Healthcare providers, physicians and third-party payors will play a primary role in the recommendation and prescription of any product candidates for which we obtain marketing approval. Our current and future arrangements with healthcare professionals, clinical investigators, CROs, third-party payors and customers may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we market, sell and distribute our product candidates for which we obtain marketing approval. Restrictions under applicable federal and state healthcare laws and regulations, include the following:
- the U.S. federal Anti-Kickback Statute, which prohibits, among other things, persons and entities from knowingly and willfully soliciting, offering, receiving or providing remuneration, directly or indirectly, in cash or in kind to induce or reward, or in return for, either the referral of an individual for, or the purchase, order or recommendation of, any good or service, for which payment may be made under federal and state healthcare programs, such as Medicare and Medicaid. A person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- the U.S. federal false claims and civil monetary penalties laws, including the U.S. federal False Claims Act, which imposes criminal and civil penalties, including through civil whistleblower or qui tam actions, against individuals or entities for knowingly presenting, or causing to be presented, to the federal government, claims for payment that are false or fraudulent or making a false statement to avoid, decrease or conceal an obligation to pay money to the federal government. In addition, the government may assert that a claim including items and services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the False Claims Act;- HIPAA, which imposes criminal and civil liability for, among other things, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, or knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false statement in connection with the delivery of or payment for healthcare benefits, items or services; similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation;- HIPAA, as amended by HITECH, which imposes obligations on certain covered entity healthcare providers, health plans, and healthcare clearinghouses as well as their business associates that perform certain services involving the use or disclosure of individually identifiable health information, including mandatory contractual terms, with respect to safeguarding the privacy, security, and transmission of individually identifiable health information, and require notification to affected individuals and regulatory authorities of certain breaches of security of individually identifiable health information;- federal and state consumer protection and unfair competition laws, which broadly regulate marketplace activities and activities that potentially harm customers;- the U.S. Physician Payments Sunshine Act created under the ACA, and its implementing regulations, which require that certain manufacturers of drugs, devices, medical supplies and therapeutic biologics that are reimbursable under Medicare, Medicaid, and Children's Health Insurance Programs report annually to the Department of Health and Human Services information related to certain payments and other transfers of value to physicians, as defined by such law, physician assistants, certain types of advance practice nurses and teaching hospitals, as well as ownership and investment interests held by the physicians described above and their immediate family members; and - analogous state laws and regulations, such as state anti-kickback and false claims laws that may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third-party payors, including private insurers; some state laws require that pharmaceutical companies to comply with the pharmaceutical industry's voluntary compliance guidelines and the relevant compliance guidance promulgated by the federal government in addition to requiring drug and therapeutic biologics manufacturers to report information related to payments to physicians and other healthcare providers or marketing expenditures, and information related to drug pricing, including price increases. State and local laws require the registration of pharmaceutical sales representatives.
Foreign and state laws also govern the privacy and security of health information in some circumstances, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. For instance, the collection and use of health data in the EU is governed by the General Data Protection Regulation, or the GDPR, which extends the geographical scope of EU data protection law to non-EU entities under certain conditions, tightens existing EU data protection principles and creates new obligations for companies and new rights for individuals. Failure to comply with the GDPR may result in substantial fines and other administrative penalties. The GDPR may increase our responsibility and liability in relation to personal data that we possess and we may be required to put in place additional mechanisms ensuring compliance with the GDPR. We comply with the GDPR and the UK GDPR, which, together with the amended UK Data Protection Act 2018, retains the GDPR in United Kingdom national law, the latter regime having the ability to separately fine and penalize violations. The relationship between the United Kingdom and the EU in relation to certain aspects of data protection law remains unclear, and it is unclear how United Kingdom data protection laws and regulations will develop in the medium to longer term, and how data transfers to and from the United Kingdom will be regulated in the long term. Ongoing developments in the United Kingdom have created additional uncertainty regarding personal data transfers from the European Economic Area (EEA) to the United Kingdom following the termination of the personal data transfer grace period set out in the EU and United Kingdom Trade and Cooperation Agreement, which ended on June 30, 2021. It is not clear whether (and when) an adequacy decision may be granted by the European Commission enabling data transfers from EU member states to the United Kingdom long term without additional measures. Moreover, in July 2020 the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield Framework (Privacy Shield) under which personal data could be transferred from the EEA and the United Kingdom to entities in the United States who had self-certified under the Privacy Shield scheme. This has led to uncertainty about the adequate transfer mechanisms for other personal data transfers from the EEA and the United Kingdom to the United States or interruption of such transfers. In the event that any court of law orders the suspension of personal data transfers to or from a particular jurisdiction this could give rise to operational interruption in the performance of services for customers, greater costs to implement alternative data transfer mechanisms that are still permitted, regulatory liabilities or reputational harm.
In addition, state laws govern the privacy and security of health information in specified circumstances, many of which differ from each other in significant ways and may not have the same effect, thus complicating compliance efforts. Certain state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to personal information, and such laws may differ from each other, all of which may complicate compliance efforts. For example, the CCPA, as modified by the CPRA, creates individual privacy rights for California consumers and increases the privacy and security obligations of entities handling certain personal information. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA and CPRA may increase our compliance costs and potential liability, and similar laws have been proposed at the federal level and in other states. In addition, Virginia's Consumer Data Protection Act, which took effect on January 1, 2023, requires businesses subject to the legislation to conduct data protection assessments in certain circumstances and requires opt-in consent from consumers to acquire and process their sensitive personal information, which includes information revealing a consumer's physical and mental health diagnosis and genetic and biometric information that can identify a consumer. Colorado enacted the Colorado Privacy Act, and Connecticut enacted the Connecticut Data Privacy Act, each of which took effect on July 1, 2023, and Utah enacted the Consumer Privacy Act, which became effective on December 31, 2023, and each of these laws may increase the complexity, variation in requirements, restrictions, and potential legal risks, and could require increased compliance costs and changes in business practices and policies. Other states have also enacted, proposed, or are considering proposing, data privacy laws, which could further complicate compliance efforts, increase our potential liability and adversely affect our business.
Ensuring that our internal operations and future business arrangements with third parties comply with applicable healthcare, privacy and securities laws and regulations worldwide will involve substantial costs. If our operations are found to be in violation of any of the laws described above or any other governmental laws and regulations that may apply to us, we may be subject to regulatory investigations and enforcement actions, as well as civil private plaintiff litigation, which could mean significant penalties, including civil, criminal and administrative penalties, damages, fines, exclusion from participation in government-funded healthcare programs such as Medicare and Medicaid or similar programs in other countries or jurisdictions, disgorgement, imprisonment, reputational harm and diminished profits. Responding to regulatory inquiries and defending against any such actions can be costly, time-consuming and may require significant financial and personnel resources. Therefore, even if we are successful in defending against any such actions that may be brought against us, our business may be impaired.