The U.S. federal Physician Payments Sunshine Act requires certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with specific exceptions, to annually report to the Centers for Medicaid & Medicare Services (“CMS”) information related to payments or other transfers of value made to various healthcare professionals including physicians, certain other licensed health care practitioners, and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. Beginning on January 1, 2023, California Assembly Bill 1278 requires California physicians and surgeons to notify patients of the Open Payments database established under the federal Physician Payments Sunshine Act.
Dianthus is also subject to federal price reporting laws and federal consumer protection and unfair competition laws. Federal price reporting laws require manufacturers to calculate and report complex pricing metrics to government programs, where such reported prices may be used in the calculation of reimbursement and/ or discounts on approved products. Federal consumer protection and unfair competition laws broadly regulate marketplace activities and activities that potentially harm consumers.
Further, Dianthus is subject to additional similar U.S. state and foreign law equivalents of each of the above federal laws, which, in some cases, differ from each other in significant ways, and may not have the same effect, thus complicating compliance efforts. If Dianthus’ operations are found to be in violation of any of such laws or any other governmental regulations that apply, it may be subject to penalties, including, without limitation, civil, criminal and administrative penalties, damages, fines, exclusion from government-funded healthcare programs, such as Medicare and Medicaid or similar programs in other countries or jurisdictions, integrity oversight and reporting obligations to resolve allegations of non-compliance, disgorgement, individual imprisonment, contractual damages, reputational harm, diminished profits and the curtailment or restructuring of its operations.
Data Privacy and Security
Numerous state, federal, and foreign laws govern the collection, dissemination, use, access to, confidentiality, and security of personal information, including health-related information. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations, govern the collection, use, disclosure, and protection of health-related and other personal information could apply to Dianthus’ operations or the operations of its partners. For example, HIPAA, as amended by the Health Information Technology for Economic and Clinical Health (“HITECH”), and their respective implementing regulations imposes privacy, security, and breach notification obligations on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as their business associates and their covered subcontractors that perform certain services that involve using, disclosing, creating, receiving, maintaining, or transmitting individually identifiable health information for or on behalf of such covered entities. Entities that are found to be in violation of HIPAA may be subject to significant civil, criminal, and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA may be subject to criminal penalties.
Even when HIPAA does not apply, according to the Federal Trade Commission, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.
In addition, state laws govern the privacy and security of personal information, including health-related information, in certain circumstances. Failure to comply with these laws, where applicable, can result in the imposition of significant civil and/or criminal penalties and private litigation. For example, the California Consumer Privacy Act, which went into effect on January 1, 2020, creates new data privacy obligations for covered companies and provides new privacy rights to California residents.
29