The National Law Forum

Scott Mugno’s confirmation to head OSHA appears to be one of three key Department of Labor nominees caught up in political arm wrestling. Republicans are blaming Democrats for delaying the process by drawing out debates to the full 30 hours permitted by the Senate Rules.  Senate Majority Leader Mitch McConnell (R-KY) voiced his frustration on April 9^thwarning that “[t]he Senate’s workweek will not end until all of these amply qualified nominees are confirmed.”  It should also be noted that a Senate vote on Mugno has yet to be calendared.

There are concerns that OSHA has lacked leadership and direction since Trump took office in January, 2017.  Senate Democrats have indicated that they are prepared to work with Mugno at the helm of OSHA – though they seem to expect that he will be a tough enforcer against violators rather than a follower of Trump’s deregulation agenda.

Currently, there is no indication when Mugno will be confirmed.

The USPTO released a copy of the “Remarks” made by Director Andrei Iancu, that read like a major policy summary regarding challenges to the US patent system. Specific solutions were not suggested, but Iancu identified two areas that need review and may subsequently be changed, particularly since the US Chamber’s 6^th Annual International IP index showed the USPTO had fallen in the rankings from 10^th to 12^th in the world.

What makes this talk important is the Director’s recognition that the Mayo/Alice/Myriad “Rules” are rife with uncertainty for all of the stakeholders. He emphasized that the Office cannot ignore Supreme Court precedent, but he felt that the Office can also “simplify the eligibility determination for our examiners through forward-looking guidance.” (His comments about reviewing all aspects of IPR were more general in nature.)

Of course, I hope that Iancu comes to the recognition that most of the uncertainty and lack of clarity afflicting life sciences patenting comes from the PTO’s sua sponte decision to read and apply both Mayo and Myriad more broadly than the facts and the ultimate Supreme Court decisions require. Mayo involved the old use of an old compound – the correlation between the metabolite levels and side effects or efficacy of a known class of drugs does not inexorably lead to the conclusion that the discovery of a previously unknown naturally-occurring correlation and its utility as a diagnostic agent should be deemed patent-ineligible.

Likewise, the limited holding that an isolated human gene or fragment thereof is a natural product does not inexorably lead to the conclusion that isolated polypeptides or fragments thereof also natural products, and are patent ineligible. I hope that the Director will read Judge Rich’s elegant opinion in Bergy II justifying patent-eligibility of useful organisms (such as antibiotics)  discovered in, and isolated from environments (such as dirt)  which environments prevented their practical utility. In any case, the PTO took the opposite position and has been rejecting claims to naturally-sourced chemicals unless the isolation/purification step renders them “markedly different” from the chemical in its natural state.

Perhaps all that I have written here adds up to an “open letter” to the Director, suggesting just a few changes in PTO policy that he could implement without offending the Supreme Court. The Federal Circuit is another matter, but I still cling to the hope that at least some of the Judges would welcome the chance to read Mayo more narrowly, so as not to remove entire art areas from patent protection. In fact, the Director spent most of his remarks emphasizing the importance of patent protection as a driver for the entire R&D community. The Director has outlined areas that need “legal help.” Now, I hope that he will use his “Remarks” as a starting point for meaningful action.

On April 6, 2018, the U.S. District Court for the Eastern District of Pennsylvania granted a motion for summary judgment filed by a waste company in an implied certification case under the False Claims Act (FCA), holding that the relator failed to satisfy the Supreme Court’s materiality standard announced in the landmark Escobar case.

The claims in U.S. ex rel. Cressman v. Solid Waste Services, Inc. arose from waste company employees discharging leachate, a liquid that passes through or is generated by trash, onto a grassy area at a transfer station, rather than sending the leachate to a treatment plant.  The relator reported the leachate discharge to the Pennsylvania Department of Environmental Protection (DEP), which conducted an investigation.  The waste company cooperated in the investigation, conducted its own investigation, and took corrective steps in response to the allegations.  The company also entered into a consent decree in connection with which it paid a civil penalty.

The relator then filed his qui tam action under the FCA, in which the government declined to intervene.  The relator asserted that the defendant waste company was liable under the FCA because it submitted claims for payment to federal agencies without disclosing its violation of environmental regulations arising from the leachate discharge incident.

In moving for summary judgment, the defendant argued that the relator had not demonstrated that the defendant’s alleged failure to disclose the regulatory violations arising from the discharge incident was material to its right to payment by the federal agencies.  Indeed, the defendant argued that the violation had nothing to do with the waste disposal services it was contracted to perform for those agencies.

The court agreed.  First, the court observed that the defendant’s contracts with the federal agencies at issue did not even involve the transfer station where the leachate disposal occurred.  As such, the court held that the violation “was not remotely related to Defendant’s service contracts with the Federal Agencies” and as such “failed to substantiate a FCA claim under Plaintiff’s posited theory of recovery.”  The court then squarely addressed materiality, holding that the relator failed to meet the Escobar standard:

In addition, to meet the materiality requirement for his FCA claims, Plaintiff must present evidence that the Federal Agencies for whom Defendant performed waste pickup services would not have paid Defendant’s claims had they known of the February 25, 2013 Discharge Incident/Violation at Defendant’s Souderton Division transfer station.  Plaintiff has presented no such evidence.  To the contrary, record evidence demonstrates that the Federal Agencies did not deem the February 25, 2013 Discharge Incident/Violation material to their payment of the submitted invoices.  For example, record evidence shows that the government agencies to whom [Defendant] has submitted invoices for payment since the February 25, 2013 Discharge Incident/Violation have continued to pay Defendant for the waste pickup services performed even after Plaintiff filed the underlying suit and after the Department of Justice investigated the allegations contained in Plaintiff’s complaint and declined to intervene on behalf of the Federal Agencies. (emphasis added).

The court went on to emphasize the government’s lack of action after the filing of the FCA complaint:

Here, in the four years since learning of Plaintiff’s allegations in this matter, including the regulatory violations asserted and relied upon by Plaintiff, the Department of Justice has not initiated any proceedings or taken any action against Defendant. Significantly, after investigating Plaintiff’s underlying FCA claims, the Department of Justice declined to intervene and prosecute Plaintiff’s suit in the name of and on behalf of the United States Government.

This court’s decision joins the ranks of an increasingly substantial line of cases holding, based on Escobar, that what the government does—or does not do—after learning of violations is critical to the materiality analysis.

On April 2, 2018, CMS released the Contract Year 2019 Final Rules for Medicare Advantage (MA) and Part D (the MA Final Rule), incorporating changes that support CMS’ stated commitment to supporting flexibility and efficiency throughout the MA and Part D Programs.

The MA Final Rule incorporates broad changes to several aspects of the MA program, including changes to the marketing rules, the star rating process and benefit uniformity requirements, among others. Of note to providers, and the subject of today’s post, the MA Final Rule has also eliminated the requirement that providers and suppliers contracting with MA Plans, and prescribers prescribing drugs covered by Part D programs, be enrolled in Medicare. Instead, CMS will rely upon a “Preclusion List,” as described below, to eliminate prescribers, providers, and suppliers who are ineligible to provide items or services under these programs.

New Rule Eliminates Medicare Enrollment Requirement

In May of 2014, CMS implemented a rule that required that prescriptions for covered Part D drugs be prescribed by prescribers enrolled in Medicare. Later, in November of 2016, CMS implemented a rule that required providers and suppliers that furnished health care items or services to MA plan members to be enrolled in Medicare by 2019. Under the MA Final Rule, CMS is eliminating this requirement. The text of the new regulations, to take effect January 1, 2019, will instead (i) prohibit MA Plans from paying for services provided by providers and suppliers who are included in a “Preclusion List” and (ii) require pharmacy benefit managers to reject a pharmacy claim for a Part D drug if the individual who prescribed the drug is included on the preclusion list. The “Preclusion List” will be compiled by CMS and will include providers and suppliers (i) that are currently revoked from Medicare or who have engaged in behavior for which CMS could have revoked the provider or supplier to the extent applicable if they had been enrolled in Medicare, and (ii) whose underlying conduct CMS determines is detrimental to the best interests of the Medicare program. The Preclusion List will be separate and distinct from the OIG Exclusion List.

CMS will make the Preclusion List available to MA plans and Part D plan sponsors, who will be required to deny payment for claims submitted by, or associated with prescriptions written by, prescribers and providers on the list.

Impact of the New Rule on Providers and Suppliers

This new requirement allows flexibility to prescribers, providers and suppliers who have not enrolled in Medicare to provide services to MA plan members, easing the burden of enrollment, and allowing providers who have opted out of providing services under traditional Medicare to provide services to beneficiaries under Medicare part C or prescribe Part D covered drugs.

As the clock ticks down to May 25, 2018, when the European Union’s General Data Protection Regulation (“GDPR”) becomes fully enforceable throughout the EU, the Internet and airwaves have become saturated with guidance for companies about what to expect and how to prepare for its new protections and restrictions.  However, we’ve seen little intelligence for companies and their litigation counsel in situations where electronically-stored information (“ESI”) containing “personal data” resides in the EU and is relevant to discovery requests in American civil litigation.

In many ways, the process and procedures relating to transfers of personal data to the U.S. under the GDPR are similar – and similarly burdensome – to those of the existing privacy regime.  However, the GDPR does introduce new transfer options and clarifies others.  It has also added record-keeping and compliance reporting requirements as well as hefty penalties for non-compliance.

Our GDPR e-discovery series will examine these new and clarified transfer options for ESI containing personal data.  We begin our series with a newly added transfer option – the Hail Mary pass of transfer options – contained in a GDPR provision permitting a one-time limited transfer where necessary to further a “compelling interest” of the transferring party.

Before we get to the GDPR, however, some historical context is instructive about what makes transferring personal data from the EU to the U.S. for pre-trial e-discovery particularly taxing.  The challenges stem largely from the expansive definition of personal data on which existing law is premised, which encompasses any information relating to “an identified or identifiable natural person.”

The issue with this definition is immediately apparent.  In addition to information practitioners in the U.S. might typically consider “sensitive” or “private” personal data, such as social security numbers, financial account numbers, or medical treatment histories, the EU balloons the concept of personal data to include more innocuous information commonly contained in ESI, such as professional or personal email addresses, office addresses, and telephone numbers.

Existing EU privacy law further stipulates that such personal data cannot be transferred to a “third country” like the U.S. that does not ensure an adequate level of protection for personal data.  Absent such an adequacy determination by EU privacy regulators, a data transferor must demonstrate either sufficient protective safeguards incorporated into a data transfer agreement in the form of standard contractual provisions addressing the handling of the personal data; or that an enumerated “derogation,” or exemption, to the privacy law supports the transfer.

These far-reaching definitions and limited transfer options have created a classic lose-lose for American litigants.  On the one hand, U.S. courts generally observe that discovery of relevant documents in the EU cannot be avoided solely on the basis of its privacy law.  On the other, companies that do not take appropriate steps to permissibly transfer personal data can be sanctioned by privacy regulators.

While there was hope that the GDPR would address this inherent tension and simplify the transfer process, the end result is not so much simplification, or even clarity, as it is a new set of potential hazards and prospects.

It is in this context that we examine Chapter 5 of the GDPR (Articles 44 through 50) that governs transfers of personal data to third countries such as the U.S.  Of most relevance to transfers in the context of civil e-discovery are Article 46, which addresses transfers subject to standard contractual clauses relating to the handling of personal data, and Article 49, which carries over the “derogations” concept from existing law allowing for personal data transfers in the absence of Article 46 safeguards.

One Article 49 provision new to the GDPR specifically addresses the concept of a one-time limited personal data transfer, which sounds promising in the context of e-discovery.  However, this new provision also appears to be an option of last resort, applicable only where none of the safeguards or options enumerated in Articles 46 or 49 otherwise apply.  In such cases, a transfer of personal data may occur if:

• the transfer is not repetitive;
• the transfer concerns a limited number of data subjects;
• the transfer is necessary for purposes of a compelling interest of the transferor that is not overridden by the interests of the data subject; and if
• the transferor has provided suitable safeguards to protect the personal data during and after the transfer.

While this exemption sounds appealing, the jury is still out on its utility.  Just how many subjects or how much data constitutes a “limited” transfer, for example, will likely remain a subjective judgment in the eye of data protection authorities.  And, whether pre-trial e-discovery in American litigation will ultimately be considered a “compelling interest” is a new and unanswered question.  Plus, who balances the interests between the transferor and the data subjects?  Finally, this new provision subjects a transferor to significant disclosure requirements including informing the data subject about the transfer and the compelling interest being pursued as well as informing the data privacy authority of the transfer.  These disclosure requirements introduce logistical problems in-and-of-themselves.

Based on these unknowns and reporting requirements, use of this provision may entail significant risk for the transferor.  And, bear in mind that, although the GDPR was intended to harmonize some aspects of privacy law across the EU, Member States are left with the option to modify or supplement the default standard set out in Article 49.  This means you will still need to review the privacy law of a particular Member State to assess whether the compelling interest exemption even applies and, if so, in what context.

Bear in mind also that no matter what transfer method is used, the GDPR requires both transferors and transferees to maintain a record of personal data transfers and details about what adequacy decision or safeguard applied to each transfer.  Failures to do so may risk significant potential fines.  Our recommendation is that American companies with operations, employees, or data in the EU and multinational companies at risk of lawsuits or investigations in the US develop a standard policy for assessing personal data transfer requests, including those in the context of civil e-discovery.  This policy should recognize that every transfer may be different and allow flexibility based on the transfer options afforded by the GDPR.  Importantly, this policy should be adhered to rigorously and dictate the documentation required for each transfer contemplated or undertaken.

Securing data held by mobile devices is largely reliant upon technology, and a recent report by the Federal Trade Commission (“FTC”) takes aim at how that technology can be both improved and better utilized. The report, published in February 2018 and titled, Mobile Security Updates: Understanding the Issues, presents findings based upon information requested by the FTC in 2016 of eight mobile device manufacturers: Apple, Inc., Blackberry Corp., Google, Inc., HTC America, Inc., LG Electronics USA, Inc., Microsoft Corp., Motorola Mobility, LLC, and Samsung Electronics America, Inc.

Generally speaking, the FTC in the report recommended that both the devices themselves as well as their corresponding support services need to do a better job of addressing consumers’ security concerns. Security updates need to be deployed quicker and more frequently, but consumers also need to know when – and when they are not – covered by services providing these updates. The report further recommends that manufacturers provide a minimum period during which security updates are to be provided, and make that period known to the consumer prior to purchase. The report found that some manufacturers do in fact provide substantial security support, but little to no information is provided on the topic prior to purchase. It was also recommended that manufacturers consider providing security updates that are separate and distinct from other updates that are often bundled together in one package.

Providing security support services by way of software updates is only valuable, however, so long as consumers take advantage of them. To this point, the report recommended that government, industry and advocacy groups work together to educate consumers as to the importance of installing security updates as they become available. It was further recommended that manufacturers improve record keeping as pertains to update decisions, support length, update frequency, and the rate at which consumers bother to download and install the updates, all with the goal of improving upon past practices.

Takeaway for Small Businesses

The FTC’s mobile security report is intended to bolster consumer protection, however it is also relevant for small businesses and their use of mobile devices in the workplace. Many small businesses do not have the resources to implement their own mobile security measures, and thus rely heavily on the mobile device manufactures to ensure a certain level of security. Moreover, small businesses often allow for a bring-your-own-device (BYOD) policy, which permits employees to bring and use personally owned devices in the workplace. While a BYOD policy helps a small business save on device and carrier costs, it also increases the likelihood of security threats to the business.

Although small businesses should not rely entirely on the security measures provided by mobile device manufactures, improved security updates and support services as recommended by the FTC’s report will certainly be beneficial to small businesses that do not have resources to invest in security measures. That said, just as the FTC advises consumers to take of advantage of the security software updates, it is imperative that small businesses, particularly with a BYOD policy, act prudently with respect to mobile device security measures available to them by the manufactures. For more information on BYOD key issues and policy considerations, visit Jackson Lewis’s “Bring Your Own Device” BYOD Issues Outline. Mobile device manufacturers are in a constant race to stay ahead of those seeking to expose vulnerabilities. Issuing frequent updates is crucial for security, but ultimately, it is just as important that consumers and businesses that rely heavily on mobile device manufacturer securities measures, understand their role in the process.