Multiple Concussions Result in Greater Cognitive Deficits

A new study published in the Journal of Neurotrauma examined the lifetime traumatic injury and cognitive domain deficits following traumatic brain injury. Most interesting for those representing clients who sustained mild traumatic brain injuries is that the number of prior mild traumatic brain injuries and the role they play in affecting one’s cognitive abilities.

The study examined the longer-term cognitive effects of traumatic brain injury severity and the number of mild TBI’s in later life. The researchers examined the subset (n=15,764) of the PROTECT Study, a cohort assessing risk factors for cognitive decline between the ages of 50 and 90 years. The study found that those who had suffered at least a single mild TBI demonstrated significantly poorer attention scores at baseline compared with the no head injury group. Compared with those with no mild TBI’s, those in the 3 MTBI group manifested poorer baseline executive function and attention scores, while those who had suffered 4 or more mild traumatic brain injuries demonstrated poorer attention, processing speed, and working memory compared with those reporting no mild traumatic brain injuries. The researchers stated:

“TBI’s associated with fixed, dose and severity-dependent cognitive deficits. The most sensitive cognitive domains are attention and executive function, which approximately double the effect compared with processing speed and working memory. Post-TBI cognitive rehabilitation should be targeted appropriately to domain-specific effects…. Significant long-term cognitive deficits were associates with three or more lifetime MTBI’s, a critical consideration when counselling individuals post-TBI about continuing high-risk activities.”

The citation for the study is Lennon MJ, Brooker H, Creese B, Thayanandan T, Rigney G, Aarsland D, Hampshire A, Ballard C, Corbett A, Raymont V. Lifetime Traumatic Brain Injury and Cognitive Domain Deficits in Late Life: The PROTECT-TBI Cohort Study. J Neurotrauma. 2023 Jan 27. doi: 10.1089/neu.2022.0360. Epub ahead of print. PMID: 36716779.

COPYRIGHT © 2023, STARK & STARK

The FTC Announces First Health Breach Notification Rule Enforcement Action

On February 1, the Federal Trade Commission (“FTC”) announced enforcement action for the first time under its Health Breach Notification Rule[1]. The complaint against telehealth and prescription drug discount provider GoodRx Holdings Inc. (“GoodRx”), alleges its failure to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google and other companies.

In a first-of-its-kind proposed order, filed by the Department of Justice on behalf of the FTC, GoodRx will be prohibited from sharing user health data with applicable third parties for advertising purposes, and has agreed to pay a $1.5 million civil penalty for violating the rule. The proposed order must be approved by the federal court to go into effect. The Health Breach Notification Rule requires vendors of personal health records and related entities, which are not covered by the Health Insurance Portability and Accountability Act (HIPAA), to notify consumers and the FTC of unauthorized disclosures. In a September 2021 policy statement, the FTC warned health apps and connected devices that they must comply with the rule.

According to the FTC’s complaint, for years GoodRx violated the FTC Act by sharing sensitive personal health information with advertising companies and platforms—contrary to its privacy promises—and failed to report these unauthorized disclosures as required by the Health Breach Notification Rule.  Specifically, the FTC claims GoodRx shared personal health information with Facebook, Google, Criteo and others. According to the FTC, since at least 2017, GoodRx deceptively promised its users that it would never share personal health information with advertisers or other third parties. GoodRx repeatedly violated this promise by sharing sensitive personal health information—such as including its users’ prescription medications and personal health conditions.

The FTC also alleges GoodRx monetized its users’ personal health information, and used data it shared with Facebook to target GoodRx’s own users with personalized health and medication-specific advertisements on Facebook and Instagram.

The FTC further alleges that GoodRx:

  • Failed to Limit Third-Party Use of Personal Health Information: GoodRx allowed third parties it shared data with to use that information for their own internal purposes, including for research and development or to improve advertising.
  • Misrepresented its HIPAA Compliance: GoodRx displayed a seal at the bottom of its telehealth services homepage falsely suggesting to consumers that it complied with the Health Insurance Portability and Accountability Act of 1996 (HIPAA), a law that sets forth privacy and information security protections for health data.
  • Failed to Implement Policies to Protect Personal Health Information: GoodRx failed to maintain sufficient policies or procedures to protect its users’ personal health information. Until a consumer watchdog publicly revealed GoodRx’s actions in February 2020, GoodRx had no sufficient formal, written, or standard privacy or data sharing policies or compliance programs in place.

In addition to the $1.5 million penalty for violating the rule, the proposed federal court order also prohibits GoodRx from engaging in the deceptive practices outlined in the complaint and requires the company to comply with the Health Breach Notification Rule. To remedy the FTC’s numerous allegations, other provisions of the proposed order against GoodRx also:

  • Prohibit the sharing of health data for advertising: GoodRx will be permanently prohibited from disclosing user health information with applicable third parties for advertising purposes.
  • Require user consent for any other sharing: GoodRx must obtain users’ affirmative express consent before disclosing user health information with applicable third parties for other purposes. The order requires the company to clearly and conspicuously detail the categories of health information that it will disclose to third parties.  It also prohibits the company from using manipulative designs, known as dark patterns, to obtain users’ consent to share the information.
  • Require the company to seek deletion of data: GoodRx must direct third parties to delete the consumer health data that was shared with them and inform consumers about the breaches and the FTC’s enforcement action against the company.
  • Limit Retention of Data: GoodRx will be required to limit how long it can retain personal and health information according to a data retention schedule. It also must publicly post a retention schedule and detail the information it collects and why such data collection is necessary.
  • Implement a Mandated Privacy Program: GoodRx must put in place a comprehensive privacy program that includes strong safeguards to protect consumer data.

© 2023 Dinsmore & Shohl LLP. All rights reserved.

For more Cybersecurity and Privacy Legal News, click here to visit the National Law Review


FOOTNOTES

[1] 16 CFR Part 318

FDA’s Digital Health High Notes from 2022

There has been a lot of discussion lately of the Food and Drug Omnibus Reform Act of 2022 (FDORA), which was enacted on December 29, 2022 as part of the larger Consolidated Appropriations Act for 2023 (you can find our blog post on it here). As important as these kinds of future reforms are to medical product developers, we should also take a moment to review last year’s actions and policy updates on digital health from the Food and Drug Administration (FDA) and to reflect on the transformations that have been taking place at the agency as a result of the rapid pace of innovation in the field. The year 2022 marked the conclusion of the five-year Software Precertification Pilot Program and the release of the final Clinical Decision Support Software guidance, among other things, although FDA’s digital health policies generally remained consistent. In this post, we summarize the agency’s key actions in the digital health space in 2022.

Expanding into Extended Reality

Over the past few years, FDA has started a number of initiatives to explore the use of virtual, mixed, and augmented reality (the agency typically uses the term “extended reality” to cover all types of immersive digital systems) as therapeutic devices for use by patients in clinical environments and at home. The agency granted marketing authorization to two virtual reality devices for patient use, EaseVRx for chronic pain (de novo classification) and Luminopia One for treatment of lazy eye in children, in 2021 and the CureSight system, also for lazy eye in children, in 2022. It is also conducting multiple internal research projects on medical extended reality within the Center for Devices and Radiological Health (CDRH).

In conjunction with its internal research, FDA is engaging health care professionals and the industry to learn about possible benefits, as well as the risks and limitations, of medical extended reality systems to guide future decisions about the therapeutic and clinical uses of such devices. A meeting of FDA’s Patient Engagement Advisory Committee in July 2022 provided an opportunity for the agency to hear from experts and researchers in the field of extended reality and its uses, as well as companies developing medical extended reality devices and patients who have experienced such devices. The materials from the meeting are available here.

FDA also published a list of medical extended reality devices that have received marketing authorization on its website devoted to the Digital Health Center of Excellence (DHCoE), which is part of CDRH.

Application of extended reality technology and the metaverse to medicine is an exciting area of development, and we expect FDA to continue to be active in the space and to develop formal policies and guidance on extended reality devices in the near future.

Precertification Pilot Ends with Uncertain Future

FDA’s Software Precertification Pilot Program, launched in 2017 to explore innovative methods and approaches to regulating software as a medical device (SaMD), officially ended in September 2022 (see our previous posts on the Precertification program here and here). Although FDA was able to glean some key insights from the pilot, including a better understanding of SaMD manufacturer practices throughout the product life cycle, including design, development, and management of SaMD products, the agency ultimately admitted that it had encountered significant challenges in implementing the pilot program. Such challenges included:

  • limited statutory authorities, which hindered FDA’s ability to gather consistent and harmonized information on manufacturer practices and SaMD performance;
  • focusing only on SaMD for De Novo classification, which limited the number of eligible devices and created issues for testing pilot-specific special controls; and
  • the small number of participants (only nine SaMD manufacturer were accepted to the pilot program).

You can read FDA’s final report from the pilot program here.

FDA may use its observations from the pilot program when developing new guidance or other policies pertaining to SaMD, but any new rules or guidances must be consistent with the agency’s current statutory authorities. It is very likely that we have seen the end of any FDA software precertification program, unless or until Congress decides to grant the agency specific authority to implement a new or different regulatory regime for SaMD.

Leadership Changes at the Digital Health Center of Excellence

The past year marked a number of watershed changes at the DHCoE, including the departure of Bakul Patel, longstanding CDRH official in many capacities and the first director of the DHCoE, and the naming of a new acting director, Brendan O’Leary. Subsequently, in January 2023, the agency named Troy Tazbaz, former senior vice president at Oracle, as the new director of DHCoE. It will be interesting to see how Mr. Tazbaz, a newcomer to the agency, will direct the DHCoE in further developing the regulatory framework for digital health devices and in building strategic partnerships with industry stakeholders.

Digital Health Guidances

FDA introduced a number of new and revised guidance documents relating to digital health technologies in 2022. The following is a list with brief descriptions of each such agency guidance:

  • Clinical Decision Support Software (final guidance) – After a long wait (the previous draft version was published in September 2019), FDA issued a final guidance covering clinical decision support (CDS) software devices on September 28, 2022. You can find our analysis of this critical guidance in this previous post. In addition, FDA created some helpful resources to determine the regulations that may apply to a company’s CDS software or other types of SaMD: a CDS software flowchart, and a Digital Health Policy Navigator.
  • Policy for Device Software Functions and Mobile Medical Applications (revised final guidance) – FDA issued an updated version of this guidance in September 2022 to implement changes consisted with the CDS final guidance.
  • Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (draft guidance) – In recent years, FDA has repeatedly emphasized the importance of addressing cybersecurity in medical devices and has made great efforts in keeping its policies and guidance documents aligned with current cybersecurity recommendations. This guidance describes methods for incorporating cybersecurity into the design and development process for connected medical devices (including SaMD) and for maintaining cybersecurity as part of device quality systems throughout the product lifecycle. Once finalized, this guidance will supersede final guidance Content of Premarket Submissions for Management of Cybersecurity in Medical Devices, issued in October 2014. It is also worth noting that FDORA grants the agency new authorities to require cybersecurity plans as part of premarket submissions for so-called “cyber devices,” which will need to be considered and incorporated into any upcoming final guidance on this topic.
  • Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device Data – Premarket Notification [510(k)] Submissions (final guidance) & Clinical Performance Assessment: Considerations for Computer-Assisted Detection Devices Applied to Radiology Images and Radiology Device Data in Premarket Notification (510(k)) Submissions (final guidance) – This pair of final guidances describes FDA’s expectations for information included in premarket notification submissions for CADe devices, and specifically for the design of clinical studies to support marketing authorization of such devices. Many companies have developed, or are interested in developing, software with CADe functionality to detect lesions or abnormalities in radiology images for the purpose of assisting human readers, and with the rapid risk of artificial intelligence/machine learning-based software, some manufacturers may seek to develop CADe software that replaces human readers altogether. These guidances are especially useful for companies developing CADe software and preparing for clinical testing and submission to FDA.
  • Electronic Submission Template for Medical Device 510(k) Submissions (final guidance) – Although this guidance does not specifically apply to digital health technologies, it represents an important development for all medical device companies, including digital health device manufacturers. FDA released this guidance in conjunction with the announcement that CDRH will accept electronic submissions of device premarket notifications from all applicants using the electronic submission template and resource (eSTAR) tool. The guidance describes the structure of the template (and helpfully cross-references other guidance documents that relate to each section of the template). FDA has designated October 1, 2023 as the date of full transition to electronic submission for premarket notifications, meaning that FDA will no longer accept eCopies of premarket notification submissions for filing and review as of that date.

As the preceding list highlights, digital health is an active and rapidly advancing field both in the private sector and at FDA. We will continue to monitor and report on notable developments in terms of regulatory policies affecting developers and investors in the broader field.

©1994-2023 Mintz, Levin, Cohn, Ferris, Glovsky and Popeo, P.C. All Rights Reserved.
For more Food and Drug Legal News, click here to visit the National Law Review

Privacy Tip #359 – GoodRx Settles with FTC for Sharing Health Information for Advertising

The Federal Trade Commission (FTC) announced on February 1, 2023 that it has settled, for $1.5M, its first enforcement action under its Health Breach Notification Rule against GoodRx Holdings, Inc., a telehealth and prescription drug provider.

According to the press release, the FTC alleged that GoodRx failed “to notify consumers and others of its unauthorized disclosures of consumers’ personal health information to Facebook, Google, and other companies.”

In the proposed federal court order (the Order), GoodRx will be “prohibited from sharing user health data with applicable third parties for advertising purposes.” The complaint alleged that GoodRx told consumers that it would not share personal health information, and it monetized users’ personal health information by sharing consumers’ information with third parties such as Facebook and Instagram to help target users with ads for personalized health and medication-specific ads.

The complaint also alleged that GoodRx “compiled lists of its users who had purchased particular medications such as those used to treat heart disease and blood pressure, and uploaded their email addresses, phone numbers, and mobile advertising IDs to Facebook so it could identify their profiles. GoodRx then used that information to target these users with health-related advertisements.” It also alleges that those third parties then used the information received from GoodRx for their own internal purposes to improve the effectiveness of the advertising.

The proposed Order must be approved by a federal court before it can take effect. To address the FTC’s allegations, the Order prohibits the sharing of health data for ads; requires user consent for any other sharing; stipulates that the company must direct third parties to delete consumer health data; limits the retention of data; and implement a mandated privacy program. Click here to read the press release.

Copyright © 2023 Robinson & Cole LLP. All rights reserved.

Federal PFAS Drinking Water Standards: 2023 Is the Year

On Friday, October 7, 2022, the EPA formally sent its proposed federal PFAS drinking water standards to the White House Office of Management and Budget (OMB) for consideration and approval or rejection. The proposed rule cleared OMB review on November 30, 2022; however, the EPA has not yet released the proposed rule. While the details of the rule under consideration are not yet known, what is evident from the title of the document logged on the OMB website is that the drinking water standards will address PFOA and PFOS. At least from the document title, it does not appear that any other PFAS will be subject to Safe Drinking Water Act (SDWA) regulation at the moment.

The delay in releasing the proposed drinking water standards for over a month now, though, could suggest that the proposed rule may seek to regulate more than just PFOA and PFOS, and the EPA may be looking to shore up language and support language in the proposed rule for such a proposal in light of comments from the OMB. Similarly, many wonder whether the EPA proposed a limit so low that the OMB had concerns as to whether the limits were detectable. With the EPA keeping its proposed language a closely guarded secret for the time being, much of the discussions rest on speculation. What we do know is that he EPA is statutorily required to put forth a proposed standard before the first half of 2023, and it has publicly pledged repeatedly to act more quickly than that statutory requirements.

Thus, 2023 will see federal PFAS drinking water standards for at least two PFAS from the EPA and we predict that it is only a matter of days before the country sees the EPA’s proposal, which will kick off what promises to be an extremely contentious public comment period.

Now more than ever, the EPA is clearly on a path to regulate PFAS contamination in the country’s water, land and air. These regulations will require states to act, as well (and some states may still enact stronger regulations than the EPA). Both the federal and the state level regulations will impact businesses and industries of many kinds, even if their contribution to drinking water contamination issues may seem on the surface to be de minimus. In states that already have PFAS drinking water standards enacted, businesses and property owners have already seen local environmental agencies scrutinize possible sources of PFAS pollution much more closely than ever before, which has resulted in unexpected costs. Beyond drinking water, though, the EPA PFAS Roadmap from 2021 shows the EPA’s desire to take regulatory action well beyond just drinking water, and companies absolutely must begin preparing now for regulatory actions that will have significant financial impacts down the road.

©2023 CMBG3 Law, LLC. All rights reserved.

Will CMS’s Proposed Rule on “Identified Overpayments” Increase Reverse FCA Cases?

On December 27, 2022, the Centers for Medicare & Medicaid Services (CMS) publishedproposed rule which, in part, seeks to amend the existing regulations for Medicare Parts A, B, C, and D regarding the standard for when an “identified” overpayment must be refunded, pursuant to the Affordable Care Act (ACA) and the False Claims Act (FCA) reverse false claims provision. As written, the proposed rule would remove the existing “reasonable diligence” standard for identification of overpayments, and add the “knowing” and “knowingly” FCA definition. As a result, an overpayment would be identified when the entity has actual knowledge of an identified overpayment, or acts in reckless disregard or deliberate ignorance of an identified overpayment. And, a provider is required to refund overpayments it is obliged to refund within 60 days of such identified overpayment.

If this proposed rule is finalized, the Department of Justice (DOJ) and Health and Human Services (HHS) Office of Inspector General’s (OIG) should be applying the same intent standard to their evaluation of potential reverse false claims and Civil Monetary Penalty liability.

The Lay of the Land

Currently, the applicable overpayment regulations state:

A person has identified an overpayment when the person has, or should have through the exercise of reasonable diligence, determined that the person has received an overpayment and quantified the amount of the overpayment. A person should have determined that the person received an overpayment and quantified the amount of the overpayment if the person fails to exercise reasonable diligence and the person in fact received an overpayment.

42 C.F.R. § 401.305(a)(2). In the 2016 Final Rule, CMS agreed “the 60-day time period begins when either the reasonable diligence is completed or on the day the person received credible information of a potential overpayment if the person failed to conduct reasonable diligence and the person in fact received an overpayment.” This reasonable diligence standard allows entities to not only determine credibility of allegations, or issues relating to, a potential overpayment but also, when credible, to conduct a properly scoped internal investigation, during which an entity also accurately quantifies any associated overpayment due for refund.

In the proposed rulemaking, CMS is suggesting instead the following standard:

A person has identified an overpayment when the person knowingly receives or retains an overpayment. The term “knowingly” has the meaning set forth in 31 U.S.C. 3729(b)(1)(A).

31 U.S.C. 3729(b)(1)(A) defines “Knowingly” as any circumstance in which “a person, with respect to information—(i) has actual knowledge of the information; (ii) acts in deliberate ignorance of the truth or falsity of the information; or (iii) acts in reckless disregard of the truth or falsity of the information.”

The currently proposed provision has similar effect to the language CMS proposed in 2012 and, after consideration of comments, ultimately rejected in the 2014 Final Rule (Medicare Advantage and Part D) and 2016 Final Rule (Medicare Part A and Part B). In that final rulemaking, CMS removed the “actual knowledge,” “reckless disregard,” and “deliberate ignorance” terms in favor of the reasonable diligence standard, leaving practitioners to argue that CMS had lowered requisite intent to a standard less than required by the FCA.

Potential Impact

The FCA is a fraud statute, requiring intent. If a company investigating the credibility, issue, and scope of a matter (i.e., exercising reasonable diligence) also diligently determines the scope of a possible refund obligation, it would be difficult for DOJ to credibly claim an entity has acted recklessly, or with deliberate indifference to repayment under the FCA. DOJ’s general practice has been to bring reverse FCA cases when a provider does not investigate credible allegations and does not refund associated overpayments, after identifying them. For example, in a 2015 case, DOJ attorneys stated in a court conference, “[T]his is not a question … of a case where the hospital is diligently working on the claims and it’s on the sixty-first day and they’re still scrambling to go through their spreadsheets, you know, the government wouldn’t be bringing that kind of a claim.” United States ex rel. Kane v. Healthfirst, Inc., 120 F. Supp. 3d 370, 389 (S.D. N.Y. 2015).

It remains to be seen whether this change will result in an increased pursuit of reverse FCA cases. The proposed rule would eliminate an explicit diligence period (generally not to exceed six months, except in particularly complicated analyses, such as under the Physician Self-Referral or “Stark” Law) to ascertain the validity and amount of a potential obligation to refund an overpayment. The proposed rule does not explain whether providers, suppliers, and others still will have an opportunity to conduct a reasonably diligent inquiry into whether any obligation to refund exists at all, prior to the ACA 60-day clock starting to run. Ideally CMS would make clear in any preamble that the government still expects reasonable and professional efforts be undertaken before making refunds, even if that process may take some time to complete

Absent such clarity, the fact remains that it is difficult to “identify” an obligation to refund, much less any refundable amounts, without first validating the alleged overpayment and quantifying any obligation.

Additionally, this standard may prompt entities to submit an HHS-OIG self-disclosure before all facts are known. While OIG requires a disclosing party to conduct an internal investigation prior to submission, it is near impossible to thoroughly investigate issues and identify any refund 60 days from learning of a possible issue that might result in a refund (especially when multiple payors are involved). Even if a disclosing party notes within a self-disclosure that an investigation is ongoing, the disclosing party must certify that it will complete its investigation within 90 days of the submission date – which still may not be enough time based on the complexity of the allegations or claims review required. The resulting back-and-forth of incomplete information likely would create unnecessary delays in reaching a resolution and frustration among all parties involved.

We encourage all providers, suppliers, Medicare Advantage organizations, Part D participants, and other stakeholders to submit comments on this proposed rule. The public has until 5 p.m. ET on February 13, 2023 to submit comments, which are accepted, electronically or by mail.

© 2023 Foley & Lardner LLP

A COVID Surge in China Results in Renewed Restrictions for Travel to the United States

Effective January 5 (at 12:01am, Eastern Standard Time), all passengers inbound from China, Hong Kong and Macau, or who were in the country in the 10 days prior to their departure to the United States, must show a negative PCR or monitored antigen test in order to board flights to the United States. In addition, the same requirement will apply for those passengers who were physically present in China within the 10 days prior to flying through South Korea’s Incheon International Airport, Toronto Pearson International, and Vancouver International.

Background:

Amid concerns over lack of transparency around COVID case data and loosening of COVID-related restrictions, China is facing their largest coronavirus outbreak since the start of the pandemic. The large surge of cases could potentially infect upwards of 800 million people over the next few months. Such a spike in infections over a very short period increases the chances of a new variant emerging, and with the risk of new mutations come the risks of heightened transmission and death rates.

In response, several countries including the United States, Japan, Italy, India, South Korea and Taiwan are implementing measures for travelers to both limit the spread of infection and to improve early detection of new variants. As of January 5, 2023, in order to enter the United States either directly or indirectly from China, Hong Kong and Macau, all passengers over the age of 2, regardless of nationality or vaccination status, must show evidence of a negative PCR or antigen test taken within two days at the departure gate. The only exception will be for those who have recently tested positive. Those who have had COVID-19 in the 90 days prior to their travel to the United States may present documentation of recovery from COVID-19 in lieu of a negative test result.

In addition to the steps taken to specifically protect against those who test positive while traveling from China to the United States, the CDC is also expanding its Traveler Genomic Surveillance program (TGS) to additional airports. TGS, run by the Travelers’ Health Branch at the Center for Disease Control, tests international travelers to detect new variants entering the country and to fill in gaps in global surveillance. During the early days of the Omicron surge, TGS detected two Omicron subvariants weeks before they were reported elsewhere. As part of the program, arriving international travelers volunteer to participate and anonymously provide nasal swabs that are then sent for testing to allow for detection of multiple variants as well as viral characterization to help provide information on a variant’s transmissibility, virulence, and response to current treatments or vaccines.

As the case counts and variants evolve and increase, so, too, must the guidelines around international travel and efforts to control the spread. Before making any international travel plans, make sure to double-check the guidelines in place for each intended destination, prepare for delays and disruption, and continually monitor reliable news sources for updates.

Listen to this post: Here

Copyright © 2023, Hunton Andrews Kurth LLP.
For more Coronavirus Legal News, click here to visit the National Law Review.

Office of Science and Technology Policy Requests Public Input on Biotechnology Regulation

  • The Office of Science and Technology Policy (OSTP) issued a request for information (RFI) today in which it invites public comment on the Coordinated Framework for the Regulation of Biotechnology (the “Coordinated Framework”).
  • The Coordinated Framework, which is a Federal regulatory policy for ensuring the safety of biotechnology products, was first issued in 1986, updated in 1992— to affirm that federal regulation should focus on characteristics of the product and the environment into which it being introduced, and not on the process by which it is produced—and then updated again in 2017 to clarify the roles of EPA, FDA, and USDA. And, in September of this year, Executive Order 14081 directed the three agencies to clarify and streamline regulations to support the safe of use of biotechnology products.
  • Accordingly, the RFI requests comment on seven questions related to the Coordinated Framework. The questions include a request for comment on identification of any regulatory gaps, inefficiencies, or uncertainties; data or information to improve any identified issues; and new or emerging biotechnology products that the agencies should be prepared to address. Comments to the RFI are due by February 3, 2023. Also, on January 12, 2023, OTSP will host a virtual event in which it will listen to public feedback on the RFI.
© 2022 Keller and Heckman LLP

Warning Sign? A New Round of FDA Warning Letters Over CBD Consumer Confusion May Signal a Shift in Government Enforcement

FDA warning letters are nothing new in the cannabis industry. In fact, we here at Budding Trends have covered this topic a number of times (herehere, and here). Not resigned to playing the hits, however, the FDA issued a new set of warning letters on November 21 that may signal a shift in enforcement posture away from solely targeting companies that market CBD as a potential medical treatment and towards including companies that market their products in ways that could cause consumer confusion. This is a “Warning Sign” that might cause the cannabis industry “A Rush of Blood to the Head,” much like Coldplay’s multi-platinum album that recently celebrated its 20-year anniversary. So, turn back the “Clocks,” book your flight to “Amsterdam,” and indulge us if you will — just not too much.

Congress legalized the production of hemp and hemp-derived products under the 2018 Farm Bill. But federal legalization did not exempt the hemp industry from federal regulation. Indeed, the FDA and FTC retain overlapping enforcement authority over CBD marketing, with the FDA having primary authority over labeling. Far more than “A Whisper,” the FDA and FTC have not been shy about issuing warning letters to hemp companies that fail to follow the FDA’s labeling requirements and guidance.

Since its first set of warning letters to CBD companies in April 2019, the FDA has focused its enforcement activity on companies that market their CBD products as treatment and cures for a variety of diseases and illnesses. But the FDA’s most recent warning letters took a different tack, focusing on potential health risks from long-term CBD use, consumer confusion leading to unintentional or overconsumption of CBD, and CBD products that could be seen as marketed to children.

The basis of the FDA’s five new warning letters was that CBD is neither an authorized food additive nor generally recognized as safe. The FDA noted it had “not found adequate information showing how much CBD can be consumed, and for how long, before causing harm,” and claimed that “scientific studies show” potential harm to the “male reproductive system” and “liver” from long-term CBD use. In the FDA’s words, “[p]eople should be aware of the potential risks associated with the use of CBD products.”

The products highlighted in the warning letters included gummies, fruit snacks, lollipops, cookies, teas, and other beverages. The FDA said these products were targeted because consumers may confuse them for traditional foods or beverages, “which may result in unintentional consumption of overconsumption of CBD.” Further, the FDA noted that gummies, candies, and cookies are especially concerning because they may appeal to children. Likewise, the FDA cited tea, coffee, sparkling water, beverage “shots,” and honey as products similar to traditional food that may confuse consumers into over-consuming CBD.

Keeping its focus on unintended consumption or unintended overconsumption, the FDA also chastised one company for failing to specifically list CBD as an ingredient on the label of its hemp-infused tea. This is particularly important to note for hemp companies, many of which have sought to avoid listing “CBD” on the product labels for full spectrum hemp extracts in an effort to avoid the FDA and FTC’s seemingly CBD-focused enforcement actions.

Given this new enforcement posture, CBD companies may consider avoiding marketing attempts that seek to link CBD products too closely with traditional foods and beverages. This may include limiting references to the similarity of CBD products to traditional ones. And CBD companies should continue to avoid product labels and marketing campaigns that would be enticing to children, especially for CBD products that are in a form children might be likely to consume (such as gummies and candies).

It remains to be seen where the FDA will draw the line between appropriate marketing and marketing that goes too far towards confusing consumers, but, aside from a falsetto Chris Martin, “nobody said it was easy.” Until then, watch this space and remember to follow the marketing dos and don’ts we provided in one of our previous blog posts.

© 2022 Bradley Arant Boult Cummings LLP

CMS Issues Calendar Year 2023 Home Health Final Rule

On November 4, 2022, the Centers for Medicare & Medicaid Services (CMS) published the calendar year 2023 Home Health Prospective Payment System Rate final rule, which updates Medicare payment policies and rates for home health agencies.  Some of the key changes implemented by the final rule are summarized below.

  • Home Health Payment Rates. Instead of imposing a significant rate cut, as was included in the proposed rule released earlier this year, CMS has increased calendar year 2023 Medicare payments to home health agencies by 0.7 percent or $125 million in comparison to calendar year 2022.

 

  • Patient-Driven Groupings Model and Behavioral Changes. A -3.925 percent permanent adjustment to the 30-day payment rate has been implemented for calendar year 2023. The purpose of this adjustment is to ensure that aggregate expenditures under the new patient-driven groupings model payment system are equal to what they would have been under the old payment system. Additional permanent adjustments are expected to be proposed in future rulemaking.

 

  • Permanent Cap on Wage Index Decreases. The rule finalizes a permanent 5 percent cap on negative wage index changes for home health agencies.

 

  • Recalibration of Patient-Driven Groupings Model Case-Mix Weights. CMS has finalized the recalibration of the case-mix weights, including the functional levels and co-morbidity adjustment subgroups and the low utilization payment adjustment thresholds, using calendar year 2021 data in an effort to more accurately pay for the types of patients home health agencies are serving.

 

  • Telehealth. CMS plans to begin collecting data on the use of telecommunications technology under the home health benefit on a voluntary basis beginning on January 1, 2023, and on a mandatory basis beginning on July 1, 2023. Further program instruction for reporting this information on home health claims is expected to be issued in January of 2023.

 

  • Home Infusion Therapy Benefit. The Consumer Price Index for all urban consumers for June 2022 is 9.1 percent and the corresponding productivity adjustment is a reduction of 0.4 percent. Therefore, the final home infusion therapy payment rate update for calendar year 2023 is an increase of 8.7 percent. The standardization factor, the final geographic adjustment factors, national home infusion therapy payment rates, and locality-adjusted home infusion therapy payment rates will be posted on CMS’ Home Infusion Therapy Services webpage once the rates are finalized.

 

  • Finalization of All-Payer Policy for the Home Health Quality Reporting Program. CMS has ended the temporary suspension of Outcome and Assessment Information Set (OASIS) data collection on non-Medicare/non-Medicaid home health agency patients. Beginning in calendar year 2027, home health agencies will be required to submit all-payer OASIS data, with two quarters of data required for program year 2027. A phase-in period will occur from January 1, 2025 through June 30, 2025, and during that time the failure to submit the data will not result in a penalty.

 

  • Health Equity Request for Information. The comments received from stakeholders providing feedback on health equity measure development for the Home Health Quality Reporting Program and the potential future application of health equity in the Home Health Value-Based Purchasing Expanded Model’s scoring and payment methodologies are summarized in the final rule.

 

  • Baseline Years in the Expanded Home Health Value-Based Purchasing (HHVBP) Model. For the Expanded Home Health Value-Based Purchasing Expanded Model, CMS is: updating definitions, changing the home health agency baseline calendar year (from 2019 to 2022 for existing home health agencies with a Medicare certification date prior to January 1, 2019, and from 2021 to 2022 for home health agencies with a Medicare certification date prior to January 1, 2022); and changing the model baseline calendar year from 2019 to 2022 starting in 2023.

For more Health Care legal news, click here to visit the National Law Review.

Copyright © 2022 Robinson & Cole LLP. All rights reserved.