Additionally, the federal Physician Payment Sunshine Act created under Section 6002 of the ACA and its implementing regulations, require that manufacturers of prescription drugs for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with certain exceptions, report annually to the CMS information related to certain payments or other “transfers of value” made or distributed to or at the request of covered recipients, namely US-licensed physicians (defined to include doctors of medicine or osteopathy, dentists, optometrists, podiatrists and chiropractors), physician assistants, nurse practitioners, clinical nurse specialists, and certified registered nurse anesthetists and anesthesiologist assistants, and certified nurse-midwives and US teaching hospitals, as well as ownership and investment interests in an applicable drug manufacturer held by physicians and their immediate family. Payments made to physicians, other principal investigators, and certain research institutions for research, including clinical trials, are included within the ambit of this law. Disclosure of such information is made on a publicly available website. Failure to submit required information may result in civil monetary penalties, with increased penalties for “knowing failures,” for each payment, transfer of value or ownership or investment interest not timely and accurately reported in an annual submission.
There are also an increasing number of analogous state laws and laws in local jurisdictions that regulate price increases, require manufacturers to file reports with states on pricing and price increases, prohibit, restrict and/or require tracking and reporting of gifts, compensation, other remuneration and items of value provided to healthcare professionals and healthcare entities, and require registration of and impose training requirements on sales representatives. Many of these laws contain ambiguities as to what is required in order to comply with such laws. The laws in some states also require pharmaceutical companies to establish and implement compliance programs that are consistent with voluntary industry guidelines and guidance published by the HHS-OIG. Certain state laws also regulate manufacturers’ use of prescriber-identifiable data. These laws may affect our future sales, marketing and other promotional activities by imposing restrictions on those activities as well as administrative and compliance burdens. In addition, given the lack of clarity with respect to these laws and their implementation, our reporting actions could be subject to the penalty provisions of the pertinent state and federal authorities.
If our operations are found to be in violation of any of the laws or regulations described above or any other laws that apply to us, we may be subject to a variety of penalties, depending upon the law found to have been violated, potentially including criminal and significant civil monetary penalties, damages, fines, imprisonment, exclusion from participation in government healthcare programs, corporate integrity agreements, non-prosecution agreements, refusal of government contracts, debarment from federal government procurement and non-procurement programs, and the curtailment or restructuring of our operations, any of which could adversely affect our ability to operate our business and our results of operations. To the extent that any of our products are sold in a foreign country, we may be subject to similar foreign laws and regulations, which may include, for instance, applicable post-marketing requirements, including safety surveillance, anti-fraud and abuse laws, and implementation of corporate compliance programs and reporting of payments or transfers of value to healthcare professionals.
Notification Obligations and Potential Liability Around Data Security Incidents, Including Cyberattacks
If personal or other sensitive information about patients or employees is disclosed in an unauthorized manner, or if we or our service providers are subject to real or perceived cyberattacks, ransomware, data breaches, or other security incidents or compromises, or disruption of information technology systems or software, our customers may curtail use of our platform, we may be exposed to liability, our reputation may suffer and our operations may be materially harmed and disrupted.
We, and third parties acting on our behalf, receive, collect, access, generate, store, disclose, share, make accessible, protect, secure, transmit, transfer, dispose of, use, store and otherwise process (collectively, “Process” or “Processing”) personal, confidential and proprietary information. The information technology networks and systems owned, operated, controlled or used by us or our service providers to Process information, including personal and other sensitive information, and to perform other business operations may be vulnerable to damage, disruptions or shutdowns, software or hardware vulnerabilities, data breaches, ransomware attacks, security incidents, supply-side attacks, failures during the process of upgrading or replacing software, databases or components, power outages, natural disasters, hardware failures, attacks by computer hackers, telecommunication failures, user errors, user malfeasance, computer viruses, unauthorized access, phishing or social engineering attacks, ransomware attacks, denial-of-service attacks and other real