AR 95-1 (Army Flight Regulations) is just the tip of spear for everything that occurred with this incident. The NG Supplement to AR 95-1, AR 40-3, NG Pam 95-5, and the FARs are all pertinent to the discussion.
While the most interesting facet if doing a post-mortem on this operation is probably the briefing and approving process and how DSCA/DOMOPs is trained, planned, and resourced, the lowest hanging fruit is the use of a medevac helicopter for the operation.
As Nark well knows, the use of medevac painted helicopters is very restrictive - generally they can only do medevac, transport patients, or conduct training. 40-3 has the full list. Any mission outside of that list has to be approved by the Deputy Chief of Staff, G–3/5/7, or Chief National Guard Bureau depending on what regulation you want to believe. The NG Supp does not give any relief to this requirement. However, 95-5 does give a possibility to use medevac helicopters in support of domestic operations but the authorized support as listed is murky at best. Of the list of authorized mission sets, the closest this mission would fall under is support for civil law enforcement, and there's a heck of an approval process required to support civil law enforcement. Now we can't really know if this mission was requested and approved by DAMO-AV/ CNGB or not, and we don't know if the DSCA approvals were received, but the timeline suggests it is probably unlikely they even tried. But of course we don't know for sure.
The second lowest hanging fruit is their altitude. The NG Supp says we'll do 91.119 except for a bunch of reasons, one of which is for "risk managed" and "approved" DOMOPS missions. Doing some "regulation gymnastics" can kind of circle around to their altitude being okay - if they were indeed on an approved DOMOPS mission, were responding in support of disaster relief, or were an "immediate" need for civil authorities. All of that stuff is in 95-5 (also known as the SAAO bible) and if you haven't read it, it's a dense, complicated read. Regardless, the NG Supp and 91.119 would be controlling in this case if it is indeed true per the article that they were never granted permission to fly below those altitudes.
Now I don't know if any "laws" were broken here - but at least one military regulation probably was broken. What I know for sure as a guy involved with these processes in a seat a little different from a stick wiggler's is if I got a call to send some of my folks out on a mission like this, an APU wouldn't start until NGB gave me something in writing saying it was okay and the JAG said it was right. I also know the briefing and approving process here, while it might have been technically by the book in sort of a rote step 1, step 2 way, was weak at best. You just don't shoot from the hip with DOMOPS/DSCA missions, especially non-standard, untrained-for missions.