In recent weeks, the Department of Justice ("DOJ") announced two significant medical device enforcement resolutions—one criminal and one civil—that highlight the powerful tools prosecutors and regulators can bring to bear against companies they believe have violated critical quality-related obligations. The criminal plea agreement with Magellan Diagnostics, Inc. ("Magellan") and the long-expected consent decree of permanent injunction against Philips RS North America LLC, Respironics California LLC, Philips Holding USA Inc. (collectively, "Philips Respironics") and five Philips Respironics executives (the "Consent Decree") outline demanding and intrusive remediation and reporting obligations for these companies that will place them under significant scrutiny from the Food and Drug Administration ("FDA") and the DOJ for many years to come. Further, FDA's use of novel regulatory enforcement tools in the lead up to the Consent Decree provides a clear warning to companies about the agency's expectations for ensuring the effectiveness of product recalls in the future.
Magellan Diagnostics
On May 21, 2024, the U.S. Attorney's Office for the District of Massachusetts (the "Office") announced that Magellan had agreed to plead guilty to two misdemeanor device misbranding charges and had entered into a two-year deferred prosecution agreement ("DPA") with respect to two felony conspiracy counts: (1) to commit wire fraud; and (2) to defraud an agency of the United States. In connection with the plea agreement, the company agreed to pay $21.8 million in criminal fines, $10.9 million in criminal forfeiture and $9.3 million in victim compensation. The DPA requires the appointment of an independent monitor and compliance with a comprehensive corporate compliance program for the company to avoid prosecution on the deferred conspiracy charges.
The prosecution against Magellan, a Massachusetts manufacturer of lead testing devices, arises from an investigation into the company's alleged mishandling of a device malfunction that impacted the accuracy of lead testing results in certain of its LeadCare devices. Samples tested too quickly after blood was mixed with treatment reagent allegedly could produce lead level readings that were too low, whereas samples allowed to incubate for hours or days before testing could produce results that were higher than they should be.
Basis of Misdemeanor Plea
The misdemeanor criminal information (the "Misdemeanor Information") alleges that while Magellan was conducting FDA-requested testing in response to an application hold memo during the 510(k) review process for its LeadCare Ultra device in June 2013, it identified the malfunction but failed to disclose it to FDA at that time. The device subsequently received clearance in August 2013 with a label that included instructions for how long to wait before testing blood samples mixed with treatment reagent based on temperature and storage conditions. Magellan allegedly released the LeadCare Ultra device to market months later, after additional testing confirmed the malfunction, without informing FDA or customers that the test could produce false lows and false highs depending on the timing of testing. The Misdemeanor Information also alleges that Magellan failed to inform FDA or customers when it learned, shortly thereafter, that the malfunction also implicated test results obtained with the company's LeadCare II device.
According to the Misdemeanor Information, LeadCare Ultra customers identified testing inaccuracies related to the malfunction in August 2014 and, in turn, reported those inaccuracies to the company. Magellan responded with a letter to LeadCare Ultra customers advising them to allow blood samples mixed with treatment reagent to sit for a minimum of 24 hours before testing. According to the government, Magellan neither reported this customer advisory to FDA as a correction, nor sought a new 510(k) for the device when it added these same instructions to the product label, user guide, and website. The Misdemeanor Information also alleges that Magellan failed to timely file a medical device report ("MDR") to FDA regarding the malfunction (in violation of reporting requirements), and that after FDA questioned Magellan in 2017 about testing inaccuracies caused by its devices, FDA recommended a recall of all LeadCare devices in May 2017.
Based on the facts alleged in the Misdemeanor Information, Magellan agreed to plead guilty to two counts of causing the introduction of misbranded devices into interstate commerce related to (1) a late-filed MDR; and (2) a failure to both report a correction in connection with the 2014 customer letter and to file a new 510(k) after it revised its device labeling.
Basis of Deferred Felony Charges
A separate criminal information (the "Felony Information") outlines the deferred felony conspiracy charges resting on additional allegations that Magellan hid the malfunction and later deceived customers and FDA, allegedly causing tens of thousands of children and other patients to receive inaccurate lead test results. In particular, the Felony Information alleges that:
- In response to FDA's hold memo for the LeadCare Ultra 510(k) filing, rather than report results from the tests that identified the malfunction, Magellan reported results from different temperature and humidity studies that did not analyze blood lead level measurements.
- Despite knowing that the malfunction could impact the LeadCare II device, the company's top-selling product, Magellan decided not to confirm, analyze, or quantify the effect of the malfunction on that device to maintain "plausible deniability."
- In responding to customer complaints of testing inaccuracies, Magellan employees provided false and materially misleading information suggesting that the company was surprised by the reports and had not been able to replicate the inaccuracies seen by customers.
- The August 2014 LeadCare Ultra customer letter contained several materially false and misleading statements about the nature, extent and frequency of testing inaccuracies and when Magellan discovered the problem.
- The company filed the MDR containing multiple inaccuracies, did so only after a consultant threatened to report the issue to FDA, and waited three years to amend that MDR to inform FDA that the malfunction also affected LeadCare II
- The company concealed information from FDA that would have revealed that a new product, the LeadCare Plus, was also likely affected by the malfunction.
- In 2017, in response to a question from FDA, the company caused its consultant to mislead FDA about when the malfunction was first discovered.
Deferred Prosecution Agreement
Under the terms of the DPA, Magellan is required to admit to all the factual allegations in the Felony Information and to agree to strict corporate compliance obligations to prevent and detect violations of the Federal Food, Drug, and Cosmetic Act ("FDCA") and ensure compliance with Magellan's compliance code, policies, and procedures (the "Corporate Compliance Program"). These obligations include reviewing and, as applicable, updating compliance policies and procedures at least annually, and periodically testing such policies and procedures and implementing any remediation needed considering prior alleged misconduct. Among other things, updates to policies and procedures must broadly consider "relevant developments in the field, evolving industry standards, and the risk profile of the [c]ompany and its products." The company also agrees to comply with specific reporting requirements and to be subject to an independent compliance monitor for a minimum of two years.
The sweeping obligations in the Corporate Compliance Program impact all levels of the company and are emphatically forward-looking. For example, Magellan must ensure that senior leadership provide "strong, explicit, and visible support and commitment to its corporate policy against violating the FDCA" and "demonstrate rigorous adherence by example." Magellan must also assign compliance oversight responsibility to one or more senior executives with authority and autonomy to report directly to an independent monitoring body. Magellan must ensure that employees at all levels of the company understand that they are duty-bound to comply with corporate ethics and compliance policies and procedures, and Magellan must train on compliance accordingly. Moreover, the compliance obligations extend to the business as it is currently conducted, as well as to how it will be conducted in the future upon the acquisition of, or merger with, any new entities. In the event of any such merger or acquisition, Magellan must ensure that its compliance policies and procedures regarding the FDCA apply to the new business "as quickly as is practicable."
These compliance program elements are nearly identical, with a few important exceptions, to those set out in another medical device company DPA entered into in July 2021 that a representative of DOJ's Consumer Protection Branch ("CPB") publicly suggested would serve as a template for future DPA compliance requirements.1 Thus, medical product companies can expect to continue to see these provisions in DPAs in the future, even in cases like this one, where CPB is not a signatory to the agreement.
Unlike the 2021 DPA, with a term of three years, the Magellan DPA has a term of only two years but requires Magellan to retain an independent compliance monitor for those two years to assess and monitor Magellan's compliance with the DPA and corporate compliance obligations therein.2
The Magellan DPA also reflects slightly different requirements regarding the reporting of potential or actual violations of law. Whereas the 2021 agreement included as part of "future cooperation and disclosure requirements" a requirement to report to DOJ promptly "any evidence or allegation of a violation of the FDCA or U.S. obstruction of fraud laws" by the company's employees, the Magellan DPA requires that the company, following an investigation, report to the Office any event "a reasonable person would consider a material violation of the FDCA and its associated regulations" (a "Reportable Event"). Magellan is also obligated to provide biannual reports on Reportable Events that identify (a) whether any Reportable Events have occurred in the preceding quarter, (b) a description of the Reportable Event, (c) a description of the company's actions to investigate and correct the Reportable Event, and (d) a description of any further steps the company plans to take to address the Reportable Event and prevent it from recurring.
Prosecution of Individuals
In addition to this corporate resolution, Magellan's former CEO, Chief Operating Officer and Director of Quality Assurance and Regulatory Affairs were indicted in April 2023 on the same misdemeanor and felony charges reflected in the corporate plea agreement and an additional count of wire fraud.3 A jury trial for the three defendants is scheduled to begin in September 2024.
Philips Respironics
On April 29, 2024, the government announced a long-expected Consent Decree that reflects the most recent step in FDA's efforts to force Philips Respironics to make users of certain recalled devices whole, fix identified problems with the devices, and evaluate and remediate, as necessary, any identified quality system deficiencies at a number of its U.S. facilities.
Philips Respironics manufactures sleep and respiratory care devices, including for patients with sleep apnea. Starting in June 2021, the company initiated a series of recalls for many of its continuous positive airway pressure machines, bi-level positive airway pressure machines and certain mechanical ventilators related to significant risks associated with the degradation of polyester-based polyurethane ("PE-PUR") foam used in the devices for sound abatement. Information about these recalls, required remediation, and follow-on enforcement actions have been publicly chronicled on FDA's website since the recalls started. To date, FDA reports that the recalls have impacted approximately 15 million devices globally and that, since April 2021, the agency has received more than 116,000 MDRs related to the recalled devices, including 561 reports of deaths potentially associated with the breakdown of PE-PUR foam.
Prior to entering consent decree negotiations, FDA exercised rarely used enforcement authorities under section 518 of the FDCA. Specifically, in March 2022, FDA issued Philips Respironics, Inc. ("Philips") a 518(a) Notification Order, explaining in detail why FDA had reached the determination that a 518(a) Notification Order was "necessary to eliminate the unreasonable risk of harm" caused by the recalled devices and why no more practicable means was available to do so (the "Notification Order"). The Notification Order required Philips to obtain contact information for, and contact, all patients, health care providers, and consumers who used the recalled products and inform them of the risks of continued use and the opportunity to register their devices with the company. The Notification Order also required Philips to direct such parties to a website containing all available testing results and third-party conclusions and findings from such testing regarding the devices using PE-PUR foam.
In April 2022, the company disclosed that it had received a DOJ subpoena seeking information related to the events leading to the recalls. The next month, FDA exercised—we believe for the first time—its authority under section 518(b) of the FDCA in issuing Philips a Notice of Opportunity for a Hearing regarding FDA's proposal to issue an order that would require Philips to submit a "plan for the repair, replacement and/or refund of the purchase price" of the recalled devices. Philips did not respond publicly to the notice and no public hearing was held. In July 2022, Philips disclosed that it had received a proposed consent decree from DOJ. After nearly two years of negotiations, the U.S. District Court for the Western District of Pennsylvania entered the Consent Decree on April 9, 2024.
The complaint accompanying the Consent Decree alleges (1) device adulteration due to alleged current good manufacturing practice violations identified at four company manufacturing facilities; and (2) device misbranding arising from the failure to provide FDA information about specific device corrections and removals.
The Consent Decree is unique for many reasons, including (1) FDA's extensive public communications regarding its view of the risks associated with the recalled sleep apnea and ventilator devices; (2) the broad scope of the decree; (3) the enforcement tools FDA used prior to entry of the decree; (4) the incorporation of requirements related to the recall, refund, or replacement of recalled devices; (5) the overall complexity of the decree's operative provisions; and (6) the sheer number of defendants (three corporate entities and five individuals).
Notably, the Consent Decree:
- goes to significant lengths to make U.S. customers whole by forcing the company to provide repaired or reworked devices, replacement devices, or refunds for recalled products in a strict timeframe. In announcing the Consent Decree, FDA noted that the decree "marks the first time a device company is providing a remediation payment option for a recalled device under a consent decree."
- prohibits the company from exporting devices until it can show that all U.S. patients have received new devices or refunds, and there is sufficient supply to meet U.S customer demand of the model being exported for the next year.
- with exceptions for certain medically necessary devices, enjoins the manufacture, holding, and distribution of specific devices at or from the Philips Respironics facilities that made the recalled devices until (1) the company addresses all observations made by the independent quality systems expert who is tasked with evaluating compliance at those facilities; (2) an independent design expert reports on whether changes made to the replacement and reworked devices necessitates a new 510(k) submission; and (3) FDA inspects the facilities and notifies the company that it believes the facilities are in compliance.
- requires the company to disgorge an increasing percentage of net revenues from sales of excepted "medically necessary" devices to the U.S. Treasury until FDA notifies the company that it has complied with the requirements of the decree.
The Consent Decree is likely to require a massive investment in the company's quality program and personnel, after already agreeing to pay $1.1 billion to settle personal injury litigation and a medical monitoring class action related to the recalled devices. Additionally, the company will be subject to extensive FDA scrutiny for years to come, and further action from DOJ arising out of its April 2022 subpoena may still await.
Medical device consent decrees are relatively rare—this is only the fifth such consent decree that has been entered in the last 10 years. For that reason alone, there is much to learn from the recent Consent Decree and the events leading up to it. Perhaps the greatest lesson is best embodied by the adage "an ounce of prevention is worth a pound of cure."
Conclusion
The Magellan and Philips Respironics cases are a strong reminder to industry that FDA and DOJ can take serious and heavy-handed action when they believe companies are failing to effectively remedy product quality issues that pose significant risks to patient health and safety. Although FDA relies in large part on voluntary compliance, these cases showcase the variety of tools that FDA and its law enforcement partners can employ to (1) punish a company; (2) force a company to take very specific remedial actions; and (3) require ongoing independent assessments, corporate compliance monitoring, and reporting.
Footnotes
1.See, e.g., Brenda Sandburg, "GMP Violations Won't Trigger Breach of DOJ Compliance Agreement Government Attorney Says," Pink Sheet (Dec. 22, 2022).
2.The factors DOJ considers when determining the appropriateness of a monitorship are laid out in Deputy Attorney General Lisa Monaco's October 28, 2021 Memorandum regarding Updates to DOJ Corporate Enforcement Policies. The two-year DPA term can be extended for a third year at the Office's discretion.
3.See Indictment, U.S. v. Amy Winslow, Mohammad Hossein Maleknia and Reba Daoust, Case 1:23-cr-10094-PBS, available at https://www.justice.gov/usao-ma/file/1580646/dl?inline.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.