state. To that end, the marketing authorization holder must provide the EMA or the competent authority with a consolidated version of the file in respect of quality, safety and efficacy, including all variations introduced since the marketing authorization was granted, at least six months before the marketing authorization ceases to be valid. Once renewed, the marketing authorization is valid for an unlimited period, unless the European Commission or the competent authority decides on justified grounds relating to pharmacovigilance to proceed with one additional five-year renewal period.
Other healthcare laws and compliance requirements
In the United States, our activities are potentially subject to regulation by various federal, state and local authorities in addition to the FDA, including but not limited to, the Centers for Medicare & Medicaid Services, or CMS, other divisions of the U.S. Department of Health and Human Services (such as the Office of Inspector General and the Health Resources and Service Administration), the Department of Justice, or the DOJ, and individual U.S. Attorney offices within the DOJ, and state and local governments. For example, research, sales, marketing activities and scientific/educational grant programs must comply with the anti-fraud and abuse provisions of the Social Security Act, the False Claims Act, transparency laws, the health information privacy and security laws, similar state laws, and regulations, each as amended, as applicable.
The federal Anti-Kickback Statute prohibits, among other things, any person or entity, from knowingly and willfully offering, paying, soliciting or receiving any remuneration, directly or indirectly, overtly or covertly, in cash or in kind, to induce or in return for purchasing, leasing, ordering or arranging for the purchase, lease or order of any item or service for which payment may be made, in whole or in part, under Medicare, Medicaid or other federal healthcare programs.
The federal false claims laws, including the FCA, which can be enforced by private citizens through civil qui tam actions and civil monetary penalty laws prohibit any person or entity from, among other things, knowingly presenting, or causing to be presented, a false or fraudulent claim for payment to, or approval by, federal healthcare programs, or knowingly making, using, or causing to be made or used a false record or statement material to a false or fraudulent claim to the federal government.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) created additional federal criminal statutes that prohibit, among other actions, knowingly and willfully executing, or attempting to execute, a scheme to defraud any healthcare benefit program, including private third party payors, knowingly and willfully embezzling or stealing from a healthcare benefit program, willfully obstructing a criminal investigation of a healthcare offense, and knowingly and willfully falsifying, concealing or covering up a material fact or making any materially false, fictitious or fraudulent statement in connection with the delivery of or payment for healthcare benefits, items or services. Like the U.S. federal Anti-Kickback Statute, a person or entity does not need to have actual knowledge of the statute or specific intent to violate it in order to have committed a violation.
We may be subject to data privacy and security regulations by both the federal government and the states in which we conduct our business. HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act, or HITECH, and its implementing regulations, also impose requirements relating to the privacy, security and transmission of individually identifiable health information on certain healthcare providers, healthcare clearinghouses, and health plans, known as covered entities, and independent contractors, or agents of covered entities that receive or obtain individually identifiable health information in connection with providing a service on behalf of a covered entity, known as a business associates, as well as their covered subcontractors.
In Europe, we are subject to Regulation (EU) 2016/679, the General Data Protection Regulation, or GDPR, in relation to our collection, control, processing and other use of personal data. The GDPR is directly applicable in each European Union Member State, however, it provides that European Member States may introduce further conditions, including limitations which could limit our ability to collect, use and share personal data (including health and medical information), or could cause our compliance costs to increase, ultimately having an adverse impact on our business. These changes may lead to additional compliance costs and could increase our overall risk.