Use the Lexology Getting the Deal Through tool to compare the answers in this article with those from other jurisdictions.

Overview

Healthcare funding

In general terms, how is healthcare, including access to medicines and medical devices, funded in your jurisdiction? Outline the roles of the public and private sectors.

Access to healthcare is universally granted pursuant to the principles set forth in Article 32 of the Constitution. In general terms, Italian public healthcare expenditure is funded through the following sources:

  • regional taxation - regional tax on economic activities (IRAP), and additional and municipal Income Tax (IRPEF);
  • revenues from prescriptions charged to patients;
  • intramural activities performed by physicians within public hospitals; and
  • the state budget - specifically, the National Health Fund and shares in VAT income.

In 2017, the total healthcare expenditure was €134 billion (76 per cent public expenditure and 24 per cent private (out-of-pocket), funded mainly by private supplementary insurance).

Delivery

In general terms, how is healthcare delivered in your jurisdiction? Outline the roles of the public and private sectors.

After a Constitutional Reform approved in 2001 that contributed to decentralisation, both public and private providers have to comply with specific requirements laid down by laws. Providers must obtain authorisation. In addition public providers (as well as private providers whose service costs are charged to the national healthcare system (SSN)) have to be accredited. The requirements and conditions necessary to obtain authorisation and accreditation are laid down by state and regional laws and regulations, on the basis of the internal allocation of powers.

Key legislation

Identify the key legislation governing the delivery of healthcare and establishing the regulatory framework.

The SSN was established by Law no. 833/1978 and the Legislative Decree no. 502/1992 (subsequently amended by other laws) defining its organisation and operating procedures. The 2001 Constitutional Reform defined a ‘concurrent’ legislative system: the state has exclusive competence in establishing the general principles and in defining the essential levels of assistance throughout Italy’s regions (LEA). The LEAs are determined through a process involving the regions. Every region has the power to define its own legal and regulatory framework for the organisation and management of healthcare services, which must comply with the general principles laid down by the state legislation (mainly by the Legislative Decree 502/1992). Moreover, every regional system must be organised to guarantee LEAs through services provided by public and private providers.

Responsible agencies

Which agencies are principally responsible for the enforcement of laws and rules applicable to the delivery of healthcare?

The activity of public and private providers is constantly monitored through a system of controls involving many entities - such as Local Health Administration Units (ASL), municipalities and police anti-adulteration units - operating at a local level and the Italian National Agency for Regional Healthcare Services (AGENAS), that operates at the central level.

AGENAS is a public body that supports the Italian Ministry of Health and acts as a link between the central, regional and local levels, providing technical and operational support to regions and healthcare organisations with regards to organisational, economic, financial aspects and efficacy of health interventions, as well as ensuring patient-centred, quality and safe care. The funding of public healthcare authorities does not depend on results of their enforcement actions.

Scope of enforcement

What is the scope of their enforcement and regulatory responsibilities?

Controls mainly concern the service providers and their compliance with the legal and regulatory framework established at national and regional levels. In particular, the controlling bodies and agencies ensure that service providers have the requirements prescribed by law for providing healthcare services. In the event that a service provider is found to be non-compliant with the applicable laws and regulations, the consequences depend on the seriousness of the breach. For the most serious breaches, the authorisation of the service provider can be temporarily suspended or definitively revoked.

Regulation of pharmaceutical products and medical devices

Which agencies are principally responsible for the regulation of pharmaceutical products and medical devices?

The Italian Medicines Agency (AIFA) is the national authority responsible for the marketing authorisation of medical products in Italy. It is a public body operating autonomously and transparently under the direction of the Ministry of Health and under the vigilance of the Ministry of Health and the Ministry of Economy. The Ministry of Health (MH) is responsible for the regulation of medical devices. The Istituto Superiore della Sanità (ISS), operating under the control of MH, is in charge of research, experimentation, consultancy and educational activities in public health matters.

Scope of enforcement

What is the scope of their enforcement and regulatory responsibilities?

AIFA in cooperation with the European Medicines Agency (EMA) and the ISS, is entitled to monitor compliance with all the legal requirements governing medicinal products, including pharmacovigilance and good manufacturing and delivery practices (GMPs). MH is the authority entitled to monitor compliance with Italian laws and regulations on medical devices, including incidents, importation, exportation and advertising.

Other agencies

Which other agencies have jurisdiction over healthcare, pharmaceutical and medical device cases?

Public prosecutors (PPs) have jurisdiction in cases involving possible criminal offences in the healthcare and life science sectors. The Italian Competition Authority has jurisdiction mainly over cases of price fixing on drugs and abuse of dominant position.

Simultaneous investigations

Can multiple government agencies simultaneously conduct an investigation of the same subject? Does a completed investigation bar another agency from investigating the same facts and circumstances?

It is possible for multiple government agencies to simultaneously conduct investigations on the same subject, within the scope of their respective responsibilities. It happens that the various authorities and agencies involved cooperate and share the findings of the relevant investigations. A general prohibition of investigating facts already investigated by a different agency or authority does not exist.

Regulation of pharmaceutical products and medical devices

Monitoring powers

What powers do the authorities have to monitor compliance with the rules on drugs and devices?

AIFA and MH may carry out inspections at sites, facilities and premises where medicines are produced, imported or stored, take samples of pharmaceutical products and medical devices and examine and analyse such products.

AIFA regularly inspects manufacturing sites in Italy, in order to guarantee consistency in the manufacturing process of medicinal products and an adequate pharmaceutical quality of the finished dosage form. AIFA also coordinates the activities necessary to maintain the equivalence of the Italian Inspection System with the other member states of the European Union and with countries that have a mutual recognition agreement on inspections with the EU.

In the event a criminal offence has occurred, PPs can carry out investigations by means of site inspections, seizures, forensic imaging of electronic devices and requests for documentation. PPs, in their inspection activities, also have the power to interview people who might have relevant information for the investigation. In the most serious cases, wiretapping of conversations is also allowed.

Investigation time frames

How long do investigations typically take from initiation to completion? How are investigations started?

There is no fixed time limit for an AIFA investigations to be carried out. AIFA carries out unannounced periodical inspections at producers’ sites in Italy or in third countries with the collaboration of the relevant agencies, as well as upon request of the European Commission, EMA or another EU member state.

Criminal investigations may have a maximum duration of two years in the most serious cases. It may happen that investigations last more than two years and in these cases any investigative act carried out after the two years shall not be used in the proceeding. Investigations of regulatory agencies and PPs can start also from whistleblowing.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

AIFA shall draw up a report regarding the outcome of the inspections and inform the subjects. As to criminal proceedings, investigation files are held to be secret until the closure of the investigations. The subject of an investigation, therefore, may have access to the files once he or she receives notice that the prosecutor has closed the investigation. Only in cases of precautionary measures (eg, arrest or seizure) issued during an investigation, is partial discovery of files possible.

Investigations abroad

If pharmaceutical products or medical devices are made in a foreign country, may the authorities conduct investigations of the manufacturing processes in that other country?

Yes. For example, as provided for by Decree 219/2006 (Decree 219), AIFA is entitled to conduct inspections at extra-EU sites where active principles, used for medicines to be commercialised in Italy, are produced. As mentioned, it carries out inspections of production sites located abroad, with the collaboration of the relevant local agencies.

Enforcement proceedings

Through what proceedings do agencies enforce the rules?

AIFA enforces administrative fines and precautionary measures provided for by Decree 219. The fines applied by AIFA can be appealed before the Administrative Regional Courts. In order to enforce criminal sanctions (eg, those provided for by Decree 219) criminal proceedings must to be initiated by a PP.

Sanctions

What sanctions and other measures can the authorities impose or seek in enforcement actions against drug and device manufacturers and their distributors?

AIFA is entitled to revoke or suspend production licences, recall and or seize drugs, and close plants partially or totally. Criminal convictions may entail the arrest of the person and the confiscation of the proceeds of crimes and of the goods used in committing the crime as well.

In case of crimes that trigger corporate criminal liability pursuant to Decree no. 231/2001, companies can be sentenced to:

  • pay pecuniary sanctions of up to €1,549,000;
  • disqualifying sanctions, such as the debarment of the company;
  • a ban from entering into agreements with a public administration;
  • suspension or revocation of licences and authorisations;
  • exclusion from, or revocation of, public financing; and
  • a ban from advertising goods or services.

Disqualifying sanctions can also be imposed as precautionary measures.

Actions against employees

Can the authorities pursue actions against employees as well as the company itself?

AIFA and MH actions are typically carried out against companies, and usually do not involve employees.

Criminal sanctions provided for by Decree 219 are issued against individuals, typically to the legal representative of a company or to the infringer manufacturer, importer or supplier and/or the person responsible for the crime. Specific criminal offences (eg, corruption, fraud against the state) committed by employees may trigger the corporate criminal liability pursuant to Legislative Decree no. 231/2001.

Defences and appeals

What defences and appeals are available to drug and device company defendants in an enforcement action?

As provided for by Decree 219, defendants in AIFA enforcement actions are entitled to submit comments after the challenge of the authority. Then, an appeal of AIFA decision is available to the defendants. In this case, as mentioned, the competent courts are the Administrative Regional Courts.

In criminal proceedings, the subjects under investigation have the right to file defensive briefs after the closure of the investigations in order to ask the PP to dismiss the case. In case of a trial, if the defendants are unsuccessful they can challenge the decision before the Court of Appeal and then before the Italian Supreme Court.

Minimising exposure

What strategies should companies adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

The adoption of appropriate preventive measures and compliance procedures regulating the most critical issues, such as pharmacovigilance, GMPs and interactions with HCPs are recommended in order minimise exposure to enforcement actions and reduce liability once an enforcement action is under way. From a criminal law perspective, the adoption and implementation of compliance programme pursuant to Decree no. 231/2001 could also be appropriate.

Recent enforcement activities

What have the authorities focused on in their recent drugs and devices enforcement activity and what sanctions have been imposed?

Authorities are usually focused on any issues concerning pharmaceutical products and medical devices’ safety. For example, recently AIFA imposed the withdrawal of several batches of drugs containing a carcinogenic ingredient as a consequence of infringing the GMP.

Self-governing bodies

Are there self-governing bodies for the companies that sell pharmaceutical products and medical devices? How do those organisations police members’ conduct?

Yes. Such bodies are:

  • Farmindustria - the private association of pharmaceutical companies; and
  • Assobiomedica - the private association representing producers of medical devices.

They regulate their members’ conduct through Codes of Conduct.

Relationships between healthcare professionals and suppliers

Relationship rules

What are the rules prohibiting or controlling the financial relationships between healthcare professionals and suppliers of products and services?

The law provisions regulating the financial relationships between healthcare professionals and suppliers of products and services are Articles 170 and 172 of Decree No. 1265/1934 and Article 123 of the Legislative Decree No. 219/2006. The Code of Ethics adopted by Farmindustria regulates interactions between pharmaceutical companies and HCPs and health care organisations (HCOs). The Code of Ethics adopted by Assobiomedica regulates interactions between medical device producers and HCPs and HCOs.

Enforcement

How are the rules enforced?

The rules of law are enforced in courts.

Infringements of Farmindustria’s Code of Ethics are punished with:

  • requests to cease the conduct;
  • warning letters;
  • temporary suspensions; or
  • exclusion from Farmindustria.

Violations of Assobiomedica’s Code of Ethics are punished with:

  • warning letters;
  • suspension of the right of the members to take part in the Meeting of Assobiomedica or in the meeting of the associations to which they belong;
  • revocation of the representatives of the members who hold executive offices in Assobiomedica or in the associations to which they belong;
  • suspension of the right to vote and/or right to stand as a candidate in Assobiomedica or in the associations to which they belong; and
  • expulsion from Assobiomedica.

Infringements of the Code of Ethics are enforced by bodies of Farmindustria and Assobiomedica.

Reporting requirements

What are the reporting requirements on such financial relationships? Is the reported information publicly available?

There is an obligation to declare expenses directed to promote medicinal products and medical devices and to pay fixed fee of 5 per cent on the payment. Also, pharmaceutical companies adhering to Farmindustria are required to document any transfer of value (with the exception of those linked to over-the-counter drugs) directly or indirectly made to HCPs and HCOs. Such data shall be published on companies’ websites. The Assobiomedica Code of Ethics has similar reporting requirements.

Regulation of healthcare delivery

Authority powers

What powers do the authorities have to monitor compliance with the rules on delivery of healthcare?

The authorities, having the responsibility to monitor compliance with the rules on delivery of healthcare, all have investigative powers to ensure that the service providers meet the requirements prescribed by laws for providing healthcare services. They might carry out inspections and collect data. PPs can carry out investigations by means of site inspections, seizures, forensic imaging of electronic devices and requests of documentation. PPs, in their inspection activities, also have the power to interview people who might have relevant information for the investigation.

 

Investigation time frames

How long do investigations of healthcare providers typically take from initiation to completion? How are investigations started?

There is no fixed time limit regarding the investigations carried out by the authorities mentioned above. Criminal investigations may have a maximum duration of two years in the most serious cases.

Access to investigation materials

What rights or access does the subject of an investigation have to the government investigation files and materials?

The authorities shall inform the subjects of the investigations carried out. As to criminal proceedings, investigation files are held to be secret until the closure of the investigations. The subject of an investigation, therefore, may have access to the files once he or she receives notice that the prosecutor has closed the investigation. Only in the case of precautionary measures (eg, arrest, seizure) issued during an investigation, is partial discovery of the files possible.

Enforcement agencies

Through what proceedings do agencies enforce the rules?

In order to enforce criminal sanctions (eg, those provided for by Decree 219) criminal proceedings need to be initiated by a PP.

Sanctions

What sanctions and other measures can the authorities impose or seek in enforcement actions against healthcare providers?

Criminal convictions may entail the arrest of the person, and the confiscation of the proceeds of crimes and of the goods used in committing the crime. Disqualifying sanctions can also be imposed as precautionary measures.

Defences and appeals

What defences and appeals are available to healthcare providers in an enforcement action?

Healthcare providers can appeal sanctions applied by relevant authorities to the territorially competent Regional Administrative Court. As per criminal proceedings, the subjects under investigation have the right to file defensive briefs after the closure of the investigations in order to ask the PP to dismiss the case. In case of a trial, if the defendants are unsuccessful they can challenge the decision before the Court of Appeal and then before the Italian Supreme Court.

Minimising exposure

What strategies should healthcare providers adopt to minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way?

The adoption of appropriate preventive measures and compliance procedures regulating the most critical issues, such as pharmacovigilance, GMP and interactions with HCPs are recommended in order minimise their exposure to enforcement actions and reduce their liability once an enforcement action is under way. From a criminal law perspective, the adoption and implementation of compliance programme pursuant to Decree no. 231/2001 could also be appropriate.

Recent enforcement activities

What have the authorities focused on in their recent enforcement activity and what sanctions have been imposed on healthcare providers?

As to criminal investigations, PPs have focused their activity on cases of corruption of healthcare professionals. Recently many investigations for corruption that involved several representative of companies, physicians and companies themselves have been initiated. Against companies PPs issued precautionary disqualifying measures pursuant to Decree no. 231/01.

Self-governing bodies

Are there self-governing bodies for healthcare providers? How do those organisations police members’ conduct?

Yes. Such bodies are:

  • Confindustria Sanità - the private association of healthcare providing companies;
  • Associazione Italiana Ospedalità Privata (AIOP) - the private association of healthcare providing companies;
  • Federsanità; and
  • the public association of Municipalities and Local Health Administration Units (ANCI).

These organisations regulate their members’ conduct through Codes of Conduct (see question 22).

Remedies for poor performance

What remedies for poor performance does the government typically include in its contracts with healthcare providers?

The government’s Regions and the Local Health Administration Units sign contracts with private healthcare providers typically every two years, periods in which specific qualitative and quantitative levels of the services to be provided and the related remuneration are defined. In case the provider is found not compliant with the levels defined in the contract, this may be terminated by the government or not renewed when it expires.

Private enforcement

Causes of action

What private causes of action may citizens or other private bodies bring to enforce a healthcare regulation or law?

Legal actions may be instigated under civil law (see answer of question no. 35) or criminal law.

Under Article no. 590-sexies of the Italian Criminal Code, a healthcare professional who causes death or personal injury to a patient during the exercise of his or her function is subject to penalties for manslaughter or negligent personal injury, unless he or she acted in accordance with recommended guidelines published under law. In addition, when ethical rules are breached disciplinary proceedings may be brought against medical professionals before the order of doctors to which they belong.

Framework for claims

What is the framework for claims of clinical negligence against healthcare providers?

On 1 April 2017 Law No. 24/1207, known as the Gelli Law, entered into force and set the new framework for medical malpractice as follows:

  • liability of healthcare facilities/structures (public or private) is based in the contractual liability pursuant to Section no. 1218 and Section no. 1228 of Italian Civil Code; and
  • liability of healthcare professionals/doctors is based on ordinary tort law rules in accordance with section no. 2043 of Italian Civil Code (with exception of self-employed doctors who entered into a contractual obligation with the patient).

Under contractual liability, patients must provide evidence of the damages suffered due to the treatment, alleging the relevant breach of contractual duty. Hospitals, instead, must demonstrate that the performance was duly carried out and the outcomes were caused by an unforeseeable event or force majeure, and was unavoidable in the context of ordinary professional care.

On the other hand, medical professionals can be found liable only if all of the following requirements are proven:

  • unlawful conduct and relevant omission (ie, a breach of specific guidelines - not yet enacted - or principles of good practice);
  • actual damages;
  • a subjective element (ie, intentional fault and negligence); and
  • a causal link between the conduct and the suffered damages.

Courts are not reluctant to ascertain public or quasi-public professionals’ negligence if the above requirements are totally met.

Italian law allows for the recovery of actual damages as:

  • pecuniary damages (economic loss, out-of-pocket expenses and loss of profit); and
  • non-pecuniary damages - those resulting from personal injury, the loss of physical and/or mental integrity, or pain and suffering.

Seeking recourse

How and on what grounds may purchasers or users of pharmaceuticals or devices seek recourse for regulatory and legal infringements?

Pharmaceuticals and medical devices are included in the general product liability under Italian Consumer Code No. 206/2005 that implemented Directive 85/374/EEC on liability for defective products (old Product Liability Directive).

An injured party can bring claims for defective pharmaceuticals or devises on the basis of:

  • tort law (Articles 2043 to 2015 of the Italian Civil Code (ICC)).
  • contract law, when the injured party is in a contractual relationship with the producer (Articles 1218 to 1494, ICC).

Under Article 120 of the Consumer Code, the injured user must prove:

  • the defect in the product;
  • the damages suffered; and
  • a causal relationship between the defect in the product and the damages claimed.

Compensation

Are there any compensation schemes in place?

There are not specific compensation schemes in place. The assessment of biological damage (see question 35) is divided into two sub-­categories - temporary disability (usually measured in days) and permanent disability (expressed in a percentage of loss of mental and physical health conditions) - and are usually based on tables arranged by the Court of Milan. Although they are not formally binding, the tables are followed by the majority of courts and, based on a ruling by the Supreme Court, they should be applied for the purpose of assessing damages resulting from personal injuries.

Class and collective actions

Are class actions or other collective claims available in cases related to drugs, devices and provision of care?

Class actions were introduced by Law no. 244 of 2 December 2007 and came into force on 1 January 2010.

One or more consumers or users (promoters) can individually, or through associations to which they grant power, or committees in which they participate, instigate a class action to assess liability and seek damages and compensation (Article 140-$3, Consumer Code). Other consumers and users in the same or a homogeneous situation as the promoters can join the class action without a lawyer by filing their application by certified email or fax. There is no minimum number of consumers required to bring a class action.

The claim is submitted to the court located in the capital of the region in which the company is based. If the class action is declared admissible, the court sets the terms and methods for publicising the action so that those belonging to the class can join promptly, with a deadline of at least 120 days for consumers and users willing to opt in.

The final judgment will be delivered two or three years from the start of the action (depending on the evidence collection phase) and it becomes enforceable 180 days after its adoption.

Class actions are not common. There is no official database, but around 50 actions have been brought since 2010, and less than five actions have been decided on the merits with a positive outcome for consumers.

Review

Are acts, omissions or decisions of public and private institutions active in the healthcare sphere subject to judicial or administrative review following a complaint from interested parties?

Acts, omissions or decisions of public institutions active in the healthcare sphere are typically subject to administrative review following a complaint from interested parties. The competent Court is the Administrative Regional Court. A complaint must be made within 60 days.

Whistleblowers

Are there any legal protections for whistleblowers?

Yes, as introduced by Law no. 179 of 2017:

  • it is prohibited to put in place acts of retaliation or discrimination against whistleblowers;
  • retaliation or discrimination measures (ie, dismissal or demotion) adopted against whistleblowers are null and void;
  • burden of proof lies on the employer, which is obliged to demonstrate that the acts of discrimination or retaliation, if any, against the whistleblower were adopted for reasons totally unrelated to the reporting made by the whistleblower; and
  • companies shall guarantee the confidentiality of the report and of the identity of whistleblowers.

Does the country have a reward mechanism for whistleblowers?

No, it does not.

Are mechanisms allowing whistleblowers to report infringements required?

Law no. 179 of 2017 in amending Decree 231/2001 requires companies to update their compliance programmes in order to include different reporting channels able to protect the identity of whistleblowers, as well as penalties imposed on whoever infringes such measures of protection or, wilfully or negligently, makes groundless reporting or retaliates against whistleblowers.

Cross-border enforcement and extraterritoriality

Cooperation with foreign counterparts

Do prosecutors and law enforcement authorities in your country cooperate with their foreign counterparts in healthcare cases?

Yes. Examples are cases of counterfeiting medicine.

Triggering investigations

In what circumstances will enforcement activities by foreign authorities trigger an investigation in your country?

An investigation by Italian PP may be triggered by:

  • criminal offences committed in Italy or by Italian citizens;
  • infringements of Italian laws; and
  • criminal offences against Italian individuals and/or legal entities.

Pursuing foreign entities for infringement

In what circumstances will foreign companies and foreign nationals be pursued for infringements of your country’s healthcare laws?

In case of criminal offences committed in Italy, foreign companies and foreign nationals shall be punished according to the applicable Italian law.

Update and trends

Current developments

What are the authorities’ enforcement priorities likely to be in the coming year? Are there any noteworthy cases pending? Are there any current developments or emerging policy or enforcement trends that should be noted?

A major change relates to the coming into force of the General Data Protection Regulation (EU) 2016/679 (GDPR) which provides sanctions up to 4 per cent of the global turnover of the breaching entity or €20 million, whichever is the higher amount.

This is expected to considerably impact on the drug and healthcare sector. For instance a notification to the data protection authorities and, in some cases, the relevant individuals is prescribed in case of data breaches.

Likewise, the GDPR requires a very detailed control over the processing of personal data, setting a threshold of compliance that is much higher than what has been requested in the past.