•injunctions or the imposition of civil or criminal penalties; or
•litigation involving patients using our products.
Non-compliance with European Union requirements regarding safety monitoring or pharmacovigilance, and with requirements related to the development of products for the pediatric population, can also result in significant financial penalties. Similarly, failure to comply with the European Union’s or United Kingdom’s requirements regarding the protection of personal information can also lead to significant penalties and sanctions.
In addition, manufacturers of approved products and those manufacturers’ facilities are required to comply with extensive FDA requirements, including ensuring that quality control and manufacturing procedures conform to cGMPs applicable to drug manufacturers. Additionally, under FDORA, sponsors of approved drugs and biologics must provide six months’ notice to the FDA of any changes in marketing status, such as the withdrawal of a drug, and failure to do so could result in the FDA placing the product on a list of discontinued products, which would revoke the product’s ability to be marketed. We will also be subject to other regulatory requirements, including submissions of safety and other post-marketing information and reports, registration and listing requirements, requirements regarding the distribution of samples to clinicians, and recordkeeping.
Our relationships with healthcare providers, physicians and third-party payors will be subject to applicable anti-kickback, fraud and abuse, false claims, transparency, health information privacy and security, and other healthcare laws and regulations, which, in the event of a violation, could expose us to criminal sanctions, civil penalties, contractual damages, reputational harm, administrative burdens and diminished profits and future earnings.
If we obtain regulatory approval and commercialize any products, healthcare providers, physicians and third-party payors will play a primary role in the recommendation and prescription of any product candidates for which we obtain marketing approval. Our future arrangements with healthcare providers, physicians and third-party payors may expose us to broadly applicable fraud and abuse and other healthcare laws and regulations that may constrain the business or financial arrangements and relationships through which we market, sell and distribute any products for which we obtain marketing approval. In addition, we may be subject to transparency laws and patient privacy regulation by U.S. federal and state governments and by governments in foreign jurisdictions in which we conduct our business. See Item 1 “Business—Government Regulation and Product Approvals—Health Care Law and Regulation” in the 2024 Annual Report.
The distribution of pharmaceutical products is subject to additional requirements and regulations, including extensive record-keeping, licensing, storage and security requirements intended to prevent the unauthorized sale of pharmaceutical products.
The scope and enforcement of each of these laws is uncertain and subject to rapid change in the current environment of healthcare reform, especially in light of the lack of applicable precedent and regulations. Efforts to ensure that our business arrangements with third parties will comply with applicable healthcare laws and regulations will involve substantial costs. It is possible that governmental authorities will conclude that our business practices may not comply with current or future statutes, regulations or case law involving applicable fraud and abuse or other healthcare laws and regulations. If our operations, including anticipated activities that would be conducted by our sales team, are found to be in violation of any of these laws or any other governmental regulations that may apply to us, we may be subject to significant civil, criminal and administrative penalties, damages, fines, imprisonment, exclusion of products from government funded healthcare programs, such as Medicare and Medicaid, and the curtailment or restructuring of our operations. If any of the physicians or other healthcare providers or entities with whom we expect to do business is found to be not in compliance with applicable laws, they may be subject to criminal, civil or administrative sanctions, including exclusions from participation in government funded healthcare programs.
Compliance with global privacy and data security requirements could result in additional costs and liabilities to us or inhibit our ability to collect and process data globally, and the failure to comply with such requirements could subject us to significant fines and penalties, which may have a material adverse effect on our business, financial condition or results of operations.
The legislative and regulatory framework for the collection, use, safeguarding, sharing, transfer and other processing of information worldwide is rapidly evolving and is likely to remain uncertain for the foreseeable future. Globally, virtually every jurisdiction in which we operate has established its own data security and privacy frameworks with which we must comply. For example, the collection, use, disclosure, transfer, or other processing of personal data regarding individuals in the European Economic Area, or EEA, including personal health data, is subject to the European Union’s General Data Protection Regulation, or EU GDPR. Following the withdrawal of the United Kingdom from the European Union, or Brexit, the EU GDPR has been incorporated into United Kingdom’s laws, or UK GDPR, alongside the UK Data Protection Act 2018, and together with the EU GDPR, is referred to as GDPR.
Despite Brexit, the EU and UK GDPR remain largely aligned. Currently, the most impactful point of divergence relates to transfer mechanisms (i.e., the ability for companies in the European Union or the United Kingdom to transfer personal information to third countries, including the United States), because it requires us to implement a variety of different contractual clauses approved by