In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, make accessible, protect, secure, dispose of, transmit, and share (collectively, processing) personal data and other sensitive information, including proprietary and confidential business data, trade secrets, intellectual property, data we collect about trial participants in connection with clinical trials, and sensitive third-party data.
Our data processing activities may subject us to numerous data privacy and security obligations established in various laws, regulations, guidance, industry standards, external and internal privacy and security policies, contractual requirements, and other obligations relating to data privacy and security, that affect our sales, marketing and other promotional activities by, among other things, limiting the kinds of financial arrangements we may have with hospitals, healthcare providers or other potential purchasers of our products. These laws are often broadly written, and it is often difficult to determine precisely how these laws will be applied to specific circumstances. For example, within the EU, the control of unlawful marketing activities is largely a matter of national law and regulations in each of the EU Member States. There are a variety of organizations and entities within EU Member States which monitor perceived unlawful marketing activities. We could face civil, criminal and administrative sanctions if it is determined that we have breached our obligations in any EU Member State in respect of our marketing activities. Industry associations also closely monitor the activities of member companies. If these organizations or authorities name us as having breached our obligations under their regulations, rules or standards, our reputation would suffer and our business and financial condition could be adversely affected.
In addition, there are numerous U.S. federal, state and local healthcare regulatory laws, and similar foreign laws, including but not limited to, anti-kickback laws, false claims laws, antitrust, privacy laws, and transparency laws. Our relationships with healthcare providers and entities, including but not limited to, hospitals, blood centers, physicians, other healthcare providers, and our customers are subject to scrutiny under these laws. Violations of these laws can subject us to significant penalties, including, but not limited to, administrative, civil and criminal penalties, damages, fines, disgorgement, imprisonment, exclusion from participation in federal and state healthcare programs, including the Medicare and Medicaid programs, or equivalent foreign programs, additional reporting requirements and/or oversight if we become subject to a corporate integrity agreement or similar agreement to resolve allegations of non-compliance with these laws, and the curtailment of our operations. The laws that may affect our ability to operate include, but are not limited to:
•the federal Anti-Kickback Statute, which prohibits, among other things, persons and entities from knowingly and willfully offering, paying, soliciting, or receiving any remuneration, directly or indirectly, overtly or covertly, in cash or in kind, in exchange for or to induce, the referral of an individual for, the purchase, lease, order or recommendation of, any good, facility, item or service for which payment may be made, in whole or in part, under federal healthcare programs such as Medicare and Medicaid;
•federal false claims laws, including the civil False Claims Act, which can be enforced by private citizens on behalf of the government, through civil whistleblower or qui tam actions, and the federal civil monetary penalties law, that prohibit, among other things, knowingly presenting, or causing to be presented, claims for payment or approval from Medicare, Medicaid or other federal payors that are false or fraudulent, or knowingly making a false statement to improperly avoid, decrease or conceal an obligation to pay money to the federal government, and which may apply to entities that provide coding and billing advice to customer;
•the federal Health Insurance Portability and Accountability Act of 1996, as amended, or HIPAA, which created federal criminal laws that prohibit, among other things, executing a scheme to defraud any healthcare benefit program, including private payors, or making materially false statements in connection with the delivery of, or payment for, healthcare benefits, items or services relating to healthcare matters;
•HIPAA, as amended by the Health Information Technology for Economic and Clinical Health Act of 2009, or HITECH, and their respective implementing regulations, which impose requirements on covered entities, including certain healthcare providers, health plans and healthcare clearinghouses as well as their business associates and their subcontractors that create, receive, maintain or transmit individually identifiable health information for or on behalf of a covered entity, relating to the privacy, security and transmission of individually identifiable health information, including mandatory contractual terms as well as directly applicable privacy and security standards and requirements;
•the Federal Trade Commission Act and similar laws regulating advertisement and consumer protections; and
•foreign, or U.S. state or local law equivalents of each of the above federal laws, such as anti-kickback and false claims laws which may apply to items or services reimbursed by any third-party payor, including commercial insurers; laws that require device and biologics companies to comply with the industry’s voluntary compliance guidelines and the relevant compliance guidance promulgated by the government or otherwise restrict payments that may be made to healthcare providers; laws that require device and biologics manufacturers and distributors to report information related to payments and other transfers of value to physicians and other healthcare providers or marketing expenditures; and laws governing the privacy and security of certain health information, many of which differ from each other in significant ways and often are not preempted by HIPAA, thus complicating compliance efforts.