We are subject to various healthcare laws and regulations in the U.S. and internationally, including anti-kickback laws, false claims laws, data privacy and security laws, and laws related to ensuring compliance. In the U.S., the federal Anti-Kickback Statute makes it illegal for any person or entity, including a pharmaceutical company, to knowingly and willfully offer, solicit, pay or receive any remuneration, directly or indirectly, in exchange for or to induce the referral of business, including the purchase, order or prescription of a particular drug, for which payment may be made under federal healthcare programs, such as Medicare and Medicaid. Under the federal Anti-Kickback Statute and related regulations, certain arrangements are deemed not to violate the federal Anti-Kickback Statute if they fit within a statutory exception or regulatory safe harbor. However, the exceptions and safe harbors are drawn narrowly, and practices that involve remuneration not intended to induce prescribing, purchases or recommendations may be subject to scrutiny if they do not qualify for an exception or safe harbor. Our practices may not in all cases meet all of the criteria for safe harbor protection from Anti-Kickback liability, although we seek to comply with these safe harbors. Many states have adopted laws similar to the federal Anti-Kickback Statute, some of which apply to referral of patients for healthcare services reimbursed by any source, not just governmental payers. As previously disclosed, we received a subpoena from the U.S. Department of Justice requesting that we produce certain documents regarding our sponsored testing programs relating to VIMIZIM and NAGLAZYME. We have produced documents in response to the subpoena and are cooperating fully, but there is no assurance that such sponsored testing programs, or our other operations or programs, will not be found to violate such laws.
Federal and state false claims laws, including the civil False Claims Act and the Civil Monetary Penalties Law, prohibit any person or entity from knowingly presenting, or causing to be presented, a false claim for payment to the federal government, or knowingly making, or causing to be made, a false statement to have a false claim paid, or knowingly making, using, or causing to be made or used, a false record or statement to avoid, decrease or conceal an obligation to pay money to the federal government. In addition, certain marketing practices, including off-label promotion, may also violate false claims laws.
Under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), we also are prohibited from, among other things, knowingly and willfully executing a scheme to defraud any healthcare benefit program, including private payers, or knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services.
In addition, federal and state healthcare legislation have strengthened these laws in the U.S. For example, the PPACA, among other things, amends the intent requirement of the federal Anti-Kickback Statute and criminal healthcare fraud statutes. A person or entity no longer needs to have actual knowledge of these statutes or specific intent to violate them in order to commit a violation. Moreover, the PPACA provides that the government may assert that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the civil False Claims Act.
HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act and its implementing regulations, also imposes obligations, including mandatory contractual terms, on certain types of individuals and entities, with respect to safeguarding the privacy, integrity, availability, security and transmission of individually identifiable health information.
Many state and non-U.S. laws also govern the privacy and security of health information. They often differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts. The global data protection landscape is rapidly evolving, and implementation standards and enforcement practices are likely to remain uncertain for the foreseeable future. In the U.S., state privacy laws and regulations impose restrictive requirements regulating the use and disclosure of health information and other sensitive personal information that is not subject to HIPAA. For example, California enacted the California Consumer Privacy Act (CCPA), which took effect on January 1, 2020. The CCPA gives California consumers expanded rights to access and delete their personal information, opt out of certain personal information sales, and receive detailed information about how their personal information is used. The CCPA provides for civil penalties for violations, as well as a private right of action for data breaches that is expected to increase data breach litigation. The CCPA was expanded substantially on January 1, 2023 when the California Privacy Rights Act of 2020 (CPRA) took effect and amended the CCPA. Following the CPRA amendments, the CCPA, among other things, gives consumers the ability to limit use of information deemed to be sensitive, increase the maximum penalties for violations concerning consumers under age 16, expands an individual's private right of action and establishes the California Privacy Protection Agency to implement and enforce the new law and impose administrative fines.
Other U.S. states have recently adopted consumer data protection and privacy laws, and more U.S. states may do so in the future. This creates the potential for a patchwork of overlapping but different state laws and could mark the beginning of a trend toward more stringent privacy legislation in the U.S., which could increase our potential liability and adversely affect our business, financial condition, and results of operations. Many other states are considering proposed comprehensive data privacy legislation and all 50 states have passed some form of legislation relating to privacy or cybersecurity.
Aspects of the CCPA, CPRA and similar laws in other states and their interpretation and enforcement remain uncertain. The potential effects of these laws are far-reaching and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to comply. Complying with these or other similar laws, regulations, amendments to or re-interpretations of existing laws and regulations, and contractual or other obligations relating to privacy, data protection, data transfers, data localization, or information security may require us to make changes to our services to enable us or our customers to meet new legal requirements, incur substantial operational costs, modify our data practices and policies, and restrict our business operations. Any actual or perceived failure by us to comply with these laws, regulations, or other obligations may lead to significant fines, penalties, regulatory investigations, lawsuits, significant costs for remediation, damage to our reputation, or other liabilities.
The European Regulation 2016/679, known as the General Data Protection Regulation (GDPR), as well as EEA Member State legislations supplementing such regulation, apply to the processing of personal data of individuals located in the EEA, including health-related information, by companies located in the EEA, or in certain circumstances, by companies located outside of the EEA. These laws impose strict obligations on the ability to collect, record, store, disclose, use and transmit personal data, including health-related information. These include several requirements relating to (i) obtaining, in some situations, the informed consent of the individuals to whom the personal data relates, (ii) the information provided to the individuals about how their personal information is used, (iii) ensuring the security and confidentiality of the personal data, (iv) the obligation to notify regulatory authorities and affected individuals of personal data breaches, (v) extensive internal privacy governance obligations, and (vi) obligations to honor rights of individuals in relation to their personal data (for example, the right to access, correct and delete their data). Switzerland has adopted similar restrictions.
The GDPR and other European data protection laws generally restrict the transfer of personal information from Europe, including the EEA and Switzerland, to the U.S. and most other countries unless the U.S. companies participate in the EU-U.S. Data Privacy Framework in accordance with the EC's adequacy decision adopted on July 10, 2023, or have implemented specific safeguards to protect the transferred personal information. U.S. companies can join the EU-U.S. Data Privacy Framework by committing to comply with a detailed set of privacy obligations and U.S. companies that do not fall under the EU-U.S. Data Privacy Framework must implement certain specific safeguards. One of the primary safeguards allowing U.S. companies to import personal information from the EEA has been the EC's Standard Contractual Clauses (SCCs). However, the Court of Justice of the EU (CJEU) issued a decision that called into question whether the SCCs can lawfully be used for transfers of personal information from Europe to the United States or most other countries. After the mentioned CJEU judgment, new sets of SCCs were published on June 4, 2021. Most importantly, the use of SCCs does not any longer automatically ensure compliance with the GDPR. Instead, companies remain required to conduct a data transfer impact assessment for each transfer, which adds a compliance burden.
Potential pecuniary fines for noncompliance with the GDPR may be up to the greater of €20 million or 4% of annual global revenue. The GDPR has increased our responsibility and liability in relation to personal data that we process and has increased our compliance costs. The EU regulations that make certain materials we submit to the EMA in connection with our clinical trials subject to public disclosure have increased the risk that we may unintentionally disclose personal information protected under the GDPR and thereby incur associated penalties and suffer reputational damage.
In addition to the U.S. and European countries, other countries in which we operate have also enacted data privacy laws or may do so in the future. For example, Brazil's General Data Protection Law (LGPD), which is modeled on the GDPR, took effect in 2020.
Substantial new laws and regulations affecting compliance have also been adopted in the U.S. and certain non-U.S. countries, which may require us to modify our business practices with healthcare practitioners. For example, in the U.S., the PPACA, through the Physician Payments Sunshine Act, requires certain drug, biologicals and medical supply manufacturers to collect and report to CMS information on payments or transfers of value to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), other health care professionals (such as physicians assistants and nurse practitioners), and teaching hospitals, as well as investment and ownership interests held by such physicians and their immediate family members during the preceding calendar year. In addition, there has been a recent trend of increased state regulation of payments made to physicians. Certain states and/or local jurisdictions mandate implementation of compliance programs, compliance with the Office of Inspector General Compliance Program Guidance for Pharmaceutical Manufacturers and the Pharmaceutical Research and Manufacturers of America (PhRMA) Code on Interactions with Healthcare Professionals, the registration of pharmaceutical sales representatives and/or the tracking and reporting of gifts, compensation and other remuneration to physicians, marketing expenditures, and drug pricing. Likewise, in many non-U.S. countries there is an increasing focus on the relationship between drug companies and healthcare practitioners. Recently enacted non-U.S. legislation creates reporting obligations on payments, gifts and benefits made to these professionals. Outside the U.S., interactions between pharmaceutical companies and health care professionals are also governed by strict laws, such as national anti-bribery laws of European countries, national sunshine rules, regulations, industry self-regulation codes of conduct and physicians' codes of professional conduct. The shifting regulatory environment and the need to implement systems to comply with multiple jurisdictions with different compliance and/or reporting requirements increases the costs of maintaining compliance and the possibility that we may violate one or more of the requirements and be subject to fines or sanctions.
Due to the breadth of the healthcare and privacy and data protection laws described above, the narrowness of available statutory and regulatory exceptions and safe harbors and the increased focus by law enforcement authorities in enforcing such laws, our business activities could be subject to challenge under one or more of such laws. If we are found in violation of one of these laws, we may be subject to significant criminal, civil or administrative sanctions, including damages, fines, disgorgement, imprisonment, contractual damages, reputational harm, public reprimands, diminished profits and future earnings, additional reporting requirements and oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, curtailment of our operations, and debarment, suspension or exclusion from participation in government healthcare programs, any of which could adversely affect our business, financial condition and results of operations.