on a cumulative review of all of its facts and circumstances. Our practices, including our arrangements with physicians, may not in all cases meet all of the criteria for protection under a statutory exception or regulatory safe harbor.
The federal false claims and civil monetary penalty laws, including the FCA, which can be enforced by private citizens through civil qui tam actions, prohibit any person or entity from, among other things, knowingly presenting, or causing to be presented, a false or fraudulent claim for payment to, or approval by, the federal healthcare programs, including Medicare and Medicaid, or knowingly making, using, or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government. A claim includes “any request or demand” for money or property presented to the U.S. government. For instance, historically, pharmaceutical and other healthcare companies have been, and continue to be, prosecuted under these laws for allegedly providing free product to customers with the expectation that the customers would bill federal programs for the product. A violation of the Anti-Kickback Statute makes any claim submitted as a result of the violation of the Anti-Kickback Statute, a false claim under the FCA. Other companies have been prosecuted for causing false claims to be submitted because of the companies’ marketing of the product for unapproved, off-label, and thus generally non-reimbursable, uses.
HIPAA created additional federal criminal statutes that prohibit, among other things, knowingly and willfully executing, or attempting to execute, a scheme to defraud or to obtain, by means of false or fraudulent pretenses, representations or promises, any money or property owned by, or under the control or custody of, any healthcare benefit program, including private third-party payors, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up by trick, scheme or device, a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Like the federal Anti-Kickback Statute, under HIPAA such that a person or entity no longer needs to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation.
Also, many states have similar, and typically more prohibitive, fraud and abuse statutes or regulations that apply to items and services reimbursed under Medicaid and other state programs, or, in several states, apply regardless of the payor. Additionally, to the extent that our product is sold in a foreign country, we may be subject to similar foreign laws.
We may be subject to data privacy and security regulations by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and their implementing regulations, impose requirements relating to the privacy, security and transmission of individually identifiable health information on certain healthcare providers, healthcare clearinghouses, and health plans, known as covered entities, as well as independent contractors, or agents of covered entities that create, receive or obtain individually identifiable health information in connection with providing a service on behalf of a covered entity, known as a business associates. Among other things, HITECH makes HIPAA’s privacy and security standards directly applicable to business associates. HITECH also created four new tiers of civil monetary penalties, amended HIPAA to make civil and criminal penalties directly applicable to business associates, and gave state attorneys general new authority to file civil actions for damages or injunctions in federal courts to enforce HIPAA and seek attorneys’ fees and costs associated with pursuing federal civil actions. In addition, many state laws govern the privacy and security of health information in specified circumstances, many of which differ from each other in significant ways, are often not pre-empted by HIPAA, and may have a more prohibitive effect than HIPAA, thus complicating compliance efforts.
Additionally, the federal Physician Payments Sunshine Act, or the Sunshine Act, within the ACA, and its implementing regulations, require that certain manufacturers of drugs, devices, biological and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program (with certain exceptions) report annually to CMS information related to certain payments or other transfers of value made or distributed to physicians, as broadly defined by such law, and teaching hospitals, or to entities or individuals at the request of, or designated on behalf of, the physicians and teaching hospitals, and to report annually certain ownership and investment interests held by physicians and their immediate family members. Beginning in 2022, applicable manufacturers also will be required to report such information regarding payments and transfers of value provided, as well as ownership and investment interests held, during the previous year to certain other healthcare professionals, including physician assistants and nurse practitioners. In addition, many states also govern the reporting of payments or