This article is an extract from GTDT Healthcare Enforcement & Litigation 2023. Click here for the full guide.
Overview
The legal framework of healthcare enforcement responsibilities in the European Union has to be separated between the statutes for pharmaceutical products and the ones for medical devices. Given the different regulatory approaches to both categories, the regulation of pharmaceutical products is deeper than the one for medical devices. However, in both fields, the competencies and responsibilities are primarily at the member state level, with European authorities having mainly a more coordinative role.
Regulation of pharmaceutical products and medical devices
The main EU-harmonised enforcement regulations for pharmaceutical products relate to the pharmacovigilance of pharmaceutical products. These regulations go back to the ‘Contergan tragedy’ leading to a stronger harmonisation of the European regulation of pharmaceutical products. In addition, there are certain measures relating to clinical trials provided at EU level.
The legal framework for pharmacovigilance of pharmaceutical products in the European Union is governed in Regulation (EC) No. 726/2004 and Directive 2001/83/EC on the Community code relating to medicinal products for human use, as amended in 2010 by Regulation (EU) No. 1235/2010 and Directives 2010/84/EU and 2012/26/EU respectively, as well as by the Commission Implementing Regulation (EU) No. 520/2012 on the Performance of Pharmacovigilance Activities Provided for in Regulation (EC) No. 726/2004 and Directive 2001/83/EC (the new pharmacovigilance legislation in the European Union).
Chapter 3 of the Regulation (EC) No. 726/2004 as amended, Title IX (article 101-108b) of the Directive 2001/83/EC as amended and the Implementing Regulation contain the majority of pharmacovigilance provisions in the legislation. Basically, the European Union requires member states to operate a pharmacovigilance system for the fulfilment of their pharmacovigilance tasks and their participation in European Union pharmacovigilance activities. The pharmacovigilance system shall be used to collect information on the risks of medicinal products as regards patients’ or public health. That information shall in particular refer to adverse reactions in human beings, arising from the use of the medicinal product within the terms of the marketing authorisation as well as from use outside the terms of the marketing authorisation, and to adverse reactions associated with occupational exposure. The same applies to marketing authorisation holders, who are also obliged to install a risk management system (see article 104, paragraph 3 Directive 2001/83/EC as amended).
The new pharmacovigilance legislation has the primary goal of strengthening and rationalising pharmacovigilance and increasing patient safety. According to article 108a(a) of Directive 2001/83/EC as amended, also a set of guidelines for the conduct of pharmacovigilance in the European Union was developed by the Agency in cooperation with competent authorities in member states and interested parties, the new guidance on good pharmacovigilance practices (GVP). GVP aims to facilitate the performance of pharmacovigilance activities within the European Union and applies to marketing authorisation holders in the European Union, the Agency and competent authorities in member states. A table of contents of GVP is accessible at the Agency’s website. The pharmacovigilance legal requirements and GVP apply to all pharmaceutical products authorised in the European Union, whether centrally or nationally authorised.
According to article 22 of Regulation (EC) No. 726/2004, the European Medicines Agency (Agency), acting in close cooperation with the national pharmacovigilance systems, shall receive all relevant information concerning suspected adverse reactions to pharmaceutical products that have been authorised by the Community and shall, where appropriate, draw up publicly accessible opinions on the measures necessary. Member states have to implement such requirements. For instance, section 68 of the German Act on Medicinal Products (AMG) stipulates that all national competent authorities shall provide the Agency or the European Commission with all of the information that is necessary to monitor compliance with the pharmaceutical product-related regulations.
Besides, there are several EU-wide enforcement provisions relating to the conduction of clinical trials. The long-awaited Clinical Trials Regulation (CTR) has come into application (subject to a three-year transition period) with the Clinical Trials Information System (CTIS) having gone live on 31 January 2022. The CTR aims to harmonise the submission, assessment and supervision processes for clinical trials for medicines in the European Union. CTIS is a single-entry point for sponsors and regulators of clinical trials for the submission and assessment of clinical trial data. Instead of submitting clinical trials applications separately to national competent authorities (NCAs) and ethics committees in each country to gain regulatory approval to run clinical trials in the past, sponsors can now apply for authorisations in up to 30 EU/EEA countries at the same time and with the same documentation. The CTR has an immediate effect on every member state and provides in its article 78 respective requirements for member state inspections. Among others, article 78, paragraph 5 CTR clarifies that the Agency shall coordinate the cooperation between member states concerned on inspections conducted in member states, in third countries, and inspections conducted in the framework of an application for a marketing authorisation under Regulation (EC) No. 726/2004. Pursuant to article 78, paragraph 7 CTR, the Commission shall specify, by means of implementing acts, the detailed arrangements for the inspection procedures including the qualification and training requirements for inspectors.
An example of an implementing regulation in a member state for the collaboration in clinical trial enforcement on EU level is section 14 of the German Ordinance on the implementation of Good Clinical Practice in the conduct of clinical trials on medicinal products for use in humans (GCP Ordinance). According to section 14, paragraph 1 of this Ordinance, the National Competent Authority (NCA) shall inform the authorities responsible for the supervision, the competent ethics committee and the Commission immediately, stating its reasons, for the ordering of remedial measures. Section 14, paragraph 5 of the GCP Ordinance further stipulates that the NCA shall immediately send information on all suspected cases of unexpected serious adverse reactions to an investigational medicinal product to the EudraVigilance database established within the Agency.
The field of medical devices (with the exemption of in-vitro-diagnostics) is, from 26 May 2021 on, widely harmonised within the European Union through the Regulation 2017/745 of 5 April 2017 on medical devices, amending Directive 2001/83/EC, Regulation (EC) No. 178/2002 and Regulation (EC) No. 1223/2009 and repealing Council Directives 90/385/EEC and 93/42/EEC (MDR). With regard to enforcement, the MDR provides market surveillance rules in particular between the member states, but on the European level more in a cooperative way.
According to article 93, paragraph 9 of the MDR, the competent authorities of the member states shall coordinate their market surveillance activities, cooperate and share with each other and with the Commission the results thereof, to provide for a harmonised and high level of market surveillance in all member states. Furthermore, there is Chapter VIII of the MDR which relates to, among other things, the European cooperation in a European-wide medical device coordinating group. According to article 102, paragraph 1 MDR, the competent authorities of the member states shall cooperate with each other and with the Commission. The Commission shall provide for the organisation of exchanges of information necessary to enable this Regulation to be applied uniformly. The same provisions as in article 93, paragraph 9 and article 102, paragraph 1 MDR will apply, from 26 May 2022 on in vitro diagnostics according to article 88, paragraph 9, and article 97 of the Regulation 2017/746 of 5 April 2017 on in vitro diagnostic medical devices, and repealing Directive 98/79/EC and Commission Decision 2010/227/EU.
Relationships between healthcare professionals and suppliers
The collaboration of the pharmaceutical industry with healthcare professionals is in a field of tension between the EU member state’s fight against corruption and the necessary cooperation of the industry with healthcare professionals in the area of financing research activities in product developments, clinical trials or monitoring of applications. The regulation of legal relationships falls under the competence of the EU member states and is governed by them in various ways. For instance, with the German Act to Combat Corruption in Healthcare, Germany introduced a regulation that makes it possible to punish a health care professional under criminal law if he or she accepts, demands or permits himself or herself to be promised an advantage in the exercise of his or her profession, for example, for prescribing pharmaceutical products and medical devices.
At the European level, there are only a few regulations that provide a legal framework. One of the regulations on the European level is the restriction of promotions of pharmaceutical products according to Directive 2001/83/EC. Directive 2001/83/EC provides in article 94, paragraph 1 that in the promotion of medicinal products it is prohibited to supply, offer or promise a gift or pecuniary benefits to persons who are authorised to prescribe or supply them. According to article 94, paragraph 3 of Directive 2001/83/EC, healthcare professionals may not demand or accept such inducements. The only exceptions are benefits that are of little value and are relevant to medical or pharmaceutical practice. According to the case law of the European Court of Justice (ECJ), the purpose of the statute is to prevent promotional practices by the pharmaceutical industry that are likely to arouse an economic interest in healthcare professionals in prescribing or supplying medicinal products (see ECJ, judgment of 22 April 2010, C-62/09, marg. No. 29). In contrast, direct or indirect hospitality is permissible at purely professional and scientific events. However, in this case, hospitality is strictly limited to the main purpose of the event and may only apply to healthcare professionals (article 94, paragraph 2, 95 of Directive 2001/83/EC). However, these regulations are not directly applicable in the respective EU member states but require an act of implementation by the member states. For the implementation, article 94, paragraph 4 of Directive 2001/83/EC provides an opening clause for the member states, whereas the restrictions on sales promotion measures do not affect national discount and price regulations for medicinal products.
For the enforcement of violations of the advertising restrictions, Directive 2001/83/EC provides that the member states must establish adequate and effective methods to monitor the advertising of medicinal products. These methods must provide that a court can order the prohibition of advertising without the requirement of damage or intent or negligence and can also order the temporary cessation of advertising (article 97 of Directive 2001/83/EC). Court proceedings at the national level are usually civil proceedings conducted by persons or nationally designated bodies.
In addition, the demand for more transparency in interactions between the pharmaceutical industry and healthcare professionals and organisations has been raised within the pharmaceutical and healthcare industry in the past decade and has led to a system of voluntary compliance by the pharmaceutical industry. To this end, the European Federation of Pharmaceutical Industries and Associations (EFPIA), as the European umbrella organisation, adopted the EFPIA Code on Disclosure of Transfers of Value from Pharmaceutical Companies to Healthcare Professionals and Healthcare Organisations in 2013. According to this code, pharmaceutical companies are required to disclose, among other things, all types of financial and other pecuniary benefits to healthcare professionals and healthcare organisations. On 22 March 2019, this code was merged with the EFPIA Code on The Promotion of Prescription-Only Medicines to, and Interactions with, Healthcare Professionals and the EFPIA Code of Practice on Relationships between the Pharmaceutical Industry and Patient Organisations to form a uniform code of conduct, the EFPIA Code of Practice. This is to apply as a uniform European minimum standard.
However, the EFPIA Code of Practice only links the 36 national associations and 39 pharmaceutical companies that are members of EFPIA. Via the 36 national associations, further pharmaceutical companies are also indirectly bound by the regulations of the EFPIA Code of Practice. For this purpose, the respective member associations must implement the regulations in their own code. Should stricter or more far-reaching requirements than those of EFPIA be imposed at the national level, these will not be affected by the regulations of the EFPIA Code of Practice. However, not all companies are covered by the EFPIA Code of Practice.
The EFPIA Code of Practice requires disclosing transfers of value to healthcare professionals and healthcare organisations. Under these regulations, EFPIA member companies will have to disclose the names of healthcare professionals or organisations that have received payments or other transfers of value from them. They will also have to disclose the total amounts of value transferred by type of activity. The payments to healthcare professionals include consultancy fees, speaker fees and sponsorship to attend meetings. Moreover, donations and grants to healthcare organisations must be disclosed. Payments made for research and development activities are disclosed in aggregate.
The disclosure of payments is published differently in the respective EU member states. In the majority of countries, payments are disclosed annually on company websites. In some European countries, disclosure on a central government platform is also required due to national legal regulations (eg. France, Belgium et al). In addition, disclosure is also performed through EFPIA’s member associations in some countries.
Regulation of healthcare delivery
Within the scope of harmonising the European legal framework, article 168 paragraph 7 of the Treaty on the Functioning of the European Union (TFEU) provides for a limitation of the EU’s activities. Thus, the responsibility of the member states for the establishment of health policy, the organisation of health care services and medical care must be preserved. The administration of health care also falls within the responsibility of the member states. Therefore, the monitoring of healthcare delivery is also mainly the responsibility of the member states and the authorities they entrust with these tasks.
Private enforcement
Whereas in cases of clinical negligence the legal framework for claims is established in national law, the grounds on which purchasers or users of pharmaceuticals or medical devices can seek recourse for regulatory and legal infringements are strongly influenced by European law.
In the European Union, producers are liable for damages caused by the defectiveness of their products. This liability is based on the Product Liability Directive (Directive 85/374/EEC), which was implemented into the law of the member states.
In accordance with the Product Liability Directive, producers must provide compensation to injured persons regardless of fault. A compensation claim requires that the injured person proves the damage, the defect and the causal relationship between the defect and damage (article 4 Product Liability Directive).
The liability of the producer under this Directive cannot be limited or excluded towards the injured party by a clause limiting or excluding liability (article 12 Product Liability Directive).
However, the claim for compensation under the Product Liability Directive is time-barred after the expiry of a period of three years from the date on which the plaintiff became aware or should have become aware of the damage, the defect and the identity of the producer (article 10, paragraph 1 Product Liability Directive). Further, the rights of the injured party pursuant to this Directive expire 10 years from the date on which the producer put into circulation the product which caused the damage unless the injured party has commenced legal proceedings against the producer in the meantime (article 11 Product Liability Directive).
According to article 13 of the Product Liability Directive, its provisions do not affect any rights which an injured party may have under the rules of contractual and non-contractual liability or under any special liability regime existing at the time of notification of this Directive. This applies, for example, to the strict liability rule under section 84 of the German Medicinal Products Act.
The Medical Device Regulation (Regulation (EU) 2017/745) also contains provisions on liability for defective products.
With regard to compensation claims arising due to the defectiveness of a product, the MDR refers to applicable Union and national law (article 10, paragraph 16 MDR).
Also, the authorised representative is legally liable for defective devices on the same basis as the manufacturer, jointly and severally with the latter, if the manufacturer is not established in a member state and has not fulfilled its obligations under the MDR (article 11, paragraph 5 MDR).
Notified bodies may also be liable under national law due to a culpable failure to fulfil their obligations in connection with the declaration of conformity procedures (CJEU, judgment of 16 February 2017, Case C-219/15).
In addition to the legal grounds set out in these Directives, the law of the member states may provide further grounds for purchasers or users of pharmaceuticals or medical devices to seek recourse in case of regulatory or legal infringements.
The availability of class and collective actions varies across the member states. However, a directive on representative actions was recently adopted in the European Union. The Representative Actions Directive (Directive (EU) 2020/1828) came into force on 24 December 2020 to protect the collective interests of consumers. The member states are obliged to implement this Directive into national law by 25 December 2022. Laws, regulations and administrative provisions based on this Directive must be applied by 25 June 2023.
Pursuant to this Directive, member states must ensure that representative actions may be brought by qualified entities. A ‘qualified entity’ as defined in the Directive is any organisation or a public body representing consumers’ interests which have been designated by a member state as qualified to bring representative actions in accordance with this Directive (article 3, paragraph 4 Representative Action Directive).
According to article 2, paragraph 1 of the Representative Actions Directive, representative actions may be brought against infringements by traders of certain provisions of Union law including provisions implementing these Union laws which affect or threaten to affect the collective interests of consumers.
The scope of representative actions also covers health law regulations such as the Product Liability Directive, the MDR and the Directive 2001/83/EC, also known as the Community code relating to medicinal products for human use (Annex I of Representative Action Directive).
Qualified entities shall be entitled to sue at least for injunctive and redress measures such as compensation, repair, replacement, price reduction, contract termination or reimbursement of the price paid, but only to the extent provided for by Union or national law (article 8 and 9 Representative Action Directive).
The Directive also entails cross-border representative actions. Member states must ensure that qualified entities designated in advance in another member state for the purpose of bringing cross-border representative actions can bring such representative actions before courts or administrative authorities (article 6 Representative Action Directive).
All in all, the Representative Action Directive will strengthen private enforcement, including in the field of healthcare law. This directive will harmonise the regulations in the member states on representative actions and enable cross-border representative action. The directive also provides that entities qualified to bring representative action can sue for remedial decisions. This is particularly important for consumers in those member states in which this is not possible currently. At the European level, the so-called Directive on the protection of persons who report breaches of Union law (Directive (EU) 2019/1937) was created on 23 October 2019. The Directive aims to ensure a high level of protection for whistle-blowers in regard to breaches of Union law by setting common minimum standards. The material scope of application also includes Union acts relating to public health, such as Directive 2001/83/EC.
A whistle-blower is entitled to protection under article 6 of Directive (EU) 2019/1937 if the whistle-blower had reasonable grounds to believe that the reported information about breaches was true at the time of the report and that the information fell within the scope of the Directive and, in addition, either made an internal or external report or disclosed the information. Three forms of reporting are therefore protected: Article 8 of Directive (EU) 2019/1937 provides that in the internal reporting procedure, the information on infringements is transmitted to a legal person governed by public or private law. Member states shall ensure that legal persons in the private and public sectors establish internal channels and procedures for reporting and follow-up. In any case, all private companies with more than 50 employees are obliged to do so. According to article 8, paragraph 5 of Directive (EU) 2019/1937, the reporting channels can be provided by a person or department designated for this purpose or externally by a third party. The whistle-blower should receive an acknowledgement of receipt of internal reports within a maximum of three months.
In the external reporting procedure, the whistle-blower contacts the competent authorities directly. To this end, the member states must ensure that the competent authorities that are authorised to receive these reports provide feedback on them and take appropriate follow-up action. In addition, member states must ensure that independent and autonomous external reporting channels are established for receiving and processing information submitted by whistle-blowers (article 11, paragraph 2 of Directive (EU) 2019/1937). The whistle-blower should receive an acknowledgement of receipt of external reports within a maximum of three months (article 11, paragraph 2 lit. d of Directive (EU) 2019/1937).
Public disclosure is understood to mean ‘the making of information on breaches available in the public domain’ pursuant to article 5 paragraph 6 of Directive (EU) 2019/1937. This includes the case group of disclosure to the press if no appropriate measures have been taken in the internal and external reporting procedure or if there is a special reason for the disclosure, such as the fear of retaliation in the case of an external report.
Directive (EU) 2019/1937 aims that the confidentiality of the identity of whistle-blowers should be preserved. According to article 16 of Directive (EU) 2019/1937, the whistle-blower’s identity may only be disclosed without his explicit consent if this is a necessary and proportionate measure under Union or national law in the context of investigations by national authorities or judicial proceedings. In addition, the whistle-blower should be protected from retaliation. For this purpose, article 19 of Directive (EU) 2019/1937 contains a wide catalogue of reprisals that is standardised. In addition, article 21 of Directive (EU) 2019/1937 provides that a wide exclusion of the whistle-blower’s liability is to be regulated, whereby liability in court proceedings for defamation, breach of copyright, breach of secrecy, breach of data protection rules, disclosure of trade secrets, or for compensation claims is excluded.
According to articles 25 and 26 of Directive (EU) 2019/1937, the provisions of the Directive must be transposed into national law by 17 December 2021 but may deviate from its regulations in favour of the rights of whistle-blowers. Despite this deadline, 24 of the 28 EU member states have not transposed Directive (EU) 2019/1937 into national law to date. To foster immediate implementation, the European Commission has now initiated infringement proceedings against member states.
Cross-border enforcement and extraterritoriality In general, EU authorities cannot investigate violations of healthcare laws and other legal provisions independently as it is the responsibility of the law enforcement authorities of the member states.
Although the European Public Prosecutor’s Office conducts its own investigation procedures since 1 June 2021, it only investigates (cross-border) crimes against the financial interests of the EU (eg, corruption, certain forms of subsidy fraud).
To fight cross-border crimes, member states are cooperating and the EU facilitates such cooperation. For example, Europol assists member states in countering crime and facilitates police cooperation among member states. Its competence extends to organised crime, terrorism, forms of crime that violate a common interest that is the subject of a Union policy or other forms of serious crime where two or more EU member states are involved.
Tasks of Europol include gathering and exchanging data, coordinating investigative activities and working on joint investigations. Nonetheless, Europol has no investigative or enforcement powers of its own. Further, Eurojust supports coordination and cooperation between national law enforcement authorities with regard to serious crimes affecting two or more member states or requiring a prosecution on a common basis.
However, the focus is on certain serious crimes such as terrorism, cybercrime, drug trafficking and human trafficking.
Update and trends
The most significant recent developments have taken place in the area of pandemic control. In general, the European Union’s focus in the pandemic was to coordinate a joint response of the member states and to support the member states in their crisis management. Nonetheless, the EU has taken numerous measures to address the Coronavirus crisis and mitigate its economic and societal impact.
Under the ‘rescEU’ programme, common stock of protective equipment and respirators has been acquired and medical equipment has been made available throughout Europe. Further, the Council adopted a recommendation regarding a unified framework for covid testing, including mutual recognition of test results (Council Recommendation for a harmonised framework for the use and validation of rapid antigen tests and mutual recognition of covid-19 test results in the EU 2021/C 24/01). Covid-19 tests were made available to member states under the Emergency Aid Instrument.
Moreover, the production of covid vaccines was supported (eg, by facilitating regulatory requirements). Provisions related to clinical trials on medicinal products containing or consisting of genetically modified organisms have been amended. Certain operations within the context of clinical trials have been exempted from the requirement of a prior environmental risk assessment or consent in accordance with articles 6 to 11 of Directive 2001/18/EC or articles 4 to 13 of Directive 2009/41/EC (article 2 Regulation (EU) 2020/1043).
To ensure access to vaccines in the European Union, several regulations were passed requiring companies to submit an export authorisation when exporting vaccines. Due to progress in vaccine production, the fulfilment of advance purchase agreements between the European Union and vaccine manufacturers as well as the security of the EU’s supply of covid-19 vaccines are no longer at risk. Therefore, the Commission Implementing Regulation (EU) 2021/2071 of 25 November 2021 stipulates that authorisation is no longer required for the export of SARS-CoV-2 vaccines beyond 31 December 2021. However, SARS-CoV-2 vaccines will be subject to export surveillance for a period of 24 months from 1 January 2022 as transparency in the export of vaccines remains important due to the existing risk of new outbreaks and the emergence of new variants. To enable free movement during the pandemic, the EU Digital COVID Certificate was implemented. The certificate can be issued in the form of a vaccination certificate, a test certificate or a certificate of recovery attesting that the holder has received covid-19 vaccinations, has recovered from a SARS-CoV-2 infection, or tested negative for a SARS-CoV-2 infection respectively. The details regarding issuance, verification and acceptance of these certificates are set out in Regulation (EU) 2021/953.
Furthermore, the EU programme EU4Health was adopted for the period 2021–2027 with the aim to strengthen the health systems and promote innovation in the health sector.
Finally, one major development in the past year was the foundation of the EU Health Emergency Preparedness and Response Authority (HERA) on 16 September 2021. The new agency was established by the European Commission to provide a rapid response to future pandemics. In particular, the goal is to quickly develop, produce, and distribute medicines, vaccines and other medical equipment such as masks.
