FDA and Equivalent Non-U.S. Regulatory Authorities
Our activities are subject to extensive regulation encompassing the entire life cycle of our products, from research and development activities to marketing approval (including specific post-marketing obligations), manufacturing, labeling, packaging, adverse event and safety reporting, storage, advertising, promotion, sale, pricing and reimbursement, recordkeeping, distribution, importing and exporting. The failure by us or any of our third party partners, including our corporate development and collaboration partners, clinical trial sites, suppliers, distributors and our central pharmacy for Xywav and Xyrem, to comply with applicable requirements could subject us to administrative or judicial sanctions or other negative consequences, such as delays in approval or refusal to approve a product candidate, restrictions on our products, our suppliers, our other partners or us, the withdrawal, suspension or variation of product approval or manufacturing authorizations, untitled letters, warning letters, fines and other monetary penalties, unanticipated expenditures, product recall, withdrawal or seizure, total or partial suspension of production or distribution, interruption of manufacturing or clinical trials, operating restrictions, injunctions, suspension of licenses, civil penalties and/or criminal prosecution, any of which could result in a significant drop in our revenues from the affected products and harm to our reputation and could have a significant impact on our sales, business and financial condition.
We monitor adverse events resulting from the use of our products, as do the regulatory authorities, and we file periodic reports with the authorities concerning adverse events. The authorities review these events and reports and, if they determine that any events and/or reports indicate a trend or signal, they can require a change in a product label, restrict sales and marketing and/or require conduct or other actions, potentially including variation, withdrawal or suspension of the marketing authorization, any of which could result in reduced market acceptance and demand for our products, could harm our reputation and our ability to market our products in the future, and could have a material adverse effect on our business, financial condition, results of operations and growth prospects. FDA, the competent authorities of the EU member states on behalf of EMA, and the competent authorities of other European countries, also periodically inspect our records related to safety reporting. EMA's Pharmacovigilance Risk Assessment Committee may propose to the Committee for Medicinal Products for Human Use that the marketing authorization holder be required to take specific steps or advise that the existing marketing authorization be varied, suspended or revoked. Failure to adequately and promptly correct the observation(s) can result in further regulatory enforcement action, which could include the variation, suspension or withdrawal of marketing authorization or imposition of financial penalties or other enforcement measures.
Rylaze and Epidyolex are available on a named patient basis or through a compassionate use process in many countries where they are not commercially available. If any such country's regulatory authorities determine that we are promoting such products without proper authorization, we could be found to be in violation of pharmaceutical advertising laws or the regulations permitting sales under named patient programs. In that case, we may be subject to financial or other penalties. Any failure to maintain revenues from sales of products on a named patient basis and/or to generate revenues from commercial sales of these products exceeding historical sales on a named patient basis could have an adverse effect on our business, financial condition, results of operations and growth prospects.
FDA, the competent authorities of the EU member states and other European countries, and other governmental authorities require advertising and promotional materials to be truthful and not misleading, and products to be marketed only for their approved indications and in accordance with the provisions of the approved label. Regulatory authorities actively investigate allegations of off-label promotion in order to enforce regulations prohibiting these types of activities. A determination that we have promoted an approved product for off-label uses could subject us to significant liability, including civil and administrative financial penalties and other remedies as well as criminal financial penalties, other sanctions and imprisonment. Even if we are not determined to have engaged in off-label promotion, an allegation that we have engaged in such activities could have a significant impact on our sales, business and financial condition. The U.S. government has also required companies to enter into complex corporate integrity agreements and/or non-prosecution agreements that impose significant reporting and other burdens on the affected companies. Failure to maintain a comprehensive and effective compliance program, and to integrate the operations of acquired businesses into a combined comprehensive and effective compliance program on a timely basis, could subject us to a range of regulatory actions and/or civil or criminal penalties that could affect our ability to commercialize our products and could harm or prevent sales of the affected products, or could substantially increase the costs and expenses of commercializing and marketing our products.
Other Regulatory Authorities
We are also subject to regulation by other regional, national, state and local agencies, including the DEA, the DOJ, the FTC, the United States Department of Commerce, the OIG, and other regulatory bodies, as well as similar governmental authorities in those non-U.S. countries in which we commercialize our products.
We are subject to numerous fraud and abuse laws and regulations globally and our sales, marketing, patient support and medical activities may be subject to scrutiny under these laws and regulations. These laws are described in "Business-Government Regulation" in Part I, Item 1 of this Annual Report on Form 10-K. While we maintain a comprehensive compliance program to try to ensure that our practices and the activities of our third party contractors and employees fall within the scope of available statutory exceptions and regulatory safe harbors whenever possible, and otherwise comply with applicable laws, regulations or guidance, regulators and enforcement agencies may disagree with our assessment or find fault with the conduct of our employees or contractors. In addition, existing regulations are subject to regulatory revision or changes in interpretation by the DOJ or OIG. For example, in November 2020, the OIG issued a Special Fraud Alert to highlight certain inherent risks of remuneration related to speaker programs sponsored by drug and medical device companies, which may not in all circumstances qualify under either safe harbor or statutory exception protection. The Special Fraud Alert sent a clear signal that speaker programs will be subject to potentially heightened enforcement scrutiny, in particular for those programs with certain characteristics identified as risk factors by OIG.
Many companies have faced government investigations or lawsuits by whistleblowers who bring a qui tam action under the False Claims Act on behalf of themselves and the government for a variety of alleged improper marketing activities, including providing free product to customers expecting that the customers would bill federal programs for the product, providing consulting fees, grants, free travel and other benefits to physicians to induce them to prescribe the company's products, and inflating prices reported to private price publication services, which are used to set drug reimbursement rates under government healthcare programs. For example, we are subject to a qui tam whistleblower lawsuit originally filed under seal on May 27, 2021. For additional information see "Qui tam matter" in Note 13, Commitments and Contingencies-Legal Proceedings of the Notes to Consolidated Financial Statements, included in Part IV of this Annual Report on Form 10-K. In addition, the government and private whistleblowers have pursued False Claims Act cases against pharmaceutical companies for causing false claims to be submitted as a result of the marketing of their products for unapproved uses or violations of the federal anti-kickback statute. If we become the subject of a government False Claims Act or other investigation or whistleblower suit, we could incur substantial legal costs (including settlement costs) and business disruption responding to such investigation or suit, regardless of the outcome.
Any investigations or litigation may result in damages, fines, penalties or administrative sanctions against us, negative publicity or other negative actions that could harm our reputation, reduce demand for our products and/or reduce coverage of our products, including by federal health care programs and state health care programs. If any or all of these events occur, our business and stock price could be materially and adversely affected.
Public reporting under the Sunshine provisions, and other similar state laws, the requirements of which are discussed in "Business-Government Regulation" in Part I, Item 1 of this Annual Report on Form 10-K, has resulted in increased scrutiny of the financial relationships between industry, teaching hospitals, physicians and other health care providers. Such scrutiny may negatively impact our ability to engage with physicians and other health care providers on matters of importance to us. In addition, government agencies and private entities may inquire about our marketing practices or pursue other enforcement activities based on the disclosures in those public reports. If the data reflected in our reports are found to be in violation of any of the Sunshine provisions or any other U.S. federal, state or local laws or regulations that may apply, or if we otherwise fail to comply with the Sunshine provisions or similar requirements of state or local regulators, we may be subject to significant civil, and administrative penalties, damages or fines.
We have various programs to help patients access our products, including patient assistance programs, which include co-pay coupons for certain of our products, assistance to help patients determine their insurance coverage for our products, and a free product program. Co-pay coupon programs for commercially insured patients, including our program for Xyrem, have received negative publicity related to allegations regarding their use to promote branded pharmaceutical products over other less costly alternatives, and some states have imposed restrictions on manufacturer co-pay programs when therapeutic equivalents are available. In September 2014, the OIG issued a Special Advisory Bulletin warning manufacturers that they may be subject to sanctions under the federal Anti-Kickback Statute and other laws if they do not take appropriate steps to exclude Medicare Part D beneficiaries from using co-pay coupons. It is possible that changes in insurer policies regarding co-pay coupons and/or the introduction and enactment of new legislation or regulatory action could restrict or otherwise negatively affect these patient support programs, which could result in fewer patients using affected products, including Xyrem, and therefore could have a material adverse effect on our sales, business and financial condition.
We have established programs to consider grant applications submitted by independent charitable organizations, including organizations that provide co-pay support to patients who suffer from the diseases treated by our drugs. The OIG has issued guidance for how pharmaceutical manufacturers can lawfully make donations to charitable organizations who provide co-pay assistance to Medicare patients, provided that such organizations, among other things, are bona fide charities, are entirely independent of and not controlled by the manufacturer, provide aid to applicants on a first-come basis according to consistent financial criteria, and do not link aid to use of a donor's product. As of August 2024, we have fulfilled the terms and OIG closed out our corporate integrity agreement that required us to maintain our ongoing corporate compliance program. Although we are continuing to implement our corporate compliance program and have structured our programs to follow available guidance, if we or our vendors or donation recipients are deemed to fail to comply with relevant laws, regulations or evolving government guidance in the operation of these programs, such facts could be used as the basis for an enforcement action against us by the federal government or other enforcement agencies or private litigants, or we could become liable for payment of certain stipulated penalties or could be excluded from participation in federal health care programs, which would have a material adverse effect on our sales, business and financial condition.
Our business activities outside of the U.S. are subject to the FCPA, and similar anti-bribery or anti-corruption laws, regulations or rules of other countries in which we operate, including the U.K. Bribery Act. In certain countries, the health care providers who prescribe pharmaceuticals are employed by their government and the purchasers of pharmaceuticals are government entities; therefore, our dealings with these prescribers and purchasers may be subject to regulation under the FCPA, the U.K. Bribery Act and equivalent national laws in other countries. Violation of these laws by us or our suppliers and other third party agents for which we may be liable may result in civil or criminal sanctions, which could include monetary fines, criminal penalties, and disgorgement of past profits, which could have a material adverse impact on our business and financial condition.
Outside the U.S., interactions between pharmaceutical companies and physicians are also governed by strict laws, such as national anti-bribery laws of European countries, national sunshine rules, regulations, industry self-regulation codes of conduct and physicians' codes of professional conduct. Failure to comply with these requirements could result in reputational risk, public reprimands, administrative penalties, fines or imprisonment.
We are also subject to federal, state, national and international laws and regulations governing the privacy and security of health-related and other personal data we collect and maintain, including, but not limited to, Section 5 of the Federal Trade Commission Act, the Health Breach Notification Rule, HIPAA, the California Consumer Privacy Act, as amended by California Privacy Rights Act, as well as other similar state privacy laws, and the EU's and U.K.'s GDPR. The GDPR, for example, imposes restrictions on the processing (e.g., collection, use and disclosure) of personal data in the EU and the U.K. and also imposes strict restrictions on the transfer of personal data out of the EU to the U.S. The GDPR imposes penalties of up to 20 million Euros or up to 4% of annual global revenue. HIPAA imposes privacy and security obligations on covered entity health care providers, health plans, and health care clearinghouses, as well as their "business associates" – certain persons or covered entities that create, receive, maintain, or transmit protected health information in connection with providing a specified service or performing a function for or on behalf of a covered entity. Although we are not directly subject to HIPAA, we could potentially be subject to criminal penalties if we, our affiliates, or our agents knowingly receive individually identifiable health information maintained by a HIPAA-covered entity in a manner that is not authorized or permitted by HIPAA. The FTC also sets expectations for failing to take appropriate steps to keep consumers' personal information secure or failing to provide a level of security commensurate to promises made to an individual about the security of their personal information (such as in a privacy notice); such failures may constitute unfair or deceptive acts or practices in violation of Section 5(a) of the Federal Trade Commission Act. Compliance with these laws requires a flexible privacy framework and substantial resources, and compliance efforts will likely be an increasing and substantial cost in the future.
If we or our third party partners fail to comply or are alleged to have failed to comply with these or other applicable data protection and privacy laws and regulations, or if we were to experience a data breach involving personal data, we could be subject to government enforcement actions or private lawsuits. Any associated claims, inquiries, or investigations or other government actions could lead to unfavorable outcomes that have a material impact on our business including through significant penalties or fines, monetary judgments or settlements including criminal and civil liability for us and our officers and directors, increased compliance costs, delays or impediments in the development of new products, negative publicity, increased operating costs, diversion of management time and attention, or other remedies that harm our business, including orders that we modify or cease existing business practices.