Regulation of pharmaceutical products and medical devices

Monitoring powers

What powers do the authorities have to monitor compliance with the rules on drugs and devices?

Federal authorities have authority to approve, authorise or clear drugs and devices for use, and they also have extensive monitoring powers over drugs and devices. Drug-related monitoring covers new drugs, generic drugs, biologics and bio-equivalents. Once a drug is approved, the US Food and Drug Administration (FDA) monitors the manufacturing process to ensure that the drug is produced in compliance with established federal criteria (known as Good Manufacturing Practices). Manufacturers and regulated facilities are subject to site inspections to determine compliance with applicable federal laws and regulations. Federal authorities also have the power to issue warning letters, which provide notice of an alleged violation of federal regulations, and to request documents or records from a regulated entity. Relatedly, drug and device manufacturers are required to maintain various types of records and must file annual reports with the FDA about their regulated drug or medical device.

In addition, drug and device companies must report certain ‘adverse events’ associated with a drug or medical device. The FDA also monitors and enforces compliance with strict requirements for the labelling and promotion of drugs and devices. The FDA and US Department of Justice (DOJ) also have authority to enforce laws regarding commercial marketing of unapproved drugs and devices, as well as promotion of drugs and devices that is not consistent with the FDA-approved label for the drug or device.

Investigation time frames

How long do investigations typically take from initiation to completion? How are investigations started?

Criminal and civil federal investigations, including those conducted by DOJ through any of its Criminal, Civil or Antitrust Divisions, or by the Federal Trade Commission may last several years. In contrast, FDA regulatory investigations regarding product labelling and promotion may be initiated and concluded within a one-year time period, and often more quickly if the investigation involves simple and uncontested issues.

Investigations may commence in a number of ways. First, federal agencies, such as the US Department for Health and Human Services or DOJ, may initiate investigations. DOJ’s Civil Division has increasingly used sophisticated data-driven analyses to investigate healthcare fraud. Second, external triggers – such as a news story or public event – may trigger an investigation. Third, private persons (referred to as relators or whistle-blowers) may precipitate a federal investigation by invoking the qui tam provisions of the federal False Claims Act (31 USC section 3729, et seq) and filing a civil complaint in federal district court on behalf of the United States.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

During an investigation, and before criminal charges or a civil complaint is filed, the subject of an investigation has no right to access government investigation files. Once criminal or civil proceedings commence, the targeted company or person typically has extensive rights to obtain documents, depose persons under oath (in a civil proceeding), and obtain certain statements made to the government (in a criminal proceeding). Those rights are determined by the type of proceeding (ie, criminal, civil or administrative) and the rules applicable to that proceeding.

Investigations abroad

If pharmaceutical products or medical devices are made in a foreign country, may the authorities conduct investigations of the manufacturing processes in that other country?

Yes. The FDA has authority over any manufacturer of any active ingredient in a product regulated by the FDA, so long as that product is sold or distributed within the United States (satisfying jurisdictional requirements).

Enforcement proceedings

Through what proceedings do agencies enforce the rules?

Agencies’ rules may be enforced through (1) state or federal court proceedings or (2) administrative agency proceedings. Enforcement proceedings in court may be either criminal or civil. For example, DOJ has exclusive authority to bring criminal charges in federal court.

With respect to administrative agency proceedings, various sub-agencies within the US Department of Health and Human Services, such as the FDA and the Centers for Medicare & Medicaid Services (CMS), have authority to bring civil administrative enforcement and adjudication proceedings. For example, CMS has the power to enforce compliance with enrolment and other requirements relating to the Medicare programme (health insurance for elderly persons) and other agency programmes.


What sanctions and other measures can the authorities impose or seek in enforcement actions against drug and device manufacturers and their distributors?

Available sanctions for a violation of federal law depend in part on the nature of the enforcement proceedings. In criminal cases, sanctions include criminal fines, penalties, restitution and product seizures. In civil cases, damages involve monetary recovery, and parties can also obtain injunctions, which generally prevent certain conduct. Civil damages in the United States can be massive. For example, under the federal False Claims Act (31 USC section 3729, et seq) (FCA), the government can recover treble damages – ie, three times the amount of the government’s actual loss – in addition to mandatory statutory penalties. Private citizens (called whistle-blowers or relators) who file FCA claims on behalf of the United States may collect between 15 and 30 per cent of any recovery, plus attorneys’ fees.

Agency enforcement proceedings introduce a number of other potential sanctions as well. For example, the Office of Inspector General for the US Department of Health and Human Services has mandatory and permissive (discretionary) authority to exclude individuals and entities from participating in all federal healthcare programmes, based on certain statutorily defined offences. Similarly, the FDA has mandatory and permissive authority to debar or prohibit a corporation or an individual from participating in FDA-regulated activities. Exclusion and debarment effectively amount to a total ban on operating in the healthcare industry.

Actions against employees

Can the authorities pursue actions against employees as well as the company itself?

Yes. Individuals, like companies, are subject to criminal, civil and administrative investigations and proceedings. Individuals are also subject to criminal sentences, financial liability and administrative sanctions, such as exclusion (a bar) from selling products, providing services or treating patients if the conduct involves payments from federal healthcare programmes, such as Medicare.

Defences and appeals

What defences and appeals are available to drug and device company defendants in an enforcement action?

Any defendant in an enforcement action may avail itself of legal, factual, and constitutional defences, as appropriate based on the nature of the specific case. Legal defences include arguments that the alleged conduct did not violate the statute or regulation at issue, as well as procedural defences relating to jurisdiction and notice. Factual defences may include that the allegations are not accurate or did not occur, the defendant did not have the requisite state of mind to violate the legal requirement or that no payment was sought or obtained for the item or service at issue. Finally, all defendants have certain constitutional defences, including the right to due process.

Minimising exposure

What strategies should companies adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

The hallmark of mitigating exposure to enforcement actions is an effective corporate compliance programme. Compliance programmes should be tailored to the company and the relevant industry, but some features are nearly universal, including:

  • the designation of a compliance officer responsible for implementing and overseeing the compliance programme;
  • written policies and procedures documenting appropriate standards of conduct and identifying prohibited conduct;
  • periodic training sessions and audits of employees and departments that are subject to the compliance programme; and
  • standards for investigating and disciplining violations of the compliance programme or other misconduct.


Once an enforcement action is underway, the company should review its compliance programme, policies and procedures to ensure effectiveness, preserve all records and internally investigate the facts relevant to the alleged conduct. DOJ has policies in place that reward effective compliance programmes, and both DOJ and the Office of Inspector General for the US Department of Health and Human Services publish guidance regarding how to build and maintain one.

Recent enforcement activities

What have the authorities focused on in their recent drugs and devices enforcement activity and what sanctions have been imposed?

The federal False Claims Act (31 USC section 3729, et seq) is a major enforcement tool used by DOJ in the healthcare industry. In fiscal year 2020, DOJ recovered a total of $1.8 billion under the FCA in healthcare-related settlements and judgments. The largest of those recoveries came from the pharmaceutical industry. Recent DOJ enforcement actions involving pharmaceutical and medical device companies have focused on kickbacks allegedly paid by drug companies to physicians and opioid-related fraud schemes.

In July 2020, Novartis Pharmaceuticals Corporation entered into two civil FCA settlements totalling $642 million. The first settlement resolved allegations that the company provided illegal kickbacks by using three charitable foundations as vehicles to fund Medicare co-payments for patients taking its drugs. The second settlement resolved charges that the company paid kickbacks to physicians through its physician-speaker programmes to induce those physicians to prescribe the company’s drugs.

Also in July 2020, Indivior, an opioid marketing company, pleaded guilty to making false statements about the safety of Suboxone Film (an opioid-addiction treatment drug) and the risks of ‘accidental’ paediatric exposure. The company pleaded guilty to a criminal false statement charge and paid $600 million to resolve criminal and civil charges. Notably, two of the company’s executives also pleaded guilty to criminal charges, one of whom was the former Chief Executive Officer and was sentenced to six months in prison under the ‘responsible corporate officer’ doctrine.

In October 2020 (part of fiscal year 2021), DOJ announced an $8.34 billion settlement and global resolution of criminal and civil investigations into Purdue Pharma and its shareholders, the Sackler family. The resolution included $3.54 billion in criminal penalties, $2 billion in forfeiture, a $2.8 billion civil settlement with Purdue and a separate civil settlement with the Sackler family, who agreed to pay $225 million to resolve their civil FCA liability. These are the largest penalties DOJ has ever recovered from a pharmaceutical manufacturer.

Self-governing bodies

Are there self-governing bodies for the companies that sell pharmaceutical products and medical devices? How do those organisations police members’ conduct?

Generally, no self-governing bodies have the authority to enforce regulatory requirements against pharmaceutical and medical device companies. Rather, enforcement is conducted by federal and state authorities. That said, some industry groups and trade associations publish voluntary standards of conduct (eg, the AdvaMed Code of Ethics for medical device companies and the PhRMA Code of Interactions with Health Care Professionals for drug manufacturers), but they do not enforce or police the conduct of their members.

Law stated date

Correct on

Give the date on which the information above is accurate.

14 August 2020.