There are numerous U.S. federal, state, local and foreign health care fraud and abuse laws pertaining to our business, including anti-kickback, false claims and physician transparency laws. Our business practices and relationships with providers, patients and third-party payors are subject to scrutiny under these laws. These laws may impact, among other things, our potential sales, marketing, patient assistance and education programs. We may also be subject to patient information privacy and security regulation by both the federal government, states and foreign jurisdictions in which we conduct our business. The healthcare laws and regulations that may affect our ability to operate include:
- the U.S. federal Anti-Kickback Statute, which prohibits, among other things, knowingly and willfully offering, soliciting, receiving, or paying remuneration directly or indirectly, in cash or in kind to induce or reward either the referral of an individual for, or the purchase, order or recommendation of goods or services for which payment may be made in whole or part by Medicare, Medicaid or other federal health care programs. Remuneration has been broadly defined to include anything of value, including cash, improper discounts, and free or reduced price items and services. The intent standard under the federal Anti-Kickback Statute was amended by the ACA to a stricter standard such that a person or entity no longer needs to have actual knowledge of the statute or specific intent to violate it, in order to have committed a violation. In addition, the ACA provides that a claim including items or services resulting from a violation of the federal Anti-Kickback Statute constitutes a false or fraudulent claim for purposes of the FCA. Additionally, many states have similar laws that apply to their state health care programs as well as private payors. Violations of the federal or state anti-kickback laws can result in exclusion from federal and state health care programs and substantial civil and criminal penalties;- the federal civil and criminal false claims laws and civil monetary penalties laws, including the FCA, prohibit, among other things, individuals or entities from knowingly presenting, or causing to be presented, false, fictitious or fraudulent claims for payment from Medicare, Medicaid or other federal healthcare programs, and knowingly making, using or causing to be made or used a false record or statement material to a false or fraudulent claim to avoid, decrease or conceal an obligation to pay money to the federal government. As a result of a modification made by the Fraud Enforcement and Recovery Act of 2009, a claim includes "any request or demand" for money or property presented to the federal government. Even where pharmaceutical companies do not submit claims directly to payors, they can be held liable under these laws if they are deemed to "cause" the submission of false or fraudulent claims by, for example, providing inaccurate billing or coding information to customers, promoting a product off-label, marketing products of sub-standard quality, or, as noted above, paying a kickback that results in a claim for items or services. In addition, activities relating to the reporting of wholesaler or estimated retail prices for pharmaceutical products, the reporting of prices used to calculate Medicaid rebate information and other information affecting federal, state and third-party reimbursement for such products, and the sale and marketing of such products, are subject to scrutiny under this law. For example, several pharmaceutical and other healthcare companies have faced enforcement actions under these laws for allegedly inflating drug prices they report to pricing services, which in turn were used by the government to set Medicare and Medicaid reimbursement rates, and for allegedly providing free product to customers with the expectation that the customers would bill federal programs for the product. Private individuals or "whistleblowers" can bring FCA "qui tam" actions on behalf of the government and may share in recovered amounts. The FCA has been used to prosecute persons submitting claims for payment that are inaccurate or fraudulent, that are for services not provided as claimed, or for services that are not medically necessary. Proof of intent to deceive is not required to establish liability under the civil False Claims Act;- HIPAA, which imposes criminal and civil liability for, among other things, executing or attempting to execute a scheme to defraud any healthcare benefit program, including any third party payors, knowingly and willfully embezzling or stealing from a healthcare benefit program, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statements or representations, or making false statements relating to healthcare benefits, items or services. Similar to the federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it to have committed a violation;- HIPAA, as amended by HITECH, and their respective implementing regulations, including the Final Omnibus Rule published on January 25, 2013, which impose, among other things, obligations, including mandatory contractual terms, with respect to safeguarding the privacy, security and transmission of individually identifiable health information held by certain healthcare providers, health plans and healthcare clearinghouses, known as "covered entities," and "business associates." Among other things, HITECH made certain aspects of HIPAA's rules (notably the Security Rule) directly applicable to business associates - independent contractors or agents of covered entities that receive or obtain individually identifiable health information in connection with providing a service on behalf of a covered entity, and their covered subcontractors. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal court to enforce the federal HIPAA laws and seek attorney's fees and costs associated with pursuing federal civil actions. The Department of Health and Human Services Office for Civil Rights ("OCR") has increased its focus on compliance and continues to train state attorneys general for enforcement purposes. The OCR has increased both its efforts to audit HIPAA compliance and its level of enforcement, with one penalty amounting to $16 million. In addition, according to the United States Federal Trade Commission ("FTC") failing to take appropriate steps to keep consumers' personal information secure constitutes unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act ("FTCA") 15 USC § 45(a). The FTC expects a company's data security measures to be reasonable and appropriate in light of the sensitivity and volume of consumer information it holds, the size and complexity of its business, and the cost of available tools to improve security and reduce vulnerabilities. Medical data is considered sensitive data that merits stronger safeguards. The FTC's guidance for appropriately securing consumers' personal information is similar to what is required by the HIPAA Security Rule;- the federal Physician Payments Sunshine Act and its implementing regulations, which require certain manufacturers of prescription drugs, devices and medical supplies for which payment is available under Medicare, Medicaid or the Children's Health Insurance Program to annually report to CMS information related to payments and other transfers of value to physicians (defined to include doctors, dentists, optometrists, podiatrists and chiropractors), certain other healthcare professionals (such as nurse practitioners and physicians assistants) and teaching hospitals, or to entities or individuals at the request of, or designated on behalf of, the physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. In addition, Section 6004 of the ACA requires annual reporting of information about drug samples that manufacturers and authorized distributors provide to physicians; and - analogous state, local and foreign laws and regulations, such as state anti-kickback and false claims laws, and other states' laws addressing the pharmaceutical and healthcare industries, may apply to sales or marketing arrangements and claims involving healthcare items or services reimbursed by non-governmental third party payors, including private insurers, and in some cases that may apply regardless of payor, i.e., even if reimbursement is not available; state laws that require drug companies to comply with the industry's voluntary compliance guidelines (the PhRMA Code) and the applicable compliance program guidance promulgated by the federal government (HHS-OIG) or otherwise prohibit or restrict gifts or payments that may be made to healthcare providers and other potential referral sources; state and local laws that require the licensure of sales representatives; state laws that require drug manufacturers to report information related to drug pricing or payments and other transfers of value to healthcare providers or marketing expenditures and pricing information; and state laws related to insurance fraud in the case of claims involving private insurers.
These and similar laws may be subject to amendment or reinterpretation, and implementing regulations may be revised or reinterpreted, in ways that may significantly affect our business. State and federal authorities have aggressively targeted pharmaceutical companies for alleged violations of these fraud and abuse laws based on improper research or consulting contracts with doctors, certain marketing arrangements that rely on volume-based pricing, off-label marketing schemes, and other improper promotional practices.
Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs. It is possible that governmental authorities will conclude that our business practices do not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations are found to be in violation of any of the health regulatory laws described above or any other laws or regulations that apply to us, we may be subject to significant penalties, including criminal, civil and administrative penalties, damages, fines, disgorgement, individual imprisonment, exclusion from participation in government healthcare programs, debarment from contracting with the U.S. government, injunctions and private qui tam actions brought by individual whistleblowers in the name of the government. Companies targeted in such actions have, among other consequences, paid substantial fines in the hundreds of millions of dollars or more, have been forced to implement extensive corrective action plans, and have often become subject to consent decrees or corporate integrity agreements that severely restrict the manner in which they conduct their business, including the requirement of additional reporting and oversight obligations. Due to the breadth of these laws, the narrowness of statutory exceptions and regulatory safe harbors available, and the range of interpretations to which they are subject, it is possible that some of our current or future practices might be challenged under one or more of these laws. Responding to investigations, enforcement actions and litigation can be time-and resource-consuming and can divert management's attention from the business. Any such investigation, action, litigation or settlement could increase our costs or otherwise have an adverse effect on our business and reputation. Even an unsuccessful challenge or investigation into our practices could cause adverse publicity and be costly to respond to. In addition, the approval and commercialization of any of our product candidates outside the U.S. will also likely subject us to non-U.S. equivalents of the healthcare laws mentioned above, among other non-U.S. laws.