GLOBAL HEALTH CARE COMPLIANCE NEWS & ANALYSIS 2016 - 2019 TABLE OF CONTENTS I. International Risk a. In Bloomberg Law, Cross-Practice Team Analyzes Vertical Integration and Firewalls in Health Care Transactions b. Podcast: The Current Trade Secrets Landscape: Criminal and Civil Litigation Strategies and Tactics c. In Bio-IT World, Attorneys Address ROI of Health Care Compliance d. New International Pharmaceutical Practice Code Tightens Restrictions on Gifts e. Bid Rigging: For Multinationals, More Than Just a Local Law Violation f. Implications of Distributor Misconduct for Global Health Care and Life Sciences Companies g. Corporate Social Responsibility Compliance in 2018, and Beyond – An Overview for In-House Legal Counsel h. Globalizing Your Compliance Program i. DOJ Publishes New Guidance for Compliance Programs j. Forecasting International Risk Climate Under President Trump k. $519 million FCPA Payment by Teva Pharmaceuticals – Largest Ever FCPA Payment by a Pharmaceutical Company – Follows Large FCPA Plea Agreement with Odebrecht and Braskem l. Mondelēz Agrees to Pay $13 Million to Settle FCPA Charges Related to Inadequate Due Diligence and Accounting Controls over Third Party in India m. Hot Topics in Supply Chain Compliance n. Case Closed! – The Conflict Minerals Rule Litigation is Over, but the Drama Continues o. SEC Issues Updated Statement on Conflict Minerals Rule p. Evaluating the FCPA Pilot Program: The Data, The Trends q. Helping Piece Together the Life Sciences Puzzle r. Using Biospecimens Collected Abroad in Future Research: Key Considerations s. No Need to Overreact: Protecting Privilege in the U.S. and U.K. After the ENRC Decision t. Australia Proposes Modern Slavery Reporting Requirements for Multinationals u. Unintended Consequences: Ex-U.S. Activities Impacting U.S. Federal Health Care Business II. Privacy & Data Security a. GDPR is here: the dawning of a new era? b. GDPR – No Notification Fees, But UK Regulator to Implement New “Data Protection” Fees c. New Draft Guidelines on GDPR Consent Requirement’s Application to Scientific Research d. The UK’s Data Protection Authority goes myth-busting: fining powers; consent; the “misconception” that the GDPR is an unnecessary burden; and data breach reporting e. Privacy Implications of President Trump’s Immigration Order f. The GDPR – Possible Impact on the Life Sciences and Healthcare Sections g. Cookies Crumble? The draft EU Regulation on Privacy and Electronic Communications h. Thoughts on EU’s Draft E-Privacy Regulation i. The Information Commissioner’s Guidance on Consent under the GDPR j. UK Government Sets Forth Approach for GDPR III. Brexit a. Implications of the UK’s Brexit Referendum b. An Update on Brexit and the Implications for General Data Protection Regulation (GDPR) c. Brexit White Paper Published IV. Asia a. In Asia-Pacific Biotech News, Life Sciences Partner Addresses Proposed China Pharmaceutical Regulatory Changes b. The Evolving Regulatory Landscape for Clinical Trials in India c. The China Drug Administration Proposes a Working Procedure for Pharmaceutical Study Data Protection d. Spotlight on Korea e. China FDA Clarifies Legal Consequences of Clinical Trial Data Inspections f. Donations and Grants in China: Compliance Controls Beyond T&E g. Recent Developments in Japanese Enforcement of Foreign Bribery Laws h. China Solicits Comments on Drug GCP a. CFA Amends Medical Device Recall Rules b. Hong Kong Proposes Enhanced AML Obligations for Professionals and Beneficial Owner Registries for Hong Kong Companies c. China’s State Council Announces Major Policies to Reform the Pharmaceutical Industry d. U.S. Department of Commerce Establishes Favorable Export Control Policies for India e. South Korea Fines Prominent Pharmaceutical Manufacturer in Latest Anti- Corruption Enforcement Efforts f. Shanghai Tightens Industry Interactions with HCPs V. European Union, Middle East, Africa a. De-Implementation Day: Preparing for Changes to U.S. Sanctions Targeting Iran b. European Health Care Compliance Challenges (And Solutions) c. EU Reaches Final Agreement on Conflict Minerals Regulation – An Overview d. The UK Modern Slavery Act – A Compliance Primer for Fund Managers e. Privacy Shield Dented? The EU Parliament’s Civil Liberties, Justice and Home Affairs Committee Identifies Deficiencies in U.S. Implementation of the Privacy Shield f. Excessive Pricing in Generic Drug Markets g. The EU Conflict Minerals Regulation – Frequently Asked Questions h. U.S. Announces Revocation of Sudanese Sanctions Regulations: New Opportunities and Familiar Risks VI. Latin America a. Mexico Enacts a Sweeping New Anti-Corruption Regime, Accompanied by a Public Apology from President Peña Nieto and Increased Attention on Mexico’s Energy Sector by U.S. Regulators b. Top 10 Anti-Corruption Red Flags in Latin America c. Update on the Anti-Corruption Landscape in Mexico d. A Judicial Reinterpretation of the Brazilian Constitution’s Right to Health Care INTERNATIONAL RISK IN THE NEWS In Bloomberg Law, Cross-Practice Team Analyzes Vertical Integration and Firewalls in Health Care Transactions June 20, 2019 Practices: Health Care, Health Care Finance & Restructuring, Data Practice, Digital Health, Health Privacy & Security, Technology, Media & Telecommunications, Antitrust In a Bloomberg Law article published on June 19, health care partners Tim McCrystal and Adrianne Ortega (both of Boston) and antitrust associate David Young (Washington, D.C.) analyze the potential legal risks that arise in health care industry vertical transactions. The article also examines key issues to consider when creating firewall structures to mitigate risks. The authors explain that a range of legal issues may arise when organizations integrate vertically beyond their current line of business, including data sharing, antitrust, fraud and abuse laws, conflicts of interest, confidentiality obligations and corporate practice of medicine. Copyright © 2019 Ropes & Gray LLP. All rights reserved. Attorney advertising. Prior results do not guarantee a similar outcome. Professional Perspective Vertical Integration and Firewalls in Health-Care Transactions Timothy M. McCrystal, Adrianne Ortega, and David A. Young, Ropes & Gray Reproduced with permission. Published June 2019. Copyright © 2019 The Bureau of National Affairs, Inc. 800.372.1033. For further use, please visit: http://bna.com/copyright-permission-request/ Vertical Integration and Firewalls in Health-Care Transactions Contributed by Timothy M. McCrystal, Adrianne Ortega, David A. Young, Ropes & Gray Driven by a desire to reduce cost, improve care, keep up with competitors, and participate in evolving reimbursement programs, health-care providers are increasingly undertaking vertical integration transactions. While these transactions present opportunities for health-care organizations to expand their operations, they may also present a variety of legal risks related to the sharing and use of information and data. Vertical integration is an expansion up or down the service or supply chain beyond a company's current line of business. In the health-care industry, vertical integration translates to organizations offering, directly or indirectly, a broader range of services on the continuum of the delivery of health-care services. Examples of vertical integration in the health-care industry include CVS Health's acquisition of insurance company Aetna, UnitedHealth's planned acquisition of DaVita's physician group, Cigna's acquisition of Express Scripts, a pharmacy benefit manager, and Medtronic's 2015 acquisition of Diabeter, a diabetes clinic and research center. Health-care organizations that seek to integrate vertically should consider the attendant legal risks, including antitrust, confidentiality, and conflict of interest concerns, among others. To address these issues, acquirers should consider whether organizational and/or operational separation of certain functions of the combined organization is appropriate. These structural and/or operational constructs are commonly referred to as “firewalls.” This article will discuss potential legal risks that arise in the context of vertical integration, and key issues to consider when creating firewall structures. Firewalls Firewalls may help mitigate the legal and conflict of interest risks involved with vertical integration by insulating an organization, or a part of it, from sharing information that increases an organization's exposure to risk. Examples of this type of information include personal health information, and data belonging to an entity that competes with an organization's vertically integrated business. Firewalls may be set up within the different parts of an organization, as well as between companies and other parties. The elements of a firewall may include structural, technical, or operational separation of one or more of the following business components: • Separate organizations, to create a clear line of demarcation between the operations of affiliates • Management and employee teams, to ensure that business objectives, financial goals, pricing, and compensation are not connected with the performance of the firewalled organization • IT systems and servers, to limit flows of sensitive or protected data between organizations, such as patient or competitor data • Compliance programs, with separate policies and procedures, to ensure that proper reporting mechanisms are in place for each organization and to ensure that both organizations property maintain the firewall • Marketing and sales, to