A Look Ahead in Life Sciences: What We Are Tracking in the Fourth Quarter of 2024 and Beyond

How Companies Develop Their Products

• We are monitoring whether the Senate will pass a heavily amended version of H.R.3433, the Give Kids a Chance Act of 2023 (first introduced in May 2023), which was passed by the House of Representatives on September 23, 2024. The legislation aims to improve outcomes for children with rare cancers by requiring drugmakers to conduct pediatric clinical trials when studying combinations of multiple cancer drugs. The legislation includes provisions from two other long-discussed bills that would codify the FDA’s long-standing interpretation of exclusivity for orphan drugs (permitting FDA approval of the same drug for two different patient populations) and reauthorize the agency’s rare pediatric disease priority review voucher program through September 30, 2029. In the interim, the program has been reauthorized until December 20, 2024 through the continuing resolution agreed to by the House and Senate on September 25, 2024. Under the amended statutory sunset provisions, after December 20, 2024, the FDA may award a voucher for an approved rare pediatric disease product application only if the sponsor has rare pediatric disease designation for the drug and if that designation was granted by December 20, 2024. After September 30, 2026, the FDA may not award any rare pediatric disease priority review vouchers. Companies holding or pursuing rare pediatric disease designations should be mindful of these upcoming deadlines.
• In September 2024, the FDA issued final guidance on Conducting Clinical Trials With Decentralized Elements, which provides recommendations for drug, biologic, and device developers on how to conduct clinical trials in which certain trial-related activities occur remotely (e.g., via telehealth, through in-home visits with remote trial personnel, or by incorporating visits with local healthcare providers). The guidance notes that decentralized trials are one tool to potentially expand clinical trial access to more representative patient populations, in keeping with the FDA’s focus on improving enrollment of underrepresented groups in clinical studies. Although the guidance notes that sponsor responsibilities are the same for trials that include decentralized elements and those that do not include decentralized elements, the guidance provides further details for sponsors on how recordkeeping and monitoring can be conducted in the decentralized context. The guidance also discusses how investigators can work with local healthcare providers to conduct trial assessments effectively.
• In September 2024, the FDA issued draft guidance on Considerations for Generating Clinical Evidence From Oncology Multiregional Clinical Development Programs with “recommendations to sponsors who are planning global clinical development programs for drugs intended to treat cancer, on improving the evidence obtained from one or more multiregional clinical trials (MRCTs) intended to support a marketing application.” The FDA states that the draft guidance expands on existing guidance by providing “additional recommendations for the planning, design, conduct, and analysis of an oncology MRCT that may facilitate the FDA’s assessment of applicability of the data to the US population with the cancer being investigated and to US medical practice.” Comments on this draft guidance may be submitted through November 18, 2024.
• The comment period has closed on the FDA’s long-awaited draft guidance, Diversity Action Plans to Improve Enrollment of Participants From Underrepresented Populations in Clinical Studies. The draft guidance addresses the preparation of diversity action plans for Phase 3 or pivotal study drug, biologic and device developers conducting clinical trials (whether under investigational device exemptions or not), pursuant to Section 3601 of the Food and Drug Omnibus Reform Act of 2022 (FDORA). The draft guidance describes the format and content of Diversity Action Plans, the medical products and clinical studies for which a Diversity Action Plan is required, and the timing and process for submitting Diversity Action Plans to the FDA. The draft guidance also outlines the criteria and process that developers can use for seeking a waiver. Stakeholders had until September 26, 2024, to submit comments on the draft guidance, which the FDA will now review with the aim to issue final guidance. Read our blog on the FDA’s draft guidance.
• We are continuing to monitor the implementation by the Medicines and Healthcare products Regulatory Agency (MHRA) of legislation to reform the regulatory framework for clinical trials in the UK. On March 21, 2023, the MHRA published its response to the public consultation that it conducted at the beginning of 2022 on legislative proposals concerning the regulation of UK clinical trials. The MHRA has confirmed that the new legislation will ensure patients and their safety are the focus of all clinical trials; bring the benefits of clinical trials to everyone; create a proportionate and flexible regulatory environment; cement the UK as a destination for international trials; and provide a framework that is streamlined, agile, and responsive to innovation. On October 12, 2023, the MHRA introduced a Notification Scheme in the UK, which ensures that initial clinical trial applications for the lowest-risk Phase 3 and Phase 4 trials are approved by the MHRA within 14 days instead of the statutory 30 days, provided the sponsor shows that the trial meets the MHRA’s inclusion criteria.
• We are continuing to monitor the implementation of Executive Order 14117 and a related Advance Notice of Proposed Rulemaking issued by the US Department of Justice (DOJ). Both of these documents target foreign access to “bulk sensitive personal data” of US persons by countries of concern (i.e., the People’s Republic of China [including Hong Kong and Macao], Russia, Iran, North Korea, Cuba, and Venezuela) and certain entities and individuals connected to these countries. The proposed DOJ framework would prohibit or restrict certain transactions through which a country of concern or covered person could access human genomic data, personal health data, or biometric identifiers (among other types of data), subject to proposed volume thresholds ranging from 100 to 1 million US persons. These rules could implicate commercial relationships with counterparties that have ties to the listed countries, including for clinical trial data, depending on the thresholds to be determined in the rulemaking. We will continue to monitor these developments, which may inform updates to public company regulatory risk factors, particularly for companies with connections to China or another country of concern (for details, see our Client Alert).

Deciding Whether a Company Can Market or Sell a Specific Product

Pharmaceuticals and Biologics

• In September 2024, the National Academies of Sciences, Engineering, and Medicine issued their long-awaited consensus study report, “Regulatory Processes for Rare Disease Drugs in the United States and European Union: Flexibilities and Collaborative Opportunities.” The report includes recommendations for the FDA. Because the FDA will convene a hybrid public meeting on October 16, 2024, to enlist input on the priorities of its recently formed FDA Rare Disease Innovation Hub, the report’s recommendations may prove timely for the FDA’s consideration. Registration for the FDA’s public meeting is available here.
• In June 2024, the FDA issued draft guidance, “Considerations in Demonstrating Interchangeability With a Reference Product: Update,” which describes the FDA’s evolution in thinking about considerations for switching studies intended to support a demonstration of interchangeability with a reference product. Specifically, the FDA notes that “currently available analytical technologies can structurally characterize highly purified therapeutic proteins and model in vivo functional effects with a high degree of specificity and sensitivity using in vitro biological and biochemical assays.” As such, the FDA notes that it will update its interchangeability guidance to reflect that applicants can “choose to provide an assessment of why the comparative analytical and clinical data provided in the application or supplement support a showing that the switching standard … has been met.” Sponsors developing biosimilars should consider how this draft guidance may alter their development plans and regulatory strategies, and public companies developing biologics or biosimilars should review any current risk factor or government regulation descriptions to determine if updates are needed to reflect the acceptance of analytical data for interchangeability demonstrations.
• We are continuing to monitor the implementation of the European Commission’s legislative proposals — Regulation 2023/0131 and Directive 2023/0132 — to replace the current EU regulatory framework for medicines (including those for rare diseases and for children). The proposals, announced on April 26, 2023, aim to reduce costs, expedite the introduction of new medicines, and prevent medicine shortages. Read our summary of these proposals here. The European Commission provided the legislative proposals to the European Parliament and the European Council for their review and approval, and in April 2024, the European Parliament proposed amendments to the legislative proposals. Read our summary of these proposed amendments here. Once the European Commission’s legislative proposals are approved (with or without amendment), they will be adopted into EU law.
• We are continuing to monitor the implementation of the Windsor Framework, which will apply as of January 1, 2025, in the UK. On February 27, 2023, the UK government and the European Commission announced a political agreement in principle to replace the Northern Ireland Protocol with a new set of arrangements: the Windsor Framework. This new framework fundamentally changes the existing system under the Northern Ireland Protocol, including the regulation of medicines in the UK. In particular, the MHRA will be responsible for approving all medicines destined for the UK market (i.e., Great Britain and Northern Ireland), and the European Medicines Agency (EMA) will no longer have a role in approving medicines destined for Northern Ireland. The MHRA will grant a single UK-wide marketing authorization for all medicinal products sold in the UK, enabling medicines to be sold in a single pack and under a single authorization throughout the UK. Medicines marketed in the UK will also be required to carry a “UK only” label to differentiate them from those sold within the EU. The Windsor Framework was approved by the EU-UK Joint Committee on March 24, 2023, meaning the UK government and the EU will enact legislative measures to bring it into law.
• We are continuing to monitor the effects in the UK of the International Recognition Procedure (IRP) (effective January 1, 2024), which replaces the European Commission Decision Reliance Procedure. The IRP allows the MHRA to consider the expertise and decision-making of medicine regulators in Australia, Canada, the EU, Japan, Singapore, Switzerland, and the US when approving a new medicine. The decentralized and mutual recognition reliance procedure, which allows the MHRA to have regard for approvals in the EU, will be incorporated under the umbrella of the IRP.

Medical Devices and Medtech

• We are monitoring the FDA’s implementation of the action items identified in its “CDRH 2024 Safety Report” and “CDRH 2024 Innovation Report.” The action items identified in the reports include advancing improved device quality, enhancing the medical-device recall program, and modernizing premarket review.
• In August 2024, the FDA issued draft guidance on Predetermined Change Control Plans for Medical Devices. Predetermined Change Control Plans (PCCPs) provide a mechanism through which the FDA may preauthorize certain modifications of a device that generally would otherwise require a new marketing submission. The draft guidance covers many similar concepts as the draft guidance on PCCPs for Artificial Intelligence/Machine Learning (AI/ML)-enabled device software functions issued in April 2023, but it covers PCCP content and process for all device types and for all types of device marketing submissions. The FDA hosted a webinar on the draft guidance in September 2024, and comments on the draft may be submitted through November 20, 2024.
• In August 2024, the FDA issued a discussion paper on Health Equity for Medical Devices. In the discussion paper, the FDA describes “factors and considerations that may be important for sponsors and other relevant parties as they develop medical device clinical studies” and requests feedback in particular on the “possible considerations that may help inform the design of a clinical study that adequately reflects the intended use population for a particular medical device.” Comments on the discussion paper may be submitted through October 4, 2024.
• In August 2024, the FDA issued final guidance on the Voluntary Malfunction Summary Reporting (VMSR) Program for Manufacturers, which allows manufacturers to submit malfunction summary reports on a quarterly basis for certain malfunctions related to certain types of devices, instead of individual 30-day malfunction reports. The final guidance generally reflects the draft version of the guidance issued in 2022 and provides an explainer of the VMSR Program. We are continuing to monitor how the program is implemented by the FDA and industry.
• In September 2024, the FDA issued draft guidance on Incorporating Voluntary Patient Preference Information over the Total Product Life Cycle. The draft guidance proposes updates to the FDA’s final guidance on the subject issued in 2016, and when finalized, will provide updated recommendations for designing, collecting, and evaluating patient preference information in the context of benefit-risk assessments of devices. The FDA plans to hold a webinar on the draft guidance on October 15, 2024, and comments on this draft guidance may be submitted through December 5, 2024.
• We are continuing to monitor the activities of the recently formed FDA Digital Health Advisory Committee (DHAC). The committee will convene its first meeting November 20-21, 2024, to discuss “premarket performance evaluation, risk management, and postmarket performance monitoring for Generative AI-enabled devices.” We are additionally monitoring for potentially forthcoming draft guidance on the subject of AI in regulated drug development contexts as well as life cycle management considerations and premarket submission recommendations for AI/ML-enabled device software functions.
• We are continuing to monitor updates to the FDA’s virtual town halls focused on discussion of “the current medical device sterilization landscape and potential activities to advance innovation in the field of medical device sterilization.” Upcoming town halls have been scheduled for October 9 and October 30, 2024.
• We are continuing to monitor the implementation of new cybersecurity authorities for software-containing or internet-connected devices, enabling the FDA to require sponsors to develop cybersecurity plans for post-market implementation, as mandated in section 3305 of FDORA. The FDA issued its guidance on its Refuse to Accept Policy for cyber devices and related systems in March 2023, but this policy expired on October 1, 2023, after the FDA published its final guidance in September 2023, “Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions.” In March 2024, the FDA issued draft guidance with select updates to the September 2023 guidance related to cybersecurity considerations for cyber devices and for documentation in device premarket submissions.
• We are continuing to monitor the effects of Regulation (EU) 2017/745 (the European Medical Device Regulation, or MDR), which has been applicable in the EU since May 26, 2021. Medical devices with a valid certificate under the previous EU Medical Devices Directive must be fully transitioned to the MDR (subject to fulfillment of certain conditions) by December 31, 2027, for higher-risk medical devices (except for custom-made Class III implantable devices, for which the relevant date is May 26, 2026), and by December 31, 2028, for lower-risk medical devices. The MDR also requires the use of the EU’s medical-device database, EUDAMED, which effectively outlines the life cycle of medical devices by collating and processing information about those medical devices and related companies, such as the manufacturers of those devices. EUDAMED will contain six modules related to: (1) actor registration (e.g., manufacturer, authorized representative, distributor, or importer); (2) unique device identification/device registration; (3) notified bodies and certificates; (4) clinical investigations and performance studies; (5) vigilance and post-market surveillance; and (6) market surveillance. Modules (1), (2), and (3) are already available, and Modules (4), (5), and (6) are under development. The use of EUDAMED is not yet mandatory. There will be a gradual rollout of EUDAMED, requiring manufacturers to provide information about their products to available EUDAMED modules without needing to wait for the remaining modules to be developed. This mandatory registration is expected to take effect in late 2025.

In Vitro Diagnostics and Laboratory Testing

• We are monitoring the FDA’s efforts to reclassify most in vitro diagnostics (IVDs) that are currently Class III (high risk), including infectious disease and companion diagnostic IVDs, into Class II (moderate risk). According to a press release dated January 31, 2024, the FDA intends to propose reclassification of IVDs for which it believes there is sufficient information to establish special controls that, in combination with general controls, provide a reasonable assurance of safety and effectiveness for the tests. For example, on September 25, 2024, the FDA issued a proposal to reclassify antigen, antibody, and nucleic acid-based Hepatitis B virus assay devices from Class III to Class II. Comments on the FDA’s proposal to reclassify these tests may be submitted through November 25, 2024.
• New Regulation 2024/0021 became applicable on June 13, 2024, in the EU. The new regulation extends the transition periods under the In Vitro Diagnostic Medical Devices Regulation (subject to fulfillment of certain conditions) for in vitro diagnostic medical devices until December 31, 2027, for higher-risk IVDs, and until December 31, 2029, for lower-risk IVDs. The IVDR requires manufacturers to submit all applications for higher-risk IVDs that they want to transition to the IVDR by May 26, 2025, and by May 26, 2027, for lower-risk IVDs. The IVDR also requires manufacturers to have in place a quality management system in accordance with the IVDR by May 26, 2025, and a signed contract with an EU notified body for review and conformity assessment by September 26, 2025, for higher-risk IVDs, and by September 26, 2027, for lower-risk IVDs.

How Companies Manufacture, Promote, and Monitor Their Approved Products

• The FDA issued an updated final guidance on nitrosamine impurities in September 2024. This guidance expands the agency’s 2021 guidance and provides recommendations for risk assessments, testing, and implementation of controls to prevent or reduce nitrosamine impurities in active pharmaceutical ingredients (APIs) and drug products. Importantly, the guidance explains that nitrosamine drug substance-related impurities (NDSRIs) (e.g., a scenario in which the API itself may be a nitrosamine precursor) are considered nitrosamine impurities. The guidance also notes that investigational new drug (IND) sponsors, not just sponsors of approved products, should be mindful of potential nitrosamine impurities in drug products so these impurities can be addressed before submission of a New Drug Application (NDA) or Biologics License Application (BLA).
• The FDA issued draft guidance titled Addressing Misinformation About Medical Devices and Prescription Drugs: Questions and Answers in early July with recommendations for industry on voluntarily addressing misinformation about or related to their approved/cleared medical products. In the draft guidance, the FDA interprets the term “misinformation” to refer to “implicit or explicit false, inaccurate, or misleading representations of fact about or related to a firm’s approved/cleared medical product.” The FDA expresses as its primary concern with misinformation the potential public health harm that it may cause.
• Industry members and their supply chain partners are continuing to enjoy a one-year stabilization period until November 27, 2024, to allow trading partners to implement, troubleshoot, and mature their electronic interoperable systems to meet the requirements of the Drug Supply Chain and Security Act (DSCSA). This stabilization period is intended to avoid disruption to the supply chain and ensure continued patient access to drug products as trading partners work to fully implement the enhanced drug security requirements of the DSCSA. The FDA also issued a compliance policy guidance, effective immediately, regarding the enforcement of requirements for enhanced drug distribution security. It also issued a revised final compliance policy guidance that describes the FDA’s policies regarding enforcement requirements for wholesale distributors and dispensers to verify a product’s identifier in certain circumstances. As the year progresses, companies and their trading partners must finalize implementation of electronic interoperable systems. To date, the FDA has not issued any extension of the stabilization period, and speaking at a late-August conference, the director of the FDA’s Office of Drug Security, Integrity, and Response noted that exemption requests could be made by industry members where technical issues continue.
• In February 2024, the FDA published its final rule harmonizing its device good manufacturing practice requirements to align more closely with the international consensus standard for devices by converging with the quality management system requirements used by other regulatory authorities from other jurisdictions. The final rule will take effect February 2, 2026.

Whether Government or Commercial Payers Are Willing to Pay for a Product, How Much They Are Willing to Spend, and Under What Circumstances

Pharmaceuticals and Biologics

• Via our Inflation Reduction Act (IRA) web page, we are continuing to follow how the IRA of 2022 will affect Medicare and commercial reimbursement for pharmaceutical and biologic products. On August 14, 2024, the Centers for Medicare & Medicaid Services (CMS) released the first round of “maximum fair prices” for the first 10 drugs selected for negotiation. These prices will go into effect on January 1, 2026. We anticipate that CMS will release its statutorily mandated public explanation of these prices by March 1, 2025. The release of this information will provide the industry with a better understanding of how low CMS set the first prices under the drug price negotiation program, including potentially how closely CMS adhered to the pricing of therapeutic alternatives identified for each of the selected drugs. This will come approximately one month after CMS identifies the next 15 drugs subject to negotiation on February 1, 2025 (with pricing going into effect January 1, 2027). We are also actively tracking ongoing constitutional challenges to the IRA’s drug price negotiation program. Most recently, on September 20, 2024, the US Circuit Court of Appeals for the Fifth Circuit reversed a federal district court decision to dismiss a suit brought by the National Infusion Center Association (NICA) against the federal government for lack of subject-matter jurisdiction. The appeals court found that NICA did in fact have standing to challenge the negotiation program. While there also continue to be a host of legislative proposals regarding the IRA, as of the third quarter of 2024, none appear likely to pass through Congress in the near term.
• We are continuing to monitor the backlash from the framework proposed by the National Institute of Standards and Technology in December 2023 for how government agencies can implement “march-in” rights under the Bayh-Dole Act, as well as the White House statement released on the same day indicating that it plans to use such march-in rights to combat pharmaceutical pricing, signaling that the government will consider marching in and assigning drug patents to others to the extent that a particular drug has been funded by taxpayers and the government considers the price to be too high. See “‘March-In’ Rights Under the Bayh-Dole Act: Implications for Pharmaceutical and Medical Technology Companies.”
• We are monitoring any future litigation developments in the Genesis Health Care v. Becerra ruling in November 2023, which deemed the interpretation of eligible 340B patients by the Health Resources and Services Administration (HRSA) to be too narrow. In response to this case, the HRSA announced a new web page with program policies, guidance documents, and regulations for stakeholders to assist 340B-covered entities with the meaning of “eligible patient” under the 340B program. Here is a link to the web page for 340B Patient Definition Compliance Resources.
• Congress is considering numerous proposed pharmacy benefit manager (PBM) reforms in both the House and the Senate. Legislative proposals include, but are not limited to, eliminating rebates; divorcing service fees from the price of a drug, discount, or rebate; prohibiting spread pricing; limiting administrative fees; requiring PBMs to report formulary placement rationale; promoting transparency; and many others. PBM reform and transparency measures have become a key policy topic in Washington and continue to be front and center for policymakers.
• In July 2024, the Federal Trade Commission (FTC) released an interim staff report (the Interim Report), “Pharmacy Benefit Managers: The Powerful Middlemen Inflating Drug Costs and Squeezing Main Street Pharmacies.” The Interim Report describes what FTC staff has uncovered to date during a two-year investigation of the six largest PBMs. The agency claims that vertical integration and market consolidation have allowed a few PBMs to exert power over drug and consumer prices as well as unaffiliated pharmacies. In September 2024, Express Scripts sued the FTC over the Interim Report. The lawsuit describes the FTC’s report as “unfair, biased, erroneous, and defamatory,” and asks the court to order the agency to withdraw the report. Further, in September 2024 the FTC sued CVS Health’s Caremark and its Group Purchasing Organization (GPO), Zinc Health Services; UnitedHealth Group’s Optum Rx and its GPO, Ascent Health Services; and Cigna Group’s Express Scripts/Evernorth Health and their GPOs, Medco Health Services/Ascent Health Services. In this lawsuit the FTC alleges that the defendants inflated insulin prices through alleged anticompetitive practices, among other allegations. The outcome of the Express Scripts and FTC lawsuits and the FTC’s increasing scrutiny of PBMs is unclear.
• On September 26, 2024, CMS published a final rule in the Federal Register titled “Medicaid Program; Misclassification of Drugs, Program Administration and Program Integrity Updates Under the Medicaid Drug Rebate Program” (the Final Rule). In issuing the Final Rule, CMS declined to finalize parts of its May 2023 proposed rule such as Best Price stacking, defining “vaccine,” broadening the term “manufacturer,” or implementing a drug price verification survey. However, the Final Rule adopts other significant changes to the Medicaid Drug Rebate Program that may alter manufacturers’ rebate obligations. Of note, CMS finalized new definitions of “covered outpatient drug,” “internal investigations,” and “market date.” The Final Rule also implements a future requirement that Medicaid managed care beneficiary identification cards include Medicaid-specific billing identifiers, which may support curbing 340B duplicate discounts.
• We are monitoring the implementation of Regulation (EU) 2021/2282 (the HTA Regulation) on health technology assessment (HTA), which came into force on January 11, 2022, in the EU and will apply as of January 12, 2025. An HTA is a multidisciplinary process that summarizes information about the medical, social, economic, and ethical issues related to the use of a health technology in a systematic, transparent, unbiased, and robust manner. Currently — and until the applicability of the HTA Regulation in 2025 — after obtaining the respective authorization for health technologies, a manufacturer must apply to different HTA agencies in various EU member states before new health technologies are broadly accessible. The HTA Regulation aims to harmonize various procedures and standards by ensuring that health technology developers can submit only once and at the EU level any information, data, analyses, and other evidence required for the contemplated joint clinical assessment. The HTA Regulation will have a phased rollout but will eventually become applicable for all medicines with a new active substance that receives a marketing authorization in the EU under the centralized procedure. The rollout will be as follows: (i) January 12, 2025, for oncology and advanced therapy medicinal products; (ii) January 12, 2028, for orphan medicinal products; and (iii) January 12, 2030, for all other applicable medicinal products.

Medical Devices and Medtech

• On August 6, 2024, CMS released its final Transitional Coverage for Emerging Technologies (TCET) rule, which describes a process for leveraging the current national coverage determination and coverage with evidence development protocols to speed up Medicare coverage of medical technology that has been granted “breakthrough” status by the FDA. Notably, CMS anticipates accepting around five TCET candidates each year, with quarterly review cycles depending on when applications are received. 

Companies’ Interactions With Their Customers and Other Stakeholders

• Recent Fraud and Abuse and Compliance-Related Actions:
  • September 6, 2024: Medical-device company THD America agreed to pay $700,000 to resolve allegations that it knowingly caused physicians to use incorrect codes to obtain inflated reimbursement from Medicare and Medicaid in connection with the use of THD’s hemorrhoid removal system. The DOJ press release is available here.
  • September 4, 2024: Generic drug maker Glenmark Pharmaceuticals agreed to pay $25 million to settle allegations of price fixing for its drug pravastatin. Specifically, the government alleged that Glenmark paid and received compensation in violation of the Anti-Kickback Statute through arrangements on prices, supply, and allocation of customers with other pharmaceutical manufacturers. The DOJ press release is available here.
  • July 18, 2024: DaVita Inc. agreed to pay approximately $35.5 million to resolve allegations of violating the False Claims Act by paying kickbacks to induce referrals to a former subsidiary, DaVita Rx, that provided pharmacy services for dialysis patients. The government alleged that DaVita paid kickbacks to a competitor to induce referrals to the Rx subsidiary to serve as a “central fill pharmacy” for the competitor’s Medicare patients — and that in exchange, DaVita paid to acquire European dialysis clinics and agreed to purchase competitor products. The government also alleged that DaVita paid kickbacks to nephrologists and vascular access physicians (in the form of uncollected management fees) to encourage the referral of patients to DaVita’s dialysis centers. The DOJ press release is available here.

Companies’ Interactions With Patient Data

• With companies collecting patient data on a global basis, we closely follow the latest privacy law developments around the world. In the EU, the UK, and Switzerland, we are tracking evolving case law and guidance surrounding the EU and UK General Data Protection Regulation and the Swiss Federal Act, as well as implications for companies collecting and handling patient data. 
• In the US, the post-Dobbs era is marked by intense regulatory focus on health data. This includes state consumer privacy legislation protecting sensitive health information; health-data-specific laws, such as the state of Washington’s My Health My Data Act, which came into force on March 31, 2024 (see Goodwin’s client alert for more information); and a wave of FTC enforcement actions against digital health providers. To protect information related to reproductive health services, the Health and Human Services Office for Civil Rights (HHS-OCR) issued regulations amending the Privacy Rule of the Health Insurance Portability and Accountability Act (HIPAA) to prohibit covered entities and business associates from disclosing information about reproductive health services to law enforcement in cases where the procedures were lawful in the state in which they occurred. The amendments become effective in December 2024. 
• On June 20, 2024, the US District Court for the Northern District of Texas in American Hospital Association (AHA), et al. v. Xavier Becerra, et al. vacated the portion of HHS-OCR’s bulletin on tracking technologies that states that an IP address combined with an unauthenticated visit to a website could constitute protected health information (PHI). The ruling left intact the remainder of the bulletin, which clarifies that HIPAA applies to a covered entity’s or business associate’s use of website cookies and other tracking technologies, when the data collected by such technologies relates to identifiable patients. HHS-OCR will not appeal the ruling.
• On February 28, 2024, President Joe Biden signed Executive Order 14117 on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern (the EO) (see Goodwin’s client alert for more information). At the same time, the DOJ issued an Advance Notice of Proposed Rulemaking (ANPRM), which set out a framework for proposed regulations that would implement the EO and solicited public comments. Together, the EO and ANPRM contemplate a framework that would regulate access to certain sensitive data categories — including, notably, health data, human “omic” data, and, potentially, biospecimens — by people and entities associated with “countries of concern,” such as the People’s Republic of China (including Hong Kong and Macao), Russia, North Korea, Iran, Cuba, and Venezuela. The proposed framework would ban sales of “bulk” sensitive data and disclosures of “bulk” human omics data to these countries of concern while also imposing cybersecurity restrictions on access to sensitive data by vendors, employees, and investors residing in, owned by, or subject to the control of a country of concern. The public comment period closed on April 19, 2024, and an initial draft of the proposed regulations implementing the EO is expected in the next several months.
• The European Council and European Parliament have reached a provisional agreement on the European Health Data Space (EHDS). The European Commission published a proposal for the EHDS back in May 2022, and now we’re reaching the final stages. The main objectives of the EHDS are to improve individual access to and control over patient health data in the EU and to facilitate cross-border research and innovation in health. The European Council and European Parliament will need to endorse the provisional agreement before it is formally adopted. See Goodwin’s blog posts here and here for further details.