_Healthcare_Legal_Framework.docx; MA_Healthcare_Legal_Framework_Extended.docx
H.5159 expanded oversight of Pharmacy Benefit Managers with new licensing requirements aligning PBMs with the regulatory frameworks applied to health plans.
Massachusetts expanded Medicaid in 2014 (MassHealth CarePlus, 1115 waiver through 2027); a ConnectorCare expansion pilot (2024-2025) extended eligibility to 500% FPL with membership up 135%.
H.5159 (2025) expanded the 'material change' definition requiring 60-day advance notice to the HPC, CHIA, and AG, prohibited acute-hospital licensure/renewal where the main campus is leased from a REIT (grandfathered as of April 1, 2024), and added two new licensure categories.
Providers must satisfy HIPAA plus stricter Massachusetts requirements; mental-health records carry heightened protection under MGL c.123 36.
Electronic monitoring of controlled-substance prescribing/dispensing governs the state PDMP.
Michigan's standard-of-care framework is detailed: a statutory standard (600.2912a), an affidavit-of-merit regime, strict expert-witness qualifications (600.2169), and an inflation-indexed noneconomic-damages cap (600.1483) with a higher catastrophic tier (announced ~$1.065M for 2026). Michigan retains CON and runs the MAPS PDMP. Malpractice settlements must be reported to LARA within 30 days.
Source: MI_Healthcare_SOC_Extended.docx; MI_Healthcare_SOC_QuickReference.docx
Administered by MDHHS under the Social Welfare Act; managed-care delivery (expansion state).
Michigan Automated Prescription System; prescribers of Schedule 2-5 controlled substances must check MAPS before prescribing to a new patient and at each subsequent controlled-substance visit.
Privacy under HIPAA/HITECH plus federal SUD confidentiality (42 C.F.R. Part 2); affidavit-expert identity protected unless designated a trial witness.
Minnesota does not cap medical-malpractice damages and uses a 4-year limitations period (541.076) with a 180-day expert affidavit of merit (145.682). State privacy law (the Government Data Practices Act and breach statutes) frequently exceeds HIPAA and controls. The Board of Pharmacy's remit expressly includes PBMs.
Source: MN_Healthcare_Legal_Framework_Extended_v2.docx; MN_Healthcare_Legal_Framework_short.docx
The Board of Pharmacy's statutory jurisdiction (Ch. 151) expressly extends to pharmacy benefit managers alongside pharmacists, technicians, and facilities.
Medicaid (Medical Assistance) and the MinnesotaCare public program operate as Minnesota's coverage programs; HIPAA/ERISA/ACA preemption is frequently litigated.
HIPAA baseline plus the Government Data Practices Act (Ch. 13) and breach-notification statute (325E.61); Minnesota law is frequently more protective and controls.
Mississippi maintains an active Certificate of Need program (Title 41, Ch. 7), reformed in 2026 by HB 3 (removing some PRTF Medicaid bed limits and authorizing specific new beds). Notably, HB 17 (2025) — the Protecting Patient Access to Physician-Administered Drugs Act — restricts insurers and PBMs from denying coverage or penalizing patients who get physician-administered drugs from in-network providers, with mandated fair reimbursement.
Source: Mississippi_Healthcare_Legal_Framework.docx
HB 17 (2025), the Protecting Patient Access to Physician-Administered Drugs Act, bars insurers and PBMs from denying coverage or imposing penalties when patients receive physician-administered drugs directly from in-network providers, and mandates fair provider reimbursement.
HB 539 (2024) presumptive eligibility for pregnant women; SB 2212 (2024) extended postpartum Medicaid to 12 months; HB 565 (2026) mandates biomarker-testing coverage; HB 1622 small-community-hospital pilot.
The Division of Medicaid administers Medicaid; Mississippi has not adopted full ACA expansion.
Missouri's framework spans RSMo Chapters 197-335 with DHSS as lead public-health agency. The state enacted a $350,000 noneconomic-damages cap (538.210), which the Missouri Supreme Court held unconstitutional as applied to jury-tried cases in Watts (2012). Medicaid expansion came by voter initiative (Amendment 2, 2020) and faced implementation litigation.
Source: missouri_healthcare_legal_framework.docx
Missouri voters approved Medicaid expansion via Amendment 2 (2020) to 138% FPL (MO HealthNet); implementation faced appropriation litigation.
Health privacy governed by HIPAA/HITECH plus state confidentiality statutes that in places exceed federal minimums.
Missouri (historically the last state to adopt a statewide PDMP) operates controlled-substance monitoring; verify current statewide-program scope.
Montana runs a streamlined structure with DPHHS as central authority. Malpractice limitations are 2 years general / 3-year discovery (MCA 27-2-205). It operates a Certificate of Need program in place since 1975 (MCA Title 50, Ch. 5, Part 3) — with ASCs explicitly exempt — and extended Medicaid expansion in the 2025 session, while preparing community-engagement requirements ahead of federal H.R. 1 mandates effective July 2026.
Source: Montana_Healthcare_Legal_Framework.docx
The 2025 legislature extended Medicaid expansion; Montana submitted a Section 1115 waiver amendment to implement community-engagement requirements ahead of federal H.R. 1 mandates effective July 2026.
The Cannabis Control Division (Department of Revenue) administers the medical-marijuana registry and adult-use licensing under MCA Title 16, Ch. 12.
Nebraska's defining feature is a pioneering PDMP: effective January 1, 2018 it became the first state to require reporting of all dispensed prescription drugs — not just controlled substances. Facility licensing runs under the Health Care Facility Licensure Act, and the Nebraska Telehealth Act governs telehealth. DHHS administers most functions, with the Department of Insurance regulating coverage.
Source: Nebraska_Healthcare_Legal_Framework_Extended_Version.docx; Nebraska_Healthcare_Legal_Framework_Short_Version.docx
Medicaid administered by DHHS; Nebraska adopted expansion (Heritage Health Adult) following voter initiative.
From January 1, 2018, all licensed and mail-order pharmacies report all dispensed prescription drugs — both controlled and non-controlled — to the Nebraska PDMP, the first such comprehensive program nationally.
Telehealth governed by the Nebraska Telehealth Act (71-8501 to 71-8512); Medicaid reimburses HIPAA/CMS-compliant two-way real-time telehealth.
Covered entities comply with the HIPAA Privacy Rule with safeguards, authorization, and breach notification; no comprehensive state consumer-health-data statute identified.
Nevada caps noneconomic malpractice damages at $350,000 and applies a 3-year-from-injury / 1-year-from-discovery limitations rule with a 3-year repose (NRS 41A.097), plus a mandatory affidavit/certificate of merit (NRS 41A.071). Nevada grants APRNs full practice authority under NRS 632 after an early collaborative period.
Source: Nevada_Healthcare_Legal_Framework.docx
DHHS administers Medicaid; Nevada is an expansion state.
HIPAA applies to covered entities/business associates; the Attorney General enforces state-level HIPAA violations in coordination with HHS.
New Hampshire's 'Live Free or Die' posture has favored market-based healthcare and lean state programs. It was hit hard by the opioid epidemic and responded with the New Hampshire Controlled Drug Prescription Health and Safety Program (its PDMP). DHHS administers facilities and Medicaid; many COVID-era telehealth flexibilities (including audio-only behavioral health) were made permanent.
Source: new_hampshire_healthcare_legal_framework.docx
DHHS's Division of Medicaid Services administers Medicaid; New Hampshire is an expansion state.
The Insurance Department regulates health insurance under RSA Title XXXVII.
New Hampshire's PDMP was enacted as part of its opioid-epidemic response amid among the highest per-capita overdose death rates nationally.
DHHS permanently incorporated many pandemic-era Medicaid telehealth flexibilities, retaining audio-only behavioral health as a covered service.
New Jersey, the most densely populated state, maintains a comprehensive, heavily regulated framework including a Certificate of Need program (with a State Health Planning Board), licensure and inspection of 2,000+ facilities through NJDOH, and commercial-insurance regulation under NJDOBI. Medicaid (NJ FamilyCare) is administered by NJDHS through the Division of Medical Assistance and Health Services.
Source: New_Jersey_Healthcare_Legal_Framework.docx
NJDOBI regulates commercial health insurance under Titles 17 and 26, reviews rates/forms, and administers the IHC and SEHB programs.
NJDHS administers Medicaid/NJ FamilyCare through DMAHS via managed-care contracts; New Jersey is an expansion state.
Health privacy governed by HIPAA with consumer-protection overlays; no comprehensive consumer-health-data statute identified.
New Mexico applies a 3-year-from-the-negligent-act malpractice limitations rule subject to the discovery rule (NMSA 1978, 41-5-13) and caps noneconomic damages at $750,000 for PCF-enrolled providers under its Medical Malpractice Act / Patient's Compensation Fund structure. NMDOH leads public health and facility licensing.
Source: New_Mexico_Healthcare_Legal_Framework.docx
New Mexico is an expansion state administering Medicaid (Turquoise Care) through the Health Care Authority/Human Services.
The Board of Pharmacy administers controlled-substance monitoring; opioid-response provisions apply.
New York runs a single-regulator insurance model under DFS and one of the most active Certificate of Need programs in the country (Article 28 PHL), reviewing facility transactions, ownership changes, and construction. Its Corporate Practice of Medicine doctrine is among the oldest and most deeply embedded, administered through the State Education Department. A consumer-health-data bill (NY HIPA) was vetoed in 2025 and is expected to be reintroduced.
Source: New_York_healthcare_legal_framework.docx; New York_healthcare_extended.docx
The New York Health Information Privacy Act (S9269, revised; introduced Feb 20, 2026) passed the Senate June 3 and the Assembly June 4, 2026 (substituting A10357) and awaits the Governor's action as of June 21, 2026; it regulates non-HIPAA 'regulated health information' collected or inferred by consumer-facing businesses and would take effect six months after enactment. The prior version (S929/A2141) was vetoed Dec 19, 2025 (Veto 135 of 2025). It exempts HIPAA-covered entities, Part 2/SUD records, clinical-trial/human-subjects data, and FDA-regulated activities.
Unlike California's dual model, DFS regulates all commercial health insurance (HMO, PPO, EPO, indemnity) plus solvency, cybersecurity, and healthcare fraud.
NYSDOH administers New York Medicaid (one of the largest programs nationally); expansion state.
Among the oldest, most embedded CPOM frameworks; combines Education Law and Business Corporation Law with a century of case law, administered through the State Education Department.
The Public Health Law (thousands of sections) governs facility operation, patient rights, public-health enforcement, Medicaid, and health-data collection.
North Carolina has seen unusually heavy structural change since 2023: Medicaid expansion launched December 1, 2023 (~600,000 adults), the restrictive Certificate of Need program is being phased back under Session Law 2023-7, and the NC Medical Board expanded its Corporate Practice of Medicine reach via August 2024 enforcement guidance. Privacy relies on HIPAA plus targeted state confidentiality statutes rather than a comprehensive consumer-health-data law.
Source: NC_healthcare_standard.docx; NC_healthcare_extended.docx
No comprehensive consumer-health-data law comparable to CA CMIA or NY HIPA; non-HIPAA digital-health and wellness data falls primarily under the federal FTC Act.
Expansion launched December 1, 2023 (~600,000 adults); delivered through Standard Plans, Tailored Plans, and the Children and Families Specialty Plan with a 2027 Standard Plan reprocurement ahead.
CPOM enforced via Chapter 55B and Chapter 90; NCMB's August 2024 guidance meaningfully expanded reach over PE-backed and DTC telehealth arrangements (GLP-1, medication-abortion, telemental platforms drew scrutiny).
SB 570 would have codified sweeping CPOM restrictions modeled on California SB 351 but failed the May 8, 2025 crossover deadline; enforcement nonetheless stricter than pre-2024 via NCMB guidance.
No comprehensive state health-privacy statute; HIPAA baseline plus NC Identity Theft Protection Act breach notice, SUD confidentiality (GS 122C-52), and HIV/AIDS confidentiality (GS 130A-143).
State PDMP; prescribers of Schedule II-IV controlled substances must query the CSRS before a first controlled-substance prescription or where abuse is suspected.
North Dakota consolidated its health agencies via a 2022 merger into ND HHS. Malpractice limitations run 2 years from discovery with a 6-year repose (NDCC 28-01-18). The state has progressively expanded APRN independent practice and joined multiple interstate licensure compacts (Medical, Nurse, APRN, PT, Psychology).
Source: ND_Healthcare_Legal_Framework.docx; ND_Healthcare_Legal_Framework short.docx
Medicaid administered by ND HHS; North Dakota is an expansion state.
Controlled-substance prescribing and the state PDMP are administered through the Board of Pharmacy.
Ohio retains an active Certificate of Need program (one of ~34 states) limited mainly to long-term-care beds, and codifies malpractice limitations, repose, and a noneconomic-damages cap for medical claims. The Ohio Automated Rx Reporting System (OARRS) imposes mandatory PDMP checks before controlled-substance prescribing.
Source: OH_Healthcare_SOC_QuickReference.docx; OH_Healthcare_extended_of_Care_Research.docx
Administered by the Ohio Department of Medicaid; Ohio is a Medicaid expansion state (managed-care delivery).
Ohio Automated Rx Reporting System; prescribers must check OARRS before prescribing Schedule II-V controlled substances to a new patient and at each subsequent controlled-substance visit.
Health privacy governed by HIPAA/HITECH with federal SUD confidentiality (42 C.F.R. Part 2); no comprehensive state consumer-health-data statute identified.
The Oklahoma document is structured as a hospital compliance reference across six federal/state domains rather than a malpractice survey. Hospitals operate under a dual regime: federal CMS/OCR requirements plus state licensure under the Oklahoma Hospital Standards Act (63 O.S. 1-701), with Medicare/Medicaid Conditions of Participation (42 C.F.R. Part 482) and Joint Commission/DNV accreditation pathways.
Source: OK_Healthcare_Compliance_Framework.docx
The Oklahoma Health Care Authority administers Medicaid (SoonerCare) under the dual federal/state hospital-compliance regime.
HIPAA governs privacy/security; OSDH facility rules require medical-record retention (10 years per the framework) exceeding the federal 5-year baseline.
Oregon centralizes much of its framework in the Oregon Health Authority, which administers the Oregon Health Plan (Medicaid), the Certificate of Need program, and a Sustainable Health Care Cost Growth Target program (ORS 442.386) holding hospitals and entities to annual cost benchmarks. Hospitals also face the federal CMS price-transparency rule plus additional OHA reporting; physicians register with the state PDMP.
Source: OR_Healthcare_Compliance_Framework.docx
Oregon's Sustainable Health Care Cost Growth Target program (ORS 442.386) holds hospitals and healthcare entities accountable to annual cost-growth benchmarks.
Hospitals must comply with the federal CMS hospital price-transparency rule (machine-readable file + shoppable services) plus additional OHA price-transparency reporting.
OHA administers the Oregon Health Plan (Medicaid) through coordinated care organizations; Oregon is an expansion state.
Physicians register with the Oregon Prescription Drug Monitoring Program (ORS 431A.855); the Oregon Medical Board administers licensure under ORS Ch. 677.
Pennsylvania enforces a strict Corporate Practice of Medicine doctrine requiring physician ownership of medical practices, licenses clinicians through the State Board of Medicine under the Medical Practice Act of 1985 (amended by Act 79 of 2021), and has made telehealth reimbursement parity permanent (Act 98 of 2022; Act 42 of 2024). DDAP regulates opioid-treatment programs with specific telehealth-initiation rules.
Source: Pennsylvania_Healthcare_Legal_Framework_Extended_Version.docx; Pennsylvania_Healthcare_Legal_Framework_Short_Version.docx
DHS administers Medicaid (Medical Assistance) and HealthChoices managed care; Pennsylvania is an expansion state.
Pennsylvania requires physician ownership of medical practices under a strict CPOM doctrine; medical-practice ownership is a distinct compliance focus.
Permanent telehealth reimbursement parity (Act 98 of 2022; Act 42 of 2024); OUD treatment may be initiated via telehealth through narcotic treatment programs with an in-person exam required within 14 days (DDAP Licensing Alert 01-2025).
Covered entities comply with the HIPAA Privacy Rule with safeguards, authorization, and breach-notification procedures; no comprehensive state consumer-health-data statute identified.
Rhode Island licenses facilities under R.I. Gen. Laws Ch. 23-17 through RIDOH and conducts Certificate of Need review via the Health Services Council. It imposes no malpractice damages cap and requires no pre-suit certificate of merit (limitations: 3 years, 9-1-14.1). PBM data practices are regulated under DBR, and 2026 bills (HB 7721 / SB 2459) would strengthen Corporate Practice of Medicine restrictions and regulate MSO contracts.
Source: Rhode_Island_Healthcare_Legal_Framework.docx
Pharmacy Benefit Manager data practices are regulated under DBR oversight to prevent unauthorized disclosure of patient prescription patterns.
Medicaid operates alongside HealthSource RI (the state exchange) regulated under Title 27; Rhode Island is an expansion state.
HB 7721 and SB 2459 (2026) propose to strengthen CPOM restrictions by prohibiting unlicensed entities from owning practices or employing licensees and by regulating MSO contracts.
A major structural change: DHEC was abolished July 1, 2024 (Act 60 of 2023) and healthcare facility licensing moved to the new Department of Public Health — pre-2024 DHEC citations must be updated. Malpractice has a CPI-adjusted noneconomic cap ($580,461 per provider in 2025) under 15-32-220, with a 3-year discovery / 6-year repose limitations period. CON is residual and a CPOM bill (S.46) is proposed.
Source: SC_Healthcare_Legal_Framework_EXTENDED.docx; SC_Healthcare_Legal_Research_Framework.docx
S. 46 is a proposed CPOM/healthcare-contracts measure addressing corporate practice of medicine.
Controlled Substances Act (Title 44 Ch. 53) with PDMP and prescribing limits; SC Bureau of Drug Control registration is required (in addition to DEA) to prescribe controlled substances via telemedicine to SC patients.
South Dakota's framework rests on SDCL Titles 34/36/58 and reflects heavy use of voter initiatives (medical cannabis, Medicaid expansion, reproductive measures). Malpractice limitations run 2 years (SDCL 15-2-14.1). The PDMP (SDCL Ch. 34-20E) requires reporting within 24 hours of dispensing and a query before prescribing Schedule II/III opioids to new patients. Medicaid expansion took effect via initiative in 2023.
Source: south_dakota_healthcare_legal_framework.docx
South Dakota Medicaid (DSS, SDCL Ch. 28-6) expanded coverage effective 2023 following a voter-approved initiative.
South Dakota's PDMP (SDCL Ch. 34-20E) requires dispensers to report within 24 hours; prescribers must query before prescribing Schedule II or III opioids to new patients; the program interfaces with PMPInterConnect.
Health privacy governed by HIPAA/HITECH plus targeted state confidentiality statutes for sensitive categories.
Tennessee's Health Care Liability Act imposes a procedurally demanding 60-day pre-suit Notice of Intent with a HIPAA authorization (TCA 29-26-121) — described in the research as a 'graveyard' for technical defects — plus a two-tier noneconomic-damages cap (29-39-102) and contiguous-state expert rules. CON is retained. Governmental providers route through the Claims Commission with a $300,000 limit.
Source: TN_Healthcare_SOC_Extended.docx; TN_Healthcare_SOC_QuickReference.docx
Medicaid delivered through TennCare managed care; Tennessee has not adopted full ACA expansion.
Tennessee participates in the Interstate Medical Licensure Compact (63-6-234); controlled-substance monitoring and prescribing limits apply (PDMP framework).
Privacy under HIPAA/HITECH plus federal SUD confidentiality; the NOI HIPAA authorization is a distinctive litigation requirement.
Texas pairs the nation's largest uninsured population and a no-Certificate-of-Need market (since 1985) with one of the strictest, most actively litigated Corporate Practice of Medicine doctrines (a 2023 Travis County jury awarded $10M in a CPOM case). It has not expanded Medicaid. Privacy relies primarily on HIPAA plus Health & Safety Code Chapter 181, and the 89th Legislature (2025) produced significant fraud-enforcement and EHR-content legislation including the contested SB 1188.
Source: TX_healthcare_standard.docx; TX_healthcare_extended.docx
SB 1038 adds civil/administrative Medicaid fraud penalties; HB 142 updates HHSC-OIG overpayment review and recovery authority; SB 513 (rural pilot), HB 136 (lactation coverage) also enacted.
Texas has not expanded Medicaid (highest uninsured rate nationally, ~17-18%); managed care via STAR/STAR+PLUS/STAR Kids; expansion bills again died in 2025, next window 2027.
Among the strictest CPOM regimes; rooted in the Medical Practice Act (Occ. Code 164.052(a)(17)), TBOC Chapter 301, and TMB Rule 177.17. A 2023 Travis County jury awarded $10M for management-company control over physician decision-making.
HIPAA baseline plus Health & Safety Code Chapter 181 (broader 'covered entity' definition, HHSC + AG enforcement), Business & Commerce Code Chapter 521, and mental-health records Chapter 611.
Requires EHRs maintained in Texas to record biological sex at birth and incorporate it into AI clinical-decision tools; agencies (HHSC, TMB, TDI, TDLR) developing an implementation MOU; commentators flag ACA Section 1557 conflict.
Asynchronous DTC prescribing platforms (GLP-1, hair loss, birth control) raise CPOM and fee-splitting concerns where the platform sets protocols and compensates physicians per encounter.
Utah administers Medicaid through DHHS with full expansion effective January 1, 2020, and licenses clinicians through DOPL (Department of Commerce). Telehealth parity is required (31A-22-618), and the framework rests on the Health Care Facility Licensure Act, the Utah Medical Practice Act, the Telehealth Act, the Controlled Substances Act, and the Medical Cannabis Act.
Source: Utah_Healthcare_Legal_Framework_Extended_Version.docx; Utah_Healthcare_Legal_Framework_Short_Version.docx
Utah implemented full Medicaid expansion effective January 1, 2020; administered by DHHS with integrated behavioral-health managed care.
Insurers must cover telehealth with equivalent reimbursement and cost-sharing; audio-only behavioral health for established patients must be covered; telehealth meets the same standard of care.
Controlled-substance regulation under the Controlled Substances Act (58-37); medical cannabis under the Medical Cannabis Act (26B-4-1501 et seq.).
Covered entities comply with the HIPAA Privacy Rule; no comprehensive state consumer-health-data statute identified in the excerpts.
Vermont operates one of the most regulated healthcare environments in the country despite its small population: a uniquely powerful all-payer rate-setting body (the Green Mountain Care Board), an aggressive and expansive Certificate of Need program, and pioneering state-level health-information-privacy laws that exceed federal minimums. Hospitals are licensed by VDH (18 V.S.A. Ch. 43) and must meet federal Conditions of Participation.
Source: VT_Healthcare_Compliance_Framework.docx
The Green Mountain Care Board is a uniquely powerful all-payer rate-setting body governing hospital budgets and rates.
The Department of Vermont Health Access administers Medicaid; Vermont is an expansion state operating within the all-payer model.
Vermont has enacted state-level health-information-privacy laws that exceed federal minimums.
Virginia's framework is anchored by a statutory standard of care (8.01-581.20) and a scheduled, inflation-rising medical-malpractice damages cap (8.01-581.15, roughly $2.65M-$2.70M). Pre-service expert certification is required, out-of-state experts must show familiarity with Virginia's statewide standard, and peer-review privilege is broad (expanded to wellness committees in 2025). Recent attempts to eliminate the cap failed.
Source: VA_Healthcare_SOC_QuickReference.docx; VA_Healthcare_Standard_of_Care_Research.docx
Medicaid administered by DMAS under 12 VAC 30; Virginia expanded Medicaid (referenced via DMAS administration and 12 VAC 30 rules).
SB 904 (2025) proposed complete elimination of malpractice damages caps and was passed by indefinitely in committee; SB 493 (2024) to remove the cap for patients age 10 and under failed to advance.
Privacy governed by HIPAA/HITECH with the federal fraud-and-abuse overlay (Stark, AKS, FCA, 42 C.F.R. Part 2); no comprehensive state consumer-health-data statute identified in the research.
The Washington research is organized around four themes rather than malpractice: reproductive health (Reproductive Privacy Act, Shield Law), mental-health parity, Medicaid policy, and healthcare antitrust / private equity. Washington is building aggressive transaction oversight — a Mini-HSR law (RCW 19.420, effective July 27, 2025), a Healthcare Entity Registry, and a pending Corporate Practice of Medicine prohibition (SB 5387).
Source: Healthcare_Legal_Framework_Washington_DeepResearch.docx
Carriers must offer meaningful MH coverage in each benefit classification, adopt federal parity rules, meet utilization-review timelines (auto-approval if missed), and may not retroactively deny claims older than 180 days (except fraud).
Medicaid (Apple Health) administered by the Health Care Authority; the research notes ASAM-criteria adoption timing changes for SUD treatment in managed care.
The Reproductive Privacy Act (RCW 9.02, voter-enacted 1991) guarantees abortion and contraception rights independent of Dobbs; a Shield Law and emergency hospital abortion rules add provider/patient protections.
SB 5387 would prohibit the corporate practice of medicine and limit PE/MSO ownership, effective Jan. 1, 2027 if passed; among the most consequential 2025 bills.
A Mini-HSR antitrust pre-merger notice law (RCW 19.420) took effect July 27, 2025; the Healthcare Entity Registry requires ownership/subsidiary disclosure (including PE-backed entities); the pending Keep Our Care Act would add 90-day notice and AG approval.
West Virginia, hit hardest by the opioid epidemic, has enacted the nation's most aggressive statutory response — prescriber limits, mandatory PDMP consultation, pharmacy dispensing restrictions, and hospital-based intervention programs. Hospitals are licensed by the state health department through OHFLAC (W. Va. Code 16-2B-1) and operate a broad Certificate of Need program plus the federal CMS price-transparency rule.
Source: WV_Healthcare_Compliance_Framework.docx
Hospitals must comply with the federal CMS hospital price-transparency rule, with WV-specific reporting as required.
Medicaid administered by the state health/human-resources agency; West Virginia is an expansion state.
West Virginia's opioid response is among the most aggressive nationally — prescriber limits, mandatory PDMP consultation, pharmacy dispensing restrictions, and hospital-based intervention programs.
Wisconsin caps medical-malpractice noneconomic damages (655.017; 893.55(4)) and repealed CON for most facilities. Patient-records confidentiality is detailed (146.81-146.84) with heightened HIV and mental-health protections, and the PDMP covers Schedule II-IV substances (961.385). Notably, PBM oversight legislation stalled in 2024, leaving Wisconsin without PBM transparency rules many neighbors have adopted.
Source: WI_Healthcare_Legal_Framework.docx
In 2024 the legislature considered but did not enact a Prescription Drug Affordability Review Board or broader PBM regulation; as of March 2026 Wisconsin lacks PBM oversight rules many neighboring states have, an active advocacy gap.
BadgerCare Plus (~1M members) administered by DHS via ForwardHealth; Wisconsin occupies a singular non-traditional-expansion position covering adults to 100% FPL without formal ACA expansion.
Patient health-care records are protected under 146.81-146.84 (broader than HIPAA in places), with heightened HIV (252.15) and mental-health (51.30, 51.61) protections including a right to refuse medication in non-emergencies.
Wisconsin operates a PDMP for Schedule II-IV controlled substances; prescribers are encouraged (and in some cases required) to check it before prescribing, and dispensers must report.
Wyoming repealed its Certificate of Need program, allowing market-driven facility entry subject to WDH licensure (W.S. Title 35). Malpractice limitations run 2 years from discovery (W.S. 1-3-107) and the state caps noneconomic damages at an inflation-adjusted figure (about $2,007,977) under W.S. 1-1-132 — notable because many states' caps have been struck down.
Source: WY_Healthcare_Legal_Framework.docx
WDH administers Medicaid; Wyoming has not adopted ACA expansion.
These are the obligations pharma teams typically expect from a state compliance product. None appeared in the uploaded research, so none are represented as findings above. Each must be sourced from primary law before it can be added — this list is the build specification, not a dataset.
Treat this report as the boundary of the product. Marketing or relying on the page as covering these topics would misrepresent it.
This page is built onlyfrom a fixed set of uploaded state research documents (Word files prepared February–April 2026, each marked "current as of" that period). Every entry is tied to a source statute, agency, or document name. Where the source set is silent, the entry reads Not found in provided researchand the field is hidden rather than guessed — nothing is inferred from outside the documents.
What the source set is. General state healthcare-law frameworks and medical standard-of-care research, written from a provider, hospital, and health-plan perspective. A pharma-relevance lens is applied on top: every requirement is a Direct manufacturer-facing signal, Market access / reimbursement, Commercial / prescribing / privacy adjacent, or Provider context only (the last is demoted to a collapsed block per state).
Obligation type and actionability. Each record also carries an obligation type— affirmative obligation, restriction, reporting duty, licensing duty, coverage/market-access context, liability standard, no state-specific obligation found, or proposed — so that an absence of law is never mislabeled as a duty. And each carries an actionability grade: A primary-source verified with action, deadline, agency, and penalty all filled; B verified but operational fields incomplete; C document-level only; D low confidence or attorney review required. Today the distribution is A 1 / B 0 / C 256 / D 23 — i.e. most records are still document-level and should not be relied on as verified law.
What this is not — and the gap. This is not complete pharmaceutical-manufacturer compliance coverage. Drug price transparency, manufacturer/HCP-payment (Sunshine) reporting, sales-representative licensing, gift bans, sample/coupon rules, and manufacturer/wholesaler/distributor licensing were not present in the source set and are catalogued in the Gap report rather than represented as findings.
Verification & sources. Verified items link to the official primary source (e.g., California LegInfo, the New York Senate). 2are verified so far — California SB 351 (graded A) and the New York Health Information Privacy Act / S9269 (graded D, pending) — shown with a Verified badge. All other entries remain document-level pending the same pass.
Counts. All 50 states are now covered, with 280 cited requirements; the accompanying JSON contains 280 records (one per requirement). Alaska was added in June 2026 from a later-provided single source document and is marked accordingly.
Informational only — not legal advice. Beta. A research and navigation aid for compliance, legal, regulatory-affairs, market-access, and government-affairs teams. It does not constitute legal advice or create an attorney-client relationship and is not complete manufacturer-compliance coverage. Confirm any requirement against the primary source and qualified counsel before acting.
Every item carries a confidence level and a last-reviewed date. Items flagged for attorney review or with pending legislation are marked on the card. Where a primary source was not verified during research, sparse fields are omitted rather than guessed.
This page is an informational research layer compiled from state statutes, regulations, and agency guidance. It is not legal advice, may be incomplete or out of date, and must not be relied on for compliance decisions. Consult qualified counsel and verify all requirements against primary sources.
Of 280 cited requirements across 50 states: 5 direct manufacturer-facing signals, 77 market-access/reimbursement, 89 commercial/prescribing/privacy adjacent, and 109 provider context only. Roughly 171pharma-relevant signals — meaningful, but not a substitute for a dedicated manufacturer-obligation dataset.
A 1 (verified + complete) · B 0 (verified, incomplete) · C 256 (document-level) · D 23 (low confidence / review). 23 records are flagged attorney review required. Use the Verified only and Needs attorney review filters to triage.
Primary-source verified against official sources: CA SB 351 (LegInfo; Ch. 409; effective Jan 1, 2026 — grade A) and NY HIPA / S9269 (NY Senate; passed both chambers June 2026, awaiting Governor — grade D). Everything else is document-level.
States with both short and extended documents and six or more requirements: NC, TX, FL, VA, OH, MI, GA, TN, IN, MN, CO, SC, MA, CA, NY. Single-source states: 28 of 50; thinner single-source with multiple low-confidence entries: MO.
Alaska was previously uncovered (empty source folder); a single extended framework document was supplied in June 2026 and is now integrated. As a single-source state its damages-cap/SOL specifics were not detailed — verify separately.
South Carolina materials predating July 1, 2024 cite DHEC, abolished and split into DPH (Act 60 of 2023). West Virginia agency naming is mid-reorganization. Several 2025–2026 sessions referenced were still in progress.
No, and the page says so. It is state healthcare regulatory intelligence with a pharma-relevance lens, built from a fixed research set. Manufacturer-specific obligations (price transparency, Sunshine/HCP-payment reporting, sales-rep licensing, gift bans, sample/coupon rules, manufacturer/distributor licensing) are not covered and are listed in the Gap report.
Every requirement is tagged by relevance type (Direct manufacturer-facing / Market access / Adjacent / Provider context) and by obligation type (affirmative obligation, restriction, reporting duty, licensing duty, coverage context, liability standard, no state-specific obligation found, or proposed). A "no law found" signal is never shown as a duty. Provider context is collapsed under each state.
A = primary-source verified with action, deadline, agency, and penalty filled; B = verified but operational fields incomplete; C = document-level only; D = low confidence or attorney review required. Most records are C today. Filter to 'verified only' or 'needs attorney review' to triage.
Most entries are document-level. Verified items link to the official primary source - so far CA SB 351 (California LegInfo) and NY HIPA/S9269 (New York Senate). Treat unverified entries as research leads, not legal conclusions.
Yes, as of June 2026. Alaska was the one previously uncovered state (its source folder was empty); a single extended framework document was later provided and is now integrated like any other state, flagged as single-source.
The Gap report doubles as a roadmap: a dedicated manufacturer-obligation dataset, plus primary-source URLs and operational fields (action, deadline, agency, penalty) filled for the highest-value records first - PBM, consumer health data, Medicaid, controlled substances, and pending legislation.
No. Confirm any requirement against the primary source and qualified counsel before acting.
Beta: Healthcare-law signals for pharma teams. Not complete manufacturer compliance coverage. Informational only — not legal advice. Compiled solely from a fixed set of uploaded state healthcare-law research documents (February–April 2026) with a pharmaceutical-relevance lens applied. It does not constitute legal advice and does not create an attorney-client relationship. Statutes, regulations, and agency structures change; pending bills may never become law. Verify every requirement against the primary source and qualified counsel before acting.
Generated June 22, 2026 · 50states · 280 cited requirements (5 direct / 77 market-access / 89 adjacent / 109provider context) · JSON has 280records · actionability A1/B0/C256/D23 · 2primary-source verified · source set current to early–mid 2026.