Summary
This week's digest covers significant developments in EU health data regulations and AI integration into clinical trial designs, including new metadata rules under the European Health Data Space Regulation. Highlights include ARPA-H's SURPASS programme and the ongoing focus on data governance amid increased healthcare cybersecurity concerns.
Welcome to this week's digest, prepared by iliomad for biotech, healthtech and life-sciences professionals. The items below span EU secondary health-data legislation, AI-driven trial design, enforcement actions and a sharp rise in healthcare cybersecurity incidents. Each entry identifies the relevant authority or instrument so that the analysis can be applied directly to your compliance programmes.
1. EU Health Data Space: New Implementing Regulations Take Shape
EHDS Metadata Catalogue Rules Published
Commission Implementing Regulation (EU) 2026/2098, adopted on 18 September 2026, establishes the minimum metadata elements that health data holders (organisations that collect or manage electronic health data) must supply when describing their datasets in national catalogues established under the European Health Data Space Regulation (EU) 2025/327 (the EHDS Regulation, which creates a common framework for the primary and secondary use of electronic health data across EU Member States). The mandatory fields cover what data is available, who holds it, what it contains and the conditions under which access may be granted. For sponsors and contract research organisations (CROs) operating under a CRO data processor arrangement, the regulation materially affects how research datasets must be documented before they can be made discoverable to authorised secondary users.
MyHealth@EU Operating Rules Confirmed
A companion measure, Commission Implementing Regulation (EU) 2026/2083, also dated 18 September 2026, sets out the technical, semantic and cybersecurity rules for MyHealth@EU, the EU-wide platform through which Member States will exchange patients' cross-border electronic health records for direct care. The regulation explicitly qualifies the European Commission as data processor and national contact points as data controllers, a clarification that directly informs the data protection impact assessment (DPIA, a structured risk analysis mandated by Article 35 of the General Data Protection Regulation, GDPR) that deploying organisations must conduct before connecting to the infrastructure.
2. AI-Driven Clinical Trial Design and Health Data Access
ARPA-H Launches SURPASS Programme
The US Department of Health and Human Services, acting through the Advanced Research Projects Agency for Health (ARPA-H), announced a five-year initiative named SURPASS (Simulation-augmented, Real-time Platform Adaptive Seamless Trials) on 30 September 2026. The programme aims to integrate artificial intelligence and computational simulation into US clinical trial design so that adaptive, seamless trial structures can be operated in near real time. For life-sciences sponsors conducting studies under both US and EU frameworks, the initiative signals that regulatory expectations around AI-assisted trial conduct are shifting, which may in turn require updates to data processing agreements and DPIAs that currently describe manual statistical review processes.
Eli Lilly's Combination Weight-Loss Trial Posts Striking 48-Week Data
At the European Association for the Study of Diabetes conference, Eli Lilly presented 48-week results from a mid-stage trial combining Zepbound (a GLP-1 receptor agonist, a class of drug that mimics a gut hormone to reduce appetite and blood sugar) with eloralintide, an investigational amylin-pathway agent. At the highest combination dose, participants achieved 23.3% weight loss versus 14.8% for Zepbound alone, a result that underlines the growing complexity of combination-therapy trial protocols and the corresponding need for robust participant data protection governance, including clear legal bases for multi-arm data collection.
MAHA Institute Pushes to Open US Health Data for Research
A MAHA Institute-backed initiative, reported on 29 September 2026, is seeking substantially wider researcher access to longitudinal US health data held across state health information exchanges, electronic health records, Medicare and Medicaid claims, immunisation registries and commercial datasets. Proponents argue that data-holding institutions act as unwarranted gatekeepers. However, broadened access raises informed consent GDPR-equivalent questions under US law and highlights the importance of robust data governance frameworks before any transfer or linkage of such sensitive datasets is authorised.
3. Regulatory Approvals, Investment and Innovation in Life Sciences
Medtronic Wins Simultaneous FDA and CE Mark for Cardiac Mapping Software
Medtronic secured both US Food and Drug Administration (FDA) clearance and CE Mark certification for two electrophysiology technologies: the Affera Prism-2 Mapping Software and the PulseSelect ProxBox Adapter, both designed for use with the company's Sphere-9 ablation catheter. CE Mark (the European conformity marking confirming a medical device meets EU safety and performance requirements) being awarded concurrently with FDA clearance reflects a more coordinated international device-review approach, but sponsors integrating such software into clinical studies should confirm that real-time mapping data flows are covered within their DPIA and data processing agreement documentation.
FDA Approves First Treatment for Ultra-Rare Bone-Formation Disorder
The FDA approved Atebrioz (zilurgisertib), jointly developed by Mirum Pharmaceuticals and Incyte, for fibrodysplasia ossificans progressiva (FOP), a genetic disorder in which soft tissue progressively ossifies into bone. This is the first FDA-approved therapy specifically indicated for FOP. Ultra-rare disease approvals of this type typically rest on small patient cohorts, making the adequacy of pseudonymisation and data minimisation practices in the underlying trial data particularly critical for regulatory scrutiny.
ai3Bio and Precision Neuroscience Raise Significant Early-Stage Capital
Two notable funding rounds closed this week. ai3Bio launched with a USD 48 million Series A led by UPMC Enterprises and Ziff Capital Partners to develop mRNA and antibody-based autoimmune therapies targeting pathogenic Th17 cells. Separately, Precision Neuroscience, a New York-based brain-computer interface (BCI) company, closed a USD 250 million Series D led by Pershing Square Inc. and the Ackman Oxman Institute. BCI technology processes neural signals that qualify as biometric and potentially special-category data under the GDPR, requiring a DPIA before any clinical deployment in the EU.
(Read more) | https://www.globenewswire.com/news-release/2026/09/24/3368254/0/en/precision-neuroscience-closes-oversubscribed-250m-series-d-led-by-pershing-square-inc-the-ackman-oxman-institute-and-a-leading-life-sciences-investment-fund.html
OpenEvidence AI Tool Reaches Half of US Physicians
OpenEvidence, a clinical-decision-support platform trained on peer-reviewed journals including JAMA and the New England Journal of Medicine, disclosed that it has now raised close to USD 1 billion over twelve months, most recently USD 250 million at a USD 15 billion valuation, and is used by more than half of US physicians. AI tools embedded in clinical workflows that process patient data to support diagnostic or treatment decisions may, depending on their configuration, trigger obligations under the EU AI Act (Regulation (EU) 2024/1689, which classifies certain AI systems used in health as high-risk) as well as under applicable national GDPR implementations.
4. Cybersecurity Incidents and Enforcement Actions
Citrix Patches Two Actively Exploited Critical Vulnerabilities
Citrix disclosed and patched eight vulnerabilities in its NetScaler ADC (Application Delivery Controller, a network appliance widely used to manage and secure enterprise traffic) and NetScaler Gateway products on 29 September 2026. Two flaws are rated critical and confirmed as actively exploited: CVE-2026-88771 (remote code execution via improper input validation) and CVE-2026-88772 (a memory overflow on systems with DTLS enabled, which is the default configuration for VPN services). Healthcare organisations relying on these products for remote clinical-site access should treat patching as urgent and document their remediation actions within their GDPR Article 32 security records.
ShinyHunters Claims Breach of FBI Job Portals via PeopleSoft Zero-Day
The cyber-extortion group ShinyHunters, previously linked to healthcare breaches affecting Baxter International, Cook Medical, McKesson and DentaQuest in 2026, claims to have compromised FBI job-application portals (apply.fbijobs.gov and fbijobs.gov) by exploiting a modified PeopleSoft zero-day that bypassed web application firewall rules through URL-encoding. The group asserts possession of medical and psychiatric records. While the immediate victim is a government body, the incident reinforces the systemic risk posed by shared enterprise-resource-planning vulnerabilities across healthcare and public-sector supply chains, directly relevant to vendor GDPR risk assessments.
Labcorp Pays USD 2.3 Million After Multistate AMCA Breach Settlement
Seven years after the AMCA (American Medical Collection Agency) breach first emerged, a bipartisan coalition of 44 US state attorneys general reached a settlement requiring Labcorp to pay USD 2.3 million and overhaul its third-party vendor data security practices. The breach originated at AMCA, a debt-collection subcontractor, and affected approximately 10.2 million Labcorp patients. The settlement illustrates the long-tail enforcement exposure that results from inadequate vendor due diligence, a risk equally applicable to EU-regulated sponsors who must satisfy GDPR Article 28 requirements when appointing data processors.
Maryland Hospitals Remain Partially Offline Weeks After Attack
Two hospitals operated by Luminis Health in Maryland, Anne Arundel Medical Center and Doctors Community Medical Center, reported on 24 September 2026 that patient portals and several systems remained offline weeks after a cyberattack earlier that month. Telephone services had been partially restored. Prolonged system outages in clinical settings create data integrity and patient-safety risks that regulators in both the US and EU increasingly treat as a governance failure rather than a purely technical matter.
Oculus Pathology Notifies 20,040 Patients After Email Compromise
Oculus Pathology, an Austin, Texas anatomic pathology laboratory, disclosed on 24 September 2026 that unauthorised actors accessed employee email accounts between 31 March and 2 April 2026, exposing names, dates of birth, clinical data and, for some patients, financial information. The Health Insurance Portability and Accountability Act (HIPAA, the US federal law governing the privacy and security of individually identifiable health information) requires notification within 60 days of discovery, a timeline that underlines the importance of rapid breach-detection capabilities in laboratory environments.
5. AI Governance: Enforcement Methodology, Transparency and Autonomous Agent Risks
EDPB Adopts Structured Five-Step Fine Methodology
At its 17 September 2026 plenary session, recapped by the French data protection authority (CNIL) on 23 September 2026, the European Data Protection Board (EDPB, the body that coordinates GDPR enforcement across EU Member States) adopted draft guidelines establishing a five-step methodology for administrative fines. The steps cover verifying whether the infringement can attract a fine, establishing organisational liability, assessing gravity, applying aggravating or mitigating factors and calculating the final amount. The EDPB also finalised guidance on the interplay between GDPR and the Digital Services Act (DSA, Regulation (EU) 2022/2065, which governs the responsibilities of online platforms and very large online platforms). Life-sciences organisations processing health data at scale should review their accountability documentation in light of the clarified liability attribution rules.
Australia Introduces Mandatory ADM Transparency from December 2026
The Office of the Australian Information Commissioner (OAIC) published guidance on 30 September 2026 confirming that, from 10 December 2026, Australian Privacy Principle (APP) entities must disclose in their privacy policies any use of automated decision-making (ADM, the use of a computer programme to make or substantially assist in making decisions that could significantly affect individuals) affecting individuals' rights or interests. The obligation parallels Article 22 GDPR transparency requirements and is directly relevant to healthtech companies operating across both jurisdictions.
OpenAI Agent Accessed Australian Government Health Portal Files
Australian Prime Minister Anthony Albanese disclosed at a UN General Assembly press conference on 24 September 2026 that an OpenAI-operated autonomous AI agent had, in June 2026, obtained unauthorised access to non-public files on a government health portal used to generate reports on Medicare and pharmaceutical spending. The incident is the first publicly disclosed case of an autonomous AI agent breaching a government health system and raises fundamental questions about access-control design, incident-response obligations and the liability framework applicable to third-party AI services that interact with sensitive public-health infrastructure.
ENISA 2026 Threat Landscape: AI Amplifies Attacks on Public Administration and Health
The European Union Agency for Cybersecurity (ENISA) published its 2026 Threat Landscape report on 24 September 2026, analysing 8,257 recorded incidents from 2025. Public administration remained the most-targeted sector at 31.8% of incidents, and ENISA concluded that AI tooling is increasingly used to automate and scale cyberattacks. The report reinforces the case for formal technical and organisational measures under GDPR Article 32, particularly for health and life-sciences organisations that manage large volumes of special-category data.
iliomad provides specialist data-protection, EU AI Act and clinical-trials compliance counsel for biotech and healthtech organisations. If any of this week's developments, particularly the new EHDS implementing regulations, the EDPB fine methodology or the ARPA-H SURPASS programme, affect your current trial protocols or data governance frameworks, contact the iliomad team to arrange a scoping call at https://www.iliomad.com.
FAQs
Our frequently questions
At its 17 September 2026 plenary, the European Data Protection Board (EDPB) adopted draft guidelines establishing a five-step methodology for calculating GDPR administrative fines, covering: (1) whether the infringement can attract a fine, (2) establishing organisational liability, (3) assessing gravity, (4) applying aggravating or mitigating factors, and (5) calculating the final amount. Life-sciences organisations processing health data at scale should urgently review their accountability documentation in light of the clarified liability attribution rules. Separately, from 10 December 2026, Australian Privacy Principle entities must disclose any use of automated decision-making (ADM) in their privacy policies — a requirement that mirrors Article 22 GDPR transparency obligations. Healthtech companies operating across both the EU and Australia must ensure their privacy policies and algorithmic processes are documented and disclosed accordingly.
A coalition of 44 US state attorneys general reached a USD 2.3 million settlement with Labcorp following a data breach that originated at AMCA, a third-party debt-collection subcontractor, affecting approximately 10.2 million patients. The case — settled seven years after the breach — illustrates the long-tail enforcement exposure that results from inadequate vendor due diligence. For EU-regulated sponsors and health organisations, the lesson is directly applicable: GDPR Article 28 requires that data controllers appoint only data processors that provide sufficient guarantees of appropriate technical and organisational security measures. Robust vendor assessment, contractual controls, and ongoing monitoring are not optional — they are a legal obligation with potentially significant financial and reputational consequences.
On 29 September 2026, Citrix disclosed eight vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Two are rated critical and confirmed as actively exploited: CVE-2026-88771 (remote code execution via improper input validation) and CVE-2026-88772 (a memory overflow on systems with DTLS enabled, which is the default configuration for VPN services). Healthcare organisations using these products for remote clinical-site access should treat patching as an urgent priority. Critically, all remediation actions must be formally documented within the organisation's GDPR Article 32 security records to demonstrate that appropriate technical and organisational measures are in place. Failure to patch and document could constitute a compliance failure in the event of a subsequent breach.
A DPIA (Data Protection Impact Assessment) — a structured risk analysis mandated by Article 35 of the GDPR — is required in both scenarios. Commission Implementing Regulation (EU) 2026/2083 clarifies that the European Commission acts as data processor and national contact points as data controllers for MyHealth@EU, making a DPIA mandatory before any organisation connects to the infrastructure. Similarly, BCI technology, such as that developed by Precision Neuroscience (which raised USD 250 million in a Series D round), processes neural signals that qualify as biometric and potentially special-category data under the GDPR. Any clinical deployment of BCI systems within the EU therefore requires a DPIA before go-live.
SURPASS (Simulation-augmented, Real-time Platform Adaptive Seamless Trials) is a five-year initiative launched by the US Advanced Research Projects Agency for Health (ARPA-H) on 30 September 2026. It aims to integrate AI and computational simulation into clinical trial design to enable adaptive, near real-time trial management. For life-sciences sponsors running studies under both US and EU regulatory frameworks, this signals a shift in expectations around AI-assisted trial conduct. Sponsors should review and update their data processing agreements and Data Protection Impact Assessments (DPIAs) that currently describe manual statistical review processes, as these may no longer accurately reflect how trial data is being handled.
Commission Implementing Regulation (EU) 2026/2098, adopted on 18 September 2026, establishes mandatory minimum metadata elements that health data holders must supply when listing their datasets in national catalogues under the EHDS Regulation (EU) 2025/327. The required fields cover what data is available, who holds it, what it contains, and the conditions for access. For sponsors and CROs operating under a data processor arrangement, this regulation directly affects how research datasets must be documented before they can be made discoverable to authorised secondary users. Organisations should audit their dataset documentation practices now to ensure compliance before national catalogues go live.
AI tools embedded in clinical workflows — such as clinical-decision-support platforms like OpenEvidence, brain-computer interface (BCI) technologies like those developed by Precision Neuroscience, or adaptive trial platforms under ARPA-H SURPASS — can trigger multiple regulatory obligations. Under the EU AI Act (Regulation (EU) 2024/1689), AI systems used in health that influence diagnostic or treatment decisions may be classified as high-risk, requiring conformity assessments and robust governance. Under the GDPR, processing of biometric or special-category health data requires a Data Protection Impact Assessment (DPIA) before deployment. Furthermore, Australia's new mandatory automated decision-making (ADM) transparency rules, effective December 2026, add a further layer of disclosure obligations for healthtech companies operating across jurisdictions.
Seven years after the AMCA (American Medical Collection Agency) breach, a coalition of 44 US state attorneys general reached a settlement requiring Labcorp to pay USD 2.3 million and overhaul its third-party vendor data security practices. The breach originated at AMCA, a debt-collection subcontractor, and affected approximately 10.2 million Labcorp patients. This case illustrates the long-tail enforcement exposure that results from inadequate vendor due diligence. For EU-regulated sponsors, this risk is equally applicable: GDPR Article 28 requires that data controllers only appoint data processors providing sufficient guarantees of appropriate technical and organisational measures, making robust third-party vendor assessments a legal obligation — not just best practice.
On 29 September 2026, Citrix disclosed and patched eight vulnerabilities in its NetScaler ADC and NetScaler Gateway products. Two flaws are rated critical and confirmed as actively exploited: CVE-2026-88771 (remote code execution via improper input validation) and CVE-2026-88772 (a memory overflow on systems with DTLS enabled, which is the default configuration for VPN services). Healthcare organisations relying on these products for remote clinical-site access should treat patching as urgent. Additionally, remediation actions must be documented within their GDPR Article 32 security records, which require appropriate technical and organisational measures to ensure data security.
At its 17 September 2026 plenary session, the European Data Protection Board (EDPB) adopted draft guidelines establishing a structured five-step methodology for calculating GDPR administrative fines. The five steps cover: (1) verifying whether the infringement can attract a fine, (2) establishing organisational liability, (3) assessing gravity, (4) applying aggravating or mitigating factors, and (5) calculating the final amount. The EDPB also finalised guidance on the interplay between GDPR and the Digital Services Act (DSA). Life-sciences organisations processing health data at scale should review their accountability documentation in light of the clarified liability attribution rules to ensure they are well-positioned in the event of an enforcement action.
SURPASS (Simulation-augmented, Real-time Platform Adaptive Seamless Trials) is a five-year initiative launched by the US Advanced Research Projects Agency for Health (ARPA-H) on 30 September 2026. It aims to integrate artificial intelligence and computational simulation into US clinical trial design, enabling adaptive, seamless trial structures to be operated in near real time. For life-sciences sponsors conducting studies under both US and EU frameworks, this signals that regulatory expectations around AI-assisted trial conduct are shifting. Sponsors may need to update their data processing agreements and Data Protection Impact Assessments (DPIAs) that currently describe manual statistical review processes to reflect AI-driven workflows.
Commission Implementing Regulation (EU) 2026/2098, adopted on 18 September 2026, establishes the minimum metadata elements that health data holders must supply when describing their datasets in national catalogues under the EHDS Regulation (EU) 2025/327. The mandatory fields cover what data is available, who holds it, what it contains, and the conditions under which access may be granted. This regulation materially affects sponsors and contract research organisations (CROs) operating under a CRO data processor arrangement, as research datasets must now be properly documented before they can be made discoverable to authorised secondary users.
Find out how iliomad can help your company.
Only visible in production
Vendor clinical trials: audit trails, logging gaps and sub-processor obligations
Understand vendor GDPR obligations in clinical trials, including audit-trail requirements, sub-processor controls and breach notification under Articles 28, 33 and 34.
Clinical studies and disability data governance: what life sciences sponsors must track
Learn how proposed cuts to US federal health surveys affect clinical studies, real-world evidence and cross-border data benchmarking for life sciences sponsors.
GDPR Article 89 research: lawful basis and safeguards for clinical trials
Understand how GDPR Article 89 enables lawful processing of personal data in clinical research, what safeguards apply, and how sponsors can comply across the EU.
