Use the Lexology Getting the Deal Through tool to compare the answers in this article with those from other jurisdictions.


Healthcare funding

In general terms, how is healthcare, including access to medicines and medical devices, funded in your jurisdiction? Outline the roles of the public and private sectors.

Healthcare in the United States is funded from a variety of sources. A US citizen can purchase healthcare through a health insurance programme obtained through an employer (and many employers subsidise that cost, at least in part). For elderly individuals (defined as over the age of 65), people with disabilities or suffering from end-stage renal disease (regardless of age), the federal government administers Medicare, a national health insurance programme funded by taxpayers. Low-income mothers and children, as well as individuals with disabilities, receive healthcare through Medicaid, a joint federal and state healthcare programme. Finally, military personnel, their dependants and veterans are also provided healthcare by the federal government. In 2016, 55.7 per cent of Americans received employer-based healthcare, 19.4 per cent were on Medicaid, 16.7 per cent were on Medicare, 16.2 per cent purchased coverage directly, and 4.6 per cent received military coverage.

The Medicare programme has four Parts:

  • Part A governs hospital insurance benefits for the aged and disabled, including payments for hospital care, skilled nursing facility care and home healthcare;
  • Part B provides for supplemental medical insurance for medical and other health services, including physician services, outpatient hospital services, diagnostic services, laboratory services, durable medical equipment, ambulance services and outpatient physical therapy;
  • Part C provides for Part A and B coverage through a managed care programme (ie, managed care organisations (MCOs) or health maintenance organisations (HMOs)); and
  • Part D provides for payment for certain non-injectable drugs and biologics that patients take in an outpatient setting through prescription plans.

The federal government funds Medicare through the Medicare Trust fund, which consists of:

  • the hospital insurance trust fund, which is funded by payroll taxes and premiums paid by some beneficiaries for Part A coverage; and
  • the supplemental Medical Insurance trust fund, which is funded by authorisations from the US Congress and premiums and co-payments paid by Medicare beneficiaries.

In 2017, Medicare covered 59.1 million beneficiaries at the cost of US$702 billion.

The US federal government also funds healthcare for members of the US military and dependants through the Tricare programme, and for veterans of the US military through the Department of Veterans Affairs (VA).

The Centers for Medicare and Medicaid Services (CMS) are responsible for the payment mechanisms established for paying for care under the four Parts of the Medicare programme.

Part A payments are made through a prospective payment system. For acute care inpatient settings (eg, hospitals), the CMS utilises diagnostic-related groupings (DRGs) categories to set a payment amount for each episode of care provided to a Medicare beneficiary in that type of setting. For residents in skilled nursing facilities (SNFs), the CMS employs resource utilisation groups (RUGs) to set a payment amount based on the medically necessary therapy and other care a patient requires in that type of setting. The CMS calculates DRG and RUG payment levels based on an assessment of costs typically incurred in a specific episode of care to a patient, including any drugs or devices typically used in treating a patient in that particular DRG or RUG. A hospital or SNF will only receive the DRG or RUG amount, regardless of the actual cost incurred in delivering care to that specific patient. For example, the established price for the DRG for coronary artery bypass graft surgery includes the cost of all drugs and devices normally used in that surgery, which are not separately billable to Medicare.

The CMS generally pays for Part B care on a fee-for-service basis. To receive payment for care provided through Part B, the provider must submit a bill to Medicare describing the service provided based on established codes identifying a particular procedure performed on a beneficiary. For example, the CMS established the Health Care Common Procedure Coding System, which represents items, supplies and non-physician services that may be provided to a programme beneficiary. The American Medical Association (AMA) established the Current Procedural Terminology Code, which sets forth codes for medical procedures and physician services.

The Part B fee-for-service system also covers payments for drugs delivered to patients by physicians through injections (commonly referred to as ‘J Code’ drugs) and devices delivered to patients in an outpatient setting.

Medicare Part C is an alternative to Parts A and B, and its overall insurance coverage is comparable. The CMS pays for Part C care through a managed care programme using a complex algorithm that provides a payment to the MCO or HMO based upon an assessment of the disease burden of each Medicare beneficiary. During each calendar year, each MCO must provide the CMS with information known as adjustment data, which the CMS uses to calculate the disease burden of the risk beneficiary, classify the patient by that disease burden, and determine the payment owed to the MCO for covering the patient’s health risk for that calendar year. The payments are made without regard to the actual cost of care incurred by the MCO in paying for the patient’s care. The MCO will enter into contracts with physicians, hospitals, SNFs and other providers to pay those providers for the care provided to the MCO’s Medicare beneficiaries in a calendar year from the payments it receives from the CMS. An MCO and its providers craft the agreements in order to share some of the risk of the patient’s cost of healthcare.

In Part D, enrolled programme beneficiaries have a deductible payment and a copayment. The coverage is also subject to a coverage gap, commonly referred to as ‘the donut hole’, in which the programme beneficiary is responsible for all costs. Each Part D plan must meet coverage criteria (eg, offer at least two drugs in each therapeutic category and class).

While there are exceptions, the CMS generally does not pay for unapproved uses of medical devices and drugs.

Each state individually operates a Medicaid programme to cover healthcare for the indigent, and the programme is jointly funded by the state’s own sources of revenue and the federal government. The criteria coverage and care provided vary by state. In April 2017, Medicaid provided healthcare to approximately 35.7 million children living in low-income households and 35.2 million low-income adults. Enrolment in Medicaid has increased by more than 17 million adults and children since 2013.


In general terms, how is healthcare delivered in your jurisdiction? Outline the roles of the public and private sectors.

Healthcare for US citizens is delivered by privately run entities and practitioners (ie, not the government), with the exception of healthcare for current and veteran members of the US military.

Key legislation

Identify the key legislation governing the delivery of healthcare and establishing the regulatory framework.

Medicare was established by the Social Security Amendments of 1965. Parts of the structure of and some of the payment mechanisms for Medicare, as well as some rules governing private insurance coverage, were changed by the Patient Protection and Affordable Care Act of 2010 (often referred to as the Affordable Care Act (ACA) or ‘Obamacare’), and the Health Care and Education Reconciliation Act of 2010. Most laws regulating the delivery of and payment for healthcare are set forth in Title 42 of the US Code, with corresponding regulations set forth in Title 42 of the US Code of Federal Regulations.

The US Congress established Medicaid in 1965 for states that elect to provide medical services to impoverished individuals. A state that wishes to establish such a programme must design a plan for coverage, and if the programme is approved by the CMS, the federal government will pay a percentage of the costs of the programme (typically around 50 per cent).

The CMS is the federal agency charged with managing Medicare and Medicaid. In managing Medicaid, the CMS requires drug companies to enter into agreements with the Secretary of the Department of Health and Human Services governing the sale of their products to Medicaid beneficiaries, which requires the drug manufacturers to sell their products to Medicaid at a price equal to or lower than the best price for any other customer. Determining the best price is a complex matter, and the US Congress and the CMS have established extensive reporting requirements for manufacturers, including reporting average manufacturer prices and best prices. There is no similar best-price requirement for medical devices.

The Federal Food, Drug and Cosmetic Act (FDCA), Title 21, US Code section 301 et seq and the corresponding regulations at Title 21 of the Code of Federal Regulations govern the distribution of drugs, biologics and medical devices.

The 21st Century Cures Act, which was passed in 2016, is intended to spur the rapid discovery, development and delivery of innovative drugs and devices, in part by accelerating or simplifying the review process for drugs and medical devices. (Although drugs and biologics are legally distinct from each other, the FDCA generally regulates them in the same manner. Accordingly, references in this chapter to drugs can also be read to include biologics.) Drugs may not be distributed for human use unless they have been approved by the Food and Drug Administration (FDA) through a new drug application (NDA) submitted by the company seeking approval to distribute the drug. In that application, the company must provide evidence that the drug is safe and efficacious for an intended use, as well as a proposed label and instructions for use.

The distribution of medical devices is controlled by amendments to the FDCA enacted in 1976, which classified devices into three classes: I, II and III. The FDA then identified certain types of devices as falling within each group:

  • Class I devices are those devices that are not life-sustaining and do not present a potential unreasonable risk of illness or injury. Class I devices, such as a tongue depressor, are subject only to minimal or general controls by the FDA and may be distributed without prior FDA approval;
  • Class II devices present greater but not life-threatening risk. Class II devices are subject to special controls and may not be distributed absent submission of a pre-market notification document (a 510(k)), in which the manufacturer must demonstrate that the device is substantially equivalent to a device already on the market. If the FDA agrees, the manufacturer receives clearance to distribute the device. An example of a Class II device is a hypodermic needle; and
  • Class III devices present the greatest risk to the patient. Companies intending to distribute Class III devices must submit to the FDA a pre-market approval application (PMA), demonstrating with evidence the safety and efficacy of the device for the intended use. Examples of Class III devices are pacemakers and kidney dialysis machines.

Once a drug or device is approved for distribution, the company may only promote it for the uses approved or cleared by the FDA. While manufacturers of approved drugs and devices are subject to this distribution limitation, physicians can choose to use a drug or device off-label - a non-approved use - on any patient, if the physician determines that such use is medically indicated and necessary for the treatment or diagnosis of a patient’s disease or condition.

The Federal False Claims Act, Title 31, US Code sections 3729 to 3733, prohibits the submission or causing the submission of false claims to any federal government programme, including Medicare and Medicaid. Nearly all 50 US states have state False Claims Acts patterned after the Federal False Claims Act.

The federal Anti-Kickback Statute (AKS), set forth at Title 42, US Code section 1320a-7b, prohibits payment of remuneration to induce the referral of an item or service paid for by a federal healthcare programme. Federal healthcare programmes include Medicare, the Medicaid programmes run by each state, Tricare and the Federal Employees Health Benefit Program, which provides health insurance for employees of the federal government.

The Stark Law, set forth at Title 42, US Code section 1395nn, prohibits compensation arrangements between physicians and referral sources. Most states have laws patterned after the federal Anti-Kickback Statute and some states have a state Stark Law counterpart.

The Health Insurance Portability and Accountability Act (HIPAA), passed in 1997, created criminal penalties, set forth at Title 42, US Code section 1320d-6 for the misuse of patient-identifying information. Regulations adopted in 2003 and codified at 45 CFR Part 160 et seq set forth a series of complex rules governing the use of patient-identifying information, including the sharing of such information between healthcare providers and their business associates.

Responsible agencies

Which agencies are principally responsible for the enforcement of laws and rules applicable to the delivery of healthcare?

There are two independent law enforcement systems that enforce laws and rules applicable to the delivery of healthcare in any location in the US: the federal law enforcement system run by the federal government and the state law enforcement systems run individually by each state government.

The federal enforcement system includes prosecution agencies and agencies devoted to investigations and audits. The Department of Justice (DoJ) is the main prosecution agency and is led by the US attorney general, who is appointed by the president and is the chief law enforcement officer for the US. In addition to the DoJ, there are 93 US attorneys, also appointed by the president, who are the chief federal law enforcement officers for geographic regions of the US. There is only one US attorney for each geographic region, and while that US attorney reports to the US attorney general, he or she has an independent law enforcement authority to enforce federal laws in that geographic region. Federal investigative agencies that are involved in the enforcement of healthcare laws and rules include the Federal Bureau of Investigation (FBI), the Office of Investigations for the Office of Inspector General for the Department of Health and Human Services, the Drug Enforcement Administration and the FDA’s Office of Criminal Investigations.

The DoJ and federal enforcement agencies investigate allegations that providers and others submitted false claims for payments to the Medicare and Medicaid programmes. Prosecutors employed by the DoJ and each of the 93 US attorneys may investigate and prosecute violations of:

  • the AKS;
  • the Stark Law;
  • the FDCA; and
  • any federal crime set forth in US Code Title 18 that may apply to the specific conduct at issue, which ranges from making a false statement to the CMS on a claim form seeking payment in violation of 18 US Code section 1,001 (making a false statement to a federal agency on a matter within its jurisdiction) to knowingly executing a scheme to defraud a healthcare programme by distributing unapproved drugs or devices, in violation of 18 US Code section 1347 (healthcare fraud).

Federal prosecutors may pursue civil False Claims Act violations simultaneously with federal criminal prosecutions and investigations. A claim may be false for many reasons, and there have been federal civil and criminal investigations and prosecutions in the US for the following conduct concerning drugs and devices over the past decade:

  • claims submitted for a drug or device that was not medically necessary for the treatment of the patient’s disease or condition;
  • claims submitted for a drug or device when a different drug or device was actually used;
  • claims submitted for a drug or device following a payment to the healthcare professional who made the medical judgement to use the drug or device by the manufacturer of the drug or device to induce its use;
  • claims submitted for a drug or device that were placed by a hospital, MCO or pharmaceutical benefits manager on a formulary because the manufacturer of the drug or device made a payment to that entity to secure formulary placement;
  • claims submitted for a drug or device that was promoted for an off-label use;
  • distribution of a drug or device that was not approved for human distribution;
  • distribution of a drug or device for use outside the directions of use as set forth in the label;
  • distribution of a drug or device following submission of an NDA, PMA or 510(k) that contained false statements regarding the efficacy or safety of the device;
  • false best price and other price reporting for drugs sold to Medicaid beneficiaries;
  • claims submitted for drugs or devices where the cost of those drugs or devices had already been paid for through a DRG or a RUG;
  • claims submitted because a drug or device was advertised to the public for a use or indication not approved on its label; and
  • sharing patient-identifying information, such as patient lists obtained from a physician, reflecting the identity of patients prescribed a particular drug, for business marketing purposes without the permission of the patient.

For the state enforcement system, each state has an attorney general who is the chief law enforcement officer for that state. Most states have a consumer protection branch or division and a Medicaid Fraud Control Unit within the attorney general’s office that enforce violations of state statutes regarding the delivery of healthcare and the states’ payment for healthcare. Each state has enforcement agencies that can assist in these investigations, although the 50 states are not equally active in enforcement of healthcare laws and rules, with many state enforcement officers and attorneys general deferring to federal law enforcement. For example, when a federal investigation of a company involved in the distribution of a drug or device is nearing resolution through a civil settlement, a criminal plea or a global settlement involving both, one or more state enforcement agencies may seek to collect a judgment and payment based upon the same conduct, either as a part of the federal resolution or as a separate stand-alone resolution.

The federal enforcement authorities are primarily funded by two sources:

  • discretionary funding through congressional appropriation; and
  • mandatory funding to an expenditure account for the federal government’s Health Care Fraud and Abuse Control (HCFAC) programme to support its efforts to combat fraud and abuse in healthcare.

In 2016, this funding was in excess of US$900 million. In addition to any compensatory damages that are recovered and returned to the Medicare Trust funds, HIPAA also requires a deposit of an amount equalling recoveries from healthcare investigations (including criminal fines, forfeitures, civil settlements, civil judgments and administrative penalties) in those same Medicare Trust funds, a portion of which is then transferred to the expenditure account to support the HCFAC’s enforcement activities.

In addition, a portion of the funds appropriated under the HIPAA requirement are set aside for the Department of Health and Human Services’ Office of Inspector General, which investigates allegations of Medicare and Medicaid fraud, and carries out abuse prevention or enforcement activities.

Scope of enforcement

What is the scope of their enforcement and regulatory responsibilities?

The federal authorities investigate and enforce violations of federal statutes but do not have jurisdiction to investigate and enforce violations of state laws. Similarly, each state investigates and enforces violations of its own statutes and does not have the authority to enforce federal laws or the laws of any other state. Accordingly, a healthcare company engaged in business in all 50 states is subject to federal laws and enforcement authorities and the laws of each of the 50 states and each state’s enforcement authorities.

Regulation of pharmaceutical products and medical devices

Which agencies are principally responsible for the regulation of pharmaceutical products and medical devices?

The FDA is principally responsible for the approval and regulation of the distribution of drugs and medical devices. The FDA is funded by the US Congress, and funding is not dependent on enforcement activities.

Scope of enforcement

What is the scope of their enforcement and regulatory responsibilities?

The FDA has the authority to:

  • classify drugs and medical devices;
  • regulate the distribution of those drugs and devices for use by humans;
  • regulate and inspect the plants, both domestic and foreign, in which those devices and drugs are manufactured;
  • order the recall of drugs and devices that are no longer considered safe and efficacious for the intended use; and
  • otherwise enforce the provisions of the FDCA.

Other agencies

Which other agencies have jurisdiction over healthcare, pharmaceutical and medical device cases?

The Securities and Exchange Commission (SEC) has authority to oversee and regulate businesses whose stock is publicly traded (15 US Code section 78a et seq). The SEC may investigate allegations that management made false statements about a company’s product, which caused the price of the stock to go up or down, or withheld material information about a company’s product to keep the company’s stock price from tumbling.

Both federal prosecutors and the SEC may investigate drug and device companies for making payments to government officials in other countries, in violation of the US Foreign Corrupt Practices Act.

State prosecutors may pursue drug and device companies for violation of state laws for distribution of an unapproved drug or device, or for promotion of a drug or device for a use not approved by the FDA.

Simultaneous investigations

Can multiple government agencies simultaneously conduct an investigation of the same subject? Does a completed investigation bar another agency from investigating the same facts and circumstances?

Yes. A company can be investigated by different agencies at the same time for federal and state criminal and civil violations. There are principles that can operate to bar successive prosecutions by different sovereigns for the same conduct, including the DoJ’s Petite Policy (ie, there should be no federal prosecution following a successful state prosecution, without compelling federal interests). But practically, if different sovereigns (ie, the federal government and state governments involved) can show distinct and separate injuries, those principles will not act to bar successive and multiple investigations, criminal prosecutions or civil suits. In other words, if an individual’s or company’s conduct violates both federal and state law, that individual or entity may be investigated and prosecuted by both federal and state authorities separately.

Regulation of pharmaceutical products and medical devices

Monitoring powers

What powers do the authorities have to monitor compliance with the rules on drugs and devices?

In addition to securing approval to distribute a drug or device, a manufacturer must establish a quality manufacturing system and meet established ‘current good manufacturing practices’. The regulations for drugs are set forth at 21 CFR sections 210 and 211 and the regulations for devices are set forth at 21 CFR section 820. The regulations for biologics are set forth at 21 CFR sections 600 to 680.

Anyone who owns or operates an establishment engaged in the manufacture of any drug or device must register that establishment, which is subject to inspection, including surprise inspections (21 US Code section 360(b) and (j), and 21 USC section 374).

Finally, manufacturers of drugs and devices are required by law to maintain records regarding the manufacture and distribution of the drug and device and to file annual reports with the FDA, which reflect, among other things, any changes in the design or formula, or the manufacturing process, of the device or drug (21 CFR section 314.81(b)(2) for drugs).

Medical device manufacturers must also file medical device reports whenever the manufacturer becomes aware of information that suggests that its device may have caused or contributed to a death or serious injury, or is aware of a malfunction that, if it were to recur, could cause death or a serious injury (21 CFR section 803.1).

Pharmaceutical manufacturers are similarly required to file adverse-event reports when they become aware of an adverse event involving their product (21 CFR section 310.305).

Investigation time frames

How long do investigations typically take from initiation to completion? How are investigations started?

There is no typical length of time for an investigation, although investigations can last as long as five or six years. The statute of limitations is five years for most criminal matters and six years for most civil matters. Many investigations are started by whistleblowers filing a Federal False Claims Act suit or simply making an anonymous call to federal law enforcement authorities. Other investigations are commenced because of government audit results.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

Until the government files criminal charges or commences a civil suit, the subject of an investigation does not have any right to government investigation files and materials, and cannot use either the federal or state court systems to help it collect evidence for its defence in advance of such filings.

Investigations abroad

If pharmaceutical products or medical devices are made in a foreign country, may the authorities conduct investigations of the manufacturing processes in that other country?

Yes. If a company is distributing a product in the US, the FDA has the authority, and exercises that authority, to conduct investigations of any manufacturing processes located in other countries, as long as those processes are used for the manufacture of critical components of the drug or device.

Enforcement proceedings

Through what proceedings do agencies enforce the rules?

Government enforcement proceedings can be divided into two categories: criminal and civil. All enforcement proceedings, whether criminal or civil, are within the jurisdiction of the court system, not any agency.

Only the DoJ can make the decision to seek criminal charges under a federal criminal law. The DoJ also has the authority to bring a civil suit against a healthcare provider or supplier for submission of false claims to the federal government. Similarly, state attorneys general (or lower-level prosecutors called district attorneys) usually have the power to bring either criminal enforcement actions under state criminal laws or a civil action against a healthcare provider or supplier. Proceedings brought under state law are initiated solely at the behest of the state entity, and are not controlled in any way by the federal government.

The CMS has the authority to grant or revoke a licence to a provider or supplier to federal healthcare programmes. If the CMS revokes a licence, the provider or supplier may appeal that revocation to an administrative law judge. The provider, supplier or the CMS may appeal such a ruling by an administrative law judge may be appealed to federal court.

The Office of Inspector General (OIG) has the statutory authority to debar, or exclude, a provider or supplier from participation in federal healthcare programmes (42 USC section 1320a-7). There are numerous bases upon which the OIG may exclude a provider or supplier, some mandatory (ie, required by the statute) and others permissive (ie, the OIG may choose whether to exclude). The OIG also has the authority to impose civil monetary penalties (CMPs) for certain conduct. An exclusion decision and a decision to impose CMPs may be appealed to federal court.


What sanctions and other measures can the authorities impose or seek in enforcement actions against drug and device manufacturers and their distributors?

In a criminal case, the government may seek a criminal fine, as well as restitution for any losses and seizure of the instruments used in the criminal offence. If a provider is convicted of a federal healthcare programme offence, the provider will be automatically excluded for a minimum of five years.

In a civil Federal False Claims Act case, the government may seek a fine of three times the loss, plus restitution, and a penalty of between US$11,181 and US$22,363 for each false claim, in addition to restitution. Similar penalties may be sought by states for violation of a state False Claims Act.

The OIG may seek exclusion of a provider on numerous grounds. The exclusion is mandatory if the provider or supplier was convicted of a federal healthcare programme-related offence, for a crime of patient abuse, for a felony related to healthcare fraud or for a crime related to controlled substances (42 USC section 1320a-7(a)). The exclusion is permissive for 16 different categories of conduct, including:

  • a misdemeanour conviction related to healthcare fraud;
  • a non-healthcare fraud felony;
  • conviction relating to the obstruction of an audit or investigation;
  • conviction for misdemeanour offences related to controlled substances;
  • the provider having its licence to provide healthcare revoked or suspended; or
  • the provider being excluded from other federal programmes on grounds of professional competence, performance or financial integrity, or for submission of charges to Medicare or Medicaid substantially in excess of the charges made to others or of the providers costs (42 USC section 1320a-7(b)).

Additionally, the FDA has the authority to debar or disqualify individuals or companies convicted of certain violations of the FDCA. Once debarred, the person may no longer work for an FDA-regulated company, and a company may no longer submit drug applications to the FDA.

Actions against employees

Can the authorities pursue actions against employees as well as the company itself?

Yes. Employees may be prosecuted for federal and state criminal violations that they personally committed or as responsible corporate officers in the case of the FDCA. In criminal actions against employees, the government has the burden of proving beyond reasonable doubt that the employee had the criminal intent specified in the charged criminal statute. In 2015, the DoJ announced policy changes that suggest an increased focus on individual corporate accountability in corporate investigations. That policy has not yet resulted in a significant increase in criminal prosecutions of or civil suits against corporate officers or employees, but the current administration has stated its intent to continue pursuing individual accountability.

Employees also may be sued for violation of the federal and state False Claims Acts. When such civil suits are brought, the government has the burden of proving by a preponderance of the evidence that the employee caused the company to file a false claim, and that the employee knew that the claim was false when filed or was reckless as to the falsity of the claim.

Defences and appeals

What defences and appeals are available to drug and device company defendants in an enforcement action?

The available defences will vary depending on the conduct under investigation and the applicable criminal and civil statutes. Such defences can include:

  • that the service or item was provided or billed precisely as ordered by the physician, and was medically necessary and reasonable for the treatment and diagnosis of the patient;
  • that the drug or device was approved for the use for which it was promoted;
  • that the company made payments to a healthcare professional to compensate him or her for services rendered to the company (eg, the physician provided consulting services, and the payment represented a fair market value payment for those services);
  • that the government, in its interactions with the company or with other companies similarly situated, had approved or condoned the conduct in question;
  • that the rules at issue were confusing, vague or ambiguous and did not fairly put the defendant on notice that its conduct was criminal; and
  • that the defendant acted in good faith upon reliance of statements made by the government that the defendant believed approved the conduct, or in reasonable reliance upon advice of counsel.

Minimising exposure

What strategies should companies adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

Companies should establish a strong culture of legal compliance, which is best achieved by active messaging and participation by company leadership. Depending on the size of the company and the scope of its operations, the company may establish a corporate compliance department. When a company becomes aware of potentially non-compliant conduct, it should take immediate steps to determine whether any employees may have violated federal or state laws or regulations, and impose appropriate sanctions on any offending employees.

Once a company is aware of a government investigation, it should immediately take steps to understand the scope of the investigation and conduct an internal investigation to determine potential exposure. If the company discovers improper or illegal conduct by an employee during the internal investigation, the company should take steps to correct the conduct and appropriately sanction the employee without waiting for government action.

Recent enforcement activities

What have the authorities focused on in their recent drugs and devices enforcement activity and what sanctions have been imposed?

Recent enforcement actions concerning drug and device companies in 2017 and 2018 include those shown in the table below.

Self-governing bodies

Are there self-governing bodies for the companies that sell pharmaceutical products and medical devices? How do those organisations police members’ conduct?

For pharmaceutical products, Pharmaceutical Researchers and Manufacturers of America (PhRMA) represents biopharmaceutical and biotechnology companies. PhRMA has its Code on Interactions with Health Care Professionals, which provides guidance on appropriate and ethical relationships with healthcare professionals. While the Code is voluntary and PhRMA does not actively police compliance with the Code, PhRMA asks that all member companies adopt procedures designed to assure adherence to the Code and publicly identifies those members who have agreed to adhere to the Code.

For medical devices, Advamed is a trade association with more than 300 members worldwide. Its members produce approximately 90 per cent of the healthcare technology sold in the US. Advamed’s Code of Ethics governs interaction with healthcare professionals and a code certification programme in which members can certify adoption of the Advamed Code. While Advamed conducts seminars featuring good corporate governance and compliance, Advamed does not actively police its members’ conduct or adherence to its Code of Ethics.

For biologics, the Biotechnology Industry Organization (Bio) is a trade association that provides advocacy, business development and communications services for more than 1,000 members around the world.

Relationships between healthcare professionals and suppliers

Relationship rules

What are the rules prohibiting or controlling the financial relationships between healthcare professionals and suppliers of products and services?

The AKS, 42 US Code section 1320a-7b, prohibits, among other things, knowingly and wilfully offering or paying any remuneration, including any kickback, bribe or rebate, directly or indirectly, overtly or covertly, in cash or in kind, to any person, including healthcare professionals, to induce that person to purchase or order or to recommend the purchasing or ordering of any good, service or item that may be paid for in whole or in part by a federal healthcare programme. The AKS is a criminal prohibition and carries a punishment of up to five years in prison and fines of US$250,000 per violation.

The AKS has 10 statutory exceptions and 28 regulatory safe harbours, each with specific requirements, which can insulate or protect conduct from potential criminal prosecution (or from providing the basis for a Federal False Claims Act suit) if all requirements are satisfied. Those exceptions and safe harbours include:

  • certain price reductions and discounts;
  • personal services and management contracts;
  • investment interests;
  • payments to a group purchasing agent;
  • payment of bonuses to employees;
  • space and equipment rentals;
  • warranties;
  • ambulance restocking plans; and
  • electronic health records.

The Stark Self-Referral Law, 42 US Code section 1395nn, prohibits physicians from making referrals to any entity with whom that physician has a financial relationship, including ownership or investment interests or any kind of compensation arrangement, where the referred item may be paid for by Medicare or Medicaid. The Stark Law also prohibits that entity from billing for the service referred by physicians with whom it has a financial relationship. The Stark Law is a civil statute and has no criminal penalties. Like the AKS, the Stark Law has 16 statutory and 30 regulatory safe harbours covering matters similar to those listed above for the AKS.


How are the rules enforced?

The DoJ and the 93 US Attorneys enforce the AKS and the Stark Law, with assistance from the FBI and the OIG. Most investigations begin with the filing of a qui tam or whistleblower suit under the Federal False Claims Act. These suits typically allege that an individual or an entity, including a drug or device manufacturer, submitted or caused the submission of a false claim to a federal healthcare programme because that manufacturer paid a kickback to a physician, in violation of the AKS, or had a prohibited compensation arrangement with that physician, in violation of the Stark Law, or promoted the product for a use not approved by the FDA, in violation of the FDCA.

In criminal investigations, attorneys employed by the DoJ and the US Attorneys may use the following tools, among others:

  • when probable cause presents, they may seek permission from a federal court to conduct a search of a premise for evidence of a crime;
  • they may issue grand jury subpoenas to entities for the production of documents and other items, and they may use those subpoenas to require individuals to appear and testify under oath before a grand jury;
  • they may issue DoJ subpoenas (commonly called HIPAA subpoenas) to require entities and individuals to produce documents and other items;
  • they may seek permission from a court to conduct a wire interception and record electronic communications;
  • they may ask an individual to record a conversation with another person;
  • they may seek a court to issue an order of immunity to compel an individual to testify after that individual has declined to testify on the basis of their Fifth Amendment right against self-incrimination; and
  • they may ask a grand jury to return an indictment charging individuals and entities with one or more federal crimes.

If an indictment is returned by the grand jury, the individuals or entities charged will be arraigned in federal court, and individuals will be evaluated for release on bail, depending on their risk of flight and danger to the community. If the individuals or entities charged plead not guilty, they will be entitled to discovery of the evidence the government has collected and intends to use against them, and they will be entitled to any exculpatory or significant impeachment evidence in the government’s possession. They will also be entitled to have the charges tried by a jury, and in that trial the government bears the burden of proving the charges by proof that is beyond a reasonable doubt. If the individuals or entities are convicted after a trial, or if they choose to plead guilty, they will be entitled to a sentencing hearing before a federal judge, who will impose a sentence within statutory limits.

In civil investigations, attorneys employed by the DoJ and the US Attorneys have several tools, including civil investigative demands, that require individuals and entities to produce documents and other items, to answer specific questions (called interrogatories) and to appear and answer questions under oath. If the government chooses to sue, it may file suit in federal court. Any action filed in federal court is subject to the Federal Rules of Civil Procedure, which allow for reciprocal and broad discovery.

Any individuals or entities that are sued may seek discovery of the government’s evidence, take depositions of government employees and third parties and provide questions to the government seeking its responses.

If the matter is not settled, the suit may be tried in front of a jury if the government or the defendant requests a trial by jury. In such a trial, the government will have the burden of proving its allegations by a preponderance of the evidence.

Reporting requirements

What are the reporting requirements on such financial relationships? Is the reported information publicly available?

Drug manufacturers selling drugs that require a prescription to be dispensed and medical device manufacturers that sell devices that require pre-market approval by or notification to the FDA must report payments in excess of US$10 made to any physician and teaching hospital annually to the CMS. The reporting includes the amount, date and form of the payment, the name of the recipient, a description of the nature of the payment, and whether the payment was related to marketing, education or research specific to a drug or medical device. The data is reported publicly in a searchable format at the Open Payments section of the CMS’s website.

Regulation of healthcare delivery

Authority powers

What powers do the authorities have to monitor compliance with the rules on delivery of healthcare?

In addition to the FDCA, there are licensing authorities and regulatory bodies in each of the 50 states that govern the delivery of healthcare by physicians, hospitals, nursing homes, nurses, physician therapists and others. These rules are principally regulatory and provide for:

  • entry requirements that the individual or entity must satisfy in order to be a provider of healthcare (eg, education requirements to get and retain a medical licence); and
  • provision requirements specifying the manner of delivery of care (eg, minimum number of hours of certain types of physician therapy that an SNF must provide for certain types of patients).

Typically, there are few federal investigations that focus on the manner of delivery of healthcare. Most federal investigations focus on whether payments were made by a drug company or device manufacturer to induce a physician or other healthcare provider to use that company’s product, whether a provider billed for a service that was not provided or not medically necessary, and whether a drug or device company failed to follow one of the many rules governing the approval of the drug or device or its marketing and sales to healthcare professionals.

Investigation time frames

How long do investigations of healthcare providers typically take from initiation to completion? How are investigations started?

Investigations can last as long as six years and typically take at least three years from initiation to completion. Most investigations are initiated by whistleblowers.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

The subject of an investigation has no rights of access prior to the filing of criminal charges or the initiation of civil suit against that subject.

Enforcement agencies

Through what proceedings do agencies enforce the rules?

Agencies do not have the authority to enforce criminal laws; their role is exclusively investigative. Various of the agencies have the authority to pursue certain civil remedies. Thus, the FDA can seek to enforce the FDCA through consent decrees and other civil actions. The FDA also has both discretionary and mandatory debarment authority for certain violations of the FDCA. The OIG can seek to exclude an individual or entity from being a provider or supplier to federal healthcare programmes, and the OIG may seek to impose civil monetary penalties on individuals or entities. None of these agencies can file suit to seek monetary damages for false claims submitted to the government; only the DoJ or a US attorney may authorise such an action.


What sanctions and other measures can the authorities impose or seek in enforcement actions against healthcare providers?

See question 15.

Defences and appeals

What defences and appeals are available to healthcare providers in an enforcement action?

See question 17.

Minimising exposure

What strategies should healthcare providers adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

See question 18.

Recent enforcement activities

What have the authorities focused on in their recent enforcement activity and what sanctions have been imposed on healthcare providers?

Recent enforcement activity against healthcare providers in 2018 has included the prosecution of or civil suit against the following healthcare providers:

  • opioid-related prescribing conduct, such as improper or excessive prescribing of opioids;
  • physician convicted for violating HIPAA and obstructing a criminal healthcare investigation after allowing sales representatives to access protected health information in patient files and providing false information to federal agents when asked about her relationship with a pharmaceutical company;
  • physicians allegedly billing for medically unnecessary services;
  • physicians allegedly billing for services not provided;
  • home health company allegedly paying medical directors in exchange for certifying patients qualified for services they did not in fact qualify for, and allegedly fraudulently keeping patients on hospice services for multiple years to increase revenue;
  • healthcare system allegedly billing for physical therapy services provided by therapists without the requisite billing privileges and without appropriate physician supervision; and
  • laboratory companies allegedly billing for medically unnecessary tests.

It is also common for states to bring charges against providers related to the delivery of healthcare due to the fact that providers are licensed by state regulators.

Self-governing bodies

Are there self-governing bodies for healthcare providers? How do those organisations police members’ conduct?

Self-governing bodies for healthcare professionals include the AMA (for physicians), the American Nurses Association, the American Hospital Association, and the American Health Care Association (for long-term and post-acute care providers). In addition, there are similar organisations in almost all 50 states (eg, there is a Massachusetts Medical Society for physicians, the Massachusetts Senior Care Association for nursing facilities, the Massachusetts Nursing Association for nurses and the American Physical Therapy Association of Massachusetts for licensed physical therapists).

For the most part, these organisations do not police members’ conduct beyond providing or establishing broad voluntary codes of conduct.

Remedies for poor performance

What remedies for poor performance does the government typically include in its contracts with healthcare providers?

Until the ACA became law in 2010, the government typically did not include remedies for poor performance in contracts. The standard government claim form used by providers, the HCFA 1500 form, requires a provider to certify that the services provided to the patient and included on the claim form were ‘medically indicated and necessary to the health’ of the patient. In addition to this express certification, the US Supreme Court recently recognised an implied certification theory of liability where a party can be liable under the False Claims Act when submitting a claim for reimbursement for care provided to a Medicare or Medicaid beneficiary that makes specific representations about goods or services required, but knowingly fails to disclose non-compliance with a material statutory, regulatory or contractual requirement that makes the misrepresentation materially misleading with regard to the good or service provided. See Universal Health Services v US ex rel Escobar, 136 S. Ct. 1989 (2016). If a physician submits a claim to Medicare Part B for a J Code drug injected into a programme beneficiary, that claim impliedly certifies that the physician complied with all applicable federal laws, including the AKS. If the physician has, however, taken remuneration from the drug company to induce his or her prescription of that drug, he or she has violated the AKS, and the implied certification on the claim form is false. As a result, the physician may be sued under the Federal False Claims Act for submission of a false claim, and be subject to triple damages and payment of a penalty. The drug company that paid the remuneration in violation of the AKS may also be liable for having caused the physician to file the false claim.

Private enforcement

Causes of action

What private causes of action may citizens or other private bodies bring to enforce a healthcare regulation or law?

The Federal False Claims Act allows any citizen to file suit on behalf of the US alleging that another person or entity has submitted a false claim to the federal government. These suits are commonly referred to as qui tams, false claims suits or whistleblower suits. In such suits, the private citizen may allege that a claim was false because of the payment of a kickback in violation of the AKS or the existence of a prohibited compensation arrangement in violation of the Stark Law, or that the claim was false for another reason (eg, the claim sought payment for ‘drug X’ when in fact a cheaper drug was delivered to the patient). Once the suit is filed, under the statute, the government has an opportunity to determine whether to intervene in, or take over, the private suit. If the government intervenes and there is a recovery, the private citizen is entitled to 15 to 25 per cent of the recovery. If the government does not intervene, the private citizen may still pursue it, and if there is a recovery, the private citizen’s share can be as high as 30 per cent.

In addition to Federal False Claims Act suits, private insurance companies can also bring suit for violation of agreements with drug and device companies where the basis for the Federal False Claims Act litigation provides a basis for suing for breach of agreement.

Private citizens may also file suit against a provider for injuries they allegedly suffered because of the provider’s negligence or against a drug or device manufacturer because of injuries they allegedly suffered because of use of the drug or device.

Framework for claims

What is the framework for claims of clinical negligence against healthcare providers?

The standard for negligence against a healthcare provider is governed by state law in each of the 50 states and may vary from state to state. In general, the standard of care that a healthcare provider must meet is the level of care, skill and treatment that under the circumstances would be recognised as acceptable and appropriate by a reasonably prudent similar healthcare provider. Some states apply a locality rule, looking at the standard of care in the locality where the care at issue was provided. The same rules of negligence generally apply to physicians in private practice and to physicians who are employed by a public entity (eg, a VA hospital).

Negligence standards and violations of the standard of care are rarely, if ever, relevant in federal or state law enforcement proceedings.

Seeking recourse

How and on what grounds may purchasers or users of pharmaceuticals or devices seek recourse for regulatory and legal infringements?

Whistle-blowers can allege, and have alleged, that a drug or device company caused the submission of false claims to federal healthcare programmes in the following circumstances that involve regulatory issues:

  • the drug or device company made a false statement in the documents submitted to the FDA to secure permission to distribute the drug or device for human use. The purchaser or user of the drug or device may file a Federal False Claims Act case and can allege that every claim submitted for the drug or device was false because the company lied to the FDA when securing approval for the drug or device;
  • the drug or device company failed to get permission to distribute the drug or device for the use for which it marketed that drug or device. In this circumstance, which is commonly referred to as ‘off-label promotion’, the purchaser or user may file a Federal False Claims Act case and can allege that the claims submitted for payment for the drug or device were false because the company did not comply with the rules governing distribution of the drug or device; and
  • the drug company failed to report its best price to Medicaid and overcharged Medicaid for the drug. The purchaser or user, who could be a Medicaid beneficiary, would allege that the drug company made a false statement in its best-price reporting and caused the submission of false claims for that drug.


Are there any compensation schemes in place?

Not applicable.

Class and collective actions

Are class actions or other collective claims available in cases related to drugs, devices and provision of care?

Class actions are not relevant in federal or state law enforcement proceedings and are typically pursued by lawyers for plaintiffs for injuries allegedly caused by a drug or device. If a company has concealed a safety problem with a drug or a device from the FDA, that concealment or related false statements can form the basis for a federal criminal prosecution for making a false statement to the FDA and for a Federal False Claims Act for drugs and devices sold to federal healthcare programmes. Such prosecutions can trigger follow-on class action litigation.


Are acts, omissions or decisions of public and private institutions active in the healthcare sphere subject to judicial or administrative review following a complaint from interested parties?

Not applicable.


Are there any legal protections for whistleblowers?

Yes, state and federal law prohibits retaliation against whistleblowers.

Does the country have a reward mechanism for whistleblowers?

Yes. See question 34.

Are mechanisms allowing whistleblowers to report infringements required?

Companies are not required by law to have mechanisms in place to allow for reporting by whistleblowers. Nevertheless, many companies establish hotlines or other mechanisms to allow for anonymous reporting by whistleblowers, and the company’s compliance or legal department is typically responsible for setting up and policing those mechanisms. Because of the financial incentive created by the Federal False Claims Act to file suit, many whistleblowers who file suit never complain about the activity to company management prior to filing suit.

Cross-border enforcement and extraterritoriality

Cooperation with foreign counterparts

Do prosecutors and law enforcement authorities in your country cooperate with their foreign counterparts in healthcare cases?

Yes. DoJ attorneys routinely cooperate with their counterparts in foreign countries, especially regarding enforcement of the Foreign Corrupt Practices Act.

Triggering investigations

In what circumstances will enforcement activities by foreign authorities trigger an investigation in your country?

On occasion, foreign investigations may identify a pattern of payment of bribes or kickbacks to foreign physicians that can trigger an investigation by the DoJ to determine whether similar patterns of payments were made to physicians in the US. Such cross-border case pollination is very rare.

Pursuing foreign entities for infringement

In what circumstances will foreign companies and foreign nationals be pursued for infringements of your country’s healthcare laws?

Insofar as the healthcare laws described above are concerned, foreign companies and nationals will be treated just like US citizens, subject to the same rules, reporting requirements and civil and criminal remedies.




Mylan Inc and Mylan Specialty, LP

Reported EpiPen treatments as generic drugs to avoid paying required Medicaid rebates.

US$465 million

Novo Nordisk

Alleged violations of the False Claims Act based on failure to comply with FDA-mandated requirements.

US$58.65 million

Galena Biopharma Inc

Payment of kickbacks to physicians to prescribe Galena products. Improper billing practices and unlawful financial inducements to federal healthcare programme beneficiaries in violation of the False Claims Act and AKS.

US$7.5 million

Aegerion Pharmaceuticals Inc

Criminal and civil settlement for payments to physicians to prescribe an Aegerion product; HIPAA violations; failure to comply with risk evaluation and mitigation strategy/strategies requirements and promotional violations.

US$36 million

United Therapeutics Corporation

United Therapeutic used a foundation, which claims 501(c)(3) status for tax purposes, as a conduit to pay the co-pay allegations of thousands of Medicare patients taking United Therapeutic’s drugs, in violation of the False Claims Act.

US$210 million

DJO Global Inc

Now-defunct subsidiary (Empi Inc) submitted false claims to Tricare for excessive and unnecessary quantities of supplies.

US$7.62 million

Alere Inc

Knowingly selling unreliable diagnostic testing devices in violation of the False Claims Act.

US$33.2 million

Pfizer, Inc

Pfizer used a foundation as conduit to pay the co-pay obligations of Medicare patients taking three Pfizer drugs, in violation of the False Claims Act.

US$23.85 million

Update and trends

Current developments

What are the authorities’ enforcement priorities likely to be in the coming year? Are there any noteworthy cases pending? Are there any current developments or emerging policy or enforcement trends that should be noted?

First, the current administration has committed to remain focused on individual accountability as an effective deterrent to corporate corruption. While the DoJ has encouraged companies to cooperate in the investigation of individuals suspected of improper behaviour and provided incentives to do so, it remains to be seen how this focus on individuals will play out in terms of investigations, charges, convictions and settlements in the coming years.

Second, since the US Supreme Court’s decision in Universal Health Services v. US ex rel Escobar, 136 S. Ct. 1989 (2016), the US Circuit and District Courts continue to work to implement Escobar’s implied certification theory of liability and ‘demanding’ materiality standard, with mixed outcomes. Some circuits have expressly applied the implied certification theory of liability, while others have rejected it in certain instances, and some have yet to weigh in. Certain circuits have used Escobar’s rigorous materiality standard to dismiss Federal False Claims Act cases by finding misrepresentation in payment claims immaterial.

Escobar’s demanding materiality standard, paired with a recent memo from the DoJ regarding a more proactive approach to dismissing qui tam actions (the Granston memo), raises new challenges for False Claims Act plaintiffs and opportunities for False Claims Act defendants. The Granston memo directs DoJ attorneys to consider dismissing qui tam actions based on seven factors in order to reduce the burden that those actions have put on the DoJ. Defendants can now seek dismissal in the courts for failure to satisfy the Escobar materiality standard, as well as potentially pursue dismissal by the government based on the Granston memo.

Third, the government is likely to continue its focus on drug pricing generally, and drug manufacturers’ involvement in patient assistance programmes specifically. In 2016, the government initiated an industry-wide investigation concerning the relationships between drug manufacturers and non-profit charitable foundations that provide financial assistance to patients. In late 2017 and 2018, several drug manufacturers entered into settlement agreements with the government based on allegations that the companies used the foundations as conduits to pay co-payments for Medicare patients taking the company’s products in violation of the OIG guidance and the Federal False Claims Act.

In addition, in November 2017, the OIG rescinded a previously issued advisory opinion that specifically held that a charitable foundation’s use of pharmaceutical manufacturer donations to assist federal health programme beneficiaries did not violate the AKS. The rescission of the advisory opinion, along with the recent settlements, suggests the government’s close scrutiny of patient assistance programmes will continue.

Finally, we anticipate the recent increase in federal and state criminal and civil actions relating to opioid products will continue. DoJ and state attorneys general, in conjunction with federal and state agencies, are devoting significant resources to their enforcement activities, which include criminal and civil investigations of healthcare providers, opioid drug manufacturers and pharmacies among others.