HIPAA created additional federal criminal statutes that prohibit, among other things, executing a scheme to defraud any healthcare benefit program, including private third-party payors, and making false statements relating to healthcare matters. A person or entity does not need to have actual knowledge of the healthcare fraud statute implemented under HIPAA or specific intent to violate the statute in order to have committed a violation.
The FDCA addresses, among other things, the design, production, labeling, promotion, manufacturing, and testing of drugs, biologics and medical devices, and prohibits such acts as the introduction into interstate commerce of adulterated or misbranded drugs or devices. The U.S. Public Health Service Act also prohibits the introduction into interstate commerce of unlicensed or mislabeled biological products.
The U.S. federal Physician Payments Sunshine Act requires certain manufacturers of drugs, devices, biologics and medical supplies for which payment is available under Medicare, Medicaid or the Children’s Health Insurance Program, with specific exceptions, to annually report to CMS information related to payments or other transfers of value made to physicians and teaching hospitals, as well as ownership and investment interests held by physicians and their immediate family members. Beginning in 2022, such reporting obligations will be expanded to include payments and other transfers of value provided in 2021 to certain other healthcare professionals, including physician assistants, nurse practitioners, clinical nurse specialists, certified nurse anesthetists, and certified nurse-midwives.
We are also subject to additional similar U.S. state and foreign law equivalents of each of the above federal laws, which, in some cases, differ from each other in significant ways, and may not have the same effect, thus complicating compliance efforts. If our operations are found to be in violation of any of such laws or any other governmental regulations that apply, we may be subject to penalties, including, without limitation, civil, criminal and administrative penalties, damages, fines, exclusion from government-funded healthcare programs, such as Medicare and Medicaid or similar programs in other countries or jurisdictions, integrity oversight and reporting obligations to resolve allegations of non-compliance, disgorgement, individual imprisonment, contractual damages, reputational harm, diminished profits and the curtailment or restructuring of our operations.
Data Privacy and Security
Numerous state, federal and foreign laws, govern the collection, dissemination, use, access to, confidentiality and security of personal information, including health-related information. In the United States, numerous federal and state laws and regulations, including state data breach notification laws, state health information privacy laws, and federal and state consumer protection laws and regulations, govern the collection, use, disclosure, and protection of health-related and other personal information could apply to our operations or the operations of our partners. For example, HIPAA, as amended by HITECH, and their respective implementing regulations, imposes privacy, security and breach notification obligations on certain health care providers, health plans, and health care clearinghouses, known as covered entities, as well as their business associates that perform certain services that involve creating, receiving, maintaining or transmitting individually identifiable health information for or on behalf of such covered entities. Entities that are found to be in violation of HIPAA may be subject to significant civil, criminal and administrative fines and penalties and/or additional reporting and oversight obligations if required to enter into a resolution agreement and corrective action plan with HHS to settle allegations of HIPAA non-compliance. Further, entities that knowingly obtain, use, or disclose individually identifiable health information maintained by a HIPAA covered entity in a manner that is not authorized or permitted by HIPAA may be subject to criminal penalties.
Even when HIPAA does not apply, according to the FTC, violating consumers’ privacy rights or failing to take appropriate steps to keep consumers’ personal information secure may constitute unfair acts or practices in or affecting commerce in violation of Section 5(a) of the Federal Trade Commission Act.
In addition, certain state and non-U.S. laws, such as the GDPR govern the privacy and security of personal information, including health-related information, in certain circumstances. Failure to comply with these laws,
91