We are subject, directly or indirectly, to United States federal and state healthcare fraud and abuse and false claims laws and regulations. Prosecutions under such laws have increased in recent years and we may become subject to such litigation. If we are unable to, or have not fully complied with such laws, we could face substantial penalties.
Our operations are directly, or indirectly through customers, subject to various state and federal fraud and abuse laws, including, without limitation, the federal Anti-Kickback Statute and federal False Claims Act. These laws may impact, among other things, our sales, marketing and education programs.
The federal Anti-Kickback Statute prohibits persons from knowingly and willfully soliciting, offering, receiving or providing remuneration, directly or indirectly, in exchange for or to induce either the referral of an individual, or the furnishing or arranging for a good or service, for which payment may be made under a federal healthcare program such as the Medicare and Medicaid programs. Several courts have interpreted the statute’s intent requirement to mean that if any one purpose of an arrangement involving remuneration is to induce referrals of federal healthcare covered business, the statute has been violated. The Anti-Kickback Statute is broad and, despite a series of narrow safe harbors, prohibits many arrangements and practices that are lawful in businesses outside of the healthcare industry. Penalties for violations of the federal Anti-Kickback Statute include criminal penalties and civil sanctions such as fines, imprisonment and possible exclusion from Medicare, Medicaid and other federal healthcare programs. Many states have also adopted laws similar to the federal Anti-Kickback Statute, some of which apply to the referral of patients for healthcare items or services reimbursed by any source, not only the Medicare and Medicaid programs.
The federal False Claims Act prohibits persons from knowingly filing, or causing to be filed, a false claim to, or the knowing use of false statements to obtain payment from the federal government. Suits filed under the False Claims Act, known as “qui tam” actions, can be brought by any individual on behalf of the government and such individuals, commonly known as “whistleblowers,” may share in any amounts paid by the entity to the government in fines or settlement. The frequency of filing qui tam actions has increased significantly in recent years, causing greater numbers of medical device, pharmaceutical and healthcare companies to have to defend a False Claim Act action. When an entity is determined to have violated the federal False Claims Act, it may be required to pay up to three times the actual damages sustained by the government, plus civil penalties for each separate false claim. Various states have also enacted laws modeled after the federal False Claims Act.
We are unable to predict whether we could be subject to actions under any of these laws, or the impact of such actions. If we are found to be in violation of any of the laws described above or other applicable state and federal fraud and abuse laws, we may be subject to penalties, including civil and criminal penalties, damages, fines, exclusion from government healthcare reimbursement programs and the curtailment or restructuring of our operations.
Failure to protect our information technology infrastructure against cyber-based attacks, network security breaches, service interruptions or data corruption could materially disrupt our operations and adversely affect our business.
The operation of our business depends on our information technology systems. We rely on our information technology systems to, among other things, effectively manage sales and marketing data, accounting and financial functions, inventory management, product development tasks, clinical data, customer service and technical support functions. Our information technology systems are vulnerable to damage or interruption from earthquakes, fires, floods and other natural disasters, terrorist attacks, power losses, computer system or data network failures, security breaches, data corruption, and cyber-based attacks. Cyber-based attacks can include computer viruses, computer denial-of-service attacks, phishing attacks, worms, and other malicious software programs or other attacks, covert introduction of malware to computers and networks, impersonation of authorized users, and efforts to discover and exploit any design flaws, bugs, security vulnerabilities, or security weaknesses, as well as intentional or unintentional acts by employees or other insiders with access privileges, intentional acts of vandalism by third parties and sabotage. In addition, federal, state, and international laws and regulations, such as the General Data Protection Regulation adopted by the European Union and EEA countries can expose us to enforcement actions and investigations by regulatory authorities, and potentially result in regulatory penalties and significant legal liability, if our information technology security efforts fail. In addition, a variety of our software systems are cloud-based data management applications, hosted by third-party service providers whose security and information technology systems are subject to similar risks.
We operate in a highly competitive industry that is subject to rapid change. If our competitors are able to develop and market products that are safer or more effective than our products, our commercial opportunities will be reduced or eliminated.
The health care industry is highly competitive, subject to rapid change and significantly affected by new product introductions and other market activities of industry participants. The obesity treatment market in which we operate has grown significantly in