Regulation of pharmaceutical products and medical devices

Monitoring powers

What powers do the authorities have to monitor compliance with the rules on drugs and devices?

In addition to securing approval to distribute a drug or device, a manufacturer must establish a quality manufacturing system and meet established ‘Current Good Manufacturing Practices’. The regulations for drugs are set forth at 21 CFR sections 210 and 211 and the regulations for devices are set forth at 21 CFR section 820. The regulations for biologics are set forth at 21 CFR sections 600 to 680.

Anyone who owns or operates an establishment engaged in the manufacture of any drug or device must register that establishment, which is subject to inspection, including surprise inspections (21 US Code section 360(b) and (j), and 21 USC section 374).

Finally, manufacturers of drugs and devices are required by law to maintain records regarding the manufacture and distribution of the drug and device and to file annual reports with the FDA, which reflect, among other things, any changes in the design or formula, or the manufacturing process, of the device or drug (21 CFR section 314.81(b)(2) for drugs).

Medical device manufacturers must also file medical device reports whenever the manufacturer becomes aware of information that suggests that its device may have caused or contributed to a death or serious injury, or is aware of a malfunction that, if it were to recur, could cause death or a serious injury (21 CFR section 803.1).

Pharmaceutical manufacturers are similarly required to file adverse-event reports when they become aware of an adverse event involving their product (21 CFR section 310.305).

Investigation time frames

How long do investigations typically take from initiation to completion? How are investigations started?

There is no typical length of time for an investigation, although investigations can last as long as five or six years. The statute of limitations is five years for most criminal matters and six years for most civil matters. Many investigations are started by whistleblowers filing a federal False Claims Act suit or simply making an anonymous call to federal law enforcement authorities. Other investigations are commenced because of government audit results.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

Until the government files criminal charges or commences a civil suit, the subject of an investigation does not have any right to government investigation files and materials, and cannot use either the federal or state court systems to help it collect evidence for its defence in advance of such filings.

Investigations abroad

If pharmaceutical products or medical devices are made in a foreign country, may the authorities conduct investigations of the manufacturing processes in that other country?

Yes. If a company is distributing a product in the US, the FDA has the authority, and exercises that authority, to conduct investigations of any manufacturing processes located in other countries, as long as those processes are used for the manufacture of critical components of the drug or device.

Enforcement proceedings

Through what proceedings do agencies enforce the rules?

Government enforcement proceedings can be divided into two categories: criminal and civil. All enforcement proceedings, whether criminal or civil, are within the jurisdiction of the court system, not any agency.

Only the Department of Justice can make the decision to seek criminal charges under a federal criminal law. The Department of Justice also has the authority to bring a civil suit against a healthcare provider or supplier for submission of false claims to the federal government. Similarly, state attorneys general (or lower-level prosecutors called district attorneys) usually have the power to bring either a criminal enforcement action under state criminal laws or a civil action against a healthcare provider or supplier. Proceedings brought under state law are initiated solely at the behest of the state entity and are not controlled in any way by the federal government.

The CMS has the authority to grant or revoke a licence to a federal healthcare programme provider or supplier. If the CMS revokes a licence, the provider or supplier may appeal that revocation to an administrative law judge. The provider, supplier or the CMS may appeal the administrative law judge’s ruling to federal court.

The OIG has the statutory authority to debar, or exclude, a provider or supplier from participation in federal healthcare programmes (42 USC section 1320a-7). There are numerous bases upon which the OIG may exclude a provider or supplier, some mandatory (ie, required by the statute) and others permissive (ie, the OIG may choose whether to exclude). The OIG also has the authority to impose civil monetary penalties for certain conduct. An exclusion decision and a decision to impose such penalties may be appealed to federal court.


What sanctions and other measures can the authorities impose or seek in enforcement actions against drug and device manufacturers and their distributors?

In a criminal case, the government may seek a fine as well as restitution for any losses and seizure of the instruments used in the criminal offence. If a provider is convicted of a federal healthcare programme offence, the provider will be automatically excluded for a minimum of five years.

In a civil federal False Claims Act case, the government may seek a fine of three times the loss, plus restitution, and a penalty of between US$11,181 and US$22,363 for each false claim, in addition to restitution. Similar penalties may be sought by states for violation of a state False Claims Act.

The OIG may seek exclusion of a provider on numerous grounds. The exclusion is mandatory if the provider or supplier was convicted of a federal healthcare programme-related offence, for a crime of patient abuse, for a felony related to healthcare fraud or for a crime related to controlled substances (42 USC section 1320a-7(a)). The exclusion is permissive for 16 different categories of conduct, including:

  • a misdemeanour conviction related to healthcare fraud;
  • a non-healthcare fraud felony;
  • conviction relating to the obstruction of an audit or investigation;
  • conviction for misdemeanour offences related to controlled substances;
  • the provider having its licence to provide healthcare revoked or suspended; or
  • the provider being excluded from other federal programmes on grounds of professional competence, performance or financial integrity, or for submission of charges to Medicare or Medicaid substantially in excess of the charges made to others or of the provider’s costs (42 USC section 1320a-7(b)).

Additionally, the FDA has the authority to debar or disqualify individuals or companies convicted of certain violations of the FDCA. Once debarred, the person may no longer work for an FDA-regulated company, and a company may no longer submit drug applications to the FDA.

Actions against employees

Can the authorities pursue actions against employees as well as the company itself?

Yes. Employees may be prosecuted for federal and state criminal violations that they personally committed or as responsible corporate officers in the case of the FDCA. In criminal actions against employees, the government has the burden of proving beyond reasonable doubt that the employee had the criminal intent specified in the charged criminal statute. In 2015, the Department of Justice announced policy changes that suggest an increased focus on individual corporate accountability in corporate investigations. That policy has not yet resulted in a significant increase in criminal prosecutions of or civil suits against corporate officers or employees, but the current administration has stated its intent to continue pursuing individual accountability.

Employees also may be sued for violation of the federal and state False Claims Acts. When such civil suits are brought, the government has the burden of proving by a preponderance of the evidence that the employee caused the company to file a false claim, and that the employee knew that the claim was false when filed or was reckless as to the falsity of the claim.

Defences and appeals

What defences and appeals are available to drug and device company defendants in an enforcement action?

The available defences will vary depending on the conduct under investigation and the applicable criminal and civil statutes. Such defences can include:

  • that the service or item was provided or billed precisely as ordered by the physician, and was medically necessary and reasonable for the treatment and diagnosis of the patient;
  • that the drug or device was approved for the use for which it was promoted;
  • that the company made payments to a healthcare professional to compensate him or her for services rendered to the company (eg, the physician provided consulting services, and the payment represented a fair market value payment for those services);
  • that the government, in its interactions with the company or with other companies similarly situated, had approved or condoned the conduct in question;
  • that the rules at issue were confusing, vague or ambiguous and did not fairly put the defendant on notice that its conduct was criminal; and
  • that the defendant acted in good faith upon reliance of statements made by the government that the defendant believed approved the conduct, or in reasonable reliance upon advice of counsel.
Minimising exposure

What strategies should companies adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

Companies should establish a strong culture of legal compliance, which is best achieved by active messaging and participation by company leadership. Depending on the size of the company and the scope of its operations, the company may establish a corporate compliance department. When a company becomes aware of potentially non-compliant conduct, it should take immediate steps to determine whether any employees may have violated federal or state laws or regulations, and impose appropriate sanctions on any offending employees.

Once a company is aware of a government investigation, it should immediately take steps to understand the scope of the investigation and conduct an internal investigation to determine potential exposure. If the company discovers improper or illegal conduct by an employee during the internal investigation, the company should take steps to correct the conduct and appropriately sanction the employee without waiting for government action.

Recent enforcement activities

What have the authorities focused on in their recent drugs and devices enforcement activity and what sanctions have been imposed?

Recent enforcement actions concerning drug and device companies in 2018 and 2019 include those shown in the table below.

Recent enforcement actions concerning drug and device companies



Settlement payment

Actelion Pharmaceuticals US, Inc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its hypertension drugs, in violation of the False Claims Act.

US$360 million

Insys Therapeutics

Paid kickbacks to physicians in exchange for increased prescriptions, in violation of the False Claims Act.

US$225 million

Astellas Pharma US Inc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the federal False Claims Act.

US$100 million

Jazz Pharmaceuticals plc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the False Claims Act.

US$57 million

Lundbeck LLC

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the False Claims Act.

US$52.6 million

Alere Inc

Knowingly selling unreliable diagnostic testing devices, in violation of the False Claims Act.

US$33.2 million

ev3 Inc and Covidien, LP

Paid kickbacks to induce purchase of thrombectomy devices and distributed adulterated pharmaceuticals, in violation of FDCA.

US$30.9 million

Abbott Laboratories and AbbVie Inc

Paid kickbacks to physicians to induce them to prescribe pharmaceuticals, in violation of the False Claims Act.

US$25 million

Amgen Inc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the False Claims Act.

US$24.75 million

Pfizer, Inc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the False Claims Act.

US$23.85 million

US WorldMeds LLC

Paid kickbacks to physicians to induce them to prescribe pharmaceuticals, in violation of the False Claims Act.

US$17.5 million

Covidien LP

Provided practice and market development support services with physicians to induce purchase of vein ablation products, in violation of the False Claims Act.

US$17 million

ACell Inc

Failed to report a medical device removal in violation of FDCA, causing submissions of false claims to federal healthcare programmes, in violation of the False Claims Act.

US$15 million

Alexion Pharmaceuticals Inc

Used a foundation as a conduit to pay co-payments of Medicare patients taking its drugs, in violation of the False Claims Act.

US$13 million

AngioDynamics, Inc

Made false and misleading promotional claims that led to submission of false claims to federal healthcare programmes in violation of the False Claims Act.

US$12.5 million

Self-governing bodies

Are there self-governing bodies for the companies that sell pharmaceutical products and medical devices? How do those organisations police members’ conduct?

For pharmaceutical products, Pharmaceutical Research and Manufacturers of America (PhRMA) represents biopharmaceutical and biotechnology companies. PhRMA has its Code on Interactions with Health Care Professionals, which provides guidance on appropriate and ethical relationships with healthcare professionals. While the Code is voluntary and PhRMA does not actively police compliance with the Code, PhRMA asks that all member companies adopt procedures designed to assure adherence to the Code and publicly identifies those members who have agreed to adhere to the Code.

For medical devices, AdvaMed is a trade association with more than 300 members worldwide. Its members produce approximately 90 per cent of the healthcare technology sold in the US. AdvaMed’s Code of Ethics governs interaction with healthcare professionals and a code certification programme in which members can certify adoption of the AdvaMed Code. While AdvaMed conducts seminars featuring good corporate governance and compliance, AdvaMed does not actively police its members’ conduct or adherence to its Code of Ethics.

For biologics, the Biotechnology Innovation Organization is a trade association that provides advocacy, business development and communications services for more than 1,000 members around the world.